test_lambda_handler_me.py

"""GET /me Lambda handler: Cognito claims -> TenantContext -> DynamoDB, end to end (ADR-0024)."""
from __future__ import annotations

import json

import boto3
import pytest
from moto import mock_aws

from openjobradar.lambda_handlers.me import handler

TABLE_NAME = "test-tenant-table"


@pytest.fixture
def tenant_table(monkeypatch):
    monkeypatch.setenv("TENANT_TABLE_NAME", TABLE_NAME)
    monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
    with mock_aws():
        resource = boto3.resource("dynamodb", region_name="us-east-1")
        table = resource.create_table(
            TableName=TABLE_NAME,
            KeySchema=[
                {"AttributeName": "userId", "KeyType": "HASH"},
                {"AttributeName": "sk", "KeyType": "RANGE"},
            ],
            AttributeDefinitions=[
                {"AttributeName": "userId", "AttributeType": "S"},
                {"AttributeName": "sk", "AttributeType": "S"},
            ],
            BillingMode="PAY_PER_REQUEST",
        )
        table.wait_until_exists()
        yield table


def _event(sub: str, email: str = "alice@example.com") -> dict:
    return {"requestContext": {"authorizer": {"jwt": {"claims": {"sub": sub, "email": email}}}}}


def test_first_call_provisions_a_free_workspace(tenant_table) -> None:
    response = handler(_event("alice-sub-0000001"), None)
    assert response["statusCode"] == 200
    body = json.loads(response["body"])
    assert body == {
        "userId": "alice-sub-0000001",
        "email": "alice@example.com",
        "created": True,
        "plan": "free",
        "status": "active",
        "forcedDryRun": False,
    }


def test_second_call_is_idempotent(tenant_table) -> None:
    handler(_event("alice-sub-0000001"), None)
    response = handler(_event("alice-sub-0000001"), None)
    assert json.loads(response["body"])["created"] is False


def test_missing_authorizer_claims_returns_401_not_a_crash(tenant_table) -> None:
    response = handler({}, None)
    assert response["statusCode"] == 401
    assert json.loads(response["body"]) == {"error": "unauthenticated"}


def test_malformed_authorizer_shape_returns_401(tenant_table) -> None:
    response = handler({"requestContext": {"authorizer": {"jwt": {}}}}, None)
    assert response["statusCode"] == 401


def test_two_users_get_isolated_workspaces(tenant_table) -> None:
    alice_body = json.loads(handler(_event("alice-sub-0000001"), None)["body"])
    bob_body = json.loads(handler(_event("bob-sub-00000002", "bob@example.com"), None)["body"])
    assert alice_body["userId"] != bob_body["userId"]
    assert alice_body["email"] != bob_body["email"]