feat: validation locale du jeton draco_session — repli SSO dans get_current_user (#217)

tests/test_draco_session.py

@@ -185,6 +185,41 @@ def test_sso_authorize_liste_blanche(client):
     assert r.headers["location"] == "/"                   # refusé, pas de relais
 
 
+# ── Validation locale (ACC-3.2, #9) ──────────────────────────────────────
+
+def test_me_avec_cookie_draco_seul(admin_client):
+    # Aucune session native : le cookie partagé suffit (sub = id).
+    token, _jti, _exp = draco_session.issue_token(USER)
+    admin_client.cookies.set("draco_session", token)
+    r = admin_client.get("/api/auth/me")
+    assert r.status_code == 200, r.text
+    assert r.json()["username"] == "admin"
+
+
+def test_me_draco_revoque_refuse(admin_client):
+    token, jti, exp = draco_session.issue_token(USER)
+    draco_session.revoke(jti, exp)
+    admin_client.cookies.set("draco_session", token)
+    r = admin_client.get("/api/auth/me")
+    assert r.status_code == 401
+
+
+def test_me_draco_sub_inconnu_refuse(admin_client):
+    token, _j, _e = draco_session.issue_token(
+        {"id": "personne-99", "username": "x", "display_name": "X"})
+    admin_client.cookies.set("draco_session", token)
+    r = admin_client.get("/api/auth/me")
+    assert r.status_code == 401
+
+
+def test_me_draco_inerte_sans_secret(admin_client, monkeypatch):
+    token, _j, _e = draco_session.issue_token(USER)
+    monkeypatch.delenv("DRACO_SESSION_SECRET")
+    admin_client.cookies.set("draco_session", token)
+    r = admin_client.get("/api/auth/me")
+    assert r.status_code == 401
+
+
 def test_revocations_protegees_par_cle_machine(admin_client, monkeypatch):
     token, jti, exp = draco_session.issue_token(USER)
     draco_session.revoke(jti, exp)