diff --git a/auth/utils.py b/auth/utils.py index 4bded89..a060433 100644 --- a/auth/utils.py +++ b/auth/utils.py @@ -128,8 +128,8 @@ def decorated_function(*args, **kwargs): g.user_id = user_id g.user = user_data return f(*args, **kwargs) - except Exception as e: - return jsonify({'error': 'Unauthorized', 'details': str(e)}), 401 + except Exception: + return jsonify({'error': 'Unauthorized'}), 401 return decorated_function diff --git a/tests/test_auth.py b/tests/test_auth.py new file mode 100644 index 0000000..b179111 --- /dev/null +++ b/tests/test_auth.py @@ -0,0 +1,29 @@ +import sys +from unittest.mock import MagicMock + +# Mock cache_db module before importing auth.utils +cache_db_mock = MagicMock() +sys.modules['cache_db'] = cache_db_mock +sys.modules['cache_db.redis_client'] = cache_db_mock +sys.modules['cache_db.models'] = cache_db_mock + +from flask import Flask +import pytest +from auth.utils import login_required + +def test_login_required_unauthorized_hides_error_details(): + app = Flask(__name__) + app.config['TESTING'] = True + + @app.route('/test') + @login_required + def protected(): + return 'success' + + with app.test_client() as client: + # Request without JWT will raise an exception during verify_jwt_in_request + response = client.get('/test') + assert response.status_code == 401 + data = response.get_json() + assert data == {'error': 'Unauthorized'} + assert 'details' not in data