feat: Funcion de sistema tenants

backend/tests/integration/test_auth_integration.py

@@ -16,9 +16,6 @@ from app.models.user import User, UserRole
 from app.models.tenant import Tenant
 
 # Importar fixtures desde conftest_integration
-pytest_plugins = ['tests.conftest_integration']
-
-
 @pytest.mark.integration
 @pytest.mark.auth
 class TestAuthentication:
@@ -126,6 +123,58 @@ class TestAuthentication:
         
         assert response.status_code == 403
 
+    async def test_login_rate_limited_after_too_many_attempts(
+        self,
+        client: AsyncClient,
+        test_admin_user: User,
+        test_tenant: Tenant,
+        monkeypatch,
+    ):
+        """Debe devolver 429 después de demasiados intentos de login (rate limit)."""
+
+        import app.api.v1.endpoints.auth as auth_endpoint
+
+        class _FakeCache:
+            def __init__(self):
+                self._counts = {}
+                self._expires = {}
+
+            async def incr(self, key: str, amount: int = 1):
+                self._counts[key] = self._counts.get(key, 0) + amount
+                return self._counts[key]
+
+            async def expire(self, key: str, ttl: int):
+                self._expires[key] = ttl
+                return True
+
+            async def delete(self, key: str):
+                self._counts.pop(key, None)
+                return True
+
+        fake_cache = _FakeCache()
+        monkeypatch.setattr(auth_endpoint, "cache", fake_cache)
+        monkeypatch.setattr(auth_endpoint.settings, "RATE_LIMIT_ENABLED", True, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "TESTING", False, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "LOGIN_RATE_LIMIT_WINDOW_SECONDS", 60, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "LOGIN_RATE_LIMIT_IP_MAX_ATTEMPTS", 10_000, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "LOGIN_RATE_LIMIT_ID_MAX_ATTEMPTS", 2, raising=False)
+
+        payload = {
+            "email": test_admin_user.email,
+            "password": "WrongPassword123!",
+            "tenant_slug": test_tenant.slug,
+        }
+
+        r1 = await client.post("/v1/auth/login", json=payload)
+        assert r1.status_code == 401
+
+        r2 = await client.post("/v1/auth/login", json=payload)
+        assert r2.status_code == 401
+
+        r3 = await client.post("/v1/auth/login", json=payload)
+        assert r3.status_code == 429
+        assert "Retry-After" in r3.headers
+
 
 @pytest.mark.integration
 @pytest.mark.auth
@@ -305,13 +354,17 @@ class TestUserProfile:
     async def test_get_current_user_profile(
         self, 
         client: AsyncClient,
+        test_tenant: Tenant,
         test_admin_user: User,
         auth_headers_admin: dict
     ):
         """Test obtener perfil del usuario actual."""
         response = await client.get(
             "/v1/users/me",
-            headers=auth_headers_admin
+            headers={
+                **auth_headers_admin,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
         )
         
         assert response.status_code == 200
@@ -348,13 +401,17 @@ class TestPasswordSecurity:
     async def test_password_not_exposed_in_response(
         self, 
         client: AsyncClient,
+        test_tenant: Tenant,
         test_admin_user: User,
         auth_headers_admin: dict
     ):
         """Test que el password hash nunca se expone en las respuestas."""
         response = await client.get(
             "/v1/users/me",
-            headers=auth_headers_admin
+            headers={
+                **auth_headers_admin,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
         )
         
         assert response.status_code == 200