daddy/modbison
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PC3 Phase 3.2: real age verification (date of birth, not a checkbox)

Browse Source 
POST /api/auth/register now requires a real date_of_birth (ISO YYYY-MM-DD).
The server computes age (auth.calculate_age) and rejects under-18s with 403;
a future/nonsensical date is 400. The DOB is stored and surfaced only to
that user (/api/auth/me).

Still self-attested (a user can enter a false DOB) -- but a concrete,
stored, legally-meaningful data point and the seam for a future ID-check
pass. Encryption-at-rest for the column and the Tier-2 hook are not done;
the limitation is stated plainly in docs/architecture/content_moderation.md 5.2.

- auth.py: RegisterRequest.date_of_birth (date); MIN_AGE=18; register()
  computes + enforces; UserResponse.date_of_birth typed `date | None`
  (the old `str | None` would have 500'd /me once a DOB was actually stored).
- api_client.gd / main_menu.gd: the Over18 checkbox is now a
  "Date of birth (YYYY-MM-DD)" field with a client-side sanity check.
- tests: test_auth_age_gate.py rewritten around the endpoint + age math
  (adult/minor/exactly-18/future-dob/stored); ~25 over_18 references across
  6 backend test files + 6 game smoke tests updated. Backend 74 passed;
  game smokes green (auth 6/6, menu_full_flow 12/12, e2e 4/4, etc.);
  fresh-clone boot PASS.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jtxAiu5dAW4WxCNdGkrkJ
This commit is contained in:
daddy
2026-09-05 22:18:38 +00:00
parent 855311e731
commit 7bd8124199
19 changed files with 194 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_auth_age_gate.py
+76 -66
View File
@@ -3,92 +3,102 @@
from datetime import date, timedelta
import pytest
from fastapi.testclient import TestClient
from app.routers.auth import calculate_age
from app.main import app
from app.routers.auth import calculate_age, MIN_AGE, RegisterRequest
class TestCalculateAge:
"""Unit tests for the calculate_age helper."""
def test_exactly_18(self):
"""A person born exactly 18 years ago today is 18."""
today = date(2025, 6, 15)
today = date(2026, 6, 15)
dob = today.replace(year=today.year - 18)
assert calculate_age(dob, today=today) == 18
def test_just_turned_18(self):
"""A person who turned 18 yesterday is 18."""
today = date(2025, 6, 15)
today = date(2026, 6, 15)
dob = today.replace(year=today.year - 18) - timedelta(days=1)
assert calculate_age(dob, today=today) == 18
def test_one_day_short_of_18(self):
"""A person born one day after their 18th birthday is 17."""
today = date(2025, 6, 15)
today = date(2026, 6, 15)
dob = today.replace(year=today.year - 18) + timedelta(days=1)
assert calculate_age(dob, today=today) == 17
def test_17_years_old(self):
"""A person who is 17 years old today is 17."""
today = date(2025, 6, 15)
dob = date(2008, 6, 15)
assert calculate_age(dob, today=today) == 17
def test_leap_day_birthday_before(self):
assert calculate_age(date(2000, 2, 29), today=date(2024, 2, 28)) == 23
def test_65_years_old(self):
"""A person who is 65 is correctly calculated."""
today = date(2025, 6, 15)
dob = today.replace(year=today.year - 65)
assert calculate_age(dob, today=today) == 65
def test_newborn(self):
"""A newborn is 0."""
today = date(2025, 6, 15)
dob = today
assert calculate_age(dob, today=today) == 0
def test_birthday_not_yet_this_year(self):
"""Person born Dec 31, 2000 — on Jan 1, 2025 they are still 24."""
dob = date(2000, 12, 31)
assert calculate_age(dob, today=date(2025, 1, 1)) == 24
def test_birthday_today(self):
"""Person born Dec 31, 2000 — on Dec 31, 2024 they turn 24."""
dob = date(2000, 12, 31)
assert calculate_age(dob, today=date(2024, 12, 31)) == 24
def test_leap_day_birthday_after(self):
assert calculate_age(date(2000, 2, 29), today=date(2024, 3, 1)) == 24
class TestRegisterRequestOver18Field:
"""Tests for RegisterRequest's over_18 field.
class TestRegisterRequestDob:
def test_dob_parsed_from_iso_string(self):
req = RegisterRequest(username="u", email="u@example.com", password="p",
date_of_birth="1990-01-01")
assert req.date_of_birth == date(1990, 1, 1)
Replaces TestRegisterRequestDateValidation -- date_of_birth and its
field_validator were removed from RegisterRequest 2026-08-20 (interim
simplification: a plain client-side over_18 confirmation instead of
collecting/validating an actual date of birth; see calculate_age's
own docstring in app/routers/auth.py for why that function is still
here even though this endpoint no longer calls it). There's no date
format left to validate, so the equivalent coverage is just: the
field exists, is a real bool, and is required."""
def test_over_18_true_accepted(self):
from app.routers.auth import RegisterRequest
req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=True)
assert req.over_18 is True
def test_over_18_false_accepted(self):
"""False is a valid value at the schema level -- the endpoint,
not the schema, is what rejects it (see
TestRegister::test_register_rejects_not_over_18 in
test_auth_endpoints.py)."""
from app.routers.auth import RegisterRequest
req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=False)
assert req.over_18 is False
def test_over_18_missing_rejected(self):
"""over_18 has no default -- omitting it entirely is a validation error."""
from app.routers.auth import RegisterRequest
from pydantic import ValidationError
with pytest.raises(ValidationError):
def test_dob_required(self):
with pytest.raises(Exception):
RegisterRequest(username="u", email="u@example.com", password="p")
def test_bad_dob_string_rejected(self):
with pytest.raises(Exception):
RegisterRequest(username="u", email="u@example.com", password="p",
date_of_birth="not-a-date")
class TestRegisterAgeGate:
"""End-to-end: the /register endpoint computes age from the DOB."""
def _dob_for_age(self, years: int) -> str:
return (date.today().replace(year=date.today().year - years)).isoformat()
def test_adult_accepted(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_adult", "email": "gate_adult@e.com",
"password": "secret123", "date_of_birth": self._dob_for_age(25),
})
assert r.status_code == 201, r.text
def test_minor_rejected(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_minor", "email": "gate_minor@e.com",
"password": "secret123", "date_of_birth": self._dob_for_age(15),
})
assert r.status_code == 403
assert str(MIN_AGE) in r.json()["detail"]
def test_exactly_18_accepted(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_18", "email": "gate_18@e.com",
"password": "secret123",
"date_of_birth": (date.today().replace(year=date.today().year - 18) - timedelta(days=1)).isoformat(),
})
assert r.status_code == 201, r.text
def test_future_dob_rejected(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_future", "email": "gate_future@e.com",
"password": "secret123", "date_of_birth": "2999-01-01",
})
assert r.status_code == 400
def test_dob_is_stored(self):
client = TestClient(app)
dob = self._dob_for_age(30)
reg = client.post("/api/auth/register", json={
"username": "gate_stored", "email": "gate_stored@e.com",
"password": "secret123", "date_of_birth": dob,
})
assert reg.status_code == 201
me = client.get("/api/auth/me", headers={
"Authorization": f"Bearer {reg.json()['access_token']}"
})
assert me.json()["date_of_birth"] == dob