セキュリティ監査

# pytest + MailBrew: セキュリティ監査テスト
from mailbrew import MailBrew
import pytest

client = MailBrew("mb_your_key_here")

class TestPasswordResetSecurity:
    def test_reset_token_is_single_use(self):
        addr = client.create_address(ttl=300)
        requests.post(f"{BASE}/password/reset", json={"email": addr["address"]})

        email = client.wait_for_email(addr["address"], timeout=30)
        token = re.search(r'token=([a-f0-9]+)', email["text_body"]).group(1)

        r1 = requests.post(f"{BASE}/password/update", json={"token": token, "password": "NewPass123!"})
        assert r1.status_code == 200

        r2 = requests.post(f"{BASE}/password/update", json={"token": token, "password": "AnotherPass!"})
        assert r2.status_code in [400, 422]