セキュリティ監査

# pytest + MailBrew: セキュリティ監査テスト
import mailbrew
import pytest

client = mailbrew.Client("mb_your_key_here")

class TestPasswordResetSecurity:
    def test_reset_token_is_single_use(self):
        addr = client.addresses.create(ttl=300)
        requests.post(f"{BASE}/password/reset", json={"email": addr.address})

        emails = client.addresses.emails(addr.address)
        token = re.search(r'token=([a-f0-9]+)', emails[0].text_body).group(1)

        r1 = requests.post(f"{BASE}/password/update", json={"token": token, "password": "NewPass123!"})
        assert r1.status_code == 200

        r2 = requests.post(f"{BASE}/password/update", json={"token": token, "password": "AnotherPass!"})
        assert r2.status_code in [400, 422]