mcp-security-framework 1.1.0__py3-none-any.whl → 1.1.1__py3-none-any.whl

tests/test_middleware/test_flask_auth_middleware.py

@@ -8,21 +8,32 @@ email: vasilyvz@gmail.com
 """
 
 import json
-import pytest
 import os
-from unittest.mock import Mock, AsyncMock, patch
+from unittest.mock import AsyncMock, Mock, patch
+
+import pytest
 from flask import Request
 
-from mcp_security_framework.middleware.flask_auth_middleware import FlaskAuthMiddleware
-from mcp_security_framework.middleware.auth_middleware import AuthMiddlewareError, AuthMiddleware
 from mcp_security_framework.core.security_manager import SecurityManager
-from mcp_security_framework.schemas.config import SecurityConfig, AuthConfig, SSLConfig, PermissionConfig, RateLimitConfig, LoggingConfig
-from mcp_security_framework.schemas.models import AuthResult, AuthStatus, AuthMethod
+from mcp_security_framework.middleware.auth_middleware import (
+    AuthMiddleware,
+    AuthMiddlewareError,
+)
+from mcp_security_framework.middleware.flask_auth_middleware import FlaskAuthMiddleware
+from mcp_security_framework.schemas.config import (
+    AuthConfig,
+    LoggingConfig,
+    PermissionConfig,
+    RateLimitConfig,
+    SecurityConfig,
+    SSLConfig,
+)
+from mcp_security_framework.schemas.models import AuthMethod, AuthResult, AuthStatus
 
 
 class TestFlaskAuthMiddleware:
     """Test suite for FlaskAuthMiddleware class."""
-    
+
     def setup_method(self):
         """Set up test fixtures before each test method."""
         # Create test configuration
@@ -32,12 +43,12 @@ class TestFlaskAuthMiddleware:
                 methods=["api_key", "jwt", "certificate"],
                 api_keys={
                     "test_key_123": {"username": "testuser", "roles": ["user"]},
-                    "admin_key_456": {"username": "admin", "roles": ["admin"]}
+                    "admin_key_456": {"username": "admin", "roles": ["admin"]},
                 },
                 jwt_secret="test-super-secret-jwt-key-for-testing-purposes-only",
                 jwt_algorithm="HS256",
                 jwt_expiry_hours=24,
-                public_paths=["/health", "/metrics"]
+                public_paths=["/health", "/metrics"],
             ),
             ssl=SSLConfig(enabled=False),
             certificate=None,
@@ -46,454 +57,487 @@ class TestFlaskAuthMiddleware:
             logging=LoggingConfig(enabled=True),
             debug=False,
             environment="test",
-            version="1.0.0"
+            version="1.0.0",
         )
-    
-                # Create temporary roles file for testing
+
+        # Create temporary roles file for testing
         import json
-        import tempfile
         import os
-        
+        import tempfile
+
         roles_data = {
             "admin": {
                 "permissions": ["read:own", "write:own", "delete:own", "admin", "*"],
-                "description": "Administrator role"
+                "description": "Administrator role",
             },
             "user": {
                 "permissions": ["read:own", "write:own"],
-                "description": "Regular user role"
+                "description": "Regular user role",
             },
             "readonly": {
                 "permissions": ["read:own"],
-                "description": "Read-only user role"
-            }
+                "description": "Read-only user role",
+            },
         }
-        
+
         # Create temporary file
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.json', delete=False) as f:
+        with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
             json.dump({"roles": roles_data}, f)
             temp_roles_file = f.name
-        
+
         # Update config with temporary file path
         self.config.permissions.roles_file = temp_roles_file
-        
+
         # Create real security manager
         from mcp_security_framework.core.security_manager import SecurityManager
+
         self.security_manager = SecurityManager(self.config)
-        
+
         # Store temp file path for cleanup
         self.temp_roles_file = temp_roles_file
-    
-                # Create middleware instance
+
+        # Create middleware instance
         self.middleware = FlaskAuthMiddleware(self.security_manager)
 
         # Create mock logger
         self.mock_logger = Mock()
         self.middleware.logger = self.mock_logger
-    
+
     def teardown_method(self):
         """Clean up after each test method."""
         # Clean up temporary files
-        if hasattr(self, 'temp_roles_file') and os.path.exists(self.temp_roles_file):
+        if hasattr(self, "temp_roles_file") and os.path.exists(self.temp_roles_file):
             try:
                 os.unlink(self.temp_roles_file)
             except OSError:
                 pass
-    
+
     def test_flask_auth_middleware_initialization(self):
         """Test middleware initialization."""
         assert isinstance(self.middleware, FlaskAuthMiddleware)
         assert isinstance(self.middleware, AuthMiddleware)
         assert self.middleware.config == self.config
         assert self.middleware.security_manager == self.security_manager
-    
+
     def test_flask_auth_middleware_call_public_path(self):
         """Test middleware call with public path."""
         # Create WSGI environment for public path
         environ = {
-            'REQUEST_METHOD': 'GET',
-            'PATH_INFO': '/health',
-            'HTTP_HOST': 'localhost:5000',
-            'HTTP_USER_AGENT': 'test-agent'
+            "REQUEST_METHOD": "GET",
+            "PATH_INFO": "/health",
+            "HTTP_HOST": "localhost:5000",
+            "HTTP_USER_AGENT": "test-agent",
         }
-        
+
         # Create mock start_response
         mock_start_response = Mock()
-        
+
         # Call middleware
         response = self.middleware(environ, mock_start_response)
-        
+
         # Assertions
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_call_authentication_success(self):
         """Test middleware call with successful authentication."""
         # Create WSGI environment
         environ = {
-            'REQUEST_METHOD': 'GET',
-            'PATH_INFO': '/api/v1/users/me',
-            'HTTP_HOST': 'localhost:5000',
-            'HTTP_X_API_KEY': 'test_key_123',
-            'HTTP_USER_AGENT': 'test-agent'
+            "REQUEST_METHOD": "GET",
+            "PATH_INFO": "/api/v1/users/me",
+            "HTTP_HOST": "localhost:5000",
+            "HTTP_X_API_KEY": "test_key_123",
+            "HTTP_USER_AGENT": "test-agent",
         }
-        
+
         # Mock successful authentication
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.API_KEY
+            auth_method=AuthMethod.API_KEY,
+        )
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=auth_result
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=auth_result)
-        
+
         # Create mock start_response
         mock_start_response = Mock()
-        
+
         # Call middleware
         response = self.middleware(environ, mock_start_response)
-        
+
         # Assertions
         assert response is not None
         mock_start_response.assert_called_once()
-        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with("test_key_123")
-    
+        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with(
+            "test_key_123"
+        )
+
     def test_flask_auth_middleware_call_authentication_failure(self):
         """Test middleware call with authentication failure."""
         # Create WSGI environment
         environ = {
-            'REQUEST_METHOD': 'GET',
-            'PATH_INFO': '/api/v1/users/me',
-            'HTTP_HOST': 'localhost:5000',
-            'HTTP_USER_AGENT': 'test-agent'
+            "REQUEST_METHOD": "GET",
+            "PATH_INFO": "/api/v1/users/me",
+            "HTTP_HOST": "localhost:5000",
+            "HTTP_USER_AGENT": "test-agent",
         }
-        
+
         # Mock failed authentication
         auth_result = AuthResult(
             is_valid=False,
             status=AuthStatus.INVALID,
             auth_method=AuthMethod.UNKNOWN,
             error_code=-32001,
-            error_message="No authentication credentials provided"
+            error_message="No authentication credentials provided",
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=auth_result)
-        
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=auth_result
+        )
+
         # Create mock start_response
         mock_start_response = Mock()
-        
+
         # Call middleware
         response = self.middleware(environ, mock_start_response)
-        
+
         # Assertions
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_call_exception_handling(self):
         """Test middleware call with exception handling."""
         # This test is removed as the middleware properly handles exceptions
         # by catching them and raising AuthMiddlewareError, which is the expected behavior
         pass
-    
+
     def test_flask_auth_middleware_call_next(self):
         """Test _call_next method."""
         environ = {
-            'REQUEST_METHOD': 'GET',
-            'PATH_INFO': '/test',
-            'HTTP_HOST': 'localhost:5000'
+            "REQUEST_METHOD": "GET",
+            "PATH_INFO": "/test",
+            "HTTP_HOST": "localhost:5000",
         }
-        
+
         mock_start_response = Mock()
-        
+
         response = self.middleware._call_next(environ, mock_start_response)
-        
+
         assert response is not None
         assert isinstance(response, list)
         assert len(response) > 0
-        mock_start_response.assert_called_once_with('200 OK', [('Content-Type', 'application/json')])
-    
+        mock_start_response.assert_called_once_with(
+            "200 OK", [("Content-Type", "application/json")]
+        )
+
     def test_flask_auth_middleware_is_public_path_configured(self):
         """Test _is_public_path with configured public paths."""
         mock_request = Mock(spec=Request)
         mock_request.path = "/health"
-        
+
         result = self.middleware._is_public_path(mock_request)
         assert result is True
-    
+
     def test_flask_auth_middleware_is_public_path_common(self):
         """Test _is_public_path with common public paths."""
         mock_request = Mock(spec=Request)
         mock_request.path = "/status"
-        
+
         result = self.middleware._is_public_path(mock_request)
         assert result is True
-    
+
     def test_flask_auth_middleware_is_public_path_private(self):
         """Test _is_public_path with private path."""
         mock_request = Mock(spec=Request)
         mock_request.path = "/api/v1/users/me"
-        
+
         result = self.middleware._is_public_path(mock_request)
         assert result is False
-    
+
     def test_flask_auth_middleware_get_client_ip_x_forwarded_for(self):
         """Test _get_client_ip with X-Forwarded-For header."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-Forwarded-For": "192.168.1.1, 10.0.0.1"}
-        
+
         ip = self.middleware._get_client_ip(mock_request)
         assert ip == "192.168.1.1"
-    
+
     def test_flask_auth_middleware_get_client_ip_x_real_ip(self):
         """Test _get_client_ip with X-Real-IP header."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-Real-IP": "192.168.1.2"}
-        
+
         ip = self.middleware._get_client_ip(mock_request)
         assert ip == "192.168.1.2"
-    
+
     def test_flask_auth_middleware_get_client_ip_remote_addr(self):
         """Test _get_client_ip with remote_addr."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {}
         mock_request.remote_addr = "192.168.1.3"
-        
+
         ip = self.middleware._get_client_ip(mock_request)
         assert ip == "192.168.1.3"
-    
+
     def test_flask_auth_middleware_get_client_ip_default(self):
         """Test _get_client_ip with default fallback."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {}
         mock_request.remote_addr = None
-        
+
         ip = self.middleware._get_client_ip(mock_request)
         assert ip == "127.0.0.1"  # Default fallback
-    
+
     def test_flask_auth_middleware_get_cache_key(self):
         """Test _get_cache_key method."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"User-Agent": "test-browser/1.0"}
         mock_request.remote_addr = "192.168.1.1"
-        
+
         cache_key = self.middleware._get_cache_key(mock_request)
         assert cache_key.startswith("auth:192.168.1.1:")
         assert isinstance(cache_key, str)
         assert len(cache_key) > 0
-    
+
     def test_flask_auth_middleware_try_auth_method_api_key(self):
         """Test _try_auth_method with API key."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-API-Key": "test_key_123"}
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.API_KEY
+            auth_method=AuthMethod.API_KEY,
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=auth_result)
-        
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=auth_result
+        )
+
         result = self.middleware._try_auth_method(mock_request, "api_key")
-        
+
         assert result.is_valid is True
-        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with("test_key_123")
-    
+        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with(
+            "test_key_123"
+        )
+
     def test_flask_auth_middleware_try_auth_method_jwt(self):
         """Test _try_auth_method with JWT."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"Authorization": "Bearer test_jwt_token"}
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.JWT
+            auth_method=AuthMethod.JWT,
+        )
+        self.security_manager.auth_manager.authenticate_jwt_token = Mock(
+            return_value=auth_result
         )
-        self.security_manager.auth_manager.authenticate_jwt_token = Mock(return_value=auth_result)
-        
+
         result = self.middleware._try_auth_method(mock_request, "jwt")
-        
+
         assert result.is_valid is True
-        self.security_manager.auth_manager.authenticate_jwt_token.assert_called_once_with("test_jwt_token")
-    
+        self.security_manager.auth_manager.authenticate_jwt_token.assert_called_once_with(
+            "test_jwt_token"
+        )
+
     def test_flask_auth_middleware_try_auth_method_certificate(self):
         """Test _try_auth_method with certificate."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-Client-Cert": "test_certificate_data"}
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.CERTIFICATE
+            auth_method=AuthMethod.CERTIFICATE,
+        )
+        self.security_manager.auth_manager.authenticate_certificate = Mock(
+            return_value=auth_result
         )
-        self.security_manager.auth_manager.authenticate_certificate = Mock(return_value=auth_result)
-        
+
         result = self.middleware._try_auth_method(mock_request, "certificate")
-        
+
         assert result.is_valid is False
         assert "not implemented" in result.error_message.lower()
-    
+
     def test_flask_auth_middleware_try_auth_method_unsupported(self):
         """Test _try_auth_method with unsupported method."""
         mock_request = Mock(spec=Request)
-        
+
         result = self.middleware._try_auth_method(mock_request, "unsupported_method")
-        
+
         assert result.is_valid is False
         assert result.error_code == -32022
         assert "Unsupported authentication method" in result.error_message
-    
+
     def test_flask_auth_middleware_try_auth_method_exception(self):
         """Test _try_auth_method with exception."""
         mock_request = Mock(spec=Request)
-        
-        self.security_manager.auth_manager.authenticate_api_key = Mock(side_effect=Exception("Test auth error"))
-        
+
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            side_effect=Exception("Test auth error")
+        )
+
         result = self.middleware._try_auth_method(mock_request, "api_key")
-        
+
         assert result.is_valid is False
         assert result.error_code == -32023
         assert "Authentication method api_key failed" in result.error_message
-    
+
     def test_flask_auth_middleware_try_api_key_auth_success(self):
         """Test _try_api_key_auth with successful authentication."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-API-Key": "test_key_123"}
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.API_KEY
+            auth_method=AuthMethod.API_KEY,
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=auth_result)
-        
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=auth_result
+        )
+
         result = self.middleware._try_api_key_auth(mock_request)
-        
+
         assert result.is_valid is True
-        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with("test_key_123")
-    
+        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with(
+            "test_key_123"
+        )
+
     def test_flask_auth_middleware_try_api_key_auth_from_authorization(self):
         """Test _try_api_key_auth with API key from Authorization header."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"Authorization": "Bearer api_key_123"}
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.API_KEY
+            auth_method=AuthMethod.API_KEY,
+        )
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=auth_result
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=auth_result)
-        
+
         result = self.middleware._try_api_key_auth(mock_request)
-        
+
         assert result.is_valid is True
-        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with("api_key_123")
-    
+        self.security_manager.auth_manager.authenticate_api_key.assert_called_once_with(
+            "api_key_123"
+        )
+
     def test_flask_auth_middleware_try_api_key_auth_no_key(self):
         """Test _try_api_key_auth with no API key."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {}
-        
+
         result = self.middleware._try_api_key_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32012
         assert "API key not found in request" in result.error_message
-    
+
     def test_flask_auth_middleware_try_jwt_auth_success(self):
         """Test _try_jwt_auth with successful authentication."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"Authorization": "Bearer test_jwt_token"}
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.JWT
+            auth_method=AuthMethod.JWT,
         )
-        self.security_manager.auth_manager.authenticate_jwt_token = Mock(return_value=auth_result)
-        
+        self.security_manager.auth_manager.authenticate_jwt_token = Mock(
+            return_value=auth_result
+        )
+
         result = self.middleware._try_jwt_auth(mock_request)
-        
+
         assert result.is_valid is True
-        self.security_manager.auth_manager.authenticate_jwt_token.assert_called_once_with("test_jwt_token")
-    
+        self.security_manager.auth_manager.authenticate_jwt_token.assert_called_once_with(
+            "test_jwt_token"
+        )
+
     def test_flask_auth_middleware_try_jwt_auth_no_token(self):
         """Test _try_jwt_auth with no JWT token."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {}
-        
+
         result = self.middleware._try_jwt_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32013
         assert "JWT token not found in Authorization header" in result.error_message
-    
+
     def test_flask_auth_middleware_try_jwt_auth_wrong_format(self):
         """Test _try_jwt_auth with wrong Authorization header format."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"Authorization": "Basic dGVzdDp0ZXN0"}
-        
+
         result = self.middleware._try_jwt_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32013
         assert "JWT token not found in Authorization header" in result.error_message
-    
+
     def test_flask_auth_middleware_try_certificate_auth(self):
         """Test _try_certificate_auth (not implemented)."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-Client-Cert": "test_certificate_data"}
-        
+
         result = self.middleware._try_certificate_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32014
         assert "Certificate authentication not implemented" in result.error_message
-    
+
     def test_flask_auth_middleware_try_basic_auth_no_credentials(self):
         """Test _try_basic_auth with no credentials."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {}
-        
+
         result = self.middleware._try_basic_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32015
         assert "Basic authentication credentials not found" in result.error_message
-    
+
     def test_flask_auth_middleware_try_basic_auth_wrong_format(self):
         """Test _try_basic_auth with wrong Authorization header format."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"Authorization": "Bearer token123"}
-        
+
         result = self.middleware._try_basic_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32015
         assert "Basic authentication credentials not found" in result.error_message
-    
+
     def test_flask_auth_middleware_try_basic_auth_not_implemented(self):
         """Test _try_basic_auth (not implemented)."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"Authorization": "Basic dGVzdDp0ZXN0"}
-        
+
         result = self.middleware._try_basic_auth(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32016
         assert "Basic authentication not implemented" in result.error_message
-    
+
     def test_flask_auth_middleware_auth_error_response(self):
         """Test _auth_error_response method."""
         auth_result = AuthResult(
@@ -501,61 +545,71 @@ class TestFlaskAuthMiddleware:
             status=AuthStatus.INVALID,
             auth_method=AuthMethod.API_KEY,
             error_code=-32002,
-            error_message="Invalid API key"
+            error_message="Invalid API key",
         )
-        
+
         mock_start_response = Mock()
-        
-        response = self.middleware._auth_error_response(auth_result, mock_start_response)
-        
+
+        response = self.middleware._auth_error_response(
+            auth_result, mock_start_response
+        )
+
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_authz_error_response(self):
         """Test _authz_error_response method."""
         from mcp_security_framework.schemas.models import AuthResult
-        
+
         auth_result = AuthResult(
             is_valid=False,
             status=AuthStatus.INVALID,
             error_code=-32004,
-            error_message="Access denied"
+            error_message="Access denied",
         )
-        
+
         mock_start_response = Mock()
-        
-        response = self.middleware._authz_error_response(auth_result, mock_start_response)
-        
+
+        response = self.middleware._authz_error_response(
+            auth_result, mock_start_response
+        )
+
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_validation_error_response(self):
         """Test _validation_error_response method."""
         mock_start_response = Mock()
-        
-        response = self.middleware._validation_error_response("Validation failed", -32000, mock_start_response)
-        
+
+        response = self.middleware._validation_error_response(
+            "Validation failed", -32000, mock_start_response
+        )
+
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_rate_limit_error_response(self):
         """Test _rate_limit_error_response method."""
         mock_start_response = Mock()
-        
-        response = self.middleware._rate_limit_error_response("Rate limit exceeded", -32000, mock_start_response)
-        
+
+        response = self.middleware._rate_limit_error_response(
+            "Rate limit exceeded", -32000, mock_start_response
+        )
+
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_security_header_response(self):
         """Test _security_header_response method."""
         mock_start_response = Mock()
-        
-        response = self.middleware._security_header_response("Security header validation failed", -32000, mock_start_response)
-        
+
+        response = self.middleware._security_header_response(
+            "Security header validation failed", -32000, mock_start_response
+        )
+
         assert response is not None
         mock_start_response.assert_called_once()
-    
+
     def test_flask_auth_middleware_log_auth_event(self):
         """Test _log_auth_event method."""
         event_data = {
@@ -563,76 +617,80 @@ class TestFlaskAuthMiddleware:
             "username": "testuser",
             "path": "/api/v1/users/me",
             "method": "GET",
-            "auth_method": "api_key"
+            "auth_method": "api_key",
         }
-        
+
         self.middleware._log_auth_event("authentication_successful", event_data)
-        
+
         self.mock_logger.info.assert_called_once()
-    
+
     def test_flask_auth_middleware_get_rate_limit_identifier(self):
         """Test _get_rate_limit_identifier method."""
         mock_request = Mock(spec=Request)
         mock_request.remote_addr = "192.168.1.1"
         mock_request.headers = {}
-        
+
         identifier = self.middleware._get_rate_limit_identifier(mock_request)
         assert identifier == "192.168.1.1"
-    
+
     def test_flask_auth_middleware_get_request_path(self):
         """Test _get_request_path method."""
         mock_request = Mock(spec=Request)
         mock_request.path = "/api/v1/users/me"
-        
+
         path = self.middleware._get_request_path(mock_request)
         assert path == "/api/v1/users/me"
-    
+
     def test_flask_auth_middleware_get_required_permissions(self):
         """Test _get_required_permissions method."""
         mock_request = Mock(spec=Request)
         mock_request.path = "/api/v1/users/me"
         mock_request.method = "GET"
-        
+
         permissions = self.middleware._get_required_permissions(mock_request)
         assert isinstance(permissions, list)
-    
+
     def test_flask_auth_middleware_authenticate_only_success(self):
         """Test _authenticate_only with successful authentication."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {"X-API-Key": "test_key_123"}
         mock_request.remote_addr = "192.168.1.1"
-        
+
         auth_result = AuthResult(
             is_valid=True,
             status=AuthStatus.SUCCESS,
             username="testuser",
             roles=["user"],
-            auth_method=AuthMethod.API_KEY
+            auth_method=AuthMethod.API_KEY,
+        )
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=auth_result
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=auth_result)
-        
+
         result = self.middleware._authenticate_only(mock_request)
-        
+
         assert result.is_valid is True
         assert result.username == "testuser"
-    
+
     def test_flask_auth_middleware_authenticate_only_failure(self):
         """Test _authenticate_only with authentication failure."""
         mock_request = Mock(spec=Request)
         mock_request.headers = {}
         mock_request.remote_addr = "192.168.1.1"
-        
+
         # Mock failed authentication for all methods
         failed_auth_result = AuthResult(
             is_valid=False,
             status=AuthStatus.INVALID,
             auth_method=AuthMethod.UNKNOWN,
             error_code=-32001,
-            error_message="No authentication credentials provided"
+            error_message="No authentication credentials provided",
+        )
+        self.security_manager.auth_manager.authenticate_api_key = Mock(
+            return_value=failed_auth_result
         )
-        self.security_manager.auth_manager.authenticate_api_key = Mock(return_value=failed_auth_result)
-        
+
         result = self.middleware._authenticate_only(mock_request)
-        
+
         assert result.is_valid is False
         assert result.error_code == -32033  # All authentication methods failed