feat(auth): verifie le lien de reset des le chargement, sans le consommer

Ajoute GET /auth/reset-password/validate (lecture seule, sans rate
limit : le jeton est un secret de 256 bits non brute-forcable) pour que
la page reset-password redirige immediatement vers /login si le lien
est invalide ou expire, plutot que d'attendre la soumission du
formulaire. La verification a la soumission (confirm_password_reset)
reste la seule source de verite atomique.

apps/backend/tests/api/test_auth.py

@@ -28,12 +28,16 @@ PRINCIPAL = Principal(
 
 
 class FauxService:
-    def __init__(self, erreur: Exception | None = None) -> None:
+    def __init__(self, erreur: Exception | None = None, *, jeton_valide: bool = True) -> None:
         self._erreur = erreur
+        self._jeton_valide = jeton_valide
 
     async def refresh(self, **_: object) -> AuthenticatedSession:
         return await self.authenticate()
 
+    async def is_reset_token_valid(self, **_: object) -> bool:
+        return self._jeton_valide
+
     async def logout(self, **_: object) -> None:
         return None
 
@@ -259,6 +263,38 @@ async def test_forgot_password_rejects_a_malformed_email(
     assert response.status_code == 422
 
 
+@pytest.fixture
+def fake_auth_service_reset_validity(app: FastAPI) -> Iterator[list[bool]]:
+    programme = [True]
+    app.dependency_overrides[get_auth_service] = lambda: FauxService(jeton_valide=programme[0])
+    yield programme
+    app.dependency_overrides.pop(get_auth_service, None)
+
+
+async def test_validate_reset_token_reports_a_living_token(
+    fake_auth_service_reset_validity: list[bool], client: AsyncClient
+) -> None:
+    response = await client.get(
+        "/api/v1/auth/reset-password/validate", params={"token": "un-secret-opaque"}
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"valid": True}
+
+
+async def test_validate_reset_token_reports_an_invalid_or_expired_token(
+    fake_auth_service_reset_validity: list[bool], client: AsyncClient
+) -> None:
+    fake_auth_service_reset_validity[0] = False
+
+    response = await client.get(
+        "/api/v1/auth/reset-password/validate", params={"token": "un-secret-perime"}
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"valid": False}
+
+
 async def test_reset_password_returns_the_token_and_the_cookie_on_success(
     fake_auth_service: list[Exception | None], client: AsyncClient
 ) -> None:

apps/backend/tests/repositories/test_password_reset_token.py

@@ -89,6 +89,34 @@ async def test_invalidate_all_for_user_only_touches_living_tokens(
     assert second_passage == 0
 
 
+async def test_exists_valid_is_true_for_a_living_token(session: AsyncSession) -> None:
+    depot = PasswordResetTokenRepository(session)
+    secret = await un_jeton(depot, await un_compte(session))
+
+    assert await depot.exists_valid(fingerprint_refresh(secret)) is True
+
+
+async def test_exists_valid_is_false_for_an_expired_token(session: AsyncSession) -> None:
+    depot = PasswordResetTokenRepository(session)
+    secret = await un_jeton(depot, await un_compte(session), duree=-timedelta(minutes=1))
+
+    assert await depot.exists_valid(fingerprint_refresh(secret)) is False
+
+
+async def test_exists_valid_is_false_once_the_token_is_consumed(session: AsyncSession) -> None:
+    depot = PasswordResetTokenRepository(session)
+    secret = await un_jeton(depot, await un_compte(session))
+    await depot.consume(fingerprint_refresh(secret))
+
+    assert await depot.exists_valid(fingerprint_refresh(secret)) is False
+
+
+async def test_exists_valid_is_false_for_an_unknown_fingerprint(session: AsyncSession) -> None:
+    depot = PasswordResetTokenRepository(session)
+
+    assert await depot.exists_valid(fingerprint_refresh(generate_refresh_secret())) is False
+
+
 async def test_the_database_refuses_two_tokens_sharing_a_fingerprint(
     session: AsyncSession,
 ) -> None:

apps/backend/tests/services/test_auth.py

@@ -181,8 +181,11 @@ class FausseTransaction:
 
 
 class FauxDepotJetonsReset:
-    def __init__(self, revendique: ConsumedResetToken | None = None) -> None:
+    def __init__(
+        self, revendique: ConsumedResetToken | None = None, *, valide: bool = False
+    ) -> None:
         self.revendique = revendique
+        self.valide = valide
         self.crees: list[UUID] = []
         self.invalidations: list[UUID] = []
 
@@ -192,6 +195,9 @@ class FauxDepotJetonsReset:
     async def consume(self, token_hash: bytes) -> ConsumedResetToken | None:
         return self.revendique
 
+    async def exists_valid(self, token_hash: bytes) -> bool:
+        return self.valide
+
     async def invalidate_all_for_user(self, user_id: UUID) -> int:
         self.invalidations.append(user_id)
         return len(self.invalidations)
@@ -670,6 +676,14 @@ async def test_confirm_password_reset_revokes_every_session_then_reopens_the_cur
     assert "auth.password_reset_self_service" in attirail.audit.lignes[0][0]
 
 
+async def test_is_reset_token_valid_reflects_the_repository() -> None:
+    attirail_valide = fabrique_service(jetons_reset=FauxDepotJetonsReset(valide=True))
+    attirail_invalide = fabrique_service(jetons_reset=FauxDepotJetonsReset(valide=False))
+
+    assert await attirail_valide.service.is_reset_token_valid("un-secret-opaque") is True
+    assert await attirail_invalide.service.is_reset_token_valid("un-secret-opaque") is False
+
+
 async def test_confirm_password_reset_rejects_a_token_for_an_account_disabled_since() -> None:
     compte = FauxCompte(is_active=False)
     jetons_reset = FauxDepotJetonsReset(