feat: add SRP authentication, improve security

- Replace RSA key exchange with SRP (Secure Remote Password)
- Password never transmitted over network
- Add unit tests for endpoints
- Fix datetime.UTC compatibility for Python < 3.11
- Fix logger.exception usage
- Update README with new auth flow diagram

tests/conftest.py

@@ -0,0 +1,41 @@
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+import uuid
+import pytest
+from sanic_testing import TestManager
+from sanic import Sanic
+from sanic_ext import Extend
+from cryptography.fernet import Fernet
+
+from cmd_chat.server.managers import ConnectionManager
+from cmd_chat.server.stores import MessageStore, UserSessionStore
+from cmd_chat.server.srp_auth import SRPAuthManager
+from cmd_chat.server.routes import register_routes
+
+
+@pytest.fixture
+def app():
+    name = f"test-{uuid.uuid4().hex[:8]}"
+    
+    app = Sanic(name)
+    Extend(app)
+
+    app.ctx.message_store = MessageStore()
+    app.ctx.session_store = UserSessionStore()
+    app.ctx.connection_manager = ConnectionManager()
+    app.ctx.srp_manager = SRPAuthManager("testpassword")
+    app.ctx.fernet_key = Fernet.generate_key()
+    app.ctx.cleanup_task = None
+
+    register_routes(app)
+    TestManager(app)
+    
+    return app
+
+
+@pytest.fixture
+def test_client(app):
+    return app.test_client

tests/test_health.py

@@ -0,0 +1,17 @@
+# tests/test_health.py
+import pytest
+
+
+class TestHealth:
+    """Тесты health endpoint"""
+
+    def test_health_ok(self, test_client):
+        """GET /health возвращает статус"""
+        _, response = test_client.get("/health")
+
+        assert response.status == 200
+        data = response.json
+        assert data["status"] == "ok"
+        assert "messages" in data
+        assert "users" in data
+        assert "timestamp" in data

tests/test_srp.py

@@ -0,0 +1,48 @@
+# tests/test_srp.py
+import base64
+import pytest
+import srp
+
+
+class TestSRPFlow:
+    """Тесты SRP аутентификации"""
+
+    def test_srp_init_success(self, test_client):
+        """POST /srp/init возвращает user_id, B, salt"""
+        usr = srp.User(b"chat", b"testpassword")
+        _, A = usr.start_authentication()
+
+        _, response = test_client.post(
+            "/srp/init",
+            json={
+                "username": "testuser",
+                "A": base64.b64encode(A).decode(),
+            },
+        )
+
+        assert response.status == 200
+        data = response.json
+        assert "user_id" in data
+        assert "B" in data
+        assert "salt" in data
+
+    def test_srp_init_missing_a(self, test_client):
+        """POST /srp/init без A возвращает 400"""
+        _, response = test_client.post(
+            "/srp/init",
+            json={"username": "testuser"},
+        )
+
+        assert response.status == 400
+
+    def test_srp_verify_invalid_session(self, test_client):
+        """Verify с несуществующим user_id возвращает 401"""
+        _, response = test_client.post(
+            "/srp/verify",
+            json={
+                "user_id": "nonexistent",
+                "username": "testuser",
+                "M": base64.b64encode(b"fake").decode(),
+            },
+        )
+        assert response.status == 401

tests/test_websocket.py

@@ -0,0 +1,17 @@
+# tests/test_websocket.py
+import pytest
+
+
+class TestWebSocket:
+    """Тесты WebSocket подключения"""
+
+    def test_ws_connect_no_user_id(self, test_client):
+        """WebSocket без user_id отклоняется"""
+        _, ws = test_client.websocket("/ws/chat")
+        # Проверяем что соединение закрыто или вернулась ошибка
+        assert ws is not None
+
+    def test_ws_connect_invalid_session(self, test_client):
+        """WebSocket с невалидным user_id отклоняется"""
+        _, ws = test_client.websocket("/ws/chat?user_id=invalid123")
+        assert ws is not None