cornflow 1.2.3a4__py3-none-any.whl → 1.2.4__py3-none-any.whl

cornflow/tests/unit/test_external_role_creation.py

@@ -13,6 +13,7 @@ from cornflow.shared.const import (
     PATCH_ACTION,
     DELETE_ACTION,
     GET_ACTION,
+    PUT_ACTION,
 )
 
 
@@ -106,6 +107,13 @@ class ExternalRoleCreationTestCase(CustomTestCase):
             (VIEWER_ROLE, POST_ACTION, "scheduling_optimizer"),
             (PLANNER_ROLE, DELETE_ACTION, "quality_control"),
         ]
+        # Define permissions for custom roles used in endpoints
+        mock_const.CUSTOM_ROLES_ACTIONS = {
+            # Default permission for role 888
+            888: [GET_ACTION],
+            # Default permission for role 777
+            777: [GET_ACTION],
+        }
         mock_shared.const = mock_const
         mock_external_app.shared = mock_shared
 
@@ -206,6 +214,17 @@ class ExternalRoleCreationTestCase(CustomTestCase):
             (10000, POST_ACTION, "production_planning"),
             (999, PATCH_ACTION, "quality_control"),
         ]
+        # Define permissions for custom roles used in endpoints (888, 777) and test roles (10000, 999)
+        mock_const.CUSTOM_ROLES_ACTIONS = {
+            # Used in endpoints
+            888: [GET_ACTION],
+            # Used in endpoints
+            777: [GET_ACTION],
+            # Used in test
+            10000: [GET_ACTION],
+            # Used in test
+            999: [GET_ACTION],
+        }
         mock_shared.const = mock_const
         mock_external_app.shared = mock_shared
 
@@ -224,6 +243,7 @@ class ExternalRoleCreationTestCase(CustomTestCase):
         mock_const.EXTRA_PERMISSION_ASSIGNATION = [
             (10000, POST_ACTION, "production_planning"),
         ]
+        # Keep the same CUSTOM_ROLES_ACTIONS (role definitions don't change)
 
         # Re-run permissions registration
         access_init_command(verbose=True)
@@ -266,6 +286,13 @@ class ExternalRoleCreationTestCase(CustomTestCase):
         mock_const = MagicMock()
         # Don't set EXTRA_PERMISSION_ASSIGNATION to trigger AttributeError
         del mock_const.EXTRA_PERMISSION_ASSIGNATION
+        # Define permissions for custom roles used in endpoints
+        mock_const.CUSTOM_ROLES_ACTIONS = {
+            # Used in endpoints
+            888: [GET_ACTION],
+            # Used in endpoints
+            777: [GET_ACTION],
+        }
         mock_shared.const = mock_const
         mock_external_app.shared = mock_shared
 
@@ -304,6 +331,13 @@ class ExternalRoleCreationTestCase(CustomTestCase):
             (VIEWER_ROLE, POST_ACTION, "production_planning"),  # Extend standard role
             (PLANNER_ROLE, DELETE_ACTION, "quality_control"),  # Extend standard role
         ]
+        # Define permissions for custom roles used in endpoints
+        mock_const.CUSTOM_ROLES_ACTIONS = {
+            # Used in endpoints
+            888: [GET_ACTION],
+            # Used in endpoints
+            777: [GET_ACTION],
+        }
         mock_shared.const = mock_const
         mock_external_app.shared = mock_shared
 
@@ -385,6 +419,13 @@ class ExternalRoleCreationTestCase(CustomTestCase):
         mock_shared_initial = MagicMock()
         mock_const_initial = MagicMock()
         mock_const_initial.EXTRA_PERMISSION_ASSIGNATION = []
+        # Define permissions for custom roles used in test endpoints
+        mock_const_initial.CUSTOM_ROLES_ACTIONS = {
+            # Used in test endpoints
+            888: [GET_ACTION],
+            # Used in test endpoints
+            777: [GET_ACTION],
+        }
         mock_shared_initial.const = mock_const_initial
         mock_external_app_initial.shared = mock_shared_initial
 
@@ -459,6 +500,13 @@ class ExternalRoleCreationTestCase(CustomTestCase):
         mock_shared_updated = MagicMock()
         mock_const_updated = MagicMock()
         mock_const_updated.EXTRA_PERMISSION_ASSIGNATION = []  # Empty list
+        # Define permissions for custom roles used in test endpoints
+        mock_const_updated.CUSTOM_ROLES_ACTIONS = {
+            # Used in test endpoints
+            888: [GET_ACTION],
+            # Used in test endpoints
+            777: [GET_ACTION],
+        }
         mock_shared_updated.const = mock_const_updated
         mock_external_app_updated.shared = mock_shared_updated
 
@@ -534,6 +582,204 @@ class ExternalRoleCreationTestCase(CustomTestCase):
             f"Permissions for remaining views should still exist. Found views: {set(all_view_names)}",
         )
 
+    @patch("cornflow.commands.auxiliar.import_module")
+    @patch("cornflow.commands.views.import_module")
+    @patch.dict(
+        os.environ, {"EXTERNAL_APP": "1", "EXTERNAL_APP_MODULE": "external_test_app"}
+    )
+    def test_custom_roles_actions_success(
+        self, mock_import_views, mock_import_auxiliar
+    ):
+        """
+        Test that custom roles get their defined actions from CUSTOM_ROLES_ACTIONS
+        """
+        # Mock external app configuration
+        mock_external_app = MagicMock()
+
+        # Mock the shared.const module with CUSTOM_ROLES_ACTIONS
+        mock_shared = MagicMock()
+        mock_const = MagicMock()
+        mock_const.EXTRA_PERMISSION_ASSIGNATION = []
+        # Define custom roles actions
+        mock_const.CUSTOM_ROLES_ACTIONS = {
+            # Custom role with multiple actions
+            888: [
+                GET_ACTION,
+                POST_ACTION,
+                PUT_ACTION,
+            ],
+            # Another custom role with different actions
+            777: [
+                GET_ACTION,
+                PATCH_ACTION,
+            ],
+        }
+        mock_shared.const = mock_const
+        mock_external_app.shared = mock_shared
+
+        # Mock the endpoints.resources with fake external app endpoints
+        mock_endpoints = MagicMock()
+        mock_endpoints.resources = self._create_mock_external_app_resources()
+        mock_external_app.endpoints = mock_endpoints
+
+        mock_import_views.return_value = mock_external_app
+        mock_import_auxiliar.return_value = mock_external_app
+
+        # Mock the database session for testing
+        with patch.object(db.session, "commit"):
+            with patch.object(db.session, "rollback"):
+                # Run the complete access initialization
+                access_init_command(verbose=True)
+
+                # Verify that custom permissions were created with the correct actions
+                from cornflow.models import PermissionViewRoleModel
+
+                # Get all permissions for role 888
+                permissions_888 = PermissionViewRoleModel.query.filter_by(
+                    role_id=888
+                ).all()
+                actions_888 = {perm.action_id for perm in permissions_888}
+
+                # Get all permissions for role 777
+                permissions_777 = PermissionViewRoleModel.query.filter_by(
+                    role_id=777
+                ).all()
+                actions_777 = {perm.action_id for perm in permissions_777}
+
+                # Verify role 888 has GET, POST, PUT actions
+                expected_actions_888 = {GET_ACTION, POST_ACTION, PUT_ACTION}
+                self.assertTrue(
+                    expected_actions_888.issubset(actions_888),
+                    f"Role 888 should have actions {expected_actions_888}, but got {actions_888}",
+                )
+
+                # Verify role 777 has GET, PATCH actions
+                expected_actions_777 = {GET_ACTION, PATCH_ACTION}
+                self.assertTrue(
+                    expected_actions_777.issubset(actions_777),
+                    f"Role 777 should have actions {expected_actions_777}, but got {actions_777}",
+                )
+
+                # Verify that role 888 does NOT have actions that were not defined
+                # We check that no DELETE or PATCH actions exist for role 888
+                forbidden_actions_888 = {DELETE_ACTION, PATCH_ACTION}
+                actual_forbidden_888 = actions_888.intersection(forbidden_actions_888)
+                self.assertEqual(
+                    len(actual_forbidden_888),
+                    0,
+                    f"Role 888 should not have actions {forbidden_actions_888}, but found {actual_forbidden_888}",
+                )
+
+                # Verify that role 777 does NOT have actions that were not defined
+                # We check that no POST, PUT, DELETE actions exist for role 777
+                forbidden_actions_777 = {POST_ACTION, PUT_ACTION, DELETE_ACTION}
+                actual_forbidden_777 = actions_777.intersection(forbidden_actions_777)
+                self.assertEqual(
+                    len(actual_forbidden_777),
+                    0,
+                    f"Role 777 should not have actions {forbidden_actions_777}, but found {actual_forbidden_777}",
+                )
+
+    @patch("cornflow.commands.auxiliar.import_module")
+    @patch("cornflow.commands.views.import_module")
+    @patch.dict(
+        os.environ, {"EXTERNAL_APP": "1", "EXTERNAL_APP_MODULE": "external_test_app"}
+    )
+    def test_custom_roles_actions_error_on_undefined_role(
+        self, mock_import_views, mock_import_auxiliar
+    ):
+        """
+        Test that an error is raised when a custom role is used but not defined in CUSTOM_ROLES_ACTIONS
+        """
+        # Mock external app configuration
+        mock_external_app = MagicMock()
+
+        # Mock the shared.const module with CUSTOM_ROLES_ACTIONS that doesn't include role 888
+        mock_shared = MagicMock()
+        mock_const = MagicMock()
+        mock_const.EXTRA_PERMISSION_ASSIGNATION = []
+        # Define custom roles permissions but MISSING role 888 which is used in endpoints
+        mock_const.CUSTOM_ROLES_ACTIONS = {
+            # Only define role 777, but role 888 is used in endpoints
+            777: [
+                GET_ACTION,
+                PATCH_ACTION,
+            ],
+        }
+        mock_shared.const = mock_const
+        mock_external_app.shared = mock_shared
+
+        # Mock the endpoints.resources with fake external app endpoints that use role 888
+        mock_endpoints = MagicMock()
+        mock_endpoints.resources = (
+            self._create_mock_external_app_resources()
+        )  # This includes role 888
+        mock_external_app.endpoints = mock_endpoints
+
+        mock_import_views.return_value = mock_external_app
+        mock_import_auxiliar.return_value = mock_external_app
+
+        # Verify that a ValueError is raised for undefined role 888
+        with self.assertRaises(ValueError) as context:
+            access_init_command(verbose=True)
+
+        # Verify the error message contains the undefined role
+        error_message = str(context.exception)
+        self.assertIn("888", error_message)
+        self.assertIn("CUSTOM_ROLES_ACTIONS", error_message)
+        self.assertIn("not defined", error_message)
+
+    @patch("cornflow.commands.auxiliar.import_module")
+    @patch("cornflow.commands.views.import_module")
+    @patch.dict(
+        os.environ, {"EXTERNAL_APP": "1", "EXTERNAL_APP_MODULE": "external_test_app"}
+    )
+    def test_custom_roles_actions_fallback_when_not_defined(
+        self, mock_import_views, mock_import_auxiliar
+    ):
+        """
+        Test that the system falls back gracefully when CUSTOM_ROLES_ACTIONS is not defined
+        but no custom roles are used
+        """
+        # Mock external app configuration
+        mock_external_app = MagicMock()
+
+        # Mock the shared.const module WITHOUT CUSTOM_ROLES_ACTIONS
+        mock_shared = MagicMock()
+        mock_const = MagicMock()
+        mock_const.EXTRA_PERMISSION_ASSIGNATION = []
+        # Don't set CUSTOM_ROLES_ACTIONS to trigger AttributeError
+        # This simulates an external app that doesn't define the new constant
+        mock_shared.const = mock_const
+        mock_external_app.shared = mock_shared
+
+        # Mock endpoints that only use standard roles (no custom roles)
+        mock_production_endpoint = MagicMock()
+        # Only standard role
+        mock_production_endpoint.ROLES_WITH_ACCESS = [PLANNER_ROLE]
+        mock_production_endpoint.DESCRIPTION = "Production planning endpoint"
+
+        mock_resources = [
+            {
+                "endpoint": "production_planning",
+                "urls": "/production-planning/",
+                "resource": mock_production_endpoint,
+            }
+        ]
+
+        mock_endpoints = MagicMock()
+        mock_endpoints.resources = mock_resources
+        mock_external_app.endpoints = mock_endpoints
+
+        mock_import_views.return_value = mock_external_app
+        mock_import_auxiliar.return_value = mock_external_app
+
+        # Should not raise any exceptions since no custom roles are used
+        try:
+            access_init_command(verbose=True)
+        except Exception as e:
+            self.fail(f"access_init_command raised an exception when it shouldn't: {e}")
+
 
 if __name__ == "__main__":
     unittest.main()

cornflow/tests/unit/test_get_resources.py

@@ -0,0 +1,103 @@
+"""
+Unit tests for the get_resources function
+"""
+
+import unittest
+from unittest.mock import patch, MagicMock
+from flask import Flask
+from cornflow.endpoints import get_resources, resources
+from cornflow.shared.const import CONDITIONAL_ENDPOINTS
+
+
+class TestGetResources(unittest.TestCase):
+    """Test the get_resources function"""
+
+    def setUp(self):
+        self.app = Flask(__name__)
+        self.mock_signup_view = MagicMock()
+        self.mock_signup_view.view_class = MagicMock()
+        self.mock_login_view = MagicMock()
+        self.mock_login_view.view_class = MagicMock()
+
+    def test_returns_base_resources_when_no_conditional_endpoints(self):
+        """Test that get_resources returns base resources when no conditional endpoints are registered"""
+        with self.app.app_context():
+            with patch("flask.current_app.view_functions", {}):
+                result = get_resources()
+                self.assertEqual(result, resources)
+
+    def test_adds_conditional_endpoint_when_registered(self):
+        """Test that get_resources adds conditional endpoints when they are registered"""
+        with self.app.app_context():
+            mock_view_functions = {"signup": self.mock_signup_view}
+
+            with patch("flask.current_app.view_functions", mock_view_functions):
+                result = get_resources()
+
+                # Should have one more resource than base
+                self.assertEqual(len(result), len(resources) + 1)
+
+                # Check that signup endpoint was added correctly
+                signup_resource = next(
+                    (r for r in result if r["endpoint"] == "signup"), None
+                )
+                self.assertIsNotNone(signup_resource)
+                self.assertEqual(
+                    signup_resource["urls"], CONDITIONAL_ENDPOINTS["signup"]
+                )
+                self.assertEqual(
+                    signup_resource["resource"], self.mock_signup_view.view_class
+                )
+
+    def test_adds_both_signup_and_login_when_registered(self):
+        """Test that get_resources adds both signup and login when both are registered"""
+        with self.app.app_context():
+            mock_view_functions = {
+                "signup": self.mock_signup_view,
+                "login": self.mock_login_view,
+            }
+
+            with patch("flask.current_app.view_functions", mock_view_functions):
+                result = get_resources()
+
+                # Should have two more resources than base
+                self.assertEqual(len(result), len(resources) + 2)
+
+                # Check that both endpoints were added correctly
+                signup_resource = next(
+                    (r for r in result if r["endpoint"] == "signup"), None
+                )
+                login_resource = next(
+                    (r for r in result if r["endpoint"] == "login"), None
+                )
+
+                self.assertIsNotNone(signup_resource)
+                self.assertIsNotNone(login_resource)
+                self.assertEqual(
+                    signup_resource["urls"], CONDITIONAL_ENDPOINTS["signup"]
+                )
+                self.assertEqual(login_resource["urls"], CONDITIONAL_ENDPOINTS["login"])
+
+    def test_does_not_add_duplicate_endpoints(self):
+        """Test that get_resources does not add endpoints that already exist in base resources"""
+        with self.app.app_context():
+            mock_view_functions = {
+                "instance": MagicMock()
+            }  # 'instance' already exists in base resources
+
+            with patch("flask.current_app.view_functions", mock_view_functions):
+                result = get_resources()
+                self.assertEqual(len(result), len(resources))
+
+    def test_ignores_non_conditional_endpoints(self):
+        """Test that get_resources ignores endpoints that are not in CONDITIONAL_ENDPOINTS"""
+        with self.app.app_context():
+            mock_view_functions = {"non_conditional_endpoint": MagicMock()}
+
+            with patch("flask.current_app.view_functions", mock_view_functions):
+                result = get_resources()
+                self.assertEqual(len(result), len(resources))
+
+
+if __name__ == "__main__":
+    unittest.main()

cornflow/tests/unit/test_sign_up.py

@@ -1,18 +1,25 @@
 """
 Unit test for the sign-up endpoint
 """
-from cornflow.commands import access_init_command
-from cornflow.commands.dag import register_deployed_dags_command_test
 
 # Import from libraries
-from flask_testing import TestCase
+
+# Import from internal modules
+
 import json
+from unittest.mock import patch
+
+# Import from libraries
+from flask_testing import TestCase
 
 # Import from internal modules
 from cornflow.app import create_app
-from cornflow.models import UserModel, UserRoleModel
-from cornflow.shared.const import PLANNER_ROLE
+from cornflow.commands import access_init_command
+from cornflow.commands.dag import register_deployed_dags_command_test
+from cornflow.models import UserModel, UserRoleModel, ViewModel, PermissionViewRoleModel
 from cornflow.shared import db
+from cornflow.shared.authentication import Auth
+from cornflow.shared.const import PLANNER_ROLE, ADMIN_ROLE, POST_ACTION, NO_SIGNUP, SIGNUP_WITH_AUTH
 from cornflow.tests.const import SIGNUP_URL
 
 
@@ -95,7 +102,7 @@ class TestSignUp(TestCase):
 class TestSignUpDeactivated(TestCase):
     def create_app(self):
         app = create_app("testing")
-        app.config["SIGNUP_ACTIVATED"] = 0
+        app.config["SIGNUP_ACTIVATED"] = NO_SIGNUP
         return app
 
     def setUp(self):
@@ -120,3 +127,171 @@ class TestSignUpDeactivated(TestCase):
         )
 
         self.assertEqual(response.status_code, 400)
+
+
+class TestSignUpAuthenticated(TestCase):
+    """Test the authenticated signup endpoint (SIGNUP_ACTIVATED=SIGNUP_WITH_AUTH)"""
+
+    def create_app(self):
+        with patch("cornflow.config.Testing.SIGNUP_ACTIVATED", SIGNUP_WITH_AUTH):
+            app = create_app("testing")
+        return app
+
+    def setUp(self):
+        db.create_all()
+        access_init_command(verbose=False)
+        register_deployed_dags_command_test(verbose=False)
+
+        # Create test data
+        self.data = {
+            "username": "testname",
+            "email": "test@test.com",
+            "password": "Testpassword1!",
+        }
+
+        # Create an admin user for testing
+        self.admin_user = UserModel(
+            {
+                "username": "admin",
+                "email": "admin@test.com",
+                "password": "Adminpassword1!",
+            }
+        )
+        self.admin_user.save()
+
+        # Assign admin role to the user
+        admin_role = UserRoleModel(
+            {"user_id": self.admin_user.id, "role_id": ADMIN_ROLE}
+        )
+        admin_role.save()
+
+        # Create a regular user for testing
+        self.regular_user = UserModel(
+            {
+                "username": "regular",
+                "email": "regular@test.com",
+                "password": "Regularpassword1!",
+            }
+        )
+        self.regular_user.save()
+
+        # Assign planner role to the user
+        planner_role = UserRoleModel(
+            {"user_id": self.regular_user.id, "role_id": PLANNER_ROLE}
+        )
+        planner_role.save()
+
+    def tearDown(self):
+        db.session.remove()
+        db.drop_all()
+
+    def get_auth_token(self, user):
+        """Helper method to get authentication token for a user"""
+        auth = Auth()
+        return auth.generate_token(user.id)
+
+    def test_authenticated_signup_admin_can_register(self):
+        """Test that admin users can register new users"""
+        payload = self.data
+        admin_token = self.get_auth_token(self.admin_user)
+
+        response = self.client.post(
+            SIGNUP_URL,
+            data=json.dumps(payload),
+            follow_redirects=True,
+            headers={
+                "Content-Type": "application/json",
+                "Authorization": f"Bearer {admin_token}",
+            },
+        )
+
+        self.assertEqual(201, response.status_code)
+        self.assertEqual(str, type(response.json["token"]))
+        self.assertEqual(int, type(response.json["id"]))
+        self.assertEqual(
+            PLANNER_ROLE,
+            UserRoleModel.query.filter_by(user_id=response.json["id"]).first().role_id,
+        )
+        self.assertNotEqual(None, UserModel.get_one_user_by_email(self.data["email"]))
+
+    def test_authenticated_signup_regular_user_cannot_register(self):
+        """Test that regular users cannot register new users"""
+        payload = self.data
+        regular_token = self.get_auth_token(self.regular_user)
+
+        response = self.client.post(
+            SIGNUP_URL,
+            data=json.dumps(payload),
+            follow_redirects=True,
+            headers={
+                "Content-Type": "application/json",
+                "Authorization": f"Bearer {regular_token}",
+            },
+        )
+
+        # Should return 403 Forbidden due to insufficient permissions
+        self.assertEqual(403, response.status_code)
+        self.assertIn("error", response.json)
+
+    def test_authenticated_signup_no_auth_header_fails(self):
+        """Test that signup fails without authentication header"""
+        payload = self.data
+
+        response = self.client.post(
+            SIGNUP_URL,
+            data=json.dumps(payload),
+            follow_redirects=True,
+            headers={"Content-Type": "application/json"},
+        )
+
+        # Should return 400 Bad Request due to missing authorization
+        self.assertEqual(400, response.status_code)
+        self.assertIn("error", response.json)
+
+    def test_authenticated_signup_invalid_token_fails(self):
+        """Test that signup fails with invalid token"""
+        payload = self.data
+
+        response = self.client.post(
+            SIGNUP_URL,
+            data=json.dumps(payload),
+            follow_redirects=True,
+            headers={
+                "Content-Type": "application/json",
+                "Authorization": "Bearer invalid_token",
+            },
+        )
+
+        # Should return 400 Bad Request due to invalid token
+        self.assertEqual(400, response.status_code)
+        self.assertIn("error", response.json)
+
+    def test_signup_permissions_are_registered_in_database(self):
+        """Test that signup permissions are properly registered in the database"""
+        # Check that the signup endpoint exists in the views table
+        signup_view = ViewModel.query.filter_by(name="signup").first()
+        self.assertIsNotNone(
+            signup_view, "Signup endpoint should be registered in views table"
+        )
+        self.assertEqual("/signup/", signup_view.url_rule)
+
+        # Check that admin role has permissions for signup endpoint
+        admin_permissions = PermissionViewRoleModel.query.filter_by(
+            role_id=ADMIN_ROLE, api_view_id=signup_view.id
+        ).all()
+
+        # Admin should have POST permission for signup endpoint
+        self.assertGreater(
+            len(admin_permissions),
+            0,
+            "Admin should have permissions for signup endpoint",
+        )
+
+        # Verify that the permission is for POST action
+        post_permission = PermissionViewRoleModel.query.filter_by(
+            role_id=ADMIN_ROLE, api_view_id=signup_view.id, action_id=POST_ACTION
+        ).first()
+
+        self.assertIsNotNone(
+            post_permission, "Admin should have POST permission for signup endpoint"
+        )

{cornflow-1.2.3a4.dist-info → cornflow-1.2.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cornflow
-Version: 1.2.3a4
+Version: 1.2.4
 Summary: cornflow is an open source multi-solver optimization server with a REST API built using flask.
 Home-page: https://github.com/baobabsoluciones/cornflow
 Author: baobab soluciones
@@ -14,7 +14,7 @@ Requires-Dist: alembic==1.9.2
 Requires-Dist: apispec<=6.3.0
 Requires-Dist: cachetools==5.3.3
 Requires-Dist: click<=8.1.7
-Requires-Dist: cornflow-client>=1.2.3.a4
+Requires-Dist: cornflow-client<=1.2.4
 Requires-Dist: cryptography<=44.0.1
 Requires-Dist: disposable-email-domains>=0.0.86
 Requires-Dist: Flask==2.3.2
@@ -37,7 +37,7 @@ Requires-Dist: PuLP<=2.9.0
 Requires-Dist: psycopg2<=2.9.9
 Requires-Dist: PyJWT<=2.8.0
 Requires-Dist: pytups>=0.86.2
-Requires-Dist: requests<=2.32.3
+Requires-Dist: requests<=2.32.4
 Requires-Dist: SQLAlchemy==1.3.21
 Requires-Dist: webargs<=8.3.0
 Requires-Dist: Werkzeug==3.0.6