pyramid-fullauth 0.4.0__py3.4.egg

tests/views/test_login.py

@@ -0,0 +1,172 @@
+"""Log in related test."""
+import pytest
+import transaction
+
+from tests.tools import authenticate, is_user_logged, DEFAULT_USER
+
+
+def test_login_view(default_app):
+    """Login view."""
+    res = default_app.get('/login')
+    assert res.form
+    assert 'email' in res.form.fields
+    assert 'password' in res.form.fields
+    assert 'remember' in res.form.fields
+
+
+def test_login_view_secret(extended_app):
+    """Login:Form displayed after redirect from protected view."""
+    res = extended_app.get('/secret', status=302)
+    # check if redirect is correct
+    assert res.headers['Location'] == 'http://localhost/login?after=%2Fsecret'
+    # redirecting
+    res = extended_app.get(res.headers['Location'])
+    assert res.form
+    assert 'email' in res.form.fields
+
+
+@pytest.mark.parametrize('email', (
+    DEFAULT_USER['email'].lower(),
+    DEFAULT_USER['email'].upper()
+))
+def test_login_ok(active_user, extended_app, email):
+    """Actually log in test."""
+    res = extended_app.get('/secret', status=302)
+    res = res.follow()
+    res = extended_app.get('/login?after=%2Fsecret')
+
+    assert is_user_logged(extended_app) is False
+
+    res = authenticate(extended_app, email=email)
+    assert 'Max-Age=' not in str(res)
+
+    assert is_user_logged(extended_app) is True
+
+
+def test_login_remember(active_user, extended_app):
+    """Login user and mark remember me field."""
+    res = extended_app.get('/login')
+    assert is_user_logged(extended_app) is False
+
+    res = authenticate(extended_app, remember=True)
+
+    assert is_user_logged(extended_app) is True
+    assert 'Max-Age=' in str(res)
+
+
+def test_login_inactive(user, extended_app):
+    """Log in inactive user."""
+    assert is_user_logged(extended_app) is False
+
+    authenticate(extended_app)
+
+    assert is_user_logged(extended_app) is True
+
+
+def test_login_redirects(active_user, extended_app):
+    """Login with redirects."""
+    res = extended_app.get('/secret', status=302)
+    assert res.status_code == 302
+    res = res.follow()
+    res.form['email'] = DEFAULT_USER['email']
+    res.form['password'] = DEFAULT_USER['password']
+    res = res.form.submit()
+
+    assert is_user_logged(extended_app) is True
+    assert res.status_code == 303
+
+
+@pytest.mark.parametrize('user_kwargs', (
+    {'password': 'wrong password'},
+    {'email': 'not@registered.py'}
+))
+def test_login_wrong(active_user, user_kwargs, extended_app):
+    """Use wrong password during authentication."""
+    res = authenticate(extended_app, response_code=200, **user_kwargs)
+
+    assert 'Error! Wrong e-mail or password.' in res
+    assert res
+
+
+@pytest.mark.parametrize('post_data', (
+    {
+        'email': DEFAULT_USER['email'],
+        'password': DEFAULT_USER['password'],
+    }, {
+        'email': DEFAULT_USER['email'],
+        'password': DEFAULT_USER['password'],
+        'csrf_token': '8934798289723789347892397832789432789'
+    }
+
+))
+def test_login_csrf_error(active_user, extended_app, post_data):
+    """Try to log in with erroneus csrf token."""
+    res = extended_app.get('/login', status=200)
+    assert res
+    res = extended_app.post('/login', post_data, status=401)
+
+    assert is_user_logged(extended_app) is False
+
+
+def test_login_success_xhr(active_user, extended_app):
+    """Test xhr authentication."""
+    res = extended_app.get('/login')
+    post_data = {
+        'email': DEFAULT_USER['email'],
+        'password': DEFAULT_USER['password'],
+        'csrf_token': res.form['csrf_token'].value
+    }
+    extended_app.get('/secret', status=302)
+    res = extended_app.post('/login?after=%2Fsecret',
+                            post_data,
+                            xhr=True,
+                            expect_errors=True)
+
+    assert res.content_type == 'application/json'
+    assert res.json['status'] is True
+    assert 'after' in res.json
+    assert is_user_logged(extended_app) is True
+
+    # second call
+    res = extended_app.post('/login?after=%2Fsecret',
+                            post_data,
+                            xhr=True,
+                            expect_errors=True)
+    assert res.json['status'] is True
+    assert res.json['msg'] == 'Already logged in!'
+
+
+def test_default_login_forbidden(active_user, authable_app):
+    """After successful login, user should get 403 on secret page."""
+    authable_app.get('/secret', status=302)
+    forbidden = authable_app.get('/secret', xhr=True, status=403)
+    assert forbidden.json['status'] is False
+    authenticate(authable_app)
+    authable_app.get('/secret', status=403)
+    # go back to secret page
+    forbidden = authable_app.get('/secret', xhr=True, status=403)
+    # no permission, but logged.
+    assert forbidden.json['status'] is False
+    assert 'login_url' not in forbidden.json
+
+
+def test_default_login_redirectaway(active_user, authable_app):
+    """After successful login, access to login page should result in redirect."""
+    authenticate(authable_app)
+    res = authable_app.get('/login', status=303)
+    assert res.location == 'http://localhost/'
+
+
+def test_login_invalid_cookie(db_session, active_user, extended_app):
+    """Test access login page by deleted user."""
+    res = authenticate(extended_app)
+    assert 'Max-Age=' not in str(res)
+
+    assert is_user_logged(extended_app) is True
+
+    db_session.delete(active_user)
+    transaction.commit()
+
+    # will rise Attribute error
+    res = extended_app.get('/login')
+    assert res.status_code == 200, "Should stay since user is no longer valid!"

tests/views/test_login_social.py

@@ -0,0 +1,289 @@
+"""Social network login test."""
+import transaction
+from pyramid import testing
+from pyramid.compat import text_type
+from mock import MagicMock
+
+try:
+    from velruse import AuthenticationComplete
+    from pyramid_fullauth.views.social import SocialLoginViews
+except ImportError:
+    # tests will be skipped anyway
+    pass
+
+from pyramid_fullauth.models import User
+
+from tests.conftest import py2only
+from tests.views.conftest import mock_translate
+
+
+@py2only
+def test_social_login_link(social_app):
+    """Login:Form displayed social form."""
+    res = social_app.get('/login')
+    assert ('Connect with facebook</a>' in res.body.decode('unicode_escape'))
+
+
+@py2only
+def test_social_click_link(social_app):
+    """Click social login link."""
+    res = social_app.get('/login/facebook?scope=email%2Coffline_access', status=302)
+    assert (res.headers['Location'].startswith(
+        'https://www.facebook.com/dialog/oauth/?scope=email%2Coffline_access&state='))
+
+
+@py2only
+def test_social_login_register(social_config, db_session):
+    """Register fresh user and logs him in."""
+    profile = {
+        'accounts': [{'domain': text_type('facebook.com'), 'userid': text_type('2343')}],
+        'displayName': text_type('teddy'),
+        'verifiedEmail': text_type('we@po.pl'),
+        'preferredUsername': text_type('teddy'),
+        'emails': [{'value': text_type('aasd@bwwqwe.pl')}],
+        'name': text_type('ted')
+    }
+    credentials = {'oauthAccessToken': '7897048593434'}
+    provider_name = text_type('facebook')
+    provider_type = text_type('facebook')
+    request = testing.DummyRequest()
+    request.user = None
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(profile, credentials, provider_name, provider_type)
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    view = SocialLoginViews(request)
+    out = view()
+    assert out == {'status': True}
+    transaction.commit()
+
+    # read first new account
+    user = db_session.query(User).one()
+    assert user.is_active
+    assert user.provider_id('facebook') == profile['accounts'][0]['userid']
+
+
+@py2only
+def test_login_different_social_account(social_config, db_session, facebook_user):
+    """
+    Login with different social account than connected from same provider.
+
+    System should let user in, but not change connection.
+    """
+    # profile mock response
+    profile = {
+        # facebook user id is different than user's
+        'accounts': [{'domain': text_type('facebook.com'), 'userid': text_type('2343')}],
+        'displayName': text_type('teddy'),
+        'verifiedEmail': facebook_user.email,
+        'preferredUsername': text_type('teddy'),
+        'emails': [{'value': text_type('aasd@bwwqwe.pl')}],
+        'name': text_type('ted')
+    }
+    request = testing.DummyRequest()
+    request.user = None
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(
+        profile,
+        {'oauthAccessToken': '7897048593434'},
+        text_type('facebook'),
+        text_type('facebook'))
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    view = SocialLoginViews(request)
+    out = view()
+    # user should be authenticated recognized by email!
+    assert out['status'] is True
+    assert facebook_user.provider_id('facebook') is not profile['accounts'][0]['userid']
+
+
+@py2only
+def test_login_social_connect(social_config, active_user, db_session):
+    """Connect and logs user in."""
+    user = db_session.merge(active_user)
+
+    profile = {
+        'accounts': [{'domain': text_type('facebook.com'), 'userid': text_type('2343')}],
+        'displayName': text_type('teddy'),
+        'preferredUsername': text_type('teddy'),
+        'emails': [{'value': user.email}],
+        'name': text_type('ted')
+    }
+    credentials = {'oauthAccessToken': '7897048593434'}
+    provider_name = text_type('facebook')
+    provider_type = text_type('facebook')
+    user = None
+    request = testing.DummyRequest()
+    request.user = user
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(profile, credentials, provider_name, provider_type)
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    view = SocialLoginViews(request)
+    out = view()
+    assert out == {'status': True}
+
+
+@py2only
+def test_logged_social_connect_account(social_config, active_user, db_session):
+    """Connect facebook account to logged in user."""
+    user = db_session.merge(active_user)
+
+    profile = {
+        'accounts': [{'domain': text_type('facebook.com'), 'userid': text_type('2343')}],
+        'displayName': text_type('teddy'),
+        'preferredUsername': text_type('teddy'),
+        'emails': [{'value': text_type('aasd@basd.pl')}],
+        'name': text_type('ted')
+    }
+    credentials = {'oauthAccessToken': '7897048593434'}
+    provider_name = text_type('facebook')
+    provider_type = text_type('facebook')
+    request = testing.DummyRequest()
+    request.user = user
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(profile, credentials, provider_name, provider_type)
+    request._ = mock_translate
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    view = SocialLoginViews(request)
+    out = view()
+    assert out['status'] is True
+
+    transaction.commit()
+    user = db_session.merge(user)
+    assert user.provider_id('facebook') == profile['accounts'][0]['userid']
+
+
+@py2only
+def test_logged_social_connect_self(social_config, facebook_user, db_session):
+    """Connect self."""
+    user = db_session.merge(facebook_user)
+
+    profile = {
+        'accounts': [{'domain': text_type('facebook.com'), 'userid': user.provider_id('facebook')}],
+        'displayName':
+        text_type('teddy'),
+        'preferredUsername':
+        text_type('teddy'),
+        'emails':
+        [{'value': user.email}],
+        'name':
+        text_type('ted')
+    }
+    credentials = {'oauthAccessToken':
+                   '7897048593434'}
+    provider_name = text_type('facebook')
+    provider_type = text_type('facebook')
+    request = testing.DummyRequest()
+    request.user = user
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(profile, credentials, provider_name, provider_type)
+    request._ = mock_translate
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    view = SocialLoginViews(request)
+    out = view()
+    assert out['status'] is True
+
+    user = db_session.merge(facebook_user)
+    assert user.provider_id('facebook') == profile['accounts'][0]['userid']
+
+
+@py2only
+def test_logged_social_connect_second_account(social_config, facebook_user, db_session):
+    """Connect second facebook account to logged in user."""
+    user = db_session.merge(facebook_user)
+
+    # mock request
+    profile = {
+        'accounts':
+        [{'domain': text_type('facebook.com'), 'userid': text_type('2343')}],
+        'displayName':
+        text_type('teddy'),
+        'preferredUsername':
+        text_type('teddy'),
+        'emails':
+        [{'value': text_type('aasd@basd.pl')}],
+        'name':
+        text_type('ted')
+    }
+    credentials = {'oauthAccessToken':
+                   '7897048593434'}
+    provider_name = text_type('facebook')
+    provider_type = text_type('facebook')
+    request = testing.DummyRequest()
+    request.user = user
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(profile, credentials, provider_name, provider_type)
+    request._ = mock_translate
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    view = SocialLoginViews(request)
+    out = view()
+    # status should be false
+    assert out['status'] is False
+    assert out['msg'] == 'Your account is already connected to other ${provider} account.'
+    assert user.provider_id('facebook') is not profile['accounts'][0]['userid']
+
+
+@py2only
+def test_logged_social_connect_used_account(social_config, facebook_user, db_session):
+    """Try to connect facebook account to logged in user used by other user."""
+    # this user will be logged and trying to connect facebook's user account.
+    fresh_user = User(
+        email=text_type('new@user.pl'),
+        password=text_type('somepassword'),
+        address_ip=text_type('127.0.0.1')
+    )
+    db_session.add(fresh_user)
+    transaction.commit()
+    user = db_session.merge(facebook_user)
+    fresh_user = db_session.merge(fresh_user)
+
+    # mock request
+    profile = {
+        'accounts':
+        [{'domain': text_type('facebook.com'), 'userid': user.provider_id('facebook')}],
+        'displayName':
+        text_type('teddy'),
+        'preferredUsername':
+        text_type('teddy'),
+        'emails':
+        [{'value': text_type('aasd@basd.pl')}],
+        'name':
+        text_type('ted')
+    }
+    credentials = {'oauthAccessToken': '7897048593434'}
+    provider_name = text_type('facebook')
+    provider_type = text_type('facebook')
+    request = testing.DummyRequest()
+    request.user = fresh_user
+    request.registry = social_config.registry
+    request.remote_addr = text_type('127.0.0.123')
+    request.context = AuthenticationComplete(profile, credentials, provider_name, provider_type)
+    request._ = mock_translate
+
+    request.login_perform = MagicMock(name='login_perform')
+    request.login_perform.return_value = {'status': True}
+    # call!
+    view = SocialLoginViews(request)
+    out = view()
+    # status should be false
+    assert out['status'] is False
+    assert out['msg'] == 'This ${provider} account is already connected with other account.'
+    transaction.begin()
+    fresh_user = db_session.merge(fresh_user)
+    assert fresh_user.provider_id('facebook') is None

tests/views/test_logout.py

@@ -0,0 +1,42 @@
+"""Logout related tests."""
+import time
+
+from tests.tools import authenticate, is_user_logged
+
+
+def test_logout(active_user, extended_app):
+    """Check logout action."""
+    authenticate(extended_app)
+    assert is_user_logged(extended_app) is True
+
+    extended_app.get('/logout', status=303)
+    assert is_user_logged(extended_app) is False
+    res = extended_app.get('/secret', status=302)
+    assert res.status_code == 302
+
+
+def test_logout_login(active_user, extended_config, extended_app):
+    """Check logout action with configured logout redirection."""
+    extended_config.registry['config'].fullauth.redirects.logout = 'login'
+    authenticate(extended_app)
+    assert is_user_logged(extended_app) is True
+
+    res = extended_app.get('/logout', status=303)
+    assert is_user_logged(extended_app) is False
+    # redirection should be done to login page.
+    assert '/login' in res.location
+    res = extended_app.get('/secret', status=302)
+    assert res.status_code == 302
+
+
+def test_automatic_logout(active_user, short_config, short_app):
+    """Test automatic logout."""
+    timeout = short_config.registry['config']['fullauth']['AuthTkt']['timeout'] + 1
+
+    authenticate(short_app)
+    # Simulating inactivity
+    time.sleep(timeout)
+    res = short_app.get('/email/change')
+    assert res.headers['Location'] == 'http://localhost/login?after=%2Femail%2Fchange'
+    res = res.follow()
+    assert res.form

tests/views/test_register.py

@@ -0,0 +1,138 @@
+"""Registration related tests."""
+try:
+    from HTMLParser import HTMLParser
+except ImportError:
+    from html.parser import HTMLParser
+
+import pytest
+import transaction
+from pyramid.compat import text_type
+from sqlalchemy.orm.exc import NoResultFound
+
+from pyramid_fullauth.models import User
+from tests.tools import DEFAULT_USER
+
+
+def test_register_view(default_app):
+    """Display register form."""
+    res = default_app.get('/register')
+    assert res.form
+
+
+@pytest.mark.parametrize('email, password', (
+    # casual
+    (DEFAULT_USER['email'], DEFAULT_USER['password']),
+    # loooong password
+    (DEFAULT_USER['email'], DEFAULT_USER['password'] * 10000),
+))
+def test_register_success(db_session, default_app, email, password):
+    """Register user successfully."""
+    assert db_session.query(User).count() == 0
+
+    res = default_app.get('/register')
+    res.form['email'] = email
+    res.form['password'] = password
+    res.form['confirm_password'] = password
+    res = res.form.submit(extra_environ={'REMOTE_ADDR': '0.0.0.0'})
+    transaction.commit()
+
+    user = db_session.query(User).filter(User.email == email).one()
+
+    # User should not have active account at this moment
+    assert user.is_active is not None
+    assert user.check_password(password)
+
+
+def test_register_user_exists(db_session, user, default_app):
+    """Trying to register existing user."""
+    res = default_app.get('/register')
+    res.form['email'] = DEFAULT_USER['email']
+    res.form['password'] = DEFAULT_USER['password']
+    res.form['confirm_password'] = DEFAULT_USER['password']
+    res = res.form.submit(extra_environ={'REMOTE_ADDR': '0.0.0.0'})
+    transaction.commit()
+
+    assert 'User with given e-mail already exists' in res.body.decode('unicode_escape')
+
+
+@pytest.mark.parametrize('email, password, confirm_password, error', (
+    # no email
+    (None, DEFAULT_USER['password'], DEFAULT_USER['password'],
+        'E-mail is empty'),
+    # empty email
+    ('', DEFAULT_USER['password'], DEFAULT_USER['password'],
+        'E-mail is empty'),
+    # not matching passwords
+    (DEFAULT_USER['email'], DEFAULT_USER['password'], DEFAULT_USER['password'] + 'Typo',
+        'Passwords don\'t match'),
+    # long, incorect email
+    (text_type('email') * 100 + text_type('@wap.pl'), DEFAULT_USER['password'], DEFAULT_USER['password'],
+        'Incorrect e-mail format'),
+    # too short password
+    (DEFAULT_USER['email'], '12', '12',
+        'Password is too short'),
+    # empty password
+    (DEFAULT_USER['email'], '', '', 'Please enter your password'),
+))
+def test_register_error(db_session, default_app, email, password, confirm_password, error):
+    """Error in registration process."""
+    assert db_session.query(User).count() == 0
+
+    res = default_app.get('/register')
+    if email is not None:
+        res.form['email'] = email
+    res.form['password'] = password
+    res.form['confirm_password'] = confirm_password
+    res = res.form.submit(extra_environ={'REMOTE_ADDR': '0.0.0.0'})
+    transaction.commit()
+
+    assert error in HTMLParser().unescape(res.body.decode('unicode_escape'))
+    assert db_session.query(User).count() == 0
+
+
+def test_register_wrong_csrf(db_session, default_app):
+    """CSRF error during registration."""
+    assert db_session.query(User).count() == 0
+
+    res = default_app.get('/register')
+    res.form['email'] = DEFAULT_USER['email']
+    res.form['password'] = DEFAULT_USER['password']
+    res.form['confirm_password'] = DEFAULT_USER['password']
+    res.form['csrf_token'] = 'wrong_token'
+    res = res.form.submit(extra_environ={'REMOTE_ADDR': '0.0.0.0'},
+                          status=401)
+    transaction.commit()
+
+    assert db_session.query(User).count() == 0
+
+
+def test_no_pass_confirm(db_session, nopassconfirm_app):
+    """Register without password confirm option."""
+    assert db_session.query(User).count() == 0
+
+    res = nopassconfirm_app.get('/register')
+    res.form['email'] = DEFAULT_USER['email']
+    res.form['password'] = DEFAULT_USER['password']
+    res = res.form.submit(extra_environ={'REMOTE_ADDR': '0.0.0.0'})
+
+    assert 'Passwords don\'t match!' not in HTMLParser().unescape(res.body.decode('unicode_escape'))
+    transaction.commit()
+
+    user = db_session.query(User).filter(User.email == DEFAULT_USER['email']).one()
+
+    # User should not have active account at this moment
+    assert user.is_active is not None
+    assert user.check_password(DEFAULT_USER['password'])
+
+
+def test_register_action_no_password_required(db_session, nopassregister_app):
+    """Register without password required."""
+    with pytest.raises(NoResultFound):
+        db_session.query(User).filter(User.email == DEFAULT_USER['email']).one()
+
+    res = nopassregister_app.get('/register')
+    res.form['email'] = DEFAULT_USER['email']
+    res = res.form.submit(extra_environ={'REMOTE_ADDR': '0.0.0.0'})
+    transaction.commit()
+
+    db_session.query(User).filter(User.email == DEFAULT_USER['email']).one()