quart-security 1.2.1__tar.gz → 1.3.0__tar.gz

quart_security-1.3.0/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --group dev
+
+      - name: Run Ruff
+        run: uv run ruff check .
+
+      - name: Run tests
+        run: uv run pytest -q

quart_security-1.3.0/.github/workflows/publish.yml

@@ -0,0 +1,37 @@
+name: Publish
+
+on:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    if: github.repository == 'level09/quart-security'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/quart-security
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build distributions
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

quart_security-1.3.0/.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+.uv-cache/
+.venv/
+dist/
+uv.lock

{quart_security-1.2.1 → quart_security-1.3.0}/PKG-INFO

@@ -1,11 +1,10 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.1
 Name: quart-security
-Version: 1.2.1
+Version: 1.3.0
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-License-File: LICENSE
 Requires-Dist: quart>=0.20.0
 Requires-Dist: sqlalchemy>=2.0
 Requires-Dist: libpass>=1.9

{quart_security-1.2.1 → quart_security-1.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.2.1"
+version = "1.3.0"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"

{quart_security-1.2.1 → quart_security-1.3.0}/quart_security/templates/security/login_user.html

@@ -8,4 +8,7 @@
   {{ render_input(login_user_form.password, 'password') }}
   <button type="submit">Sign in</button>
 </form>
+{% if security.webauthn and security.wan_allow_as_first_factor %}
+<p><a href="{{ url_for_security('wan_signin') }}">Sign in with passkey</a></p>
+{% endif %}
 <p><a href="{{ url_for_security('register') }}">Create account</a></p>

{quart_security-1.2.1 → quart_security-1.3.0}/quart_security/templates/security/wan_signin.html

@@ -4,13 +4,10 @@
 <h1>Sign In with Passkey</h1>
 
 {% if not credential_options %}
-<form method="post" action="{{ url_for_security('wan_signin') }}" id="wan-signin-form">
+<form method="post" action="{{ url_for_security('wan_signin') }}" id="wan-discoverable-form">
   {{ wan_signin_form.hidden_tag() }}
-  {{ render_input(wan_signin_form.identity) }}
-  <label style="display: block; margin-bottom: 0.75rem;">
-    {{ wan_signin_form.remember }} {{ wan_signin_form.remember.label.text }}
-  </label>
-  <button type="submit">Continue</button>
+  <input type="hidden" name="identity" value="">
+  <button type="submit">Sign in with passkey</button>
 </form>
 <p><a href="{{ url_for_security('login') }}">Back to password login</a></p>
 {% else %}

{quart_security-1.2.1 → quart_security-1.3.0}/quart_security/views.py

@@ -200,6 +200,21 @@ def _extract_webauthn_credential_id(credential_payload: dict | None) -> bytes |
         return None
 
 
+def _extract_webauthn_user_handle(credential_payload: dict | None) -> str | None:
+    if not isinstance(credential_payload, dict):
+        return None
+    response = credential_payload.get("response")
+    if not isinstance(response, dict):
+        return None
+    user_handle = response.get("userHandle")
+    if not isinstance(user_handle, str) or not user_handle:
+        return None
+    try:
+        return wan.base64url_to_bytes(user_handle).decode("utf-8")
+    except Exception:
+        return None
+
+
 async def _extract_webauthn_credential_payload():
     payload = await request.get_json(silent=True)
     if isinstance(payload, dict):
@@ -689,6 +704,7 @@ async def wan_register():
             rp_name=_webauthn_rp_name(),
             challenge=challenge,
             existing_credentials=registered_credentials,
+            discoverable=(requested_usage == "primary"),
         )
         credential_options = wan.options_to_json_dict(options)
 
@@ -776,46 +792,13 @@ async def wan_signin():
     response_form = await QuartForm.from_formdata()
 
     credential_options = None
+
     if _is_post():
         await _enforce_csrf(getattr(form, "_submitted_csrf", None))
-        identity = _normalize_email(form.identity.data)
-        if not identity:
-            await flash("Email is required.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
-
-        user = await _find_user(email=identity)
-        if user is None or not getattr(user, "active", True):
-            await flash("Unable to authenticate with passkey.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
-
-        credentials = await _list_webauthn_credentials(user)
-        credentials = [
-            credential
-            for credential in credentials
-            if getattr(credential, "usage", "secondary") in {"primary", "first"}
-        ]
-        if not credentials:
-            await flash("No passkey is configured for passwordless sign-in.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
 
         challenge = secrets.token_bytes(32)
         options = await wan.begin_authentication(
-            credentials,
+            [],
             rp_id=_webauthn_rp_id(),
             challenge=challenge,
         )
@@ -823,7 +806,6 @@ async def wan_signin():
         _set_wan_state(
             "wan_signin_state",
             challenge=wan.bytes_to_base64url(challenge),
-            user_id=user.get_id(),
             remember=bool(form.remember.data),
         )
 
@@ -848,18 +830,29 @@ async def wan_signin_response():
         await flash("Passkey sign-in expired. Please try again.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    user = await _find_user(fs_uniquifier=state.get("user_id"))
-    if user is None:
-        await flash("Unable to find user for passkey sign-in.", "error")
-        return redirect(url_for_security("wan_signin"))
-
     credential_payload = await _extract_webauthn_credential_payload()
     credential_id = _extract_webauthn_credential_id(credential_payload)
     if not credential_payload or credential_id is None:
         await flash("Invalid passkey response payload.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    stored_credential = await _find_webauthn_credential(credential_id, user=user)
+    stored_credential = await _find_webauthn_credential(credential_id, user=None)
+    if stored_credential is None:
+        await flash("Passkey not recognized.", "error")
+        return redirect(url_for_security("wan_signin"))
+
+    credential_user_id = getattr(stored_credential, "user_id", None)
+    user_handle = _extract_webauthn_user_handle(credential_payload)
+    lookup_handle = credential_user_id or user_handle
+    if not lookup_handle:
+        await flash("Unable to identify user from passkey.", "error")
+        return redirect(url_for_security("wan_signin"))
+
+    user = await _find_user(fs_webauthn_user_handle=lookup_handle)
+    if user is None or not getattr(user, "active", True):
+        await flash("Unable to find user for passkey sign-in.", "error")
+        return redirect(url_for_security("wan_signin"))
+
     if stored_credential is None:
         await flash("Passkey not recognized.", "error")
         return redirect(url_for_security("wan_signin"))

{quart_security-1.2.1 → quart_security-1.3.0}/quart_security/webauthn.py

@@ -26,7 +26,12 @@ def _require_webauthn():
             verify_authentication_response,
             verify_registration_response,
         )
-        from webauthn.helpers.structs import PublicKeyCredentialDescriptor
+        from webauthn.helpers.structs import (
+            AuthenticatorSelectionCriteria,
+            PublicKeyCredentialDescriptor,
+            ResidentKeyRequirement,
+            UserVerificationRequirement,
+        )
     except ImportError as exc:
         raise RuntimeError("webauthn package is required for WebAuthn support") from exc
 
@@ -37,6 +42,9 @@ def _require_webauthn():
         "verify_authentication_response": verify_authentication_response,
         "verify_registration_response": verify_registration_response,
         "PublicKeyCredentialDescriptor": PublicKeyCredentialDescriptor,
+        "AuthenticatorSelectionCriteria": AuthenticatorSelectionCriteria,
+        "ResidentKeyRequirement": ResidentKeyRequirement,
+        "UserVerificationRequirement": UserVerificationRequirement,
     }
 
 
@@ -59,6 +67,7 @@ async def begin_registration(
     rp_name,
     challenge: bytes,
     existing_credentials=None,
+    discoverable: bool = False,
 ):
     api = _require_webauthn()
 
@@ -72,15 +81,23 @@ async def begin_registration(
             api["PublicKeyCredentialDescriptor"](id=cred.credential_id)
         )
 
-    return api["generate_registration_options"](
-        rp_id=rp_id,
-        rp_name=rp_name,
-        challenge=challenge,
-        user_id=user_id,
-        user_name=getattr(user, "email", ""),
-        user_display_name=getattr(user, "name", None) or getattr(user, "email", ""),
-        exclude_credentials=exclude_credentials,
-    )
+    kwargs = {
+        "rp_id": rp_id,
+        "rp_name": rp_name,
+        "challenge": challenge,
+        "user_id": user_id,
+        "user_name": getattr(user, "email", ""),
+        "user_display_name": getattr(user, "name", None) or getattr(user, "email", ""),
+        "exclude_credentials": exclude_credentials,
+    }
+
+    if discoverable:
+        kwargs["authenticator_selection"] = api["AuthenticatorSelectionCriteria"](
+            resident_key=api["ResidentKeyRequirement"].REQUIRED,
+            user_verification=api["UserVerificationRequirement"].REQUIRED,
+        )
+
+    return api["generate_registration_options"](**kwargs)
 
 
 async def complete_registration(

quart_security-1.3.0/tests/conftest.py

@@ -0,0 +1,241 @@
+import datetime
+from dataclasses import dataclass, field
+from itertools import count
+
+import pytest
+from quart import Quart
+
+from quart_security import Security, auth_required, hash_password, roles_required
+from quart_security.models import RoleMixin, UserMixin
+
+
+@dataclass
+class Role(RoleMixin):
+    name: str
+    description: str | None = None
+
+
+@dataclass
+class WebAuthnCredential:
+    credential_id: bytes
+    public_key: bytes
+    sign_count: int
+    name: str
+    usage: str = "secondary"
+    backup_state: bool = False
+    device_type: str = "single_device"
+    lastuse_datetime: datetime.datetime | None = None
+    user_id: str | None = None
+
+
+@dataclass
+class User(UserMixin):
+    fs_uniquifier: str
+    email: str
+    password: str
+    active: bool = True
+    name: str | None = None
+    roles: list[Role] = field(default_factory=list)
+    password_set: bool = True
+    login_count: int | None = None
+    last_login_at: object = None
+    current_login_at: object = None
+    last_login_ip: str | None = None
+    current_login_ip: str | None = None
+    tf_primary_method: str | None = None
+    tf_totp_secret: str | None = None
+    mf_recovery_codes: list[str] | None = None
+    fs_webauthn_user_handle: str | None = None
+    webauthn: list[WebAuthnCredential] = field(default_factory=list)
+    failed_login_count: int | None = None
+    locked_until: datetime.datetime | None = None
+
+    @property
+    def has_usable_password(self):
+        return self.password_set
+
+
+class InMemoryDatastore:
+    def __init__(self):
+        self.users: list[User] = []
+        self.roles: list[Role] = []
+        self._user_ids = count(1)
+        self._role_ids = count(1)
+
+    def find_user(self, **kwargs):
+        for user in self.users:
+            if all(getattr(user, key, None) == value for key, value in kwargs.items()):
+                return user
+        return None
+
+    def find_role(self, name):
+        for role in self.roles:
+            if role.name == name:
+                return role
+        return None
+
+    def create_user(self, **kwargs):
+        kwargs.setdefault("fs_uniquifier", f"user-{next(self._user_ids)}")
+        user = User(**kwargs)
+        self.users.append(user)
+        return user
+
+    def create_role(self, **kwargs):
+        kwargs.setdefault("name", f"role-{next(self._role_ids)}")
+        role = Role(**kwargs)
+        self.roles.append(role)
+        return role
+
+    def add_role_to_user(self, user, role_name):
+        role = self.find_role(role_name)
+        if role is None:
+            role = self.create_role(name=role_name)
+        if role in user.roles:
+            return False
+        user.roles.append(role)
+        return True
+
+    def remove_role_from_user(self, user, role_name):
+        for role in list(user.roles):
+            if role.name == role_name:
+                user.roles.remove(role)
+                return True
+        return False
+
+    def toggle_active(self, user):
+        user.active = not user.active
+        return user.active
+
+    def set_uniquifier(self, user, uniquifier=None):
+        user.fs_uniquifier = uniquifier or user.fs_uniquifier
+        return user.fs_uniquifier
+
+    def commit(self):
+        return None
+
+    def get_webauthn_credentials(self, user, usage=None):
+        credentials = list(user.webauthn or [])
+        if usage:
+            credentials = [
+                credential
+                for credential in credentials
+                if getattr(credential, "usage", None) == usage
+            ]
+        return credentials
+
+    def find_webauthn_credential(self, credential_id, user=None):
+        if user is not None:
+            candidates = self.get_webauthn_credentials(user)
+        else:
+            # Global lookup across all users (discoverable credential flow)
+            candidates = [
+                cred for u in self.users for cred in (u.webauthn or [])
+            ]
+        for credential in candidates:
+            if credential.credential_id == credential_id:
+                return credential
+        return None
+
+    def create_webauthn_credential(self, user, **kwargs):
+        credential = WebAuthnCredential(**kwargs)
+        credential.user_id = user.fs_webauthn_user_handle
+        user.webauthn.append(credential)
+        return credential
+
+    def delete_webauthn_credential(self, user, credential):
+        if credential in user.webauthn:
+            user.webauthn.remove(credential)
+            return True
+        return False
+
+
+@pytest.fixture
+def datastore():
+    return InMemoryDatastore()
+
+
+def _build_app(
+    datastore: InMemoryDatastore, *, two_factor: bool, webauthn: bool
+) -> Quart:
+    app = Quart(__name__)
+    app.config.update(
+        SECRET_KEY="test-secret",
+        TESTING=True,
+        SECURITY_PASSWORD_SALT="test-salt",
+        SECURITY_PASSWORD_LENGTH_MIN=8,
+        SECURITY_POST_REGISTER_VIEW="/login",
+        SECURITY_POST_LOGIN_VIEW="/protected",
+        SECURITY_CSRF_PROTECT=False,
+        SECURITY_REGISTERABLE=True,
+        SECURITY_CHANGEABLE=True,
+        SECURITY_TWO_FACTOR=two_factor,
+        SECURITY_WEBAUTHN=webauthn,
+    )
+
+    Security(app, datastore)
+
+    basic_user = datastore.create_user(
+        fs_uniquifier="user-1",
+        email="user@example.com",
+        password=hash_password("correct-password"),
+        active=True,
+    )
+
+    admin_user = datastore.create_user(
+        fs_uniquifier="admin-1",
+        email="admin@example.com",
+        password=hash_password("correct-password"),
+        active=True,
+    )
+
+    datastore.add_role_to_user(admin_user, "admin")
+
+    @app.get("/protected")
+    @auth_required("session")
+    async def protected():
+        return "ok"
+
+    @app.get("/admin")
+    @auth_required("session")
+    @roles_required("admin")
+    async def admin_only():
+        return "admin"
+
+    @app.get("/")
+    async def index():
+        return "index"
+
+    app.extensions["test_basic_user"] = basic_user
+    app.extensions["test_admin_user"] = admin_user
+    app.extensions["test_datastore"] = datastore
+    return app
+
+
+@pytest.fixture
+def client(app):
+    return app.test_client()
+
+
+@pytest.fixture
+def app(datastore):
+    return _build_app(datastore, two_factor=False, webauthn=False)
+
+
+@pytest.fixture
+def app_two_factor(datastore):
+    return _build_app(datastore, two_factor=True, webauthn=False)
+
+
+@pytest.fixture
+def client_two_factor(app_two_factor):
+    return app_two_factor.test_client()
+
+
+@pytest.fixture
+def app_webauthn(datastore):
+    return _build_app(datastore, two_factor=False, webauthn=True)
+
+
+@pytest.fixture
+def client_webauthn(app_webauthn):
+    return app_webauthn.test_client()

quart_security-1.3.0/tests/test_auth_flow.py

@@ -0,0 +1,98 @@
+import datetime
+
+import pytest
+
+
+@pytest.mark.asyncio
+async def test_protected_redirects_to_login(client):
+    response = await client.get("/protected")
+    assert response.status_code == 302
+    assert "/login" in response.headers["Location"]
+
+
+@pytest.mark.asyncio
+async def test_login_then_access_protected(client):
+    response = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+    assert response.status_code == 302
+    assert response.headers["Location"].endswith("/protected")
+
+    protected = await client.get("/protected")
+    assert protected.status_code == 200
+    assert (await protected.get_data(as_text=True)) == "ok"
+
+
+@pytest.mark.asyncio
+async def test_admin_route_forbidden_without_role(client):
+    await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    response = await client.get("/admin")
+    assert response.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_admin_route_allowed_with_role(client):
+    await client.post(
+        "/login",
+        form={"email": "admin@example.com", "password": "correct-password"},
+    )
+
+    response = await client.get("/admin")
+    assert response.status_code == 200
+    assert (await response.get_data(as_text=True)) == "admin"
+
+
+@pytest.mark.asyncio
+async def test_login_lockout_blocks_after_repeated_failures(client, app):
+    user = app.extensions["test_basic_user"]
+    app.config["SECURITY_LOGIN_MAX_ATTEMPTS"] = 2
+    app.config["SECURITY_LOCKOUT_MINUTES"] = 15
+
+    first = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "wrong-password"},
+    )
+    assert first.status_code == 200
+    assert user.failed_login_count == 1
+    assert user.locked_until is None
+
+    second = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "wrong-password"},
+    )
+    assert second.status_code == 200
+    assert user.failed_login_count == 2
+    assert user.locked_until is not None
+
+    locked = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+    assert locked.status_code == 200
+    assert user.failed_login_count == 2
+    assert user.locked_until is not None
+
+    protected = await client.get("/protected")
+    assert protected.status_code == 302
+    assert "/login" in protected.headers["Location"]
+
+
+@pytest.mark.asyncio
+async def test_login_lockout_resets_after_expiry(client, app):
+    user = app.extensions["test_basic_user"]
+    user.failed_login_count = 3
+    user.locked_until = datetime.datetime.now() - datetime.timedelta(minutes=1)
+
+    response = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+    assert response.status_code == 302
+    assert response.headers["Location"].endswith("/protected")
+    assert user.failed_login_count == 0
+    assert user.locked_until is None

quart_security-1.3.0/tests/test_core_flows.py

@@ -0,0 +1,129 @@
+import pytest
+
+from quart_security import verify_password
+
+
+@pytest.mark.asyncio
+async def test_register_creates_user(client, app):
+    datastore = app.extensions["test_datastore"]
+
+    response = await client.post(
+        "/register",
+        form={
+            "name": "New User",
+            "email": "new@example.com",
+            "password": "new-password-123",
+            "password_confirm": "new-password-123",
+        },
+    )
+
+    assert response.status_code == 302
+    assert response.headers["Location"].endswith("/login")
+
+    user = datastore.find_user(email="new@example.com")
+    assert user is not None
+    assert user.password != "new-password-123"
+    assert verify_password("new-password-123", user.password)
+
+
+@pytest.mark.asyncio
+async def test_register_duplicate_email_returns_form(client, app):
+    datastore = app.extensions["test_datastore"]
+    existing = len(datastore.users)
+
+    response = await client.post(
+        "/register",
+        form={
+            "name": "Duplicate",
+            "email": "user@example.com",
+            "password": "new-password-123",
+            "password_confirm": "new-password-123",
+        },
+    )
+
+    assert response.status_code == 200
+    assert len(datastore.users) == existing
+
+
+@pytest.mark.asyncio
+async def test_logout_clears_session(client):
+    await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    protected_before = await client.get("/protected")
+    assert protected_before.status_code == 200
+
+    logout_response = await client.get("/logout")
+    assert logout_response.status_code == 302
+    assert "/login" in logout_response.headers["Location"]
+
+    protected_after = await client.get("/protected")
+    assert protected_after.status_code == 302
+    assert "/login" in protected_after.headers["Location"]
+
+
+@pytest.mark.asyncio
+async def test_change_password_requires_current_for_standard_user(client, app):
+    user = app.extensions["test_basic_user"]
+    old_hash = user.password
+
+    await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    response = await client.post(
+        "/change",
+        form={
+            "password": "correct-password",
+            "new_password": "updated-password-123",
+            "new_password_confirm": "updated-password-123",
+        },
+    )
+
+    assert response.status_code == 302
+    assert response.headers["Location"].endswith("/change")
+    assert user.password != old_hash
+    assert verify_password("updated-password-123", user.password)
+
+    await client.get("/logout")
+
+    invalid_login = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+    assert invalid_login.status_code == 200
+
+    valid_login = await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "updated-password-123"},
+    )
+    assert valid_login.status_code == 302
+    assert valid_login.headers["Location"].endswith("/protected")
+
+
+@pytest.mark.asyncio
+async def test_change_password_skips_current_for_oauth_style_user(client, app):
+    user = app.extensions["test_basic_user"]
+    user.password_set = False
+
+    await client.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    response = await client.post(
+        "/change",
+        form={
+            "password": "",
+            "new_password": "oauth-updated-123",
+            "new_password_confirm": "oauth-updated-123",
+        },
+    )
+
+    assert response.status_code == 302
+    assert response.headers["Location"].endswith("/change")
+    assert user.password_set is True
+    assert verify_password("oauth-updated-123", user.password)

quart_security-1.3.0/tests/test_password.py

@@ -0,0 +1,14 @@
+from quart_security.password import hash_password, validate_password, verify_password
+
+
+def test_hash_and_verify(app):
+    hashed = hash_password("abcdefgh")
+    assert hashed != "abcdefgh"
+    assert verify_password("abcdefgh", hashed)
+    assert not verify_password("abcdefghx", hashed)
+
+
+def test_validate_password_length():
+    errors = validate_password("short", min_length=8)
+    assert errors
+    assert "at least 8" in errors[0]

quart_security-1.3.0/tests/test_two_factor.py

@@ -0,0 +1,108 @@
+import pytest
+
+from quart_security import totp
+
+
+@pytest.mark.asyncio
+async def test_two_factor_setup_enables_totp_and_recovery_codes(
+    client_two_factor, app_two_factor, monkeypatch
+):
+    user = app_two_factor.extensions["test_basic_user"]
+
+    monkeypatch.setattr(totp, "generate_totp_secret", lambda: "test-secret")
+    monkeypatch.setattr(
+        totp,
+        "get_totp_uri",
+        lambda secret, email, issuer: "otpauth://totp/test",
+    )
+    monkeypatch.setattr(totp, "generate_qr_code", lambda uri: "qr-data")
+    monkeypatch.setattr(
+        totp,
+        "verify_totp",
+        lambda secret, token: secret == "test-secret" and token == "123456",
+    )
+
+    await client_two_factor.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    get_response = await client_two_factor.get("/tf-setup?setup=authenticator")
+    assert get_response.status_code == 200
+
+    post_response = await client_two_factor.post(
+        "/tf-setup",
+        form={"action": "verify", "token": "123456"},
+    )
+
+    assert post_response.status_code == 302
+    assert post_response.headers["Location"].endswith("/mf-recovery-codes")
+    assert user.tf_primary_method == "authenticator"
+    assert user.tf_totp_secret == "test-secret"
+    assert (
+        len(user.mf_recovery_codes or [])
+        == app_two_factor.config["SECURITY_MULTI_FACTOR_RECOVERY_CODES_N"]
+    )
+
+
+@pytest.mark.asyncio
+async def test_login_requires_second_factor_then_allows_access(
+    client_two_factor, app_two_factor, monkeypatch
+):
+    user = app_two_factor.extensions["test_basic_user"]
+    user.tf_primary_method = "authenticator"
+    user.tf_totp_secret = "existing-secret"
+
+    monkeypatch.setattr(
+        totp,
+        "verify_totp",
+        lambda secret, token: secret == "existing-secret" and token == "123456",
+    )
+
+    login = await client_two_factor.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+    assert login.status_code == 302
+    assert login.headers["Location"].endswith("/tf-validate")
+
+    protected = await client_two_factor.get("/protected")
+    assert protected.status_code == 302
+    assert "/login" in protected.headers["Location"]
+
+    invalid_code = await client_two_factor.post(
+        "/tf-validate", form={"token": "000000"}
+    )
+    assert invalid_code.status_code == 200
+
+    valid_code = await client_two_factor.post("/tf-validate", form={"token": "123456"})
+    assert valid_code.status_code == 302
+    assert valid_code.headers["Location"].endswith("/protected")
+
+    protected_after = await client_two_factor.get("/protected")
+    assert protected_after.status_code == 200
+
+
+@pytest.mark.asyncio
+async def test_two_factor_recovery_code_login_consumes_code(
+    client_two_factor, app_two_factor
+):
+    user = app_two_factor.extensions["test_basic_user"]
+    user.tf_primary_method = "authenticator"
+    user.tf_totp_secret = None
+    user.mf_recovery_codes = ["recovery-1"]
+
+    login = await client_two_factor.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+    assert login.status_code == 302
+    assert login.headers["Location"].endswith("/tf-validate")
+
+    recovery = await client_two_factor.post(
+        "/tf-validate",
+        form={"token": "recovery-1"},
+    )
+    assert recovery.status_code == 302
+    assert recovery.headers["Location"].endswith("/protected")
+    assert user.mf_recovery_codes == []

quart_security-1.3.0/tests/test_webauthn.py

@@ -0,0 +1,243 @@
+import json
+
+import pytest
+
+from quart_security import webauthn as wan
+
+
+def _registration_options(challenge: bytes, user_id: bytes = b"user-handle"):
+    return {
+        "challenge": wan.bytes_to_base64url(challenge),
+        "user": {"id": wan.bytes_to_base64url(user_id), "name": "user@example.com"},
+        "excludeCredentials": [],
+    }
+
+
+@pytest.mark.asyncio
+async def test_wan_register_creates_credential(
+    client_webauthn, app_webauthn, monkeypatch
+):
+    user = app_webauthn.extensions["test_basic_user"]
+
+    async def fake_begin_registration(
+        user, rp_id, rp_name, challenge, existing_credentials=None, discoverable=False
+    ):
+        return {"challenge": challenge}
+
+    def fake_options_to_json_dict(options):
+        return _registration_options(options["challenge"])
+
+    async def fake_complete_registration(
+        credential,
+        challenge,
+        rp_id,
+        expected_origin,
+        require_user_verification=True,
+    ):
+        return {
+            "credential_id": b"cred-1",
+            "public_key": b"public-key",
+            "sign_count": 0,
+            "backup_state": False,
+            "device_type": "single_device",
+        }
+
+    monkeypatch.setattr(wan, "begin_registration", fake_begin_registration)
+    monkeypatch.setattr(wan, "options_to_json_dict", fake_options_to_json_dict)
+    monkeypatch.setattr(wan, "complete_registration", fake_complete_registration)
+
+    await client_webauthn.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    register_start = await client_webauthn.post(
+        "/wan-register",
+        form={"name": "MacBook Passkey", "usage": "primary"},
+    )
+    assert register_start.status_code == 200
+
+    credential_payload = {
+        "id": wan.bytes_to_base64url(b"cred-1"),
+        "rawId": wan.bytes_to_base64url(b"cred-1"),
+        "type": "public-key",
+        "response": {
+            "clientDataJSON": "client",
+            "attestationObject": "attestation",
+        },
+    }
+
+    register_finish = await client_webauthn.post(
+        "/wan-register-response",
+        form={"credential": json.dumps(credential_payload)},
+    )
+
+    assert register_finish.status_code == 302
+    assert register_finish.headers["Location"].endswith("/wan-register")
+    assert len(user.webauthn) == 1
+    assert user.webauthn[0].name == "MacBook Passkey"
+    assert user.webauthn[0].usage == "primary"
+
+
+@pytest.mark.asyncio
+async def test_wan_signin_logs_in_with_passkey(
+    client_webauthn, app_webauthn, monkeypatch
+):
+    user = app_webauthn.extensions["test_basic_user"]
+    user.fs_webauthn_user_handle = "handle-1"
+    app_webauthn.extensions["test_datastore"].create_webauthn_credential(
+        user,
+        credential_id=b"cred-primary",
+        public_key=b"public-key",
+        sign_count=1,
+        name="Phone",
+        usage="primary",
+    )
+
+    async def fake_begin_authentication(credentials, rp_id, challenge):
+        return {"challenge": challenge, "allow_credentials": []}
+
+    def fake_options_to_json_dict(options):
+        return {
+            "challenge": wan.bytes_to_base64url(options["challenge"]),
+            "allowCredentials": [],
+        }
+
+    async def fake_complete_authentication(
+        credential,
+        challenge,
+        rp_id,
+        expected_origin,
+        stored_credential,
+        require_user_verification=True,
+    ):
+        return stored_credential.sign_count + 1
+
+    monkeypatch.setattr(wan, "begin_authentication", fake_begin_authentication)
+    monkeypatch.setattr(wan, "options_to_json_dict", fake_options_to_json_dict)
+    monkeypatch.setattr(wan, "complete_authentication", fake_complete_authentication)
+
+    signin_start = await client_webauthn.post(
+        "/wan-signin",
+        form={"identity": "", "remember": "y"},
+    )
+    assert signin_start.status_code == 200
+
+    credential_payload = {
+        "id": wan.bytes_to_base64url(b"cred-primary"),
+        "rawId": wan.bytes_to_base64url(b"cred-primary"),
+        "type": "public-key",
+        "response": {
+            "clientDataJSON": "client",
+            "authenticatorData": "auth-data",
+            "signature": "sig",
+            "userHandle": wan.bytes_to_base64url(b"handle-1"),
+        },
+    }
+
+    signin_finish = await client_webauthn.post(
+        "/wan-signin-response",
+        form={"credential": json.dumps(credential_payload)},
+    )
+    assert signin_finish.status_code == 302
+    assert signin_finish.headers["Location"].endswith("/protected")
+
+    protected = await client_webauthn.get("/protected")
+    assert protected.status_code == 200
+    assert user.webauthn[0].sign_count == 2
+
+
+@pytest.mark.asyncio
+async def test_wan_verify_updates_sign_count(
+    client_webauthn, app_webauthn, monkeypatch
+):
+    user = app_webauthn.extensions["test_basic_user"]
+    user.fs_webauthn_user_handle = "handle-2"
+    app_webauthn.extensions["test_datastore"].create_webauthn_credential(
+        user,
+        credential_id=b"cred-secondary",
+        public_key=b"public-key",
+        sign_count=10,
+        name="Security Key",
+        usage="secondary",
+    )
+
+    async def fake_begin_authentication(credentials, rp_id, challenge):
+        return {"challenge": challenge, "credential_id": credentials[0].credential_id}
+
+    def fake_options_to_json_dict(options):
+        return {
+            "challenge": wan.bytes_to_base64url(options["challenge"]),
+            "allowCredentials": [
+                {"id": wan.bytes_to_base64url(options["credential_id"])}
+            ],
+        }
+
+    async def fake_complete_authentication(
+        credential,
+        challenge,
+        rp_id,
+        expected_origin,
+        stored_credential,
+        require_user_verification=True,
+    ):
+        return stored_credential.sign_count + 5
+
+    monkeypatch.setattr(wan, "begin_authentication", fake_begin_authentication)
+    monkeypatch.setattr(wan, "options_to_json_dict", fake_options_to_json_dict)
+    monkeypatch.setattr(wan, "complete_authentication", fake_complete_authentication)
+
+    await client_webauthn.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    verify_start = await client_webauthn.post("/wan-verify")
+    assert verify_start.status_code == 200
+
+    credential_payload = {
+        "id": wan.bytes_to_base64url(b"cred-secondary"),
+        "rawId": wan.bytes_to_base64url(b"cred-secondary"),
+        "type": "public-key",
+        "response": {
+            "clientDataJSON": "client",
+            "authenticatorData": "auth-data",
+            "signature": "sig",
+            "userHandle": None,
+        },
+    }
+
+    verify_finish = await client_webauthn.post(
+        "/wan-verify-response",
+        form={"credential": json.dumps(credential_payload)},
+    )
+    assert verify_finish.status_code == 302
+    assert user.webauthn[0].sign_count == 15
+
+
+@pytest.mark.asyncio
+async def test_wan_delete_removes_credential(client_webauthn, app_webauthn):
+    user = app_webauthn.extensions["test_basic_user"]
+    user.fs_webauthn_user_handle = "handle-3"
+    app_webauthn.extensions["test_datastore"].create_webauthn_credential(
+        user,
+        credential_id=b"cred-delete",
+        public_key=b"public-key",
+        sign_count=0,
+        name="To Delete",
+        usage="secondary",
+    )
+
+    await client_webauthn.post(
+        "/login",
+        form={"email": "user@example.com", "password": "correct-password"},
+    )
+
+    response = await client_webauthn.post(
+        "/wan-delete",
+        form={"credential_id": wan.bytes_to_base64url(b"cred-delete")},
+    )
+
+    assert response.status_code == 302
+    assert response.headers["Location"].endswith("/wan-register")
+    assert user.webauthn == []