uffd 2.2.0__tar.gz → 2.3.1__tar.gz

{uffd-2.2.0/uffd.egg-info → uffd-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: uffd
-Version: 2.2.0
+Version: 2.3.1
 Summary: Web-based user management and single sign-on software
 Home-page: https://git.cccv.de/uffd/uffd
 Author: CCCV
@@ -17,6 +17,36 @@ Classifier: Framework :: Flask
 Requires-Python: >=3.7
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: flask==1.0.2
+Requires-Dist: Flask-SQLAlchemy==2.1
+Requires-Dist: qrcode==6.1
+Requires-Dist: fido2==0.5.0
+Requires-Dist: oauthlib==2.1.0
+Requires-Dist: Flask-Migrate==2.1.1
+Requires-Dist: Flask-Babel==0.11.2
+Requires-Dist: alembic==1.0.0
+Requires-Dist: argon2-cffi==18.3.0
+Requires-Dist: itsdangerous==0.24
+Requires-Dist: prometheus-client==0.9
+Requires-Dist: certifi==2018.8.24
+Requires-Dist: cffi
+Requires-Dist: chardet==3.0.4
+Requires-Dist: click==7.0
+Requires-Dist: cryptography==2.6.1
+Requires-Dist: idna==2.6
+Requires-Dist: Jinja2==2.10
+Requires-Dist: MarkupSafe==1.1.0
+Requires-Dist: oauthlib==2.1.0
+Requires-Dist: pyasn1==0.4.2
+Requires-Dist: pycparser==2.19
+Requires-Dist: requests==2.21.0
+Requires-Dist: requests-oauthlib==1.0.0
+Requires-Dist: six==1.12.0
+Requires-Dist: SQLAlchemy==1.2.18
+Requires-Dist: urllib3==1.24.1
+Requires-Dist: Werkzeug==0.14.1
+Requires-Dist: python-dateutil==2.7.3
+Requires-Dist: Mako==1.0.7
 
 **DO NOT INSTALL FROM PIP FOR PRODUCTION DEPLOYMENTS**, see [Deployment](#Deployment) for more information.
 
@@ -45,7 +75,7 @@ Please note that we refer to Debian packages here and **not** pip packages.
 - python3-itsdangerous (also a dependency of python3-flask)
 - python3-mysqldb or python3-pymysql for MariaDB support
 
-Some of the dependencies (especially fido2) changed their API in recent versions, so make sure to install the versions from Debian Buster or Bullseye.
+Some of the dependencies (especially fido2) changed their API in recent versions, so make sure to install the versions from Debian Bookworm, Bullseye or Buster.
 For development, you can also use virtualenv with the supplied `requirements.txt`.
 
 ## Development
@@ -81,7 +111,7 @@ The dependencies of the pip package roughly represent the versions shipped by De
 We do not keep them updated and we do not test the pip package!
 The pip package only exists for local testing/development and to help build the Debian package.
 
-We provide packages for Debian stable and oldstable (currently Bullseye and Buster).
+We provide packages for Debian stable, oldstable and oldoldstable (currently Bookworm, Bullseye and Buster).
 Since all dependencies are available in the official package mirrors, you will get security updates for everything but uffd itself from Debian.
 
 To install uffd on Debian Bullseye, add our package mirror to `/etc/sources.list`:
@@ -90,7 +120,7 @@ To install uffd on Debian Bullseye, add our package mirror to `/etc/sources.list
 deb https://packages.cccv.de/uffd bullseye main
 ```
 
-Then download [cccv-archive-key.gpg](cccv-archive-key.gpg) and add it to the trusted repository keys in `/etc/apt/trusted.gpg.d/`.
+Then download [cccv-archive-key.gpg](https://packages.cccv.de/docs/cccv-archive-key.gpg) and add it to the trusted repository keys in `/etc/apt/trusted.gpg.d/`.
 Afterwards run `apt update && apt install uffd` to install the package.
 
 The Debian package uses uwsgi to run uffd and ships an `uffd-admin` script to execute flask commands in the correct context.

{uffd-2.2.0 → uffd-2.3.1}/README.md

@@ -21,7 +21,7 @@ Please note that we refer to Debian packages here and **not** pip packages.
 - python3-itsdangerous (also a dependency of python3-flask)
 - python3-mysqldb or python3-pymysql for MariaDB support
 
-Some of the dependencies (especially fido2) changed their API in recent versions, so make sure to install the versions from Debian Buster or Bullseye.
+Some of the dependencies (especially fido2) changed their API in recent versions, so make sure to install the versions from Debian Bookworm, Bullseye or Buster.
 For development, you can also use virtualenv with the supplied `requirements.txt`.
 
 ## Development
@@ -57,7 +57,7 @@ The dependencies of the pip package roughly represent the versions shipped by De
 We do not keep them updated and we do not test the pip package!
 The pip package only exists for local testing/development and to help build the Debian package.
 
-We provide packages for Debian stable and oldstable (currently Bullseye and Buster).
+We provide packages for Debian stable, oldstable and oldoldstable (currently Bookworm, Bullseye and Buster).
 Since all dependencies are available in the official package mirrors, you will get security updates for everything but uffd itself from Debian.
 
 To install uffd on Debian Bullseye, add our package mirror to `/etc/sources.list`:
@@ -66,7 +66,7 @@ To install uffd on Debian Bullseye, add our package mirror to `/etc/sources.list
 deb https://packages.cccv.de/uffd bullseye main
 ```
 
-Then download [cccv-archive-key.gpg](cccv-archive-key.gpg) and add it to the trusted repository keys in `/etc/apt/trusted.gpg.d/`.
+Then download [cccv-archive-key.gpg](https://packages.cccv.de/docs/cccv-archive-key.gpg) and add it to the trusted repository keys in `/etc/apt/trusted.gpg.d/`.
 Afterwards run `apt update && apt install uffd` to install the package.
 
 The Debian package uses uwsgi to run uffd and ships an `uffd-admin` script to execute flask commands in the correct context.

uffd-2.3.1/tests/test_csrf.py

@@ -0,0 +1,102 @@
+import unittest
+
+from flask import Flask, Blueprint, session, url_for
+
+from uffd.csrf import bp as csrf_bp, csrf_protect
+
+uid_counter = 0
+
+class TestCSRF(unittest.TestCase):
+	unprotected_ep = 'foo'
+	protected_ep = 'bar'
+
+	def setUp(self):
+		self.app = Flask(__name__)
+		self.app.testing = True
+		self.app.config['SECRET_KEY'] = 'DEBUGKEY'
+		self.app.register_blueprint(csrf_bp)
+
+		@self.app.route('/', methods=['GET', 'POST'])
+		def index():
+			return 'SUCCESS', 200
+
+		@self.app.route('/login', methods=['GET', 'POST'])
+		def login():
+			global uid_counter
+			session['_csrf_token'] = 'secret_csrf_token%d'%uid_counter
+			uid_counter += 1
+			return 'Ok', 200
+
+		@self.app.route('/logout', methods=['GET', 'POST'])
+		def logout():
+			session.clear()
+			return 'Ok', 200
+
+		@self.app.route('/foo', methods=['GET', 'POST'])
+		def foo():
+			return 'SUCCESS', 200
+
+		@self.app.route('/bar', methods=['GET', 'POST'])
+		@csrf_protect()
+		def bar():
+			return 'SUCCESS', 200
+		
+		self.bp = Blueprint('bp', __name__)
+
+		@self.bp.route('/foo', methods=['GET', 'POST'])
+		@csrf_protect(blueprint=self.bp) # This time on .foo and not on .bar!
+		def foo():
+			return 'SUCCESS', 200
+		
+		@self.bp.route('/bar', methods=['GET', 'POST'])
+		def bar():
+			return 'SUCCESS', 200
+
+		self.app.register_blueprint(self.bp, url_prefix='/bp/')
+		self.client = self.app.test_client()
+		self.client.__enter__()
+		# Just do some request so that we can use url_for
+		self.client.get(path='/')
+
+	def tearDown(self):
+		self.client.__exit__(None, None, None)
+
+	def set_token(self):
+		self.client.get(path='/login')
+
+	def clear_token(self):
+		self.client.get(path='/logout')
+
+	def test_notoken_unprotected(self):
+		url = url_for(self.unprotected_ep)
+		self.assertTrue('csrf' not in url)
+		self.assertEqual(self.client.get(path=url).data, b'SUCCESS')
+
+	def test_token_unprotected(self):
+		self.set_token()
+		self.test_notoken_unprotected()
+
+	def test_notoken_protected(self):
+		url = url_for(self.protected_ep)
+		self.assertNotEqual(self.client.get(path=url).data, b'SUCCESS')
+
+	def test_token_protected(self):
+		self.set_token()
+		url = url_for(self.protected_ep)
+		self.assertEqual(self.client.get(path=url).data, b'SUCCESS')
+
+	def test_wrong_token_protected(self):
+		self.set_token()
+		url = url_for(self.protected_ep)
+		self.set_token()
+		self.assertNotEqual(self.client.get(path=url).data, b'SUCCESS')
+	
+	def test_deleted_token_protected(self):
+		self.set_token()
+		url = url_for(self.protected_ep)
+		self.clear_token()
+		self.assertNotEqual(self.client.get(path=url).data, b'SUCCESS')
+	
+class TestBlueprintCSRF(TestCSRF):
+	unprotected_ep = 'bp.bar'
+	protected_ep = 'bp.foo'

uffd-2.3.1/tests/test_password_hash.py

@@ -0,0 +1,206 @@
+import unittest
+
+from uffd.password_hash import *
+
+class TestPasswordHashRegistry(unittest.TestCase):
+	def test(self):
+		registry = PasswordHashRegistry()
+
+		@registry.register
+		class TestPasswordHash:
+			METHOD_NAME = 'test'
+			def __init__(self, value, **kwargs):
+				self.value = value
+				self.kwargs = kwargs
+
+		@registry.register
+		class Test2PasswordHash:
+			METHOD_NAME = 'test2'
+
+		result = registry.parse('{test}data', key='value')
+		self.assertIsInstance(result, TestPasswordHash)
+		self.assertEqual(result.value, '{test}data')
+		self.assertEqual(result.kwargs, {'key': 'value'})
+		with self.assertRaises(ValueError):
+			registry.parse('{invalid}data')
+		with self.assertRaises(ValueError):
+			registry.parse('invalid')
+		with self.assertRaises(ValueError):
+			registry.parse('{invalid')
+
+class TestPasswordHash(unittest.TestCase):
+	def setUp(self):
+		class TestPasswordHash(PasswordHash):
+			@classmethod
+			def from_password(cls, password):
+				cls(build_value(cls.METHOD_NAME, password))
+
+			def verify(self, password):
+				return self.data == password
+
+		class TestPasswordHash1(TestPasswordHash):
+			METHOD_NAME = 'test1'
+
+		class TestPasswordHash2(TestPasswordHash):
+			METHOD_NAME = 'test2'
+
+		self.TestPasswordHash1 = TestPasswordHash1
+		self.TestPasswordHash2 = TestPasswordHash2
+
+	def test(self):
+		obj = self.TestPasswordHash1('{test1}data')
+		self.assertEqual(obj.value, '{test1}data')
+		self.assertEqual(obj.data, 'data')
+		self.assertIs(obj.target_cls, self.TestPasswordHash1)
+		self.assertFalse(obj.needs_rehash)
+
+	def test_invalid(self):
+		with self.assertRaises(ValueError):
+			self.TestPasswordHash1('invalid')
+		with self.assertRaises(ValueError):
+			self.TestPasswordHash1('{invalid}data')
+		with self.assertRaises(ValueError):
+			self.TestPasswordHash1('{test2}data')
+
+	def test_target_cls(self):
+		obj = self.TestPasswordHash1('{test1}data', target_cls=self.TestPasswordHash1)
+		self.assertEqual(obj.value, '{test1}data')
+		self.assertEqual(obj.data, 'data')
+		self.assertIs(obj.target_cls, self.TestPasswordHash1)
+		self.assertFalse(obj.needs_rehash)
+		obj = self.TestPasswordHash1('{test1}data', target_cls=self.TestPasswordHash2)
+		self.assertEqual(obj.value, '{test1}data')
+		self.assertEqual(obj.data, 'data')
+		self.assertIs(obj.target_cls, self.TestPasswordHash2)
+		self.assertTrue(obj.needs_rehash)
+		obj = self.TestPasswordHash1('{test1}data', target_cls=PasswordHash)
+		self.assertEqual(obj.value, '{test1}data')
+		self.assertEqual(obj.data, 'data')
+		self.assertIs(obj.target_cls, PasswordHash)
+		self.assertFalse(obj.needs_rehash)
+
+class TestPlaintextPasswordHash(unittest.TestCase):
+	def test_verify(self):
+		obj = PlaintextPasswordHash('{plain}password')
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+	def test_from_password(self):
+		obj = PlaintextPasswordHash.from_password('password')
+		self.assertEqual(obj.value, '{plain}password')
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+class TestHashlibPasswordHash(unittest.TestCase):
+	def test_verify(self):
+		obj = SHA512PasswordHash('{sha512}sQnzu7wkTrgkQZF+0G1hi5AI3Qmzvv0bXgc5THBqi7mAsdd4Xll27ASbRt9fEyavWi6m0QP9B8lThf+rDKy8hg==')
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+	def test_from_password(self):
+		obj = SHA512PasswordHash.from_password('password')
+		self.assertIsNotNone(obj.value)
+		self.assertTrue(obj.value.startswith('{sha512}'))
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+class TestSaltedHashlibPasswordHash(unittest.TestCase):
+	def test_verify(self):
+		obj = SaltedSHA512PasswordHash('{ssha512}dOeDLmVpHJThhHeag10Hm2g4T7s3SBE6rGHcXUolXJHVufY4qT782rwZ/0XE6cuLcBZ0KpnwmUzRpAEtZBdv+JYEEtZQs/uC')
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+	def test_from_password(self):
+		obj = SaltedSHA512PasswordHash.from_password('password')
+		self.assertIsNotNone(obj.value)
+		self.assertTrue(obj.value.startswith('{ssha512}'))
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+class TestCryptPasswordHash(unittest.TestCase):
+	def test_verify(self):
+		obj = CryptPasswordHash('{crypt}$5$UbTTMBH9NRurlQcX$bUiUTyedvmArlVt.62ZLRV80e2v3DjcBp/tSDkP2imD')
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+	def test_from_password(self):
+		obj = CryptPasswordHash.from_password('password')
+		self.assertIsNotNone(obj.value)
+		self.assertTrue(obj.value.startswith('{crypt}'))
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+class TestArgon2PasswordHash(unittest.TestCase):
+	def test_verify(self):
+		obj = Argon2PasswordHash('{argon2}$argon2id$v=19$m=102400,t=2,p=8$Jc8LpCgPLjwlN/7efHLvwQ$ZqSg3CFb2/hBb3X8hOq4aw')
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+		obj = Argon2PasswordHash('{argon2}$invalid$')
+		self.assertFalse(obj.verify('password'))
+
+	def test_from_password(self):
+		obj = Argon2PasswordHash.from_password('password')
+		self.assertIsNotNone(obj.value)
+		self.assertTrue(obj.value.startswith('{argon2}'))
+		self.assertTrue(obj.verify('password'))
+		self.assertFalse(obj.verify('notpassword'))
+
+	def test_needs_rehash(self):
+		obj = Argon2PasswordHash('{argon2}$argon2id$v=19$m=102400,t=2,p=8$Jc8LpCgPLjwlN/7efHLvwQ$ZqSg3CFb2/hBb3X8hOq4aw')
+		self.assertFalse(obj.needs_rehash)
+		obj = Argon2PasswordHash('{argon2}$argon2id$v=19$m=102400,t=2,p=8$Jc8LpCgPLjwlN/7efHLvwQ$ZqSg3CFb2/hBb3X8hOq4aw', target_cls=PlaintextPasswordHash)
+		self.assertTrue(obj.needs_rehash)
+		obj = Argon2PasswordHash('{argon2}$argon2d$v=19$m=102400,t=2,p=8$kshPgLU1+h72l/Z8QWh8Ig$tYerKCe/5I2BCPKu8hCl2w')
+		self.assertTrue(obj.needs_rehash)
+		obj = Argon2PasswordHash('{argon2}$argon2id$v=19$m=102400,t=1,p=8$aa6i4vg/szKX5xHVGFaAeQ$v6j0ltuVqQaZlmuepaVJ1A')
+		self.assertTrue(obj.needs_rehash)
+
+class TestInvalidPasswordHash(unittest.TestCase):
+	def test(self):
+		obj = InvalidPasswordHash('test')
+		self.assertEqual(obj.value, 'test')
+		self.assertFalse(obj.verify('test'))
+		self.assertTrue(obj.needs_rehash)
+		self.assertFalse(obj)
+		obj = InvalidPasswordHash(None)
+		self.assertIsNone(obj.value)
+		self.assertFalse(obj.verify('test'))
+		self.assertTrue(obj.needs_rehash)
+		self.assertFalse(obj)
+
+class TestPasswordWrapper(unittest.TestCase):
+	def setUp(self):
+		class Test:
+			password_hash = None
+			password = PasswordHashAttribute('password_hash', PlaintextPasswordHash)
+
+		self.test = Test()
+
+	def test_get_none(self):
+		self.test.password_hash = None
+		obj = self.test.password
+		self.assertIsInstance(obj, InvalidPasswordHash)
+		self.assertEqual(obj.value, None)
+		self.assertTrue(obj.needs_rehash)
+
+	def test_get_valid(self):
+		self.test.password_hash = '{plain}password'
+		obj = self.test.password
+		self.assertIsInstance(obj, PlaintextPasswordHash)
+		self.assertEqual(obj.value, '{plain}password')
+		self.assertFalse(obj.needs_rehash)
+
+	def test_get_needs_rehash(self):
+		self.test.password_hash = '{ssha512}dOeDLmVpHJThhHeag10Hm2g4T7s3SBE6rGHcXUolXJHVufY4qT782rwZ/0XE6cuLcBZ0KpnwmUzRpAEtZBdv+JYEEtZQs/uC'
+		obj = self.test.password
+		self.assertIsInstance(obj, SaltedSHA512PasswordHash)
+		self.assertEqual(obj.value, '{ssha512}dOeDLmVpHJThhHeag10Hm2g4T7s3SBE6rGHcXUolXJHVufY4qT782rwZ/0XE6cuLcBZ0KpnwmUzRpAEtZBdv+JYEEtZQs/uC')
+		self.assertTrue(obj.needs_rehash)
+
+	def test_set(self):
+		self.test.password = 'password'
+		self.assertEqual(self.test.password_hash, '{plain}password')
+
+	def test_set_none(self):
+		self.test.password = None
+		self.assertIsNone(self.test.password_hash)

uffd-2.3.1/tests/test_ratelimit.py

@@ -0,0 +1,46 @@
+from uffd.models.ratelimit import get_addrkey, format_delay, Ratelimit
+
+from tests.utils import UffdTestCase
+
+class TestRatelimit(UffdTestCase):
+	def test_limiting(self):
+		cases = [
+			(1*60, 3),
+			(1*60*60, 3),
+			(1*60*60, 25),
+		]
+		for index, case in enumerate(cases):
+			interval, limit = case
+			key = str(index)
+			ratelimit = Ratelimit('test', interval, limit)
+			for i in range(limit):
+				ratelimit.log(key)
+			self.assertLessEqual(ratelimit.get_delay(key), interval)
+			ratelimit.log(key)
+			self.assertGreater(ratelimit.get_delay(key), interval)
+
+	def test_addrkey(self):
+		self.assertEqual(get_addrkey('192.168.0.1'), get_addrkey('192.168.0.99'))
+		self.assertNotEqual(get_addrkey('192.168.0.1'), get_addrkey('192.168.1.1'))
+		self.assertEqual(get_addrkey('fdee:707a:f38a:c369::'), get_addrkey('fdee:707a:f38a:ffff::'))
+		self.assertNotEqual(get_addrkey('fdee:707a:f38a:c369::'), get_addrkey('fdee:707a:f38b:c369::'))
+		cases = [
+			'',
+			'192.168.0.',
+			':',
+			'::',
+			'192.168.0.1/24',
+			'192.168.0.1/24',
+			'host.example.com',
+		]
+		for case in cases:
+			self.assertIsInstance(get_addrkey(case), str)
+
+	def test_format_delay(self):
+		self.assertIsInstance(format_delay(0), str)
+		self.assertIsInstance(format_delay(1), str)
+		self.assertIsInstance(format_delay(30), str)
+		self.assertIsInstance(format_delay(60), str)
+		self.assertIsInstance(format_delay(120), str)
+		self.assertIsInstance(format_delay(3600), str)
+		self.assertIsInstance(format_delay(4000), str)

uffd-2.3.1/tests/test_remailer.py

@@ -0,0 +1,85 @@
+from uffd.remailer import remailer
+
+from tests.utils import UffdTestCase
+
+USER_ID = 1234
+SERVICE1_ID = 4223
+SERVICE2_ID = 3242
+ADDR_V1_S1 = 'v1-WzQyMjMsMTIzNF0.MeO6bHGTgIyPvvq2r3xriokLMCU@remailer.example.com'
+ADDR_V1_S2 = 'v1-WzMyNDIsMTIzNF0.p2a_RkJc0oHBc9u4_S8G9METflA@remailer.example.com'
+ADDR_V2_S1 = 'v2-lm2demrtfqytemzulu-ghr3u3drsoaizd567k3k67dlrkeqwmbf@remailer.example.com'
+ADDR_V2_S2 = 'v2-lmztenbsfqytemzulu-u5tl6rscltjidqlt3o4p2lyg6targ7sq@remailer.example.com'
+
+class TestRemailer(UffdTestCase):
+	def test_is_remailer_domain(self):
+		self.app.config['REMAILER_DOMAIN'] = 'remailer.example.com'
+		self.assertTrue(remailer.is_remailer_domain('remailer.example.com'))
+		self.assertTrue(remailer.is_remailer_domain('REMAILER.EXAMPLE.COM'))
+		self.assertTrue(remailer.is_remailer_domain(' remailer.example.com '))
+		self.assertFalse(remailer.is_remailer_domain('other.remailer.example.com'))
+		self.assertFalse(remailer.is_remailer_domain('example.com'))
+		self.app.config['REMAILER_OLD_DOMAINS'] = [' OTHER.remailer.example.com ']
+		self.assertTrue(remailer.is_remailer_domain(' OTHER.remailer.example.com '))
+		self.assertTrue(remailer.is_remailer_domain('remailer.example.com'))
+		self.assertTrue(remailer.is_remailer_domain('other.remailer.example.com'))
+		self.assertFalse(remailer.is_remailer_domain('example.com'))
+
+	def test_build_v1_address(self):
+		self.app.config['REMAILER_DOMAIN'] = 'remailer.example.com'
+		self.assertEqual(remailer.build_v1_address(SERVICE1_ID, USER_ID), ADDR_V1_S1)
+		self.assertEqual(remailer.build_v1_address(SERVICE2_ID, USER_ID), ADDR_V1_S2)
+		long_addr = remailer.build_v1_address(1000, 1000000)
+		self.assertLessEqual(len(long_addr.split('@')[0]), 64)
+		self.assertLessEqual(len(long_addr), 256)
+		self.app.config['REMAILER_OLD_DOMAINS'] = ['old.remailer.example.com']
+		self.assertEqual(remailer.build_v1_address(SERVICE1_ID, USER_ID), ADDR_V1_S1)
+		self.app.config['REMAILER_SECRET_KEY'] = self.app.config['SECRET_KEY']
+		self.assertEqual(remailer.build_v1_address(SERVICE1_ID, USER_ID), ADDR_V1_S1)
+		self.app.config['REMAILER_SECRET_KEY'] = 'REMAILER-DEBUGKEY'
+		self.assertNotEqual(remailer.build_v1_address(SERVICE1_ID, USER_ID), ADDR_V1_S1)
+
+	def test_build_v2_address(self):
+		self.app.config['REMAILER_DOMAIN'] = 'remailer.example.com'
+		self.assertEqual(remailer.build_v2_address(SERVICE1_ID, USER_ID), ADDR_V2_S1)
+		self.assertEqual(remailer.build_v2_address(SERVICE2_ID, USER_ID), ADDR_V2_S2)
+		long_addr = remailer.build_v2_address(1000, 1000000)
+		self.assertLessEqual(len(long_addr.split('@')[0]), 64)
+		self.assertLessEqual(len(long_addr), 256)
+		self.app.config['REMAILER_OLD_DOMAINS'] = ['old.remailer.example.com']
+		self.assertEqual(remailer.build_v2_address(SERVICE1_ID, USER_ID), ADDR_V2_S1)
+		self.app.config['REMAILER_SECRET_KEY'] = self.app.config['SECRET_KEY']
+		self.assertEqual(remailer.build_v2_address(SERVICE1_ID, USER_ID), ADDR_V2_S1)
+		self.app.config['REMAILER_SECRET_KEY'] = 'REMAILER-DEBUGKEY'
+		self.assertNotEqual(remailer.build_v2_address(SERVICE1_ID, USER_ID), ADDR_V2_S1)
+
+	def test_parse_address(self):
+		# REMAILER_DOMAIN behaviour
+		self.app.config['REMAILER_DOMAIN'] = None
+		self.assertIsNone(remailer.parse_address(ADDR_V1_S2))
+		self.assertIsNone(remailer.parse_address(ADDR_V2_S2))
+		self.assertIsNone(remailer.parse_address('foo@example.com'))
+		self.app.config['REMAILER_DOMAIN'] = 'remailer.example.com'
+		self.assertEqual(remailer.parse_address(ADDR_V1_S2), (SERVICE2_ID, USER_ID))
+		self.assertEqual(remailer.parse_address(ADDR_V2_S2), (SERVICE2_ID, USER_ID))
+		self.assertIsNone(remailer.parse_address('foo@example.com'))
+		self.assertIsNone(remailer.parse_address('foo@remailer.example.com'))
+		self.assertIsNone(remailer.parse_address('v1-foo@remailer.example.com'))
+		self.assertIsNone(remailer.parse_address('v2-foo@remailer.example.com'))
+		self.assertIsNone(remailer.parse_address('v2-foo-bar@remailer.example.com'))
+		self.app.config['REMAILER_DOMAIN'] = 'new-remailer.example.com'
+		self.assertIsNone(remailer.parse_address(ADDR_V1_S2))
+		self.assertIsNone(remailer.parse_address(ADDR_V2_S2))
+		self.app.config['REMAILER_OLD_DOMAINS'] = ['remailer.example.com']
+		self.assertEqual(remailer.parse_address(ADDR_V1_S2), (SERVICE2_ID, USER_ID))
+		self.assertEqual(remailer.parse_address(ADDR_V2_S2), (SERVICE2_ID, USER_ID))
+		# REMAILER_SECRET_KEY behaviour
+		self.app.config['REMAILER_DOMAIN'] = 'remailer.example.com'
+		self.app.config['REMAILER_OLD_DOMAINS'] = []
+		self.assertEqual(remailer.parse_address(ADDR_V1_S2), (SERVICE2_ID, USER_ID))
+		self.assertEqual(remailer.parse_address(ADDR_V2_S2), (SERVICE2_ID, USER_ID))
+		self.app.config['REMAILER_SECRET_KEY'] = self.app.config['SECRET_KEY']
+		self.assertEqual(remailer.parse_address(ADDR_V1_S2), (SERVICE2_ID, USER_ID))
+		self.assertEqual(remailer.parse_address(ADDR_V2_S2), (SERVICE2_ID, USER_ID))
+		self.app.config['REMAILER_SECRET_KEY'] = 'REMAILER-DEBUGKEY'
+		self.assertIsNone(remailer.parse_address(ADDR_V1_S2))
+		self.assertIsNone(remailer.parse_address(ADDR_V2_S2))

uffd-2.3.1/tests/test_tasks.py

@@ -0,0 +1,39 @@
+import unittest
+
+from flask import Flask
+from flask_sqlalchemy import SQLAlchemy
+
+from uffd.tasks import CleanupTask
+
+class TestCleanupTask(unittest.TestCase):
+	def test(self):
+		app = Flask(__name__)
+		app.testing = True
+		app.debug = True
+		app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///:memory:'
+		db = SQLAlchemy(app)
+		cleanup_task = CleanupTask()
+
+		@cleanup_task.delete_by_attribute('delete_me')
+		class TestModel(db.Model):
+			id = db.Column(db.Integer(), primary_key=True, autoincrement=True)
+			delete_me = db.Column(db.Boolean(), default=False, nullable=False)
+
+		with app.test_request_context():
+			db.create_all()
+			db.session.add(TestModel(delete_me=True))
+			db.session.add(TestModel(delete_me=True))
+			db.session.add(TestModel(delete_me=True))
+			db.session.add(TestModel(delete_me=False))
+			db.session.add(TestModel(delete_me=False))
+			db.session.commit()
+			db.session.expire_all()
+			self.assertEqual(TestModel.query.count(), 5)
+
+		with app.test_request_context():
+			cleanup_task.run()
+			db.session.commit()
+			db.session.expire_all()
+
+		with app.test_request_context():
+			self.assertEqual(TestModel.query.count(), 2)

uffd-2.3.1/tests/test_utils.py

@@ -0,0 +1,12 @@
+from uffd.utils import nopad_b32decode, nopad_b32encode, nopad_urlsafe_b64decode, nopad_urlsafe_b64encode
+
+from tests.utils import UffdTestCase
+
+class TestUtils(UffdTestCase):
+	def test_nopad_b32(self):
+		for n in range(0, 32):
+			self.assertEqual(b'X'*n, nopad_b32decode(nopad_b32encode(b'X'*n)))
+
+	def test_nopad_b64(self):
+		for n in range(0, 32):
+			self.assertEqual(b'X'*n, nopad_urlsafe_b64decode(nopad_urlsafe_b64encode(b'X'*n)))

{uffd-2.2.0 → uffd-2.3.1}/uffd/__init__.py

@@ -8,7 +8,7 @@ from babel.dates import LOCALTZ
 from werkzeug.exceptions import Forbidden
 from flask_migrate import Migrate
 
-from .database import db, SQLAlchemyJSON, customize_db_engine
+from .database import db, customize_db_engine
 from .template_helper import register_template_helper
 from .navbar import setup_navbar
 from .csrf import bp as csrf_bp
@@ -52,7 +52,6 @@ def init_config(app: Flask, test_config):
 
 def create_app(test_config=None): # pylint: disable=too-many-locals,too-many-statements
 	app = Flask(__name__, instance_relative_config=False)
-	app.json_encoder = SQLAlchemyJSON
 
 	init_config(app, test_config)
 

uffd-2.3.1/uffd/babel.cfg

@@ -0,0 +1,2 @@
+[python: **.py]
+[jinja2: **/templates/**.html]

{uffd-2.2.0 → uffd-2.3.1}/uffd/database.py

@@ -1,10 +1,7 @@
-from collections import OrderedDict
-
 from sqlalchemy import MetaData, event
 from sqlalchemy.types import TypeDecorator, Text
 from sqlalchemy.ext.mutable import MutableList
 from flask_sqlalchemy import SQLAlchemy
-from flask.json import JSONEncoder
 
 convention = {
 	'ix': 'ix_%(column_0_label)s',
@@ -48,15 +45,6 @@ def customize_db_engine(engine):
 			cursor.execute('SET NAMES utf8mb4 COLLATE utf8mb4_nopad_bin')
 			cursor.close()
 
-class SQLAlchemyJSON(JSONEncoder):
-	def default(self, o):
-		if isinstance(o, db.Model):
-			result = OrderedDict()
-			for key in o.__mapper__.c.keys():
-				result[key] = getattr(o, key)
-			return result
-		return JSONEncoder.default(self, o)
-
 class CommaSeparatedList(TypeDecorator):
 	# For some reason TypeDecorator.process_literal_param and
 	# TypeEngine.python_type are abstract but not actually required