wbcore 2.2.1__py2.py3-none-any.whl

wbcore/contrib/authentication/serializers/users.py

@@ -0,0 +1,350 @@
+import logging
+
+from django.conf import settings
+from django.contrib.auth import user_logged_in
+from django.contrib.auth.password_validation import validate_password
+from django.forms import ValidationError
+from django.utils import timezone
+from django.utils.translation import gettext as _
+from django.utils.translation import gettext_lazy
+from jwt import decode
+from rest_framework import exceptions, serializers
+from rest_framework.reverse import reverse
+from rest_framework_simplejwt.serializers import (
+    TokenObtainPairSerializer,
+    TokenRefreshSerializer,
+)
+from rest_framework_simplejwt.tokens import RefreshToken
+from wbcore import serializers as wb_serializers
+from wbcore.contrib.directory.models import Person
+from wbcore.contrib.directory.serializers import PersonRepresentationSerializer
+
+from ..models import Group, Permission, User
+from ..models.users_activities import refresh_user_activity
+
+logger = logging.getLogger()
+
+
+class ChangePasswordSerializer(wb_serializers.Serializer):
+    old_password = wb_serializers.CharField(label=gettext_lazy("Old password"), required=True, secure=True)
+    new_password = wb_serializers.CharField(label=gettext_lazy("New Password"), required=True, secure=True)
+    confirm_password = wb_serializers.CharField(label=gettext_lazy("Confirm new Password"), required=True, secure=True)
+
+    def validate(self, data):
+        if not (request := self.context.get("request")):
+            raise ValueError(_("No request found"))
+        user = request.user
+        # user = data.get("user")
+        current_password = data.get("old_password")
+        if not user.check_password(current_password):
+            raise serializers.ValidationError({"old_password": _("Wrong password")})
+
+        new_password = data.get("new_password")
+        confirm_password = data.get("confirm_password")
+        if new_password != confirm_password:
+            raise serializers.ValidationError(
+                {"new_password": _("Password don't match"), "confirm_password": _("Password don't match")}
+            )
+
+        if user.check_password(new_password):
+            raise serializers.ValidationError(
+                {
+                    "new_password": _("New and old password cannot be the same"),
+                    "confirm_password": _("New and old password cannot be the same"),
+                }
+            )
+
+        if user.check_password(current_password):
+            try:
+                validate_password(new_password)
+                return super().validate(data)
+            except serializers.ValidationError as e:
+                raise serializers.ValidationError({"new_password": e, "confirm_password": e})
+
+    class Meta:
+        fields = ("current_password", "new_password", "confirm_password")
+
+
+class UserRepresentationSerializer(wb_serializers.RepresentationSerializer):
+    _detail = wb_serializers.HyperlinkField(reverse_name="wbcore:authentication:user-detail")
+    computed_str = wb_serializers.SerializerMethodField()
+
+    def get_computed_str(self, obj):
+        if obj.profile:
+            return obj.profile.computed_str
+        return f"{obj.username} ({obj.email})"
+
+    class Meta:
+        model = User
+        fields = ("id", "username", "computed_str", "email", "_detail")
+
+
+class PermissionRepresentationField(serializers.RelatedField):
+    def to_representation(self, value):
+        return "{0.content_type.app_label}.{0.codename}".format(value)
+
+
+class GroupRepresentationSerializer(wb_serializers.RepresentationSerializer):
+    # _detail = wb_serializers.HyperlinkField(reverse_name='wbcore:authentication:group-detail')
+    value_key = "id"
+    label_key = "name"
+
+    class Meta:
+        model = Group
+        fields = ("id", "name")
+
+
+class PermissionRepresentationSerializer(wb_serializers.RepresentationSerializer):
+    # _detail = serializers.SerializerMethodField()
+
+    endpoint = "wbcore:authentication:permissionrepresentation-list"
+    value_key = "id"
+    label_key = "{{name}}"
+
+    # _detail = wb_serializers.HyperlinkField(reverse_name='wbcore:authentication:permission-detail')
+
+    class Meta:
+        model = Permission
+        fields = ("id", "name")
+
+
+class GroupModelSerializer(wb_serializers.ModelSerializer):
+    _permissions = PermissionRepresentationSerializer(many=True, read_only=True, source="permissions")
+
+    class Meta:
+        model = Group
+        fields = (
+            "id",
+            "name",
+            "permissions",
+            "_permissions",
+        )
+
+
+class PermissionModelSerializer(wb_serializers.ModelSerializer):
+    content_type_repr = wb_serializers.SerializerMethodField()
+
+    class Meta:
+        model = Permission
+        fields = ("id", "name", "content_type", "content_type_repr", "codename", "group_set")
+
+    def get_content_type_repr(self, obj):
+        return str(obj.content_type.app_label)
+
+
+class UserModelSerializer(wb_serializers.ModelSerializer):
+    _groups = GroupRepresentationSerializer(source="groups", many=True)
+    _user_permissions = PermissionRepresentationSerializer(source="user_permissions", many=True)
+    _profile = PersonRepresentationSerializer(many=False, required=False, source="profile")
+
+    is_active = wb_serializers.BooleanField(default=True, label=gettext_lazy("Is Active"))
+    is_superuser = wb_serializers.BooleanField(default=False)
+    last_connection = wb_serializers.DateTimeField(read_only=True, label=gettext_lazy("Last Connection"))
+    email = wb_serializers.CharField(required=False, label=gettext_lazy("E-Mail"))
+    username = wb_serializers.CharField(required=False, label=gettext_lazy("Username"))
+    profile = wb_serializers.PrimaryKeyRelatedField(queryset=Person.objects.all(), label=gettext_lazy("Profile"))
+
+    @wb_serializers.register_resource()
+    def reset_password(self, instance, request, user):
+        res = {
+            "reset_password": reverse(
+                "wbcore:authentication:user-reset-password", args=[instance.id], request=request
+            ),
+            "user_permissions": reverse(
+                "wbcore:authentication:user-permissions-list", args=[instance.id], request=request
+            ),
+        }
+        if instance.profile:
+            res["profile"] = reverse("wbcore:directory:person-detail", args=[instance.profile.id], request=request)
+        return res
+
+    @wb_serializers.register_resource()
+    def user_activity(self, instance, request, user):
+        additional_resources = dict()
+        additional_resources["user_activity"] = reverse(
+            "wbcore:authentication:user-useractivity-list", args=[instance.id], request=request
+        )
+        additional_resources["user_activity_chart"] = reverse(
+            "wbcore:authentication:user-useractivitychart-list", args=[instance.id], request=request
+        )
+        return additional_resources
+
+    def get_all_permissions(self, obj):
+        permissions = list(obj.user_permissions.all().values_list("id", flat=True))
+        for group in obj.groups.all():
+            group_permissions = group.permissions.all().values_list("id", flat=True)
+            permissions.extend(list(group_permissions))
+        return list(set(permissions))
+
+    def get_all_permissions_repr(self, obj):
+        permissions = list()
+        permissions_dict = list(obj.user_permissions.all().values_list("content_type__app_label", "codename"))
+        permissions.extend(["{0[0]}.{0[1]}".format(_permission) for _permission in permissions_dict])
+        for group in obj.groups.all():
+            group_permissions = group.permissions.all().values_list("content_type__app_label", "codename")
+            permissions.extend(["{0[0]}.{0[1]}".format(_permission) for _permission in group_permissions])
+        return list(set(permissions))
+
+    @classmethod
+    def prefetch_related(cls, queryset, request):
+        queryset = queryset.prefetch_related("groups")
+        queryset = queryset.prefetch_related("user_permissions")
+        return queryset
+
+    def validate(self, data):
+        obj = self.instance
+
+        username = data.pop("username", obj.username if obj else None)
+        email = data.pop("email", obj.email if obj else None)
+        errors = {}
+        if profile := data.pop("profile", obj.profile if obj else None):
+            if not username:
+                username = User.generate_username(profile.first_name, profile.last_name)
+            if not email and (primary_emails := profile.emails.filter(primary=True).first()):
+                email = primary_emails.address
+
+        if not email:
+            errors["email"] = _("You need to assign a profile or add a valid email address")
+        if not username:
+            errors["username"] = _("You need to assign a profile or add a valid last name")
+
+        if len(errors.keys()) > 0:
+            raise serializers.ValidationError(errors)
+        if (user_account := getattr(profile, "user_account", None)) and (user_account != self.instance):
+            errors["profile"] = f"An account already exists for this profile under the email {user_account.email}"
+        data["profile"] = profile
+
+        data["username"] = username
+        data["email"] = email
+        if errors:
+            raise ValidationError(errors)
+        return super().validate(data)
+
+    class Meta:
+        model = User
+        fields = (
+            "id",
+            "username",
+            "email",
+            "date_joined",
+            "last_connection",
+            "user_permissions",
+            "_user_permissions",
+            "groups",
+            "_groups",
+            # 'all_permissions',
+            # 'all_permissions_repr',
+            "profile",
+            "_profile",
+            "is_staff",
+            "is_active",
+            "is_superuser",
+            # 'change_password',
+            # 'reset_password',
+            # 'main_manager_of',
+            "_additional_resources",
+        )
+
+
+class UserProfileModelSerializer(wb_serializers.ModelSerializer):
+    username = wb_serializers.CharField()
+    email = wb_serializers.ReadOnlyField()
+    profile = wb_serializers.PrimaryKeyRelatedField(read_only=True)
+    _profile = PersonRepresentationSerializer(many=False, read_only=True, source="profile")
+    generic_auth_token_key = wb_serializers.SerializerMethodField(label="Generic Token Key")
+
+    calendar_subscription_link = wb_serializers.SerializerMethodField()
+    profile_image = wb_serializers.ImageField(source="profile.profile_image", read_only=True)
+    first_name = wb_serializers.CharField(source="profile.first_name", read_only=True)
+    prefix = wb_serializers.CharField(source="profile.prefix", read_only=True)
+    last_name = wb_serializers.CharField(source="profile.last_name", read_only=True)
+    birthday = wb_serializers.DateField(source="profile.birthday", read_only=True)
+
+    @wb_serializers.register_resource()
+    def additional_resources(self, instance, request, user):
+        resources = dict()
+        if user.id == instance.id:
+            resources["change_password"] = reverse(
+                "wbcore:authentication:userprofile-change-password", args=[instance.id], request=request
+            )
+            resources["reset_settings"] = reverse(
+                "wbcore:authentication:userprofile-reset-settings", args=[instance.id], request=request
+            )
+            if user.profile.is_internal:
+                resources["see_profile"] = reverse(
+                    "wbcore:directory:person-detail", args=[instance.profile.id], request=request
+                )
+        return resources
+
+    def get_calendar_subscription_link(self, obj):
+        if (key := obj.generic_auth_token_key) and (request := self.context.get("request")):
+            full_url = request.build_absolute_uri(reverse("wbcore:agenda:get_ics"))
+            return f"{full_url}?token={key}"
+        return "N/A"
+
+    def get_generic_auth_token_key(self, obj):
+        return obj.generic_auth_token_key
+
+    def update(self, instance, validated_data):
+        profile = validated_data.get("profile", None)
+        if profile:
+            instance.profile.profile_image = profile.get("profile_image", instance.profile.profile_image)
+            instance.profile.first_name = profile.get("first_name", instance.profile.first_name)
+            instance.profile.prefix = profile.get("prefix", instance.profile.prefix)
+            instance.profile.last_name = profile.get("last_name", instance.profile.last_name)
+            instance.profile.birthday = profile.get("birthday", instance.profile.birthday)
+            instance.profile.save()
+        return instance
+
+    class Meta:
+        model = User
+        fields = (
+            "id",
+            "profile_image",
+            "first_name",
+            "last_name",
+            "prefix",
+            "birthday",
+            "username",
+            "email",
+            "_profile",
+            "profile",
+            "generic_auth_token_key",
+            "calendar_subscription_link",
+            "_additional_resources",
+        )
+
+
+class MyTokenObtainPairSerializer(TokenObtainPairSerializer):
+    def validate(self, attrs):
+        authentication_status = True
+        try:
+            data = super().validate(attrs)
+            refresh = RefreshToken(data["refresh"])
+            user = User.objects.filter(email=attrs[self.username_field]).first()
+            jti = refresh.payload.get("jti", None)
+            if user and jti:
+                user_logged_in.send(
+                    sender=MyTokenObtainPairSerializer.__class__,
+                    request=self.context.get("request"),
+                    user=user,
+                    authentication_status=authentication_status,
+                    jti=jti,
+                )
+        except exceptions.AuthenticationFailed:
+            raise exceptions.AuthenticationFailed(
+                self.error_messages["no_active_account"],
+                "no_active_account",
+            )
+        return data
+
+
+class MyTokenRefreshSerializer(TokenRefreshSerializer):
+    def validate(self, attrs):
+        data = super().validate(attrs)
+        decoded_data = decode(attrs["refresh"], settings.SECRET_KEY, algorithms=["HS256"])
+        user_id = decoded_data.get("user_id", None)
+        jti = decoded_data.get("jti", None)
+        if user_id and jti:
+            refresh_user_activity.delay(user_id, timezone.now(), jti)
+        return data

wbcore/contrib/authentication/serializers/users_activites.py

@@ -0,0 +1,37 @@
+from wbcore import serializers as wb_serializers
+
+from ..models import User, UserActivity
+from .users import UserRepresentationSerializer
+
+
+class UserActivitySerializer(wb_serializers.ModelSerializer):
+    IP = wb_serializers.CharField(read_only=True)
+    _user = UserRepresentationSerializer(source="user")
+    user = wb_serializers.PrimaryKeyRelatedField(queryset=User.objects.all(), many=False)
+    time_online_minute = wb_serializers.CharField(read_only=True)
+
+    class Meta:
+        model = UserActivity
+        fields = (
+            "id",
+            "IP",
+            "date",
+            "user",
+            "_user",
+            "status",
+            "type",
+            "user_agent_info",
+            "latest_refresh",
+            "time_online_minute",
+        )
+
+
+class UserActivityTableSerializer(UserActivitySerializer):
+    today_activity = wb_serializers.CharField(read_only=True)
+    beforeyesterday_activity = wb_serializers.CharField(read_only=True)
+    yesterday_activity = wb_serializers.CharField(read_only=True)
+    user_repr = wb_serializers.CharField(read_only=True)
+
+    class Meta:
+        model = User
+        fields = ("id", "user_repr", "today_activity", "yesterday_activity", "beforeyesterday_activity")

wbcore/contrib/authentication/tasks.py

@@ -0,0 +1,29 @@
+import logging
+from datetime import datetime, timedelta
+
+from celery import shared_task
+from django.utils import timezone
+from dynamic_preferences.registries import global_preferences_registry
+
+from .models import User
+
+logger = logging.getLogger(__name__)
+
+
+@shared_task
+def delete_unregistered_user_account(prune_user_account_before_datetime: datetime | None = None):
+    if not prune_user_account_before_datetime:
+        global_preferences = global_preferences_registry.manager()
+        max_hours = global_preferences["authentication__hours_before_deleting_unregistered_account"]
+        prune_user_account_before_datetime = timezone.now() - timedelta(hours=max_hours)
+
+    for user in User.objects.filter(
+        date_joined__lt=prune_user_account_before_datetime, is_register=False, is_active=False
+    ):
+        # we wrap the deletion routine into a try catch block to avoid encountering unexpected error which would prevent the proper progression of this task
+        try:
+            if user.profile:
+                user.profile.delete()
+            user.delete()
+        except Exception as e:
+            logger.warning(f"Couldn't delete unregistered user {user} because of error {e}")

wbcore/contrib/authentication/tests/conftest.py

@@ -0,0 +1,18 @@
+from pytest_factoryboy import register
+from wbcore.contrib.directory.factories import PersonFactory
+from wbcore.tests.conftest import *
+
+from ..factories import (
+    InternalUserFactory,
+    SuperUserFactory,
+    TokenFactory,
+    UserActivityFactory,
+    UserFactory,
+)
+
+register(UserFactory, _name="user")
+register(SuperUserFactory, _name="superuser")
+register(InternalUserFactory, _name="internal_user")
+register(UserActivityFactory)
+register(PersonFactory)
+register(TokenFactory)

wbcore/contrib/authentication/tests/e2e/__init__.py

@@ -0,0 +1 @@
+from .e2e_auth_utility import create_main_company_user

wbcore/contrib/authentication/tests/e2e/e2e_auth_utility.py

@@ -0,0 +1,20 @@
+from wbcore.contrib.authentication.factories import (
+    AuthenticatedPersonFactory,
+    SuperUserFactory,
+)
+from wbcore.contrib.authentication.models import User
+
+
+def create_main_company_user(user_password: str) -> User:
+    """Creates a user for the main company.
+
+    Args:
+        user_password (str): The password used for the user
+
+    Returns:
+        User: The newly created user.
+    """
+    user = SuperUserFactory(plaintext_password=user_password)
+    profile = AuthenticatedPersonFactory(user_account=user)
+    user.profile = profile
+    return user

wbcore/contrib/authentication/tests/signals.py

@@ -0,0 +1,17 @@
+from django.dispatch import receiver
+from wbcore.test.signals import custom_update_kwargs, get_custom_factory
+
+from ..factories import UserFactory
+from ..viewsets import UserActivityTable, UserActivityUserChart
+
+
+@receiver(get_custom_factory, sender=UserActivityTable)
+def receive_factory_user_activity(sender, *args, **kwargs):
+    return UserFactory
+
+
+@receiver(custom_update_kwargs, sender=UserActivityUserChart)
+def receive_kwargs_user_activity(sender, *args, **kwargs):
+    if obj := kwargs.get("obj_factory"):
+        return {"user_id": obj.user.id}
+    return {}

wbcore/contrib/authentication/tests/test_configs.py

@@ -0,0 +1,6 @@
+from wbcore.configs.registry import ConfigRegistry
+
+
+def test_authentication_config(config_registry: ConfigRegistry):
+    authentication = config_registry.get_config_dict()["authentication"]
+    assert authentication

wbcore/contrib/authentication/tests/test_serializers.py

@@ -0,0 +1,6 @@
+import pytest
+
+
+@pytest.mark.django_db
+class TestSpecificSerializers:
+    pass

wbcore/contrib/authentication/tests/test_tasks.py

@@ -0,0 +1,33 @@
+from datetime import timedelta
+
+import pytest
+from faker import Faker
+from wbcore.contrib.authentication.tasks import delete_unregistered_user_account
+
+from ..models import User
+
+fake = Faker()
+
+
+@pytest.mark.django_db
+def test_delete_unregistered_user_account(user_factory):
+    val_datetime = fake.date_time()
+
+    registered_user = user_factory.create(is_register=True, is_active=True)
+    unregistered_but_active_user = user_factory.create(
+        is_register=False, is_active=True
+    )  # in case we have (but we shouldn't) unregistered but active user, we don't clean them
+    unregistered_user_in_retention_period = user_factory.create(
+        is_register=False, is_active=False, date_joined=val_datetime
+    )  # unregistered user created within the retention period
+    unregistered_user_obselete = user_factory.create(
+        is_register=False, is_active=False, date_joined=val_datetime - timedelta(seconds=1)
+    )  # unregistered user created outside of the retention period
+    delete_unregistered_user_account(prune_user_account_before_datetime=val_datetime)
+    assert set(User.objects.exclude(email="AnonymousUser")) == {
+        registered_user,
+        unregistered_but_active_user,
+        unregistered_user_in_retention_period,
+    }
+    with pytest.raises(User.DoesNotExist):
+        unregistered_user_obselete.refresh_from_db()

wbcore/contrib/authentication/tests/test_tokens.py

@@ -0,0 +1,126 @@
+import urllib
+from datetime import datetime, timedelta
+
+import pytest
+from django.urls import resolve
+from django.utils import timezone
+from faker import Faker
+from rest_framework import exceptions
+from rest_framework.test import APIRequestFactory
+from wbcore.contrib.authentication.authentication import inject_short_lived_token
+from wbcore.contrib.authentication.models import Token
+
+fake = Faker()
+now = datetime.now()
+
+
+class TestTokenUnitTests:
+    @pytest.fixture
+    def request_with_user(user):
+        request = APIRequestFactory().get("/")
+        request.user = user
+        return request
+
+    def setup_method(self):
+        self.token = Token()
+
+    @pytest.mark.parametrize("is_valid", [True, False])
+    def test_check_validity_for_endpoint_for_infinite_token(self, is_valid, mocker):
+        mocker.patch.object(self.token, "is_valid", is_valid)
+        if self.token.is_valid:
+            assert self.token.check_validity_for_endpoint(fake.sentence(), fake.date_time())
+        else:
+            with pytest.raises(exceptions.AuthenticationFailed) as exc_info:
+                assert self.token.check_validity_for_endpoint(fake.sentence(), fake.date_time())
+            assert str(exc_info.value) == "Token is not valid anymore"
+
+    def test_check_invalidity_for_endpoint_for_expired_token(self, mocker):
+        mocker.patch.object(self.token, "valid_until", now)
+        assert self.token.check_validity_for_endpoint(
+            self.token.protected_view_name, self.token.valid_until - timedelta(minutes=1)
+        )
+        with pytest.raises(exceptions.AuthenticationFailed) as exc_info:
+            self.token.check_validity_for_endpoint(
+                self.token.protected_view_name, self.token.valid_until + timedelta(minutes=1)
+            )
+        assert str(exc_info.value) == "Token has expired"
+
+    def test_check_invalidity_for_endpoint_for_exhausted_token(self, mocker):
+        mocker.patch.object(self.token, "number_usage_left", 2)
+        mocker.patch.object(self.token, "save")
+        while self.token.number_usage_left > 0:
+            assert self.token.check_validity_for_endpoint(self.token.protected_view_name, fake.date_time())
+        with pytest.raises(exceptions.AuthenticationFailed) as exc_info:
+            self.token.check_validity_for_endpoint(self.token.protected_view_name, fake.date_time())
+        assert str(exc_info.value) == "Token usage exhausted"
+
+    def test_check_unvalidity_for_endpoint_for_wrong_endpoint(self, mocker):
+        mocker.patch.object(self.token, "protected_view_name", "Some View Name")
+        with pytest.raises(exceptions.AuthenticationFailed) as exc_info:
+            self.token.check_validity_for_endpoint("wbcore:authentication:wrongview", fake.date_time())
+        assert str(exc_info.value) == "Token has limited scope that doesn't match the requested endpoint"
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize("view_name", [(None, "wbcore:authentication:user")])
+    def test_generate_token_for_user(self, user, view_name):
+        d1 = fake.date_time()
+        n1 = fake.pyint()
+        token = Token.generate_token_for_user(user, protected_view_name=view_name, valid_until=d1, number_of_usages=n1)
+        assert token.user == user
+        assert token.protected_view_name == view_name
+        assert token.valid_until == d1
+        assert token.number_usage_left == n1
+        token.is_valid = False
+        token.save()  # invalid token to check that retrieving it will enable it
+
+        d2 = fake.date_time()
+        n2 = fake.pyint()
+        new_token = Token.generate_token_for_user(
+            user, protected_view_name=view_name, valid_until=d2, number_of_usages=n2
+        )
+        assert new_token == token  # check that the uniqueness on schema work
+        assert new_token.valid_until == d2
+        assert new_token.number_usage_left == n2
+        assert new_token.is_valid is True
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize(
+        "endpoint,creation_time",
+        [
+            ("http://localhost:5000/wbcore/authentication/user/", now),
+            ("http://localhost:5000/wbcore/authentication/user/?some_param=True", now),
+            ("/wbcore/authentication/user/?some_param=True&other_param=foo", now),
+        ],
+    )
+    def test_generate_shareable_link(self, user, endpoint, creation_time):
+        creation_time = timezone.make_aware(creation_time)
+        parse_url = urllib.parse.urlsplit(urllib.parse.unquote(endpoint))
+        base_params = dict(urllib.parse.parse_qsl(parse_url.query))
+        link = self.token.generate_shareable_link(endpoint, user, creation_time=creation_time)
+        res_params = dict(urllib.parse.parse_qsl(urllib.parse.urlsplit(urllib.parse.unquote(link)).query))
+
+        assert endpoint in link  # check that the resulting endpoint is not modified
+        for k, v in base_params.items():  # check that the base query parameters weren't touched
+            assert res_params[k] == v
+        assert (
+            res_params["token"]
+            == Token.objects.get(user=user, protected_view_name=resolve(parse_url.path).view_name).key
+        )  # check that the token was injected as query parameter
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize("view_name", [("wbcore:authentication:user", None)])
+    def test_inject_short_lived_token(self, user, view_name, request_with_user):
+        link = fake.url() + "?a=a&b=b"
+
+        @inject_short_lived_token(view_name=view_name)
+        def dummy_resources(serializer, instance, request, user, **kwargs):
+            return {"resource": link}
+
+        res = dummy_resources(None, None, request_with_user, user)
+        res_params = dict(urllib.parse.parse_qsl(urllib.parse.urlsplit(urllib.parse.unquote(res["resource"])).query))
+        assert link in res["resource"]  # check that the resulting endpoint is not modified
+        assert res_params["a"] == "a"
+        assert res_params["b"] == "b"
+        assert (
+            res_params["token"] == Token.objects.get(user=user, protected_view_name=view_name).key
+        )  # check that the token was injected as query parameter