def post(self):
# get auth token
auth_header = request.headers.get('Authorization')
if auth_header:
auth_token = auth_header.split(" ")[1]
else:
auth_token = ''
if auth_token:
resp = User.decode_auth_token(auth_token)
if not isinstance(resp, str):
# mark the token as blacklisted
blacklist_token = BlacklistToken(token=auth_token)
try:
# insert the token
db.session.add(blacklist_token)
db.session.commit()
responseObject = {
'status': 'success',
'message': 'Successfully logged out.'
}
return make_response(jsonify(responseObject)), 200
except Exception as e:
responseObject = {'status': 'fail', 'message': e.args}
return make_response(jsonify(responseObject)), 200
else:
responseObject = {'status': 'fail', 'message': resp}
return make_response(jsonify(responseObject)), 401
else:
responseObject = {
'status': 'fail',
'message': 'Provide a valid auth token.'
}
return make_response(jsonify(responseObject)), 401
def test_valid_blacklisted_token_user(self):
""" Test for user status with a blacklisted valid token """
with self.client:
resp_register = register_user(self, '*****@*****.**', 'joe',
'123456')
# blacklist a valid token
blacklist_token = BlacklistToken(
token=json.loads(resp_register.data.decode())['auth_token'])
db.session.add(blacklist_token)
db.session.commit()
response = self.client.get(
'/auth/status',
headers=dict(
Authorization='Bearer ' +
json.loads(resp_register.data.decode())['auth_token']))
data = json.loads(response.data.decode())
self.assertTrue(data['status'] == 'fail')
self.assertTrue(
data['message'] == 'Token blacklisted. Please log in again.')
self.assertEqual(response.status_code, 401)
def post(self):
responseObjectUser, returnCodeUser = _getUser(self)
responseObjectPassword, returnCodePassword = _checkPassword(self)
if (returnCodePassword == 200):
if (returnCodeUser == 200):
# get auth token
auth_header = request.headers.get('Authorization')
auth_token = auth_header.split(" ")[1]
# mark the token as blacklisted
blacklist_token = BlacklistToken(token=auth_token)
try:
# insert the token in blacklist
db.session.add(blacklist_token)
db.session.commit()
try:
# delete the user
db.session.delete(responseObjectUser)
db.session.commit()
responseObject = {
'status': 'success',
'message': 'User successfully deleted'
}
return make_response(jsonify(responseObject)), 200
except Exception as e:
responseObject = {'status': 'fail', 'message': e}
return make_response(jsonify(responseObject)), 200
except Exception as e:
responseObject = {'status': 'fail', 'message': e}
return make_response(jsonify(responseObject)), 200
else:
return make_response(
jsonify(responseObjectUser)), returnCodeUser
else:
return make_response(
jsonify(responseObjectPassword)), returnCodePassword
def test_valid_blacklisted_token_logout(self):
""" Test for logout after a valid token gets blacklisted """
with self.client:
# user registration
resp_register = register_user(self, '*****@*****.**', 'joe',
'123456')
data_register = json.loads(resp_register.data.decode())
self.assertTrue(data_register['status'] == 'success')
self.assertTrue(
data_register['message'] == 'Successfully registered.')
self.assertTrue(data_register['auth_token'])
self.assertTrue(resp_register.content_type == 'application/json')
self.assertEqual(resp_register.status_code, 201)
# user login
resp_login = login_user(self, '*****@*****.**', 'joe', '123456')
data_login = json.loads(resp_login.data.decode())
self.assertTrue(data_login['status'] == 'success')
self.assertTrue(data_login['message'] == 'Successfully logged in.')
self.assertTrue(data_login['auth_token'])
self.assertTrue(resp_login.content_type == 'application/json')
self.assertEqual(resp_login.status_code, 200)
# blacklist a valid token
blacklist_token = BlacklistToken(
token=json.loads(resp_login.data.decode())['auth_token'])
db.session.add(blacklist_token)
db.session.commit()
# blacklisted valid token logout
response = self.client.post(
'/auth/logout',
headers=dict(
Authorization='Bearer ' +
json.loads(resp_login.data.decode())['auth_token']))
data = json.loads(response.data.decode())
self.assertTrue(data['status'] == 'fail')
self.assertTrue(
data['message'] == 'Token blacklisted. Please log in again.')
self.assertEqual(response.status_code, 401)
def post(self):
# get the post data
post_data = request.get_json()
auth_token = post_data.get('token')
new_password = post_data.get('password')
if auth_token:
resp = User.decode_auth_token(auth_token)
blacklist_token = BlacklistToken(token=auth_token)
try:
# blacklist the token
db.session.add(blacklist_token)
db.session.commit()
# change password
user = User.query.filter_by(email=resp).first_or_404()
user.password = bcrypt.generate_password_hash(
new_password,
app.config.get('BCRYPT_LOG_ROUNDS')).decode()
db.session.commit()
responseObject = {
'status': 'success',
'message': 'user password successfully modified'
}
return make_response(jsonify(responseObject)), 200
except Exception as e:
responseObject = {'status': 'fail', 'message': e.args}
return make_response(jsonify(responseObject)), 500
else:
responseObject = {
'status': 'fail',
'message': 'Provide a valid auth token.'
}
return make_response(jsonify(responseObject)), 401