def test_usertokens(standard_graph, session, users, groups, permissions): # noqa user = users["*****@*****.**"] assert len(user.tokens) == 0 tok, secret = UserToken( user=user, name="Foo" ).add(session) assert len(user.tokens) == 1 assert tok.check_secret(secret) assert tok.check_secret("invalid") == False assert tok.enabled == True tok.disable() assert tok.enabled == False assert user.tokens[0].enabled == False assert UserToken.get(session, name="Foo", user=user).enabled == False assert tok.check_secret(secret) == False
def test_usertokens(users, session, http_client, base_url): user = users["*****@*****.**"] tok, secret = UserToken( user=user, name="Foo" ).add(session) session.commit() api_url = url(base_url, '/token/validate') # Completely bogus input resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': 'invalid'})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 1 valid_token = str(tok) + ":" + secret # Valid token resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': valid_token})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "ok" assert body["data"]["identity"] == str(tok) assert body["data"]["owner"] == user.username assert body["data"]["act_as_owner"] assert body["data"]["valid"] # Token with the last character changed to something invalid bad_char = "1" if secret[-1].isalpha() else "a" token_with_bad_secret = str(tok) + ":" + secret[:-1] + bad_char resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_secret})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 4 # Token with the token name frobbed to be something invalid token_with_bad_name = str(tok) + "z:" + secret resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_name})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 2 # Token with the user frobbed to be something invalid token_with_bad_user = "******" + str(tok) + ":" + secret resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_user})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 2 # Token with the user changed to another valid, but wrong user token_with_wrong_user = "******" + tok.name + ":" + secret resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_wrong_user})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 2 # Disabled, but otherwise valid token tok.disable() session.commit() resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': valid_token})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 3