def get(self, user_id=None, name=None, token_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if (user.name != self.current_user.name) and not self.current_user.user_admin:
return self.forbidden()
token = UserToken.get(self.session, user=user, id=token_id)
return self.render("user-token-disable.html", user=user, token=token)
def post(self, user_id=None, name=None, token_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if (user.name != self.current_user.name) and not self.current_user.user_admin:
return self.forbidden()
token = UserToken.get(self.session, user=user, id=token_id)
token.disable()
AuditLog.log(
self.session,
self.current_user.id,
"disable_token",
"Disabled token: {}".format(token.name),
on_user_id=user.id,
)
self.session.commit()
return self.render("user-token-disabled.html", token=token)
def test_usertokens(standard_graph, session, users, groups, permissions): # noqa
user = users["*****@*****.**"]
assert len(user.tokens) == 0
tok, secret = UserToken(
user=user,
name="Foo"
).add(session)
assert len(user.tokens) == 1
assert tok.check_secret(secret)
assert tok.check_secret("invalid") == False
assert tok.enabled == True
tok.disable()
assert tok.enabled == False
assert user.tokens[0].enabled == False
assert UserToken.get(session, name="Foo", user=user).enabled == False
assert tok.check_secret(secret) == False
def test_usertokens(users, session, http_client, base_url):
user = users["*****@*****.**"]
tok, secret = UserToken(
user=user,
name="Foo"
).add(session)
session.commit()
api_url = url(base_url, '/token/validate')
# Completely bogus input
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': 'invalid'}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 1
valid_token = str(tok) + ":" + secret
# Valid token
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': valid_token}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "ok"
assert body["data"]["identity"] == str(tok)
assert body["data"]["owner"] == user.username
assert body["data"]["act_as_owner"]
assert body["data"]["valid"]
# Token with the last character changed to something invalid
bad_char = "1" if secret[-1].isalpha() else "a"
token_with_bad_secret = str(tok) + ":" + secret[:-1] + bad_char
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_secret}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 4
# Token with the token name frobbed to be something invalid
token_with_bad_name = str(tok) + "z:" + secret
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_name}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 2
# Token with the user frobbed to be something invalid
token_with_bad_user = "******" + str(tok) + ":" + secret
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_user}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 2
# Token with the user changed to another valid, but wrong user
token_with_wrong_user = "******" + tok.name + ":" + secret
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_wrong_user}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 2
# Disabled, but otherwise valid token
tok.disable()
session.commit()
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': valid_token}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 3
