def test_use_reset_password_to_change_password(self):
validation_key = reset_password = "******"
with mock.patch("uuid.uuid4", return_value=uuid.UUID(reset_password)):
# Create the user.
self.app.post_json(
"/accounts", {"data": {"id": "*****@*****.**", "password": "******"}}, status=201
)
# Validate the user.
resp = self.app.post_json(
"/accounts/[email protected]/validate/" + validation_key, {}, status=200
)
# Ask for a reset password.
self.app.post_json("/accounts/[email protected]/reset-password", {}, status=200)
# Use reset password to set a new password.
self.app.patch_json(
"/accounts/[email protected]",
{"data": {"password": "******"}},
headers=get_user_headers("*****@*****.**", reset_password),
status=200,
)
# Can use the new password to authenticate.
resp = self.app.get("/", headers=get_user_headers("*****@*****.**", "newpass"))
assert resp.json["user"]["id"] == "account:[email protected]"
# The user hasn't changed.
resp = self.app.get(
"/accounts/[email protected]", headers=get_user_headers("*****@*****.**", "newpass")
)
assert resp.json["data"]["id"] == "*****@*****.**"
assert resp.json["data"]["validated"]
# The reset password isn't in the cache anymore
assert get_cached_reset_password("*****@*****.**", self.app.app.registry) is None
# Can't use the reset password anymore to authenticate.
resp = self.app.get("/", headers=get_user_headers("*****@*****.**", reset_password))
assert "user" not in resp.json
def test_reset_password_sends_email(self):
reset_password = "******"
with mock.patch("uuid.uuid4", return_value=uuid.UUID(reset_password)):
# Create the user.
self.app.post_json(
"/accounts", {"data": {"id": "*****@*****.**", "password": "******"}}, status=201
)
# Ask for a reset password.
resp = self.app.post_json(
"/accounts/[email protected]/reset-password",
{"data": {"email-context": {"name": "Alice"}}},
status=200,
)
assert resp.json["message"] == "A temporary reset password has been sent by mail"
assert len(self.mailer.outbox) == 2 # Validation email, reset password email.
mail = self.mailer.outbox[1] # Get the reset password email
assert mail.sender == "*****@*****.**"
assert mail.subject == "Alice, here is a temporary reset password for [email protected]"
assert (
mail.body
== f"You can use this temporary reset password {reset_password} to change your account [email protected] password"
)
# The reset password is stored in the cache.
cached_password = get_cached_reset_password(
"*****@*****.**", self.app.app.registry
).encode(encoding="utf-8")
pwd_str = reset_password.encode(encoding="utf-8")
assert bcrypt.checkpw(pwd_str, cached_password)