Example #1
0
class TestAuthenticationPolicy(object):
    @pytest.fixture(autouse=True)
    def policy(self):
        self.api_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.fallback_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.policy = AuthenticationPolicy(
            api_policy=self.api_policy, fallback_policy=self.fallback_policy)

        self.fallback_policy.remember.return_value = [("Cookie", "auth=foobar")
                                                      ]

    # api_request and nonapi_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=API_PATHS)
    def api_request(self, request, pyramid_request):
        pyramid_request.path = request.param
        return pyramid_request

    @pytest.fixture(params=NONAPI_PATHS)
    def nonapi_request(self, request, pyramid_request):
        pyramid_request.path = request.param
        return pyramid_request

    def test_authenticated_userid_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.authenticated_userid(nonapi_request)

        self.fallback_policy.authenticated_userid.assert_called_once_with(
            nonapi_request)
        assert result == self.fallback_policy.authenticated_userid.return_value

    def test_authenticated_userid_uses_api_policy_for_api_paths(
            self, api_request):
        result = self.policy.authenticated_userid(api_request)

        self.api_policy.authenticated_userid.assert_called_once_with(
            api_request)
        assert result == self.api_policy.authenticated_userid.return_value

    def test_unauthenticated_userid_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.unauthenticated_userid(nonapi_request)

        self.fallback_policy.unauthenticated_userid.assert_called_once_with(
            nonapi_request)
        assert result == self.fallback_policy.unauthenticated_userid.return_value

    def test_unauthenticated_userid_uses_api_policy_for_api_paths(
            self, api_request):
        result = self.policy.unauthenticated_userid(api_request)

        self.api_policy.unauthenticated_userid.assert_called_once_with(
            api_request)
        assert result == self.api_policy.unauthenticated_userid.return_value

    def test_effective_principals_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.effective_principals(nonapi_request)

        self.fallback_policy.effective_principals.assert_called_once_with(
            nonapi_request)
        assert result == self.fallback_policy.effective_principals.return_value

    def test_effective_principals_uses_api_policy_for_api_paths(
            self, api_request):
        result = self.policy.effective_principals(api_request)

        self.api_policy.effective_principals.assert_called_once_with(
            api_request)
        assert result == self.api_policy.effective_principals.return_value

    def test_remember_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.remember(nonapi_request, "foo", bar="baz")

        self.fallback_policy.remember.assert_called_once_with(nonapi_request,
                                                              "foo",
                                                              bar="baz")
        assert result == self.fallback_policy.remember.return_value

    def test_remember_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.remember(api_request, "foo", bar="baz")

        self.api_policy.remember.assert_called_once_with(api_request,
                                                         "foo",
                                                         bar="baz")
        assert result == self.api_policy.remember.return_value

    def test_forget_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.forget(nonapi_request)

        self.fallback_policy.forget.assert_called_once_with(nonapi_request)
        assert result == self.fallback_policy.forget.return_value

    def test_forget_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.forget(api_request)

        self.api_policy.forget.assert_called_once_with(api_request)
        assert result == self.api_policy.forget.return_value
Example #2
0
class TestAuthenticationPolicy(object):
    @pytest.fixture(autouse=True)
    def policy(self):
        self.api_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.fallback_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.policy = AuthenticationPolicy(api_policy=self.api_policy, fallback_policy=self.fallback_policy)

        self.fallback_policy.remember.return_value = [("Cookie", "auth=foobar")]

    # api_request and nonapi_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=API_PATHS)
    def api_request(self, request, pyramid_request):
        pyramid_request.path = request.param
        return pyramid_request

    @pytest.fixture(params=NONAPI_PATHS)
    def nonapi_request(self, request, pyramid_request):
        pyramid_request.path = request.param
        return pyramid_request

    def test_authenticated_userid_uses_fallback_policy_for_nonapi_paths(self, nonapi_request):
        result = self.policy.authenticated_userid(nonapi_request)

        self.fallback_policy.authenticated_userid.assert_called_once_with(nonapi_request)
        assert result == self.fallback_policy.authenticated_userid.return_value

    def test_authenticated_userid_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.authenticated_userid(api_request)

        self.api_policy.authenticated_userid.assert_called_once_with(api_request)
        assert result == self.api_policy.authenticated_userid.return_value

    def test_unauthenticated_userid_uses_fallback_policy_for_nonapi_paths(self, nonapi_request):
        result = self.policy.unauthenticated_userid(nonapi_request)

        self.fallback_policy.unauthenticated_userid.assert_called_once_with(nonapi_request)
        assert result == self.fallback_policy.unauthenticated_userid.return_value

    def test_unauthenticated_userid_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.unauthenticated_userid(api_request)

        self.api_policy.unauthenticated_userid.assert_called_once_with(api_request)
        assert result == self.api_policy.unauthenticated_userid.return_value

    def test_effective_principals_uses_fallback_policy_for_nonapi_paths(self, nonapi_request):
        result = self.policy.effective_principals(nonapi_request)

        self.fallback_policy.effective_principals.assert_called_once_with(nonapi_request)
        assert result == self.fallback_policy.effective_principals.return_value

    def test_effective_principals_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.effective_principals(api_request)

        self.api_policy.effective_principals.assert_called_once_with(api_request)
        assert result == self.api_policy.effective_principals.return_value

    def test_remember_uses_fallback_policy_for_nonapi_paths(self, nonapi_request):
        result = self.policy.remember(nonapi_request, "foo", bar="baz")

        self.fallback_policy.remember.assert_called_once_with(nonapi_request, "foo", bar="baz")
        assert result == self.fallback_policy.remember.return_value

    def test_remember_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.remember(api_request, "foo", bar="baz")

        self.api_policy.remember.assert_called_once_with(api_request, "foo", bar="baz")
        assert result == self.api_policy.remember.return_value

    def test_forget_uses_fallback_policy_for_nonapi_paths(self, nonapi_request):
        result = self.policy.forget(nonapi_request)

        self.fallback_policy.forget.assert_called_once_with(nonapi_request)
        assert result == self.fallback_policy.forget.return_value

    def test_forget_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.forget(api_request)

        self.api_policy.forget.assert_called_once_with(api_request)
        assert result == self.api_policy.forget.return_value
Example #3
0
class TestAuthenticationPolicy(object):
    @pytest.fixture(autouse=True)
    def policy(self):
        self.session_policy = mock.Mock(spec_set=SessionAuthenticationPolicy())
        self.token_policy = mock.Mock(spec_set=TokenAuthenticationPolicy())
        self.policy = AuthenticationPolicy()
        self.policy.session_policy = self.session_policy
        self.policy.token_policy = self.token_policy

    # session_request and token_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=SESSION_AUTH_PATHS)
    def session_request(self, request):
        return DummyRequest(path=request.param)

    @pytest.fixture(params=TOKEN_AUTH_PATHS)
    def token_request(self, request):
        return DummyRequest(path=request.param)

    def test_authenticated_userid_uses_session_policy_for_session_auth_paths(
            self, session_request):
        result = self.policy.authenticated_userid(session_request)

        self.session_policy.authenticated_userid.assert_called_once_with(
            session_request)
        assert result == self.session_policy.authenticated_userid.return_value

    def test_authenticated_userid_uses_token_policy_for_token_auth_paths(
            self, token_request):
        result = self.policy.authenticated_userid(token_request)

        self.token_policy.authenticated_userid.assert_called_once_with(
            token_request)
        assert result == self.token_policy.authenticated_userid.return_value

    def test_unauthenticated_userid_uses_session_policy_for_session_auth_paths(
            self, session_request):
        result = self.policy.unauthenticated_userid(session_request)

        self.session_policy.unauthenticated_userid.assert_called_once_with(
            session_request)
        assert result == self.session_policy.unauthenticated_userid.return_value

    def test_unauthenticated_userid_uses_token_policy_for_token_auth_paths(
            self, token_request):
        result = self.policy.unauthenticated_userid(token_request)

        self.token_policy.unauthenticated_userid.assert_called_once_with(
            token_request)
        assert result == self.token_policy.unauthenticated_userid.return_value

    def test_effective_principals_uses_session_policy_for_session_auth_paths(
            self, session_request):
        result = self.policy.effective_principals(session_request)

        self.session_policy.effective_principals.assert_called_once_with(
            session_request)
        assert result == self.session_policy.effective_principals.return_value

    def test_effective_principals_uses_token_policy_for_token_auth_paths(
            self, token_request):
        result = self.policy.effective_principals(token_request)

        self.token_policy.effective_principals.assert_called_once_with(
            token_request)
        assert result == self.token_policy.effective_principals.return_value

    def test_remember_uses_session_policy_for_session_auth_paths(
            self, session_request):
        result = self.policy.remember(session_request, 'foo', bar='baz')

        self.session_policy.remember.assert_called_once_with(session_request,
                                                             'foo',
                                                             bar='baz')
        assert result == self.session_policy.remember.return_value

    def test_remember_uses_token_policy_for_token_auth_paths(
            self, token_request):
        result = self.policy.remember(token_request, 'foo', bar='baz')

        self.token_policy.remember.assert_called_once_with(token_request,
                                                           'foo',
                                                           bar='baz')
        assert result == self.token_policy.remember.return_value

    def test_forget_uses_session_policy_for_session_auth_paths(
            self, session_request):
        result = self.policy.forget(session_request)

        self.session_policy.forget.assert_called_once_with(session_request)
        assert result == self.session_policy.forget.return_value

    def test_forget_uses_token_policy_for_token_auth_paths(
            self, token_request):
        result = self.policy.forget(token_request)

        self.token_policy.forget.assert_called_once_with(token_request)
        assert result == self.token_policy.forget.return_value
Example #4
0
class TestAuthenticationPolicy(object):

    @pytest.fixture(autouse=True)
    def policy(self):
        self.session_policy = mock.Mock(spec_set=SessionAuthenticationPolicy())
        self.token_policy = mock.Mock(spec_set=TokenAuthenticationPolicy())
        self.policy = AuthenticationPolicy()
        self.policy.session_policy = self.session_policy
        self.policy.token_policy = self.token_policy

    # session_request and token_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=SESSION_AUTH_PATHS)
    def session_request(self, request):
        return DummyRequest(path=request.param)

    @pytest.fixture(params=TOKEN_AUTH_PATHS)
    def token_request(self, request):
        return DummyRequest(path=request.param)

    def test_authenticated_userid_uses_session_policy_for_session_auth_paths(self, session_request):
        result = self.policy.authenticated_userid(session_request)

        self.session_policy.authenticated_userid.assert_called_once_with(session_request)
        assert result == self.session_policy.authenticated_userid.return_value

    def test_authenticated_userid_uses_token_policy_for_token_auth_paths(self, token_request):
        result = self.policy.authenticated_userid(token_request)

        self.token_policy.authenticated_userid.assert_called_once_with(token_request)
        assert result == self.token_policy.authenticated_userid.return_value

    def test_unauthenticated_userid_uses_session_policy_for_session_auth_paths(self, session_request):
        result = self.policy.unauthenticated_userid(session_request)

        self.session_policy.unauthenticated_userid.assert_called_once_with(session_request)
        assert result == self.session_policy.unauthenticated_userid.return_value

    def test_unauthenticated_userid_uses_token_policy_for_token_auth_paths(self, token_request):
        result = self.policy.unauthenticated_userid(token_request)

        self.token_policy.unauthenticated_userid.assert_called_once_with(token_request)
        assert result == self.token_policy.unauthenticated_userid.return_value

    def test_effective_principals_uses_session_policy_for_session_auth_paths(self, session_request):
        result = self.policy.effective_principals(session_request)

        self.session_policy.effective_principals.assert_called_once_with(session_request)
        assert result == self.session_policy.effective_principals.return_value

    def test_effective_principals_uses_token_policy_for_token_auth_paths(self, token_request):
        result = self.policy.effective_principals(token_request)

        self.token_policy.effective_principals.assert_called_once_with(token_request)
        assert result == self.token_policy.effective_principals.return_value

    def test_remember_uses_session_policy_for_session_auth_paths(self, session_request):
        result = self.policy.remember(session_request, 'foo', bar='baz')

        self.session_policy.remember.assert_called_once_with(session_request, 'foo', bar='baz')
        assert result == self.session_policy.remember.return_value

    def test_remember_uses_token_policy_for_token_auth_paths(self, token_request):
        result = self.policy.remember(token_request, 'foo', bar='baz')

        self.token_policy.remember.assert_called_once_with(token_request, 'foo', bar='baz')
        assert result == self.token_policy.remember.return_value

    def test_forget_uses_session_policy_for_session_auth_paths(self, session_request):
        result = self.policy.forget(session_request)

        self.session_policy.forget.assert_called_once_with(session_request)
        assert result == self.session_policy.forget.return_value

    def test_forget_uses_token_policy_for_token_auth_paths(self, token_request):
        result = self.policy.forget(token_request)

        self.token_policy.forget.assert_called_once_with(token_request)
        assert result == self.token_policy.forget.return_value
Example #5
0
class TestAuthenticationPolicy(object):
    @pytest.fixture(autouse=True)
    def policy(self):
        self.upstream_policy = mock.Mock(
            spec_set=SessionAuthenticationPolicy())
        self.policy = AuthenticationPolicy()
        self.policy.session_policy = self.upstream_policy

    # session_request and token_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=SESSION_AUTH_PATHS)
    def session_request(self, request):
        return DummyRequest(path=request.param)

    @pytest.fixture(params=TOKEN_AUTH_PATHS)
    def token_request(self, request):
        return DummyRequest(path=request.param)

    def test_authenticated_userid_delegates_for_session_auth_paths(
            self, session_request):
        result = self.policy.authenticated_userid(session_request)

        self.upstream_policy.authenticated_userid.assert_called_once_with(
            session_request)
        assert result == self.upstream_policy.authenticated_userid.return_value

    @mock.patch('h.auth.policy.tokens')
    def test_authenticated_userid_uses_tokens_for_token_auth_paths(
            self, tokens, token_request):
        result = self.policy.authenticated_userid(token_request)

        tokens.authenticated_userid.assert_called_once_with(token_request)
        assert result == tokens.authenticated_userid.return_value

    def test_unauthenticated_userid_delegates_for_session_auth_paths(
            self, session_request):
        result = self.policy.unauthenticated_userid(session_request)

        self.upstream_policy.unauthenticated_userid.assert_called_once_with(
            session_request)
        assert result == self.upstream_policy.unauthenticated_userid.return_value

    @mock.patch('h.auth.policy.tokens')
    def test_unauthenticated_userid_uses_tokens_for_token_auth_paths(
            self, tokens, token_request):
        result = self.policy.unauthenticated_userid(token_request)

        tokens.authenticated_userid.assert_called_once_with(token_request)
        assert result == tokens.authenticated_userid.return_value

    @mock.patch('h.auth.policy.util')
    def test_effective_principals_calls_effective_principals_with_authenticated_userid(
            self, util, authn_policy):
        authn_policy.authenticated_userid.return_value = 'acct:[email protected]'
        request = DummyRequest()

        result = self.policy.effective_principals(request)

        util.effective_principals.assert_called_once_with(
            'acct:[email protected]', request)
        assert result == util.effective_principals.return_value

    def test_remember_delegates_for_session_auth_paths(self, session_request):
        result = self.policy.remember(session_request, 'foo', bar='baz')

        self.upstream_policy.remember.assert_called_once_with(session_request,
                                                              'foo',
                                                              bar='baz')
        assert result == self.upstream_policy.remember.return_value

    def test_remember_does_nothing_for_token_auth_paths(self, token_request):
        result = self.policy.remember(token_request, 'foo', bar='baz')

        self.upstream_policy.remember.assert_not_called()
        assert result == []

    def test_forget_delegates_for_session_auth_paths(self, session_request):
        result = self.policy.forget(session_request)

        self.upstream_policy.forget.assert_called_once_with(session_request)
        assert result == self.upstream_policy.forget.return_value

    def test_forget_does_nothing_for_token_auth_paths(self, token_request):
        result = self.policy.forget(token_request)

        self.upstream_policy.forget.assert_not_called()
        assert result == []
Example #6
0
class TestAuthenticationPolicy(object):
    @pytest.fixture(autouse=True)
    def policy(self):
        self.api_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.fallback_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.migration_policy = mock.Mock(spec_set=list(IAuthenticationPolicy))
        self.policy = AuthenticationPolicy(
            api_policy=self.api_policy,
            fallback_policy=self.fallback_policy,
            migration_policy=self.migration_policy)

        self.fallback_policy.remember.return_value = [('Cookie', 'auth=foobar')
                                                      ]

    # api_request and nonapi_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=API_PATHS)
    def api_request(self, request, pyramid_request):
        pyramid_request.path = request.param
        return pyramid_request

    @pytest.fixture(params=NONAPI_PATHS)
    def nonapi_request(self, request, pyramid_request):
        pyramid_request.path = request.param
        return pyramid_request

    def test_authenticated_userid_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.authenticated_userid(nonapi_request)

        self.fallback_policy.authenticated_userid.assert_called_once_with(
            nonapi_request)
        assert result == self.fallback_policy.authenticated_userid.return_value

    def test_authenticated_userid_uses_migration_policy_when_fallback_returns_none(
            self, nonapi_request):
        self.fallback_policy.authenticated_userid.return_value = None

        result = self.policy.authenticated_userid(nonapi_request)

        self.migration_policy.authenticated_userid.assert_called_once_with(
            nonapi_request)
        assert result == self.migration_policy.authenticated_userid.return_value

    def test_authenticated_userid_remembers_value_from_migration_policy_in_fallback_policy(
            self, nonapi_request):
        self.fallback_policy.authenticated_userid.return_value = None

        self.policy.authenticated_userid(nonapi_request)

        self.fallback_policy.remember.assert_called_once_with(
            nonapi_request,
            self.migration_policy.authenticated_userid.return_value)

    def test_authenticated_userid_sets_cookie_when_migrating(
            self, nonapi_request):
        self.fallback_policy.authenticated_userid.return_value = None

        self.policy.authenticated_userid(nonapi_request)

        cookies = nonapi_request.response.headers.getall('Cookie')
        assert 'auth=foobar' in cookies

    def test_authenticated_userid_uses_api_policy_for_api_paths(
            self, api_request):
        result = self.policy.authenticated_userid(api_request)

        self.api_policy.authenticated_userid.assert_called_once_with(
            api_request)
        assert result == self.api_policy.authenticated_userid.return_value

    def test_unauthenticated_userid_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.unauthenticated_userid(nonapi_request)

        self.fallback_policy.unauthenticated_userid.assert_called_once_with(
            nonapi_request)
        assert result == self.fallback_policy.unauthenticated_userid.return_value

    def test_unauthenticated_userid_uses_api_policy_for_api_paths(
            self, api_request):
        result = self.policy.unauthenticated_userid(api_request)

        self.api_policy.unauthenticated_userid.assert_called_once_with(
            api_request)
        assert result == self.api_policy.unauthenticated_userid.return_value

    def test_effective_principals_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.effective_principals(nonapi_request)

        self.fallback_policy.effective_principals.assert_called_once_with(
            nonapi_request)
        assert result == self.fallback_policy.effective_principals.return_value

    def test_effective_principals_uses_api_policy_for_api_paths(
            self, api_request):
        result = self.policy.effective_principals(api_request)

        self.api_policy.effective_principals.assert_called_once_with(
            api_request)
        assert result == self.api_policy.effective_principals.return_value

    def test_remember_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.remember(nonapi_request, 'foo', bar='baz')

        self.fallback_policy.remember.assert_called_once_with(nonapi_request,
                                                              'foo',
                                                              bar='baz')
        assert result == self.fallback_policy.remember.return_value

    def test_remember_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.remember(api_request, 'foo', bar='baz')

        self.api_policy.remember.assert_called_once_with(api_request,
                                                         'foo',
                                                         bar='baz')
        assert result == self.api_policy.remember.return_value

    def test_forget_uses_fallback_policy_for_nonapi_paths(
            self, nonapi_request):
        result = self.policy.forget(nonapi_request)

        self.fallback_policy.forget.assert_called_once_with(nonapi_request)
        assert result == self.fallback_policy.forget.return_value

    def test_forget_uses_api_policy_for_api_paths(self, api_request):
        result = self.policy.forget(api_request)

        self.api_policy.forget.assert_called_once_with(api_request)
        assert result == self.api_policy.forget.return_value
Example #7
0
class TestAuthenticationPolicy(object):

    @pytest.fixture(autouse=True)
    def policy(self):
        self.upstream_policy = mock.Mock(spec_set=SessionAuthenticationPolicy())
        self.policy = AuthenticationPolicy()
        self.policy.session_policy = self.upstream_policy

    # session_request and token_request are parametrized fixtures, which will
    # take on each value in the passed `params` sequence in turn. This is a
    # quick and easy way to generate a named fixture which takes multiple
    # values and can be used by multiple tests.
    @pytest.fixture(params=SESSION_AUTH_PATHS)
    def session_request(self, request):
        return DummyRequest(path=request.param)

    @pytest.fixture(params=TOKEN_AUTH_PATHS)
    def token_request(self, request):
        return DummyRequest(path=request.param)

    def test_authenticated_userid_delegates_for_session_auth_paths(self, session_request):
        result = self.policy.authenticated_userid(session_request)

        self.upstream_policy.authenticated_userid.assert_called_once_with(session_request)
        assert result == self.upstream_policy.authenticated_userid.return_value

    @mock.patch('h.auth.policy.tokens')
    def test_authenticated_userid_uses_tokens_for_token_auth_paths(self, tokens, token_request):
        result = self.policy.authenticated_userid(token_request)

        tokens.authenticated_userid.assert_called_once_with(token_request)
        assert result == tokens.authenticated_userid.return_value

    def test_unauthenticated_userid_delegates_for_session_auth_paths(self, session_request):
        result = self.policy.unauthenticated_userid(session_request)

        self.upstream_policy.unauthenticated_userid.assert_called_once_with(session_request)
        assert result == self.upstream_policy.unauthenticated_userid.return_value

    @mock.patch('h.auth.policy.tokens')
    def test_unauthenticated_userid_uses_tokens_for_token_auth_paths(self, tokens, token_request):
        result = self.policy.unauthenticated_userid(token_request)

        tokens.authenticated_userid.assert_called_once_with(token_request)
        assert result == tokens.authenticated_userid.return_value

    @mock.patch('h.auth.policy.util')
    def test_effective_principals_calls_effective_principals_with_authenticated_userid(self, util, authn_policy):
        authn_policy.authenticated_userid.return_value = 'acct:[email protected]'
        request = DummyRequest()

        result = self.policy.effective_principals(request)

        util.effective_principals.assert_called_once_with('acct:[email protected]', request)
        assert result == util.effective_principals.return_value

    def test_remember_delegates_for_session_auth_paths(self, session_request):
        result = self.policy.remember(session_request, 'foo', bar='baz')

        self.upstream_policy.remember.assert_called_once_with(session_request, 'foo', bar='baz')
        assert result == self.upstream_policy.remember.return_value

    def test_remember_does_nothing_for_token_auth_paths(self, token_request):
        result = self.policy.remember(token_request, 'foo', bar='baz')

        self.upstream_policy.remember.assert_not_called()
        assert result == []

    def test_forget_delegates_for_session_auth_paths(self, session_request):
        result = self.policy.forget(session_request)

        self.upstream_policy.forget.assert_called_once_with(session_request)
        assert result == self.upstream_policy.forget.return_value

    def test_forget_does_nothing_for_token_auth_paths(self, token_request):
        result = self.policy.forget(token_request)

        self.upstream_policy.forget.assert_not_called()
        assert result == []