def test_authorized_missing_args():
"""Assert that the missing args return False."""
identifier = 'a corp'
jwt = 'fake'
action = 'fake'
rv = authorized(identifier, jwt, None)
assert not rv
rv = authorized(identifier, None, action)
assert not rv
rv = authorized(None, jwt, action)
assert not rv
def test_authorized_invalid_roles(monkeypatch, app, jwt):
"""Assert that an invalid role returns False."""
import flask # noqa: F401; import actually used in mock
# setup
identifier = 'CP1234567'
username = '******'
roles = ['NONE']
token = helper_create_jwt(jwt, roles=roles, username=username)
headers = {'Authorization': 'Bearer ' + token}
def mock_auth(one, two): # pylint: disable=unused-argument; mocks of library methods
return headers['Authorization']
with app.test_request_context():
monkeypatch.setattr('flask.request.headers.get', mock_auth)
rv = authorized(identifier, jwt, ['view'])
assert not rv
def test_authorized_user_integ(monkeypatch, app, jwt,
test_name, identifier, username, roles, allowed_actions, requested_actions, expected):
"""Assert that the type of user authorization is correct, based on the expected outcome."""
import flask # noqa: F401; import actually used in mock
# setup
token = helper_create_jwt(jwt, roles=roles, username=username)
headers = {'Authorization': 'Bearer ' + token}
def mock_auth(one, two): # pylint: disable=unused-argument; mocks of library methods
return headers['Authorization']
with app.test_request_context():
monkeypatch.setattr('flask.request.headers.get', mock_auth)
rv = authorized(identifier, jwt, ['view'])
# check it
if expected == HTTPStatus.OK:
assert rv
else:
assert not rv
def test_authorized_bad_url(monkeypatch, app, jwt):
"""Assert that an invalid auth service URL returns False."""
import flask # noqa: F401; import actually used in mock
# setup
identifier = 'CP1234567'
username = '******'
roles = [BASIC_USER]
token = helper_create_jwt(jwt, roles=roles, username=username)
headers = {'Authorization': 'Bearer ' + token}
def mock_auth(one, two): # pylint: disable=unused-argument; mocks of library methods
return headers['Authorization']
with app.test_request_context():
monkeypatch.setattr('flask.request.headers.get', mock_auth)
auth_svc_url = app.config['AUTH_SVC_URL']
app.config['AUTH_SVC_URL'] = 'http://no.way.this.works/dribble'
rv = authorized(identifier, jwt, ['view'])
app.config['AUTH_SVC_URL'] = auth_svc_url
assert not rv
def get_fake(identifier: str):
if not authorized(identifier, jwt):
return jsonify(message='failed'), HTTPStatus.METHOD_NOT_ALLOWED
return jsonify(message='success'), HTTPStatus.OK