def test_url_repr():
assert (repr(validate.URL(relative=False, error=None)) ==
'<URL(relative=False, error={!r})>'.format('Not a valid URL.'))
assert (repr(validate.URL(
relative=True,
error='foo')) == '<URL(relative=True, error={!r})>'.format('foo'))
def test_url_dont_require_tld_invalid(invalid_url):
validator = validate.URL(require_tld=False)
with pytest.raises(ValidationError):
validator(invalid_url)
def test_url_custom_message():
validator = validate.URL(error="{input} ain't an URL")
with pytest.raises(ValidationError) as excinfo:
validator('invalid')
assert "invalid ain't an URL" in str(excinfo)
class UserSchema(ma.ModelSchema):
class Meta:
model = Users
include_fk = True
dump_only = ("id", "created")
load_only = ("password", )
name = field_for(
Users,
"name",
required=True,
validate=[
validate.Length(min=1,
max=128,
error="User names must not be empty")
],
)
website = field_for(
Users,
"website",
validate=[
# This is a dirty hack to let website accept empty strings so you can remove your website
lambda website: validate.URL(
error=
"Websites must be a proper URL starting with http or https",
schemes={"http", "https"},
)(website) if website else True
],
)
country = field_for(Users, "country", validate=[validate_country_code])
password = field_for(Users, "password")
@pre_load
def validate_name(self, data):
name = data.get("name")
if name is None:
return
existing_user = Users.query.filter_by(name=name).first()
current_user = get_current_user()
if is_admin():
user_id = data.get("id")
if user_id:
if existing_user and existing_user.id != user_id:
raise ValidationError("User name has already been taken",
field_names=["name"])
else:
if existing_user:
if current_user:
if current_user.id != existing_user.id:
raise ValidationError(
"User name has already been taken",
field_names=["name"])
else:
raise ValidationError(
"User name has already been taken",
field_names=["name"])
else:
if name == current_user.name:
return data
else:
name_changes = get_config("name_changes", default=True)
if bool(name_changes) is False:
raise ValidationError("Name changes are disabled",
field_names=["name"])
if existing_user:
raise ValidationError("User name has already been taken",
field_names=["name"])
@pre_load
def validate_password_confirmation(self, data):
password = data.get("password")
confirm = data.get("confirm")
target_user = get_current_user()
if is_admin():
pass
else:
if password and (bool(confirm) is False):
raise ValidationError("Please confirm your current password",
field_names=["confirm"])
if password and confirm:
test = verify_password(plaintext=confirm,
ciphertext=target_user.password)
if test is True:
return data
else:
raise ValidationError(
"Your previous password is incorrect",
field_names=["confirm"])
else:
data.pop("password", None)
data.pop("confirm", None)
views = {
"user": [
"website",
"name",
"country",
"affiliation",
"bracket",
"id",
],
"self": [
"website",
"name",
"country",
"affiliation",
"bracket",
"id",
"password",
],
"admin": [
"website",
"name",
"created",
"country",
"banned",
"affiliation",
"secret",
"bracket",
"hidden",
"id",
"password",
"type",
"verified",
],
}
def __init__(self, view=None, *args, **kwargs):
if view:
if isinstance(view, string_types):
kwargs["only"] = self.views[view]
elif isinstance(view, list):
kwargs["only"] = view
super(UserSchema, self).__init__(*args, **kwargs)
def test_url_dont_require_tld_valid(valid_url):
validator = validate.URL(require_tld=False)
assert validator(valid_url) == valid_url
def test_url_relative_valid(valid_url):
validator = validate.URL(relative=True)
assert validator(valid_url) == valid_url
def test_url_relative_invalid(invalid_url):
validator = validate.URL(relative=True)
with pytest.raises(ValidationError):
validator(invalid_url)
def test_url_absolute_valid(valid_url):
validator = validate.URL(relative=False)
assert validator(valid_url) == valid_url
def test_url_absolute_invalid(invalid_url):
validator = validate.URL(relative=False)
with pytest.raises(ValidationError):
validator(invalid_url)
def _validated(self, value):
if value is None:
return None
return validate.URL(
relative=self.relative, error=self.error_messages["invalid"]
)(value)
def test_url_custom_message():
validator = validate.URL(error="{input} ain't an URL")
with pytest.raises(ValidationError, match="invalid ain't an URL"):
validator("invalid")
class UserSchema(ma.ModelSchema):
class Meta:
model = Users
include_fk = True
dump_only = ("id", "oauth_id", "created")
load_only = ("password", )
name = field_for(
Users,
"name",
required=True,
allow_none=False,
validate=[
validate.Length(
min=1,
max=128,
error="Поле имя пользователя не должно быть пустым")
],
)
email = field_for(
Users,
"email",
allow_none=False,
validate=[
validate.Email(
"Электронная почта должна быть в правильном формате"),
validate.Length(min=1,
max=128,
error="Поле Email не должно быть пустым"),
],
)
website = field_for(
Users,
"website",
validate=[
# This is a dirty hack to let website accept empty strings so you can remove your website
lambda website: validate.URL(
error=
"Сайты должны иметь правильный URL, начинающийся с http или https",
schemes={"http", "https"},
)(website) if website else True
],
)
country = field_for(Users, "country", validate=[validate_country_code])
password = field_for(Users, "password")
fields = Nested(UserFieldEntriesSchema,
partial=True,
many=True,
attribute="field_entries")
@pre_load
def validate_name(self, data):
name = data.get("name")
if name is None:
return
name = name.strip()
existing_user = Users.query.filter_by(name=name).first()
current_user = get_current_user()
if is_admin():
user_id = data.get("id")
if user_id:
if existing_user and existing_user.id != user_id:
raise ValidationError("Имя пользователя уже занято",
field_names=["name"])
else:
if existing_user:
if current_user:
if current_user.id != existing_user.id:
raise ValidationError(
"Имя пользователя уже занято",
field_names=["name"])
else:
raise ValidationError("Имя пользователя уже занято",
field_names=["name"])
else:
if name == current_user.name:
return data
else:
name_changes = get_config("name_changes", default=True)
if bool(name_changes) is False:
raise ValidationError("Изменение имени отключено",
field_names=["name"])
if existing_user:
raise ValidationError("Имя пользователя уже занято",
field_names=["name"])
@pre_load
def validate_email(self, data):
email = data.get("email")
if email is None:
return
email = email.strip()
existing_user = Users.query.filter_by(email=email).first()
current_user = get_current_user()
if is_admin():
user_id = data.get("id")
if user_id:
if existing_user and existing_user.id != user_id:
raise ValidationError(
"Электронный адрес уже использовался",
field_names=["email"])
else:
if existing_user:
if current_user:
if current_user.id != existing_user.id:
raise ValidationError(
"Электронный адрес уже использовался",
field_names=["email"],
)
else:
raise ValidationError(
"Электронный адрес уже использовался",
field_names=["email"])
else:
if email == current_user.email:
return data
else:
confirm = data.get("confirm")
if bool(confirm) is False:
raise ValidationError(
"Пожалуйста, подтвердите ваш текущий пароль",
field_names=["confirm"])
test = verify_password(plaintext=confirm,
ciphertext=current_user.password)
if test is False:
raise ValidationError("Введенный текущий пароль неверен",
field_names=["confirm"])
if existing_user:
raise ValidationError(
"Электронный адрес уже использовался",
field_names=["email"])
if check_email_is_whitelisted(email) is False:
raise ValidationError(
"Только адреса электронной почты в домене {domain} могут регистрироваться"
.format(domains=get_config("domain_whitelist")),
field_names=["email"],
)
if get_config("verify_emails"):
current_user.verified = False
@pre_load
def validate_password_confirmation(self, data):
password = data.get("password")
confirm = data.get("confirm")
target_user = get_current_user()
if is_admin():
pass
else:
if password and (bool(confirm) is False):
raise ValidationError(
"Пожалуйста, подтвердите ваш текущий пароль",
field_names=["confirm"])
if password and confirm:
test = verify_password(plaintext=confirm,
ciphertext=target_user.password)
if test is True:
return data
else:
raise ValidationError("Введенный текущий пароль неверен",
field_names=["confirm"])
else:
data.pop("password", None)
data.pop("confirm", None)
@pre_load
def validate_fields(self, data):
"""
This validator is used to only allow users to update the field entry for their user.
It's not possible to exclude it because without the PK Marshmallow cannot load the right instance
"""
fields = data.get("fields")
if fields is None:
return
current_user = get_current_user()
if is_admin():
user_id = data.get("id")
if user_id:
target_user = Users.query.filter_by(id=data["id"]).first()
else:
target_user = current_user
# We are editting an existing user
if self.view == "admin" and self.instance:
target_user = self.instance
provided_ids = []
for f in fields:
f.pop("id", None)
field_id = f.get("field_id")
# # Check that we have an existing field for this. May be unnecessary b/c the foriegn key should enforce
field = UserFields.query.filter_by(
id=field_id).first_or_404()
# Get the existing field entry if one exists
entry = UserFieldEntries.query.filter_by(
field_id=field.id, user_id=target_user.id).first()
if entry:
f["id"] = entry.id
provided_ids.append(entry.id)
# Extremely dirty hack to prevent deleting previously provided data.
# This needs a better soln.
entries = (UserFieldEntries.query.options(
load_only("id")).filter_by(user_id=target_user.id).all())
for entry in entries:
if entry.id not in provided_ids:
fields.append({"id": entry.id})
else:
provided_ids = []
for f in fields:
# Remove any existing set
f.pop("id", None)
field_id = f.get("field_id")
value = f.get("value")
# # Check that we have an existing field for this. May be unnecessary b/c the foriegn key should enforce
field = UserFields.query.filter_by(id=field_id).first_or_404()
if field.required is True and value.strip() == "":
raise ValidationError(f"Field '{field.name}' is required",
field_names=["fields"])
if field.editable is False:
raise ValidationError(
f"Field '{field.name}' cannot be editted",
field_names=["fields"],
)
# Get the existing field entry if one exists
entry = UserFieldEntries.query.filter_by(
field_id=field.id, user_id=current_user.id).first()
if entry:
f["id"] = entry.id
provided_ids.append(entry.id)
# Extremely dirty hack to prevent deleting previously provided data.
# This needs a better soln.
entries = (UserFieldEntries.query.options(
load_only("id")).filter_by(user_id=current_user.id).all())
for entry in entries:
if entry.id not in provided_ids:
fields.append({"id": entry.id})
@post_dump
def process_fields(self, data):
"""
Handle permissions levels for fields.
This is post_dump to manipulate JSON instead of the raw db object
Admins can see all fields.
Users (self) can see their edittable and public fields
Public (user) can only see public fields
"""
# Gather all possible fields
removed_field_ids = []
fields = UserFields.query.all()
# Select fields for removal based on current view and properties of the field
for field in fields:
if self.view == "user":
if field.public is False:
removed_field_ids.append(field.id)
elif self.view == "self":
if field.editable is False and field.public is False:
removed_field_ids.append(field.id)
# Rebuild fuilds
fields = data.get("fields")
if fields:
data["fields"] = [
field for field in fields
if field["field_id"] not in removed_field_ids
]
views = {
"user": [
"website",
"name",
"country",
"affiliation",
"bracket",
"id",
"oauth_id",
"fields",
],
"self": [
"website",
"name",
"email",
"country",
"affiliation",
"bracket",
"id",
"oauth_id",
"password",
"fields",
],
"admin": [
"website",
"name",
"created",
"country",
"banned",
"email",
"affiliation",
"secret",
"bracket",
"hidden",
"id",
"oauth_id",
"password",
"type",
"verified",
"fields",
],
}
def __init__(self, view=None, *args, **kwargs):
if view:
if isinstance(view, string_types):
kwargs["only"] = self.views[view]
elif isinstance(view, list):
kwargs["only"] = view
self.view = view
super(UserSchema, self).__init__(*args, **kwargs)
class TeamSchema(ma.ModelSchema):
class Meta:
model = Teams
include_fk = True
dump_only = ("id", "oauth_id", "created", "members")
load_only = ("password",)
name = field_for(
Teams,
"name",
required=True,
validate=[
validate.Length(min=1, max=128, error="Team names must not be empty")
],
)
email = field_for(
Teams,
"email",
validate=validate.Email("Emails must be a properly formatted email address"),
)
website = field_for(
Teams,
"website",
validate=[
# This is a dirty hack to let website accept empty strings so you can remove your website
lambda website: validate.URL(
error="Websites must be a proper URL starting with http or https",
schemes={"http", "https"},
)(website)
if website
else True
],
)
country = field_for(Teams, "country", validate=[validate_country_code])
@pre_load
def validate_name(self, data):
name = data.get("name")
if name is None:
return
existing_team = Teams.query.filter_by(name=name).first()
current_team = get_current_team()
# Admins should be able to patch anyone but they cannot cause a collision.
if is_admin():
team_id = int(data.get("id", 0))
if team_id:
if existing_team and existing_team.id != team_id:
raise ValidationError(
"Team name has already been taken", field_names=["name"]
)
else:
# If there's no Team ID it means that the admin is creating a team with no ID.
if existing_team:
if current_team:
if current_team.id != existing_team.id:
raise ValidationError(
"Team name has already been taken", field_names=["name"]
)
else:
raise ValidationError(
"Team name has already been taken", field_names=["name"]
)
else:
# We need to allow teams to edit themselves and allow the "conflict"
if data["name"] == current_team.name:
return data
else:
name_changes = get_config("name_changes", default=True)
if bool(name_changes) is False:
raise ValidationError(
"Name changes are disabled", field_names=["name"]
)
if existing_team:
raise ValidationError(
"Team name has already been taken", field_names=["name"]
)
@pre_load
def validate_email(self, data):
email = data.get("email")
if email is None:
return
existing_team = Teams.query.filter_by(email=email).first()
if is_admin():
team_id = data.get("id")
if team_id:
if existing_team and existing_team.id != team_id:
raise ValidationError(
"Email address has already been used", field_names=["email"]
)
else:
if existing_team:
raise ValidationError(
"Email address has already been used", field_names=["email"]
)
else:
current_team = get_current_team()
if email == current_team.email:
return data
else:
if existing_team:
raise ValidationError(
"Email address has already been used", field_names=["email"]
)
@pre_load
def validate_password_confirmation(self, data):
password = data.get("password")
confirm = data.get("confirm")
if is_admin():
pass
else:
current_team = get_current_team()
current_user = get_current_user()
if current_team.captain_id != current_user.id:
raise ValidationError(
"Only the captain can change the team password",
field_names=["captain_id"],
)
if password and (bool(confirm) is False):
raise ValidationError(
"Please confirm your current password", field_names=["confirm"]
)
if password and confirm:
test = verify_password(
plaintext=confirm, ciphertext=current_team.password
)
if test is True:
return data
else:
raise ValidationError(
"Your previous password is incorrect", field_names=["confirm"]
)
else:
data.pop("password", None)
data.pop("confirm", None)
@pre_load
def validate_captain_id(self, data):
captain_id = data.get("captain_id")
if captain_id is None:
return
if is_admin():
team_id = data.get("id")
if team_id:
target_team = Teams.query.filter_by(id=team_id).first()
else:
target_team = get_current_team()
captain = Users.query.filter_by(id=captain_id).first()
if captain in target_team.members:
return
else:
raise ValidationError("Invalid Captain ID", field_names=["captain_id"])
else:
current_team = get_current_team()
current_user = get_current_user()
if current_team.captain_id == current_user.id:
return
else:
raise ValidationError(
"Only the captain can change team captain",
field_names=["captain_id"],
)
views = {
"user": [
"website",
"name",
"country",
"affiliation",
"bracket",
"members",
"id",
"oauth_id",
"captain_id",
],
"self": [
"website",
"name",
"email",
"country",
"affiliation",
"bracket",
"members",
"id",
"oauth_id",
"password",
"captain_id",
],
"admin": [
"website",
"name",
"created",
"country",
"banned",
"email",
"affiliation",
"secret",
"bracket",
"members",
"hidden",
"id",
"oauth_id",
"password",
"captain_id",
],
}
def __init__(self, view=None, *args, **kwargs):
if view:
if isinstance(view, string_types):
kwargs["only"] = self.views[view]
elif isinstance(view, list):
kwargs["only"] = view
super(TeamSchema, self).__init__(*args, **kwargs)
class TeamSchema(ma.ModelSchema):
class Meta:
model = Teams
include_fk = True
dump_only = ('id', 'oauth_id', 'created', 'members')
load_only = ('password', )
name = field_for(Teams,
'name',
required=True,
validate=[
validate.Length(min=1,
max=128,
error='Team names must not be empty')
])
email = field_for(Teams,
'email',
validate=validate.Email(
'Emails must be a properly formatted email address'))
website = field_for(
Teams,
'website',
validate=validate.URL(
error='Websites must be a proper URL starting with http or https',
schemes={'http', 'https'}))
country = field_for(Teams, 'country', validate=[validate_country_code])
@pre_load
def validate_name(self, data):
name = data.get('name')
if name is None:
return
existing_team = Teams.query.filter_by(name=name).first()
# Admins should be able to patch anyone but they cannot cause a collision.
if is_admin():
team_id = int(data.get('id', 0))
if team_id:
if existing_team and existing_team.id != team_id:
raise ValidationError('Team name has already been taken',
field_names=['name'])
else:
# If there's no Team ID it means that the admin is creating a team with no ID.
if existing_team:
raise ValidationError('Team name has already been taken',
field_names=['name'])
else:
current_team = get_current_team()
# We need to allow teams to edit themselves and allow the "conflict"
if data['name'] == current_team.name:
return data
else:
name_changes = get_config('name_changes', default=True)
if bool(name_changes) is False:
raise ValidationError('Name changes are disabled',
field_names=['name'])
if existing_team:
raise ValidationError('Team name has already been taken',
field_names=['name'])
@pre_load
def validate_email(self, data):
email = data.get('email')
if email is None:
return
existing_team = Teams.query.filter_by(email=email).first()
if is_admin():
team_id = data.get('id')
if team_id:
if existing_team and existing_team.id != team_id:
raise ValidationError(
'Email address has already been used',
field_names=['email'])
else:
if existing_team:
raise ValidationError(
'Email address has already been used',
field_names=['email'])
else:
current_team = get_current_team()
if email == current_team.email:
return data
else:
if existing_team:
raise ValidationError(
'Email address has already been used',
field_names=['email'])
@pre_load
def validate_password_confirmation(self, data):
password = data.get('password')
confirm = data.get('confirm')
target_team = get_current_team()
if is_admin():
pass
else:
if password and (confirm is None):
raise ValidationError('Please confirm your current password',
field_names=['confirm'])
if password and confirm:
test = verify_password(plaintext=confirm,
ciphertext=target_team.password)
if test is True:
return data
else:
raise ValidationError(
'Your previous password is incorrect',
field_names=['confirm'])
views = {
'user': [
'website',
'name',
'country',
'affiliation',
'bracket',
'members',
'id',
'oauth_id',
],
'self': [
'website', 'name', 'email', 'country', 'affiliation', 'bracket',
'members', 'id', 'oauth_id', 'password'
],
'admin': [
'website', 'name', 'created', 'country', 'banned', 'email',
'affiliation', 'secret', 'bracket', 'members', 'hidden', 'id',
'oauth_id', 'password'
]
}
def __init__(self, view=None, *args, **kwargs):
if view:
if isinstance(view, string_types):
kwargs['only'] = self.views[view]
elif isinstance(view, list):
kwargs['only'] = view
super(TeamSchema, self).__init__(*args, **kwargs)
def _valid_url(error_msg):
"""Returns a URL validation rule with custom error message."""
return validate.URL(error=error_msg)
def _validated(self, value):
if value is None:
return None
return validate.URL(relative=self.relative,
error=getattr(self, 'error'))(value)
