def get(self, user_id=None, name=None, token_id=None): user = User.get(self.session, user_id, name) if not user: return self.notfound() if (user.name != self.current_user.name) and not self.current_user.user_admin: return self.forbidden() token = UserToken.get(self.session, user=user, id=token_id) return self.render("user-token-disable.html", user=user, token=token)
def post(self, user_id=None, name=None, token_id=None): user = User.get(self.session, user_id, name) if not user: return self.notfound() if (user.name != self.current_user.name) and not self.current_user.user_admin: return self.forbidden() token = UserToken.get(self.session, user=user, id=token_id) token.disable() AuditLog.log( self.session, self.current_user.id, "disable_token", "Disabled token: {}".format(token.name), on_user_id=user.id, ) self.session.commit() return self.render("user-token-disabled.html", token=token)
def test_usertokens(standard_graph, session, users, groups, permissions): # noqa user = users["*****@*****.**"] assert len(user.tokens) == 0 tok, secret = UserToken( user=user, name="Foo" ).add(session) assert len(user.tokens) == 1 assert tok.check_secret(secret) assert tok.check_secret("invalid") == False assert tok.enabled == True tok.disable() assert tok.enabled == False assert user.tokens[0].enabled == False assert UserToken.get(session, name="Foo", user=user).enabled == False assert tok.check_secret(secret) == False
def test_usertokens(users, session, http_client, base_url): user = users["*****@*****.**"] tok, secret = UserToken( user=user, name="Foo" ).add(session) session.commit() api_url = url(base_url, '/token/validate') # Completely bogus input resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': 'invalid'})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 1 valid_token = str(tok) + ":" + secret # Valid token resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': valid_token})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "ok" assert body["data"]["identity"] == str(tok) assert body["data"]["owner"] == user.username assert body["data"]["act_as_owner"] assert body["data"]["valid"] # Token with the last character changed to something invalid bad_char = "1" if secret[-1].isalpha() else "a" token_with_bad_secret = str(tok) + ":" + secret[:-1] + bad_char resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_secret})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 4 # Token with the token name frobbed to be something invalid token_with_bad_name = str(tok) + "z:" + secret resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_name})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 2 # Token with the user frobbed to be something invalid token_with_bad_user = "******" + str(tok) + ":" + secret resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_bad_user})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 2 # Token with the user changed to another valid, but wrong user token_with_wrong_user = "******" + tok.name + ":" + secret resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': token_with_wrong_user})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 2 # Disabled, but otherwise valid token tok.disable() session.commit() resp = yield http_client.fetch(api_url, method="POST", body=urlencode({'token': valid_token})) body = json.loads(resp.body) assert resp.code == 200 assert body["status"] == "error" assert len(body["errors"]) == 1 assert body["errors"][0]["code"] == 3