def test_is_valid_fails_invalid_return_by(self):
jwt = {
"user_id": "1",
"form_type": "a",
"collection_exercise_sid": "test-sid",
"eq_id": "2",
"period_id": "3",
"period_str": "2016-01-01",
"ref_p_start_date": "2016-12-31",
"ref_p_end_date": "2016-03-31",
"ru_ref": "2016-04-04",
"ru_name": "Apple",
"return_by": "2016-09-31"
}
valid, _ = is_valid_metadata(jwt)
self.assertTrue(valid)
with self.assertRaises(InvalidTokenException) as ite:
parse_metadata(jwt)
self.assertIn("incorrect data in token", ite.exception.value)
def test_malformed_tx_id(self):
jwt = {
"user_id": "1",
"form_type": "a",
"collection_exercise_sid": "test-sid",
"eq_id": "2",
"period_id": "3",
"period_str": "2016-01-01",
"ref_p_start_date": "2016-02-02",
"ref_p_end_date": "2016-03-03",
"ru_ref": "2016-04-04",
"ru_name": "Apple",
"return_by": "2016-07-07",
# one character short
"tx_id": "83a3db82-bea7-403c-a411-6357ff70f2f"
}
valid, _ = is_valid_metadata(jwt)
self.assertTrue(valid)
with self.assertRaises(InvalidTokenException) as ite:
parse_metadata(jwt)
self.assertIn("incorrect data in token", ite.exception.value)
def setUp(self):
super().setUp()
self.jwt = {
"user_id": "1",
"form_type": "a",
"collection_exercise_sid": "test-sid",
"eq_id": "2",
"period_id": "3",
"period_str": "2016-01-01",
"ref_p_start_date": "2016-02-02",
"ref_p_end_date": "2016-03-03",
"ru_ref": "2016-04-04",
"ru_name": "Apple",
"return_by": "2016-07-07",
"tx_id": "4ec3aa9e-e8ac-4c8d-9793-6ed88b957c2f"
}
with self.application.test_request_context():
self.metadata = parse_metadata(self.jwt)
def login():
"""
Initial url processing - expects a token parameter and then will authenticate this token. Once authenticated
it will be placed in the users session
:return: a 302 redirect to the next location for the user
"""
decrypted_token = decrypt_token(request.args.get('token'))
metadata = parse_metadata(decrypted_token)
eq_id = metadata["eq_id"]
form_type = metadata["form_type"]
tx_id = metadata["tx_id"]
ru_ref = metadata["ru_ref"]
logger.bind(eq_id=eq_id, form_type=form_type, tx_id=tx_id, ru_ref=ru_ref)
logger.info("decrypted token and parsed metadata")
if not eq_id or not form_type:
logger.error("missing eq id or form type in jwt")
raise NotFound
# logging in again clears any session state
if session:
session.clear()
jti_claim = metadata.get('jti')
if jti_claim is None:
logger.debug('jti claim not provided')
else:
try:
jti_claim_storage = JtiClaimStorage(current_app.eq['database'])
jti_claim_storage.use_jti_claim(jti_claim)
except JtiTokenUsed as e:
raise Unauthorized from e
store_session(metadata)
json = load_schema_from_metadata(metadata)
navigator = PathFinder(json, get_answer_store(current_user), metadata)
current_location = navigator.get_latest_location(get_completed_blocks(current_user))
return redirect(current_location.url(metadata))
