Exemplo n.º 1
0
 def test_extra_fields(self):
     db = DAL("sqlite:memory")
     self.auth = Auth(self.session,
                      db,
                      define_tables=True,
                      extra_fields=[Field('favorite_color')])
     self.on_request()
     self.assertEqual(type(db.auth_user.favorite_color), Field)
Exemplo n.º 2
0
 def setUp(self):
     os.environ['PY4WEB_APPS_FOLDER'] = 'apps'
     self.db = DAL('sqlite:memory')
     self.session = Session(secret="a", expiration=10)
     self.session.local.data = {}
     self.auth = Auth(self.session, self.db, define_tables=True)
     self.auth.enable()
     request.app_name = '_scaffold'
Exemplo n.º 3
0
 def setUp(self):
     os.environ["PY4WEB_APPS_FOLDER"] = "apps"
     self.db = DAL("sqlite:memory")
     self.session = Session(secret="a", expiration=10)
     self.session.local.data = {}
     self.auth = Auth(self.session, self.db, define_tables=True, password_complexity=None)
     self.auth.enable()
     request.app_name = "_scaffold"
Exemplo n.º 4
0
 def test_extra_fields(self):
     self.db = DAL("sqlite:memory")
     self.session = Session(secret="a", expiration=10)
     self.session.local.data = {}
     self.auth = Auth(self.session,
                      self.db,
                      define_tables=True,
                      extra_fields=[Field('favorite_color')])
     self.assertEqual(type(self.db.auth_user.favorite_color), Field)
Exemplo n.º 5
0
 def setUp(self):
     os.environ["PY4WEB_APPS_FOLDER"] = "apps"
     _before_request()  # mimic before_request bottle-hook
     self.db = DAL("sqlite:memory")
     self.session = Session(secret="a", expiration=10)
     self.session.initialize()
     self.auth = Auth(self.session,
                      self.db,
                      define_tables=True,
                      password_complexity=None)
     self.auth.enable()
     self.auth.action = self.action
     request.app_name = "_scaffold"
Exemplo n.º 6
0
                if ct(k) >= 0 else cs(k, v, e))
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "memcache":
    import memcache, time

    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "database":
    from py4web.utils.dbstore import DBStore

    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

# #######################################################
# Instantiate the object and actions that handle auth
# #######################################################
auth = Auth(session, db, define_tables=False)
auth.use_username = True
auth.param.registration_requires_confirmation = settings.VERIFY_EMAIL
auth.param.registration_requires_approval = settings.REQUIRES_APPROVAL
auth.param.allowed_actions = settings.ALLOWED_ACTIONS
auth.param.login_expiration_time = 3600
#Ash: Changed from 50
auth.param.password_complexity = {"entropy": 0}
auth.param.block_previous_password_num = 3
auth.define_tables()

# #######################################################
# Configure email sender for auth
# #######################################################
if settings.SMTP_SERVER:
    auth.sender = Mailer(
Exemplo n.º 7
0
    # for more options: https://github.com/andymccurdy/redis-py/blob/master/redis/client.py
    conn = redis.Redis(host=host, port=int(port))
    conn.set = lambda k, v, e, cs=conn.set, ct=conn.ttl: (cs(k, v), e and ct(e)
                                                          )
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == 'memcache':
    import memcache, time
    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == 'database':
    from py4web.utils.dbstore import DBStore
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

auth = Auth(session,
            db,
            registration_requires_confirmation=False,
            password_complexity=False,
            use_username=False)

if auth.db:
    groups = Tags(db.auth_user, 'groups')

if settings.USE_PAM:
    from py4web.utils.auth_plugins.pam_plugin import PamPlugin
    auth.register_plugin(PamPlugin())

if settings.USE_LDAP:
    from py4web.utils.auth_plugins.ldap_plugin import LDAPPlugin
    auth.register_plugin(LDAPPlugin(**settings.LDAP_SETTINGS))

if settings.OAUTH2GOOGLE_CLIENT_ID:
Exemplo n.º 8
0
    # for more options: https://github.com/andymccurdy/redis-py/blob/master/redis/client.py
    conn = redis.Redis(host=host, port=int(port))
    conn.set = lambda k, v, e, cs=conn.set, ct=conn.ttl: cs(k, v, ct(k)) if ct(
        k) >= 0 else cs(k, v, e)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "memcache":
    import memcache, time

    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "database":
    from py4web.utils.dbstore import DBStore

    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

auth = Auth(session, db, password_complexity=settings.PASSWORD_COMPLEXITY)
auth.registration_requires_confirmation = settings.VERIFY_EMAIL

if settings.SMTP_SERVER:
    auth.sender = Mailer(
        server=settings.SMTP_SERVER,
        sender=settings.SMTP_SENDER,
        login=settings.SMTP_LOGIN,
        tls=settings.SMTP_TLS,
    )

if auth.db:
    groups = Tags(db.auth_user, "groups")

if settings.USE_PAM:
    from py4web.utils.auth_plugins.pam_plugin import PamPlugin
Exemplo n.º 9
0
class TestAuth(unittest.TestCase):
    def setUp(self):
        os.environ['PY4WEB_APPS_FOLDER'] = 'apps'
        self.db = DAL('sqlite:memory')
        self.session = Session(secret="a", expiration=10)
        self.session.local.data = {}
        self.auth = Auth(self.session, self.db, define_tables=True)
        self.auth.enable()
        request.app_name = '_scaffold'

    def test_register_invalid(self):
        body = {'email': '*****@*****.**'}
        self.assertEqual(
            self.auth.action('api/register', 'POST', {}, body), {
                'id': None,
                'errors': {
                    'username': '******',
                    'password': '******',
                    'first_name': 'Enter a value',
                    'last_name': 'Enter a value'
                },
                'status': 'error',
                'message': 'validation errors',
                'code': 401
            })

    def test_register(self):
        body = {
            'username': '******',
            'email': '*****@*****.**',
            'password': '******',
            'first_name': 'Pinco',
            'last_name': 'Pallino'
        }
        self.assertEqual(self.auth.action('api/register', 'POST', {}, body), {
            'id': 1,
            'status': 'success',
            'code': 200
        })
        user = self.db.auth_user[1]
        self.assertTrue(user.action_token.startswith('pending-registration'))

        self.assertEqual(self.auth.get_user(), {})

        body = {'email': '*****@*****.**', 'password': '******'}
        self.assertTrue(self.auth.action('api/login', 'POST', {}, body), {
            'status': 'error',
            'message': 'Registration is pending',
            'code': 400
        })

        token = user.action_token[len('pending-registration') + 1:]
        try:
            self.auth.action('verify_email', 'GET', {'token': token}, {})
            assert False, 'email not verified'
        except HTTP:
            pass
        user = self.db.auth_user[1]
        self.assertTrue(user.action_token == None)

        self.assertEqual(self.auth.action('api/login', 'POST', {}, body), {
            'status': 'error',
            'message': 'Invalid Credentials',
            'code': 400
        })

        body = {'email': '*****@*****.**', 'password': '******'}
        self.assertEqual(
            self.auth.action('api/login', 'POST', {}, body), {
                'user': {
                    'id': 1,
                    'username': '******',
                    'email': '*****@*****.**',
                    'first_name': 'Pinco',
                    'last_name': 'Pallino',
                },
                'status': 'success',
                'code': 200
            })

        body = {
            'email': 'ppallino',  # can login with both email and username
            'password': '******'
        }
        self.assertEqual(
            self.auth.action('api/login', 'POST', {}, body), {
                'user': {
                    'id': 1,
                    'username': '******',
                    'email': '*****@*****.**',
                    'first_name': 'Pinco',
                    'last_name': 'Pallino',
                },
                'status': 'success',
                'code': 200
            })

        body = {'email': '*****@*****.**'}
        self.assertEqual(
            self.auth.action('api/request_reset_password', 'POST', {}, body), {
                'status': 'success',
                'code': 200
            })

        body = {'token': 'junk', 'new_password': '******'}
        self.assertTrue(
            self.auth.action('api/reset_password', 'POST', {}, body), {
                'status': 'error',
                'message': 'invalid token, request expired',
                'code': 400
            })

        body = {
            'token': self.auth._link.split('?token=')[1],
            'new_password': '******'
        }
        self.assertTrue(
            self.auth.action('api/reset_password', 'POST', {}, body), {
                'status': 'success',
                'code': 200
            })

        self.assertEqual(
            self.auth.get_user(), {
                'id': 1,
                'username': '******',
                'email': '*****@*****.**',
                'first_name': 'Pinco',
                'last_name': 'Pallino'
            })

        body = {}
        self.assertEqual(
            self.auth.action('api/change_password', 'POST', {}, body), {
                'errors': {
                    'password': '******'
                },
                'status': 'error',
                'message': 'validation errors',
                'code': 401
            })
        body = {'password': '******', 'new_password': '******'}
        self.assertEqual(
            self.auth.action('api/change_password', 'POST', {}, body), {
                'updated': 1,
                'status': 'success',
                'code': 200
            })
        body = {'password': '******', 'new_email': '*****@*****.**'}
        self.assertEqual(
            self.auth.action('api/change_email', 'POST', {}, body), {
                'updated': 1,
                'status': 'success',
                'code': 200
            })
        body = {'first_name': 'Max', 'last_name': 'Powers', 'password': '******'}
        self.assertEqual(
            self.auth.action('api/profile', 'POST', {}, body), {
                'errors': {
                    'password': '******'
                },
                'status': 'error',
                'message': 'validation errors',
                'code': 401
            })

        body = {'first_name': 'Max', 'last_name': 'Powers'}
        self.assertEqual(self.auth.action('api/profile', 'POST', {}, body), {
            'updated': 1,
            'status': 'success',
            'code': 200
        })
Exemplo n.º 10
0
class TestAuth(unittest.TestCase):
    def setUp(self):
        os.environ["PY4WEB_APPS_FOLDER"] = "apps"
        self.db = DAL("sqlite:memory")
        self.session = Session(secret="a", expiration=10)
        self.session.local.data = {}
        self.auth = Auth(self.session, self.db, define_tables=True)
        self.auth.enable()
        request.app_name = "_scaffold"

    def test_register_invalid(self):
        body = {"email": "*****@*****.**"}
        self.assertEqual(
            self.auth.action("api/register", "POST", {}, body),
            {
                "id": None,
                "errors": {
                    "username": "******",
                    "password": "******",
                    "first_name": "Enter a value",
                    "last_name": "Enter a value",
                },
                "status": "error",
                "message": "validation errors",
                "code": 401,
            },
        )

    def test_register(self):
        body = {
            "username": "******",
            "email": "*****@*****.**",
            "password": "******",
            "first_name": "Pinco",
            "last_name": "Pallino",
        }
        self.assertEqual(
            self.auth.action("api/register", "POST", {}, body),
            {
                "id": 1,
                "status": "success",
                "code": 200
            },
        )
        user = self.db.auth_user[1]
        self.assertTrue(user.action_token.startswith("pending-registration"))

        self.assertEqual(self.auth.get_user(), {})

        body = {"email": "*****@*****.**", "password": "******"}
        self.assertTrue(
            self.auth.action("api/login", "POST", {}, body),
            {
                "status": "error",
                "message": "Registration is pending",
                "code": 400
            },
        )

        token = user.action_token[len("pending-registration") + 1:]
        try:
            self.auth.action("verify_email", "GET", {"token": token}, {})
            assert False, "email not verified"
        except HTTP:
            pass
        user = self.db.auth_user[1]
        self.assertTrue(user.action_token == None)

        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "status": "error",
                "message": "Invalid Credentials",
                "code": 400
            },
        )

        body = {"email": "*****@*****.**", "password": "******"}
        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "user": {
                    "id": 1,
                    "username": "******",
                    "email": "*****@*****.**",
                    "first_name": "Pinco",
                    "last_name": "Pallino",
                },
                "status": "success",
                "code": 200,
            },
        )

        body = {
            "email": "ppallino",  # can login with both email and username
            "password": "******",
        }
        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "user": {
                    "id": 1,
                    "username": "******",
                    "email": "*****@*****.**",
                    "first_name": "Pinco",
                    "last_name": "Pallino",
                },
                "status": "success",
                "code": 200,
            },
        )

        body = {"email": "*****@*****.**"}
        self.assertEqual(
            self.auth.action("api/request_reset_password", "POST", {}, body),
            {
                "status": "success",
                "code": 200
            },
        )

        body = {"token": "junk", "new_password": "******"}
        self.assertTrue(
            self.auth.action("api/reset_password", "POST", {}, body),
            {
                "status": "error",
                "message": "invalid token, request expired",
                "code": 400,
            },
        )

        body = {
            "token": self.auth._link.split("?token=")[1],
            "new_password": "******",
        }
        self.assertTrue(
            self.auth.action("api/reset_password", "POST", {}, body),
            {
                "status": "success",
                "code": 200
            },
        )

        self.assertEqual(
            self.auth.get_user(),
            {
                "id": 1,
                "username": "******",
                "email": "*****@*****.**",
                "first_name": "Pinco",
                "last_name": "Pallino",
            },
        )

        body = {}
        self.assertEqual(
            self.auth.action("api/change_password", "POST", {}, body),
            {
                "errors": {
                    "password": "******"
                },
                "status": "error",
                "message": "validation errors",
                "code": 401,
            },
        )
        body = {"password": "******", "new_password": "******"}
        self.assertEqual(
            self.auth.action("api/change_password", "POST", {}, body),
            {
                "updated": 1,
                "status": "success",
                "code": 200
            },
        )
        body = {"password": "******", "new_email": "*****@*****.**"}
        self.assertEqual(
            self.auth.action("api/change_email", "POST", {}, body),
            {
                "updated": 1,
                "status": "success",
                "code": 200
            },
        )
        body = {"first_name": "Max", "last_name": "Powers", "password": "******"}
        self.assertEqual(
            self.auth.action("api/profile", "POST", {}, body),
            {
                "errors": {
                    "password": "******"
                },
                "status": "error",
                "message": "validation errors",
                "code": 401,
            },
        )

        body = {"first_name": "Max", "last_name": "Powers"}
        self.assertEqual(
            self.auth.action("api/profile", "POST", {}, body),
            {
                "updated": 1,
                "status": "success",
                "code": 200
            },
        )
Exemplo n.º 11
0
    # for more options: https://github.com/andymccurdy/redis-py/blob/master/redis/client.py
    conn = redis.Redis(host=host, port=int(port))
    conn.set = lambda k, v, e, cs=conn.set, ct=conn.ttl: (cs(k, v), e and ct(e)
                                                          )
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "memcache":
    import memcache, time

    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "database":
    from py4web.utils.dbstore import DBStore

    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

auth = Auth(session, db)
auth.registration_requires_confirmation = settings.VERIFY_EMAIL
auth.registration_requires_approval = settings.REQUIRES_APPROVAL

if settings.SMTP_SERVER:
    auth.sender = Mailer(
        server=settings.SMTP_SERVER,
        sender=settings.SMTP_SENDER,
        login=settings.SMTP_LOGIN,
        tls=settings.SMTP_TLS,
    )

if auth.db:
    groups = Tags(db.auth_user, "groups")

if settings.USE_PAM:
Exemplo n.º 12
0
    # for more options: https://github.com/andymccurdy/redis-py/blob/master/redis/client.py
    conn = redis.Redis(host=host, port=int(port))
    conn.set = lambda k, v, e, cs=conn.set, ct=conn.ttl: (cs(k, v), e and ct(e)
                                                          )
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "memcache":
    import memcache, time

    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "database":
    from py4web.utils.dbstore import DBStore

    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

auth = Auth(session, db)

if settings.SMTP_SERVER:
    auth.sender = Mailer(
        server=settings.SMTP_SERVER,
        sender=settings.SMTP_SENDER,
        login=settings.SMTP_LOGIN,
        tls=settings.SMTP_TLS,
    )

if auth.db:
    groups = Tags(db.auth_user, "groups")

if settings.USE_PAM:
    from py4web.utils.auth_plugins.pam_plugin import PamPlugin
Exemplo n.º 13
0
elif settings.SESSION_TYPE == "memcache":
    import time

    import memcache

    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "database":
    from py4web.utils.dbstore import DBStore

    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

# #######################################################
# Instantiate the object and actions that handle auth
# #######################################################
auth = Auth(session, db, define_tables=False)
auth.use_username = True
auth.param.registration_requires_confirmation = settings.VERIFY_EMAIL
auth.param.registration_requires_approval = settings.REQUIRES_APPROVAL
auth.allowed_actions = ["all"]
auth.login_expiration_time = 3600
auth.password_complexity = {"entropy": 50}
auth.block_previous_password_num = 3
auth.define_tables()

# #######################################################
# Configure email sender for auth
# #######################################################
if settings.SMTP_SERVER:
    auth.sender = Mailer(
        server=settings.SMTP_SERVER,
Exemplo n.º 14
0
class TestAuth(unittest.TestCase):
    def setUp(self):
        os.environ["PY4WEB_APPS_FOLDER"] = "apps"
        _before_request()  # mimic before_request bottle-hook
        self.db = DAL("sqlite:memory")
        self.session = Session(secret="a", expiration=10)
        self.session.initialize()
        self.auth = Auth(self.session,
                         self.db,
                         define_tables=True,
                         password_complexity=None)
        self.auth.enable()
        self.auth.action = self.action
        request.app_name = "_scaffold"

    def tearDown(self):
        bottle.app.router.remove('/*')

    def action(self, name, method, query, data):
        request.environ['REQUEST_METHOD'] = method
        request.environ['ombott.request.query'] = query
        request.environ['ombott.request.json'] = data
        # we break a symmetry below. should fix in auth.py
        if name.startswith('api/'):
            return getattr(AuthAPI, name[4:])(self.auth)
        else:
            return getattr(self.auth.form_source, name)()

    def on_request(self, keep_session=False):
        storage = self.session._safe_local

        # mimic before_request bottle-hook
        _before_request()

        # mimic action.uses()
        self.session.initialize()
        self.auth.flash.on_request()
        self.auth.on_request()
        if keep_session:
            self.session._safe_local = storage

    def test_extra_fields(self):
        db = DAL("sqlite:memory")
        self.auth = Auth(self.session,
                         db,
                         define_tables=True,
                         extra_fields=[Field('favorite_color')])
        self.on_request()
        self.assertEqual(type(db.auth_user.favorite_color), Field)

    def test_register_invalid(self):
        self.on_request()
        body = {"email": "*****@*****.**"}
        self.assertEqual(
            self.auth.action("api/register", "POST", {}, body),
            {
                "id": None,
                "errors": {
                    "username": "******",
                    "password": "******",
                    "first_name": "Enter a value",
                    "last_name": "Enter a value",
                },
                "status": "error",
                "message": "validation errors",
                "code": 401,
            },
        )

    def test_register(self):
        self.on_request()
        body = {
            "username": "******",
            "email": "*****@*****.**",
            "password": "******",
            "first_name": "Pinco",
            "last_name": "Pallino",
        }
        self.assertEqual(
            self.auth.action("api/register", "POST", {}, body),
            {
                "id": 1,
                "status": "success",
                "code": 200
            },
        )
        user = self.db.auth_user[1]
        self.assertTrue(user.action_token.startswith("pending-registration"))
        self.assertEqual(self.auth.get_user(), {})

        self.on_request()
        body = {"email": "*****@*****.**", "password": "******"}
        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "status": "error",
                "message": "Registration is pending",
                "code": 400
            },
        )

        self.on_request()
        token = user.action_token[len("pending-registration") + 1:]
        try:
            self.auth.action("verify_email", "GET", {"token": token}, {})
            assert False, "email not verified"
        except HTTP:
            pass
        user = self.db.auth_user[1]
        self.assertTrue(user.action_token is None)

        self.on_request()
        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "status": "error",
                "message": "Invalid Credentials",
                "code": 400
            },
        )

        self.on_request()
        body = {"email": "*****@*****.**", "password": "******"}
        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "user": {
                    "id": 1,
                    "username": "******",
                    "email": "*****@*****.**",
                    "first_name": "Pinco",
                    "last_name": "Pallino",
                },
                "status": "success",
                "code": 200,
            },
        )

        self.on_request()
        body = {
            "email": "ppallino",  # can login with both email and username
            "password": "******",
        }
        self.assertEqual(
            self.auth.action("api/login", "POST", {}, body),
            {
                "user": {
                    "id": 1,
                    "username": "******",
                    "email": "*****@*****.**",
                    "first_name": "Pinco",
                    "last_name": "Pallino",
                },
                "status": "success",
                "code": 200,
            },
        )

        self.on_request(keep_session=True)
        body = {"email": "*****@*****.**"}
        self.assertEqual(
            self.auth.action("api/request_reset_password", "POST", {}, body),
            {
                "status": "success",
                "code": 200
            },
        )

        self.on_request(keep_session=True)
        body = {"token": "junk", "new_password": "******"}
        self.assertEqual(
            self.auth.action("api/reset_password", "POST", {}, body),
            {
                "status": "error",
                "message": "validation errors",
                "errors": {
                    "token": "invalid token"
                },
                "code": 401,
            },
        )

        self.on_request(keep_session=True)
        body = {
            "token": self.auth._link.split("?token=")[1],
            "new_password": "******",
            "new_password2": "987654321",
        }
        self.assertEqual(
            self.auth.action("api/reset_password", "POST", {}, body),
            {
                "status": "success",
                "code": 200
            },
        )

        self.assertEqual(
            self.auth.get_user(),
            {
                "id": 1,
                "username": "******",
                "email": "*****@*****.**",
                "first_name": "Pinco",
                "last_name": "Pallino",
            },
        )

        self.on_request(keep_session=True)
        body = {}
        self.assertEqual(
            self.auth.action("api/change_password", "POST", {}, body),
            {
                'errors': {
                    'old_password': '******'
                },
                "status": "error",
                "message": "validation errors",
                "code": 401,
            },
        )

        self.on_request(keep_session=True)
        body = {"old_password": "******", "new_password": "******"}
        self.assertEqual(
            self.auth.action("api/change_password", "POST", {}, body),
            {
                "updated": 1,
                "status": "success",
                "code": 200
            },
        )

        self.on_request(keep_session=True)
        body = {"password": "******", "new_email": "*****@*****.**"}
        self.assertEqual(
            self.auth.action("api/change_email", "POST", {}, body),
            {
                "updated": 1,
                "status": "success",
                "code": 200
            },
        )

        self.on_request(keep_session=True)
        body = {"first_name": "Max", "last_name": "Powers", "password": "******"}
        self.assertEqual(
            self.auth.action("api/profile", "POST", {}, body),
            {
                "errors": {
                    "password": "******"
                },
                "status": "error",
                "message": "validation errors",
                "code": 401,
            },
        )

        self.on_request(keep_session=True)
        body = {"first_name": "Max", "last_name": "Powers"}
        self.assertEqual(
            self.auth.action("api/profile", "POST", {}, body),
            {
                "updated": 1,
                "status": "success",
                "code": 200
            },
        )
Exemplo n.º 15
0
                if ct(k) >= 0 else cs(k, v, e))
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "memcache":
    import memcache, time

    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == "database":
    from py4web.utils.dbstore import DBStore

    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

# #######################################################
# Instantiate the object and actions that handle auth
# #######################################################
auth = Auth(session, db, define_tables=False)
auth.use_username = True
auth.param.registration_requires_confirmation = settings.VERIFY_EMAIL
auth.param.registration_requires_approval = settings.REQUIRES_APPROVAL
auth.param.login_after_registration = settings.LOGIN_AFTER_REGISTRATION
auth.param.allowed_actions = settings.ALLOWED_ACTIONS
auth.param.login_expiration_time = 3600
auth.param.password_complexity = {"entropy": 50}
auth.param.block_previous_password_num = 3
auth.param.default_login_enabled = settings.DEFAULT_LOGIN_ENABLED
#auth.extra_auth_user_fields=[Field('data_consent', 'boolean', default=False, label='I consent to Net Decision Making holding minimal personal'
#                                                         ' information to support operation of this site - it is not shared with 3rd parties',
#                                   requires=IS_NOT_EMPTY(), error_message='You must consent to register'),
auth.extra_auth_user_fields = [
    Field('notify',
          'string',
Exemplo n.º 16
0
    import redis
    host, port = settings.REDIS_SERVER.split(':')
    # for more options: https://github.com/andymccurdy/redis-py/blob/master/redis/client.py
    conn = redis.Redis(host=host, port=int(port))
    conn.set = lambda k, v, e, cs=conn.set, ct=conn.ttl: (cs(k, v), e and ct(e)
                                                          )
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == 'memcache':
    import memcache, time
    conn = memcache.Client(settings.MEMCACHE_CLIENTS, debug=0)
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=conn)
elif settings.SESSION_TYPE == 'database':
    from py4web.utils.dbstore import DBStore
    session = Session(secret=settings.SESSION_SECRET_KEY, storage=DBStore(db))

auth = Auth(session, db)

if auth.db:
    groups = Tags(db.auth_user, 'groups')

if settings.USE_PAM:
    from py4web.utils.auth_plugins.pam_plugin import PamPlugin
    auth.register_plugin(PamPlugin())

if settings.USE_LDAP:
    from py4web.utils.auth_plugins.ldap_plugin import LDAPPlugin
    auth.register_plugin(LDAPPlugin(**settings.LDAP_SETTINGS))

if settings.OAUTH2GOOGLE_CLIENT_ID:
    from py4web.utils.auth_plugins.oauth2google import OAuth2Google  # TESTED
    auth.register_plugin(