def test_oauth(monkeypatch, client, db, serving_app):
monkeypatch.setattr('frost.github.BASE_URL', serving_app.url)
monkeypatch.setattr('frost.github.API_URL', serving_app.url + '/api')
@serving_app.route('/login/oauth/access_token', methods=['POST'])
def access_token():
return flask.jsonify({'access_token': flask.request.args['code']})
@serving_app.route('/api/user')
def user():
return flask.jsonify({'login': '******'})
sid = 'noauth'
client.set_cookie('localhost', 'session', 'noauth')
rv = client.get('/oauth?state=somecsrf&code=mycode&next=/abc')
assert rv.headers.get('Location') == 'http://localhost/abc'
sid = rv.headers['Set-Cookie'][8:72]
for u in ('', 'abc', 'http://abc', 'http:///abc', 'http://localhost/abc'):
csrf = db.hget('session:{0}'.format(sid), 'csrf').decode()
url = '/oauth?state={0}&code=mycode'.format(csrf)
if u:
url += '&next=' + u
client.set_cookie('localhost', 'session', sid)
rv = client.get(url)
sid = rv.headers['Set-Cookie'][8:72]
assert rv.headers.get('Location') == 'http://localhost/'
assert 'session=noauth' not in rv.headers['Set-Cookie']
assert db.hget('session:{0}'.format(sid), 'user') == b'someuser'
assert db.hget('session:{0}'.format(sid), 'csrf') != b'somecsrf'
assert frost.model.user_exists('someuser')
def test_store_session(db):
expire = datetime.timedelta(0, 10)
frost.model.store_session_data('somekey', {'csrf': 'mycsrf'}, expire, None)
frost.model.store_session_data('noauth', {'csrf': 'thecsrf'}, expire, None)
assert db.hget('session:somekey', 'csrf') == b'mycsrf'
assert db.hget('session:noauth', 'csrf') == b'thecsrf'
def test_oauth_existing(monkeypatch, client, db, serving_app):
monkeypatch.setattr('frost.github.BASE_URL', serving_app.url)
monkeypatch.setattr('frost.github.API_URL', serving_app.url + '/api')
@serving_app.route('/login/oauth/access_token', methods=['POST'])
def access_token():
return flask.jsonify({'access_token': flask.request.args['code']})
@serving_app.route('/api/user')
def user():
return flask.jsonify({'login': '******'})
client.set_cookie('localhost', 'session', 'noauth')
rv = client.get('/oauth?state=somecsrf&code=mycode')
assert rv.headers.get('Location') == 'http://localhost/'
sid = rv.headers['Set-Cookie'][8:72]
assert db.hget('session:{0}'.format(sid), 'user') == b'nickfrostatx'
assert db.hget('session:{0}'.format(sid), 'csrf') != b'somecsrf'
def test_create_user(db):
frost.model.create_user('nickfrostatx', 't')
assert db.hget('user:nickfrostatx', 'access_token') == b't'
