def test_get_all_failed_login_attempts_by_user(db, user):
"""Get all failed login attempts for a specific user."""
failed_login_attempt = FailedLoginAttempt(user.email, '127.0.0.1')
failed_login_attempt.save()
other_failed_login_attempt = FailedLoginAttempt('foo', '127.0.0.1')
other_failed_login_attempt.save()
attempts = FailedLoginAttempt.get_all_by_user(user)
assert other_failed_login_attempt not in attempts
assert [failed_login_attempt] == attempts
def test_delete_all_failed_login_attempts_by_user(db, user):
"""Delete all failed login attempts for a specific user."""
failed_login_attempt = FailedLoginAttempt(user.email, '127.0.0.1')
failed_login_attempt.save()
other_failed_login_attempt = FailedLoginAttempt('foo', '127.0.0.1')
other_failed_login_attempt.save()
FailedLoginAttempt.delete_all_by_user(user)
db.session.commit()
attempts = FailedLoginAttempt.query.all()
assert failed_login_attempt not in attempts
assert [other_failed_login_attempt] == attempts
def test_login_attempt_purge():
"""Test purging login attempts for username/IP combo."""
foo_login_attempt = FailedLoginAttempt('foo', '127.0.0.1')
foo_login_attempt.save()
bar_login_attempt = FailedLoginAttempt('bar', '127.0.0.1')
bar_login_attempt.save()
attempts = FailedLoginAttempt.query.all()
assert len(attempts) == 2
FailedLoginAttempt.purge_failed_for_username_and_ip('foo', '127.0.0.1')
attempts = FailedLoginAttempt.query.all()
assert len(attempts) == 1
assert bar_login_attempt in attempts
def test_login_attempt_purge(superuser):
"""Test purging login attempts for username/IP combo."""
user = User('*****@*****.**', 'Foo fooson')
user.save_as(superuser)
foo_login_attempt = FailedLoginAttempt('*****@*****.**', '127.0.0.1')
foo_login_attempt.save()
bar_login_attempt = FailedLoginAttempt('bar', '127.0.0.1')
bar_login_attempt.save()
attempts = FailedLoginAttempt.query.all()
assert len(attempts) == 2
user.update_last_login_internal(commit=True, remote_address='127.0.0.1')
attempts = FailedLoginAttempt.query.all()
assert len(attempts) == 1
assert bar_login_attempt in attempts
def test_login_attempt_too_many_recent_failures(app):
"""Ensure login attempt is not allowed after too many failed attempts."""
username = '******'
remote_addr = '127.0.0.1'
app.config['XL_AUTH_FAILED_LOGIN_MAX_ATTEMPTS'] = 1
app.config['XL_AUTH_FAILED_LOGIN_TIMEFRAME'] = 5 * 60
assert FailedLoginAttempt.too_many_recent_failures_for(username) is False
login_attempt = FailedLoginAttempt(username, remote_addr)
login_attempt.save()
assert FailedLoginAttempt.too_many_recent_failures_for(username) is True
login_attempt.created_at = datetime.utcnow() - timedelta(seconds=10 * 60)
login_attempt.save()
assert FailedLoginAttempt.too_many_recent_failures_for(username) is False