def test_user_login_get(): app = pretend.stub( config=pretend.stub(), db=pretend.stub( accounts=pretend.stub( user_authenticate=pretend.stub(), ), ), templates=pretend.stub( get_template=pretend.call_recorder( lambda t: pretend.stub(render=lambda **ctx: ""), ), ), translations=None, ) request = pretend.stub( method="GET", form=MultiDict(), values={}, _session=Session({}, "1234", False), ) resp = login(app, request) assert resp.status_code == 200 assert app.templates.get_template.calls == [ pretend.call("accounts/login.html"), ]
def test_post_validate_no_redirects(self, pyramid_request, pyramid_services, expected_next_url, observed_next_url): user_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: 1), update_user=lambda *a, **k: None, ) breach_service = pretend.stub( check_password=lambda password, tags=None: False) pyramid_services.register_service(IUserService, None, user_service) pyramid_services.register_service(IPasswordBreachedService, None, breach_service) pyramid_request.method = "POST" pyramid_request.POST["next"] = expected_next_url form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), password=pretend.stub(data="password"), ) form_class = pretend.call_recorder(lambda d, **kw: form_obj) pyramid_request.route_path = pretend.call_recorder( lambda a: "/the-redirect") result = views.login(pyramid_request, _form_class=form_class) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == observed_next_url
def test_post_invalid_returns_form(self, pyramid_request, next_url): user_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context: user_service ) pyramid_request.method = "POST" if next_url is not None: pyramid_request.POST["next"] = next_url form_obj = pretend.stub(validate=pretend.call_recorder(lambda: False)) form_class = pretend.call_recorder(lambda d, user_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert pyramid_request.registry.datadog.increment.calls == [ pretend.call('warehouse.authentication.start', tags=['auth_method:login_form']), pretend.call('warehouse.authentication.failure', tags=['auth_method:login_form']), ] assert result == { "form": form_obj, "redirect": {"field": "next", "data": next_url}, } assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service), ] assert form_obj.validate.calls == [pretend.call()]
def test_redirect_authenticated_user(self): pyramid_request = pretend.stub(authenticated_userid=1) pyramid_request.route_path = pretend.call_recorder( lambda a: "/the-redirect") result = views.login(pyramid_request) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == "/the-redirect"
def test_post_invalid_returns_form(self, pyramid_request, next_url): user_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context: user_service) pyramid_request.method = "POST" if next_url is not None: pyramid_request.POST["next"] = next_url form_obj = pretend.stub(validate=pretend.call_recorder(lambda: False)) form_class = pretend.call_recorder(lambda d, user_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert result == { "form": form_obj, "redirect": { "field": "next", "data": next_url }, } assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service), ] assert form_obj.validate.calls == [pretend.call()]
def test_get_returns_form(self, pyramid_request, next_url): user_service = pretend.stub() breach_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context=None: { IUserService: user_service, IPasswordBreachedService: breach_service, }[iface]) form_obj = pretend.stub() form_class = pretend.call_recorder(lambda d, user_service: form_obj) if next_url is not None: pyramid_request.GET["next"] = next_url result = views.login(pyramid_request, _form_class=form_class) assert result == { "form": form_obj, "redirect": { "field": "next", "data": next_url }, } assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), pretend.call(IPasswordBreachedService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service) ]
def test_get_returns_form(self, pyramid_request, pyramid_services, next_url): user_service = pretend.stub() breach_service = pretend.stub() pyramid_services.register_service(IUserService, None, user_service) pyramid_services.register_service(IPasswordBreachedService, None, breach_service) form_obj = pretend.stub() form_class = pretend.call_recorder(lambda d, **kw: form_obj) if next_url is not None: pyramid_request.GET["next"] = next_url result = views.login(pyramid_request, _form_class=form_class) assert result == { "form": form_obj, "redirect": { "field": "next", "data": next_url }, } assert form_class.calls == [ pretend.call( pyramid_request.POST, request=pyramid_request, user_service=user_service, breach_service=breach_service, check_password_metrics_tags=[ "method:auth", "auth_method:login_form" ], ) ]
def test_user_login_post_valid(app, form, values, session, location): app.db = pretend.stub( accounts=pretend.stub( get_user_id=lambda username: 9001, user_authenticate=lambda user, password: True, ), ) request = pretend.stub( method="POST", form=MultiDict(form), host="example.com", values=values, url_adapter=pretend.stub( build=lambda *a, **kw: "/", ), _session=Session(session, "1234", False), ) resp = login(app, request) assert request.session["user.id"] == 9001 assert resp.status_code == 303 assert resp.headers["Location"] == location assert resp.headers.getlist("Set-Cookie") == ["username=test; Path=/"]
def test_post_invalid_returns_form(self, pyramid_request, pyramid_services, metrics, next_url): user_service = pretend.stub() breach_service = pretend.stub() pyramid_services.register_service(IUserService, None, user_service) pyramid_services.register_service(IPasswordBreachedService, None, breach_service) pyramid_request.method = "POST" if next_url is not None: pyramid_request.POST["next"] = next_url form_obj = pretend.stub(validate=pretend.call_recorder(lambda: False)) form_class = pretend.call_recorder(lambda d, user_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert metrics.increment.calls == [ pretend.call("warehouse.authentication.start", tags=["auth_method:login_form"]), pretend.call("warehouse.authentication.failure", tags=["auth_method:login_form"]), ] assert result == { "form": form_obj, "redirect": { "field": "next", "data": next_url }, } assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service) ] assert form_obj.validate.calls == [pretend.call()]
def test_post_validate_redirects(self, monkeypatch, pyramid_request, with_user): remember = pretend.call_recorder( lambda request, user_id: [("foo", "bar")] ) monkeypatch.setattr(views, "remember", remember) new_session = {} login_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: 1), ) pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service ) pyramid_request.method = "POST" pyramid_request.session = pretend.stub( items=lambda: [("a", "b"), ("foo", "bar")], update=new_session.update, invalidate=pretend.call_recorder(lambda: None), new_csrf_token=pretend.call_recorder(lambda: None), ) pyramid_request.set_property( lambda r: 1234 if with_user else None, name="unauthenticated_userid", ) form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), ) form_class = pretend.call_recorder(lambda d, login_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == "/" assert result.headers["foo"] == "bar" assert form_class.calls == [ pretend.call(pyramid_request.POST, login_service=login_service), ] assert form_obj.validate.calls == [pretend.call()] assert login_service.find_userid.calls == [pretend.call("theuser")] if with_user: assert new_session == {} else: assert new_session == {"a": "b", "foo": "bar"} assert remember.calls == [pretend.call(pyramid_request, 1)] assert pyramid_request.session.invalidate.calls == [pretend.call()] assert pyramid_request.find_service.calls == [ pretend.call(ILoginService, context=None), ] assert pyramid_request.session.new_csrf_token.calls == [pretend.call()]
def test_redirect_authenticated_user(self): pyramid_request = pretend.stub(authenticated_userid=1) pyramid_request.route_path = pretend.call_recorder( lambda a: '/the-redirect' ) result = views.login(pyramid_request) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == "/the-redirect"
def test_post_validate_redirects(self, monkeypatch, pyramid_request, with_user): remember = pretend.call_recorder( lambda request, user_id: [("foo", "bar")]) monkeypatch.setattr(views, "remember", remember) new_session = {} login_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: 1), ) pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service) pyramid_request.method = "POST" pyramid_request.session = pretend.stub( items=lambda: [("a", "b"), ("foo", "bar")], update=new_session.update, invalidate=pretend.call_recorder(lambda: None), new_csrf_token=pretend.call_recorder(lambda: None), ) pyramid_request.set_property( lambda r: 1234 if with_user else None, name="unauthenticated_userid", ) form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), ) form_class = pretend.call_recorder(lambda d, login_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == "/" assert result.headers["foo"] == "bar" assert form_class.calls == [ pretend.call(pyramid_request.POST, login_service=login_service), ] assert form_obj.validate.calls == [pretend.call()] assert login_service.find_userid.calls == [pretend.call("theuser")] if with_user: assert new_session == {} else: assert new_session == {"a": "b", "foo": "bar"} assert remember.calls == [pretend.call(pyramid_request, 1)] assert pyramid_request.session.invalidate.calls == [pretend.call()] assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), ] assert pyramid_request.session.new_csrf_token.calls == [pretend.call()]
def test_get_returns_form(self, pyramid_request): login_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service) form_obj = pretend.stub() form_class = pretend.call_recorder(lambda d, login_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert result == {"form": form_obj} assert pyramid_request.find_service.calls == [ pretend.call(ILoginService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, login_service=login_service), ]
def test_get_returns_form(self, pyramid_request): login_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service ) form_obj = pretend.stub() form_class = pretend.call_recorder(lambda d, login_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert result == {"form": form_obj} assert pyramid_request.find_service.calls == [ pretend.call(ILoginService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, login_service=login_service), ]
def test_user_login_get(app): app.db = pretend.stub(accounts=pretend.stub( user_authenticate=pretend.stub(), ), ) request = pretend.stub( method="GET", form=MultiDict(), values={}, _session=Session({}, "1234", False), ) resp = login(app, request) assert resp.status_code == 200 assert resp.response.context == { "form": mock.ANY, "next": None, }
def test_post_validate_no_redirects(self, pyramid_request, expected_next_url, observed_next_url): login_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: 1), ) pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service) pyramid_request.method = "POST" pyramid_request.POST["next"] = expected_next_url form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), ) form_class = pretend.call_recorder(lambda d, login_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == observed_next_url
def test_user_login_get(app): app.db = pretend.stub( accounts=pretend.stub( user_authenticate=pretend.stub(), ), ) request = pretend.stub( method="GET", form=MultiDict(), values={}, _session=Session({}, "1234", False), ) resp = login(app, request) assert resp.status_code == 200 assert resp.response.context == { "form": mock.ANY, "next": None, }
def test_user_login_post_valid(app, form, values, session, location): app.db = pretend.stub(accounts=pretend.stub( get_user_id=lambda username: 9001, user_authenticate=lambda user, password: True, ), ) request = pretend.stub( method="POST", form=MultiDict(form), host="example.com", values=values, url_adapter=pretend.stub(build=lambda *a, **kw: "/", ), _session=Session(session, "1234", False), ) resp = login(app, request) assert request.session["user.id"] == 9001 assert resp.status_code == 303 assert resp.headers["Location"] == location assert resp.headers.getlist("Set-Cookie") == ["username=test; Path=/"]
def test_post_validate_no_redirects(self, pyramid_request, expected_next_url, observed_next_url): login_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: 1), ) pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service ) pyramid_request.method = "POST" pyramid_request.POST["next"] = expected_next_url form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), ) form_class = pretend.call_recorder(lambda d, login_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert isinstance(result, HTTPSeeOther) assert result.headers["Location"] == observed_next_url
def test_get_returns_form(self, pyramid_request, next_url): login_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context: login_service ) form_obj = pretend.stub() form_class = pretend.call_recorder(lambda d, login_service: form_obj) if next_url is not None: pyramid_request.GET["next"] = next_url result = views.login(pyramid_request, _form_class=form_class) assert result == { "form": form_obj, "redirect": {"field": "next", "data": next_url}, } assert pyramid_request.find_service.calls == [ pretend.call(ILoginService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, login_service=login_service), ]
def test_post_invalid_returns_form(self, pyramid_request, next_url): user_service = pretend.stub() pyramid_request.find_service = pretend.call_recorder( lambda iface, context: user_service ) pyramid_request.method = "POST" if next_url is not None: pyramid_request.POST["next"] = next_url form_obj = pretend.stub(validate=pretend.call_recorder(lambda: False)) form_class = pretend.call_recorder(lambda d, user_service: form_obj) result = views.login(pyramid_request, _form_class=form_class) assert result == { "form": form_obj, "redirect": {"field": "next", "data": next_url}, } assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), ] assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service), ] assert form_obj.validate.calls == [pretend.call()]
def test_post_validate_redirects(self, monkeypatch, pyramid_request, with_user): remember = pretend.call_recorder( lambda request, user_id: [("foo", "bar")] ) monkeypatch.setattr(views, "remember", remember) new_session = {} user_id = uuid.uuid4() user_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: user_id), update_user=pretend.call_recorder(lambda *a, **kw: None), ) pyramid_request.find_service = pretend.call_recorder( lambda iface, context: user_service ) pyramid_request.method = "POST" pyramid_request.session = pretend.stub( items=lambda: [("a", "b"), ("foo", "bar")], update=new_session.update, invalidate=pretend.call_recorder(lambda: None), new_csrf_token=pretend.call_recorder(lambda: None), ) pyramid_request.set_property( lambda r: str(uuid.uuid4()) if with_user else None, name="unauthenticated_userid", ) form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), ) form_class = pretend.call_recorder(lambda d, user_service: form_obj) pyramid_request.route_path = pretend.call_recorder( lambda a: '/the-redirect' ) now = datetime.datetime.utcnow() with freezegun.freeze_time(now): result = views.login(pyramid_request, _form_class=form_class) assert pyramid_request.registry.datadog.increment.calls == [ pretend.call('warehouse.authentication.start', tags=['auth_method:login_form']), pretend.call('warehouse.authentication.complete', tags=['auth_method:login_form']), ] assert isinstance(result, HTTPSeeOther) assert pyramid_request.route_path.calls == [ pretend.call('manage.projects') ] assert result.headers["Location"] == "/the-redirect" assert result.headers["foo"] == "bar" assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service), ] assert form_obj.validate.calls == [pretend.call()] assert user_service.find_userid.calls == [pretend.call("theuser")] assert user_service.update_user.calls == [ pretend.call(user_id, last_login=now), ] if with_user: assert new_session == {} else: assert new_session == {"a": "b", "foo": "bar"} assert remember.calls == [pretend.call(pyramid_request, str(user_id))] assert pyramid_request.session.invalidate.calls == [pretend.call()] assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), pretend.call(IUserService, context=None), ] assert pyramid_request.session.new_csrf_token.calls == [pretend.call()]
def test_post_validate_redirects(self, monkeypatch, pyramid_request, with_user): remember = pretend.call_recorder( lambda request, user_id: [("foo", "bar")] ) monkeypatch.setattr(views, "remember", remember) new_session = {} user_id = uuid.uuid4() user_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: user_id), update_user=pretend.call_recorder(lambda *a, **kw: None), ) pyramid_request.find_service = pretend.call_recorder( lambda iface, context: user_service ) pyramid_request.method = "POST" pyramid_request.session = pretend.stub( items=lambda: [("a", "b"), ("foo", "bar")], update=new_session.update, invalidate=pretend.call_recorder(lambda: None), new_csrf_token=pretend.call_recorder(lambda: None), ) pyramid_request.set_property( lambda r: str(uuid.uuid4()) if with_user else None, name="unauthenticated_userid", ) form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), ) form_class = pretend.call_recorder(lambda d, user_service: form_obj) pyramid_request.route_path = pretend.call_recorder( lambda a: '/the-redirect' ) now = datetime.datetime.utcnow() with freezegun.freeze_time(now): result = views.login(pyramid_request, _form_class=form_class) assert isinstance(result, HTTPSeeOther) assert pyramid_request.route_path.calls == [ pretend.call('manage.projects') ] assert result.headers["Location"] == "/the-redirect" assert result.headers["foo"] == "bar" assert form_class.calls == [ pretend.call(pyramid_request.POST, user_service=user_service), ] assert form_obj.validate.calls == [pretend.call()] assert user_service.find_userid.calls == [pretend.call("theuser")] assert user_service.update_user.calls == [ pretend.call(user_id, last_login=now), ] if with_user: assert new_session == {} else: assert new_session == {"a": "b", "foo": "bar"} assert remember.calls == [pretend.call(pyramid_request, str(user_id))] assert pyramid_request.session.invalidate.calls == [pretend.call()] assert pyramid_request.find_service.calls == [ pretend.call(IUserService, context=None), pretend.call(IUserService, context=None), ] assert pyramid_request.session.new_csrf_token.calls == [pretend.call()]
def test_post_validate_redirects(self, monkeypatch, pyramid_request, pyramid_services, metrics, with_user): remember = pretend.call_recorder( lambda request, user_id: [("foo", "bar")]) monkeypatch.setattr(views, "remember", remember) new_session = {} user_id = uuid.uuid4() user_service = pretend.stub( find_userid=pretend.call_recorder(lambda username: user_id), update_user=pretend.call_recorder(lambda *a, **kw: None), ) breach_service = pretend.stub( check_password=lambda password, tags=None: False) pyramid_services.register_service(IUserService, None, user_service) pyramid_services.register_service(IPasswordBreachedService, None, breach_service) pyramid_request.method = "POST" pyramid_request.session = pretend.stub( items=lambda: [("a", "b"), ("foo", "bar")], update=new_session.update, invalidate=pretend.call_recorder(lambda: None), new_csrf_token=pretend.call_recorder(lambda: None), ) pyramid_request.set_property( lambda r: str(uuid.uuid4()) if with_user else None, name="unauthenticated_userid", ) form_obj = pretend.stub( validate=pretend.call_recorder(lambda: True), username=pretend.stub(data="theuser"), password=pretend.stub(data="password"), ) form_class = pretend.call_recorder(lambda d, **kw: form_obj) pyramid_request.route_path = pretend.call_recorder( lambda a: "/the-redirect") now = datetime.datetime.utcnow() with freezegun.freeze_time(now): result = views.login(pyramid_request, _form_class=form_class) assert metrics.increment.calls == [] assert isinstance(result, HTTPSeeOther) assert pyramid_request.route_path.calls == [ pretend.call("manage.projects") ] assert result.headers["Location"] == "/the-redirect" assert result.headers["foo"] == "bar" assert form_class.calls == [ pretend.call( pyramid_request.POST, request=pyramid_request, user_service=user_service, breach_service=breach_service, check_password_metrics_tags=[ "method:auth", "auth_method:login_form" ], ) ] assert form_obj.validate.calls == [pretend.call()] assert user_service.find_userid.calls == [pretend.call("theuser")] assert user_service.update_user.calls == [ pretend.call(user_id, last_login=now) ] if with_user: assert new_session == {} else: assert new_session == {"a": "b", "foo": "bar"} assert remember.calls == [pretend.call(pyramid_request, str(user_id))] assert pyramid_request.session.invalidate.calls == [pretend.call()] assert pyramid_request.session.new_csrf_token.calls == [pretend.call()]