Merge branch 'master' of https://github.com/alphagov/notifications-admin into vb-free-sms-history

tests/app/main/views/service_settings/test_inbound_sms_setting.py

@@ -1,4 +1,3 @@
-import app
 from flask import url_for
 from tests.conftest import normalize_spaces
 
@@ -59,22 +58,3 @@ def test_set_inbound_sms_when_service_already_has_sms(
     )
 
     assert normalize_spaces(page.select_one('main p').text) == "This service already has an inbound number"
-
-
-def test_set_text_message_sender_and_inbound_sms_permission_exists_return_403(
-        logged_in_client,
-        service_one,
-        mocker,
-):
-    service_one['permissions'] = ['inbound_sms']
-    mocker.patch('app.service_api_client.get_service', return_value={'data': service_one})
-    update_service_mock = mocker.patch('app.service_api_client.update_service_with_properties')
-
-    data = {"sms_sender": "elevenchars"}
-    response = logged_in_client.post(url_for('main.service_set_sms_sender', service_id=service_one['id']),
-                                     data=data)
-
-    assert response.status_code == 403
-
-    assert not update_service_mock.called
-    assert app.current_service['permissions'] == ['inbound_sms']

tests/app/main/views/test_accept_invite.py

@@ -324,7 +324,7 @@ def test_new_invited_user_verifies_and_added_to_service(
     mock_send_verify_code,
     mock_check_verify_code,
     mock_get_user,
-    mock_update_user,
+    mock_update_user_attribute,
     mock_add_user_to_service,
     mock_accept_invite,
     mock_get_service,

tests/app/main/views/test_code_not_received.py

@@ -79,11 +79,10 @@ def test_should_resend_verify_code_and_update_mobile_for_pending_user(
     client,
     mocker,
     api_user_pending,
-    mock_update_user,
+    mock_update_user_attribute,
     mock_send_verify_code,
     phone_number_to_register_with,
 ):
-
     mocker.patch('app.user_api_client.get_user_by_email', return_value=api_user_pending)
 
     with client.session_transaction() as session:
@@ -95,7 +94,7 @@ def test_should_resend_verify_code_and_update_mobile_for_pending_user(
     assert response.status_code == 302
     assert response.location == url_for('main.verify', _external=True)
 
-    mock_update_user.assert_called_once_with(api_user_pending)
+    mock_update_user_attribute.assert_called_once_with(api_user_pending.id, mobile_number=phone_number_to_register_with)
     mock_send_verify_code.assert_called_once_with(api_user_pending.id, 'sms', to=phone_number_to_register_with)
 
 

tests/app/main/views/test_send.py

@@ -44,14 +44,14 @@ test_non_spreadsheet_files = glob(path.join('tests', 'non_spreadsheet_files', '*
     (
         mock_get_service_email_template,
         multiple_reply_to_email_addresses,
-        'Choose where to send replies',
-        'Select an email address that recipients can reply to'
+        'Send to one recipient',
+        'Where should replies go?',
     ),
     (
         mock_get_service_template,
         multiple_sms_senders,
-        'Chose text message sender',
-        'Select a text message sender that the recipients can reply to'
+        'Send to one recipient',
+        'Who should the message come from?'
     )
 ])
 def test_show_correct_title_and_description_for_sender_type(
@@ -660,7 +660,6 @@ def test_send_one_off_has_skip_link(
     expected_link_text,
     expected_link_url,
 ):
-
     template_mock(mocker)
     mocker.patch('app.main.views.send.get_page_count_for_letter', return_value=99)
 
@@ -683,6 +682,23 @@ def test_send_one_off_has_skip_link(
         assert not skip_links
 
 
+def test_skip_link_will_not_show_on_sms_one_off_if_service_has_no_mobile_number(
+    logged_in_client,
+    service_one,
+    fake_uuid,
+    mock_get_service_template,
+    active_user_with_permissions
+):
+    active_user_with_permissions.mobile_number = None
+    response = logged_in_client.get(
+        url_for('main.send_one_off_step', service_id=service_one['id'], template_id=fake_uuid, step_index=0),
+        follow_redirects=True
+    )
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    skip_links = page.select('a.top-gutter-4-3')
+    assert not skip_links
+
+
 @pytest.mark.parametrize('endpoint, expected_redirect, placeholders', [
     (
         'main.send_test_step',

tests/app/main/views/test_sign_in.py

@@ -77,7 +77,7 @@ def test_logged_in_user_redirects_to_choose_service(
     assert response.location == url_for('main.choose_service', _external=True)
 
 
-def test_process_sign_in_return_2fa_template(
+def test_process_sms_auth_sign_in_return_2fa_template(
     client,
     api_user_active,
     mock_send_verify_code,
@@ -94,6 +94,25 @@ def test_process_sign_in_return_2fa_template(
     mock_verify_password.assert_called_with(api_user_active.id, 'val1dPassw0rd!')
 
 
+def test_process_email_auth_sign_in_return_2fa_template(
+    client,
+    api_user_active_email_auth,
+    mock_send_verify_code,
+    mock_verify_password,
+    mocker
+):
+    mocker.patch('app.user_api_client.get_user', return_value=api_user_active_email_auth)
+    mocker.patch('app.user_api_client.get_user_by_email', return_value=api_user_active_email_auth)
+
+    response = client.post(
+        url_for('main.sign_in'), data={
+            'email_address': 'valid@example.gov.uk',
+            'password': 'val1dPassw0rd!'})
+    assert response.status_code == 302
+    assert response.location == url_for('.two_factor_email_sent', _external=True)
+    mock_verify_password.assert_called_with(api_user_active_email_auth.id, 'val1dPassw0rd!')
+
+
 def test_should_return_locked_out_true_when_user_is_locked(
     client,
     mock_get_user_by_email_locked,

tests/app/main/views/test_two_factor.py

@@ -1,8 +1,10 @@
-from flask import url_for
-from tests.conftest import SERVICE_ONE_ID
-
 from unittest.mock import ANY
 
+from flask import url_for
+from bs4 import BeautifulSoup
+
+from tests.conftest import SERVICE_ONE_ID, normalize_spaces, set_config
+
 
 def test_should_render_two_factor_page(
     client,
@@ -200,7 +202,7 @@ def test_two_factor_should_activate_pending_user(
     mocker,
     api_user_pending,
     mock_check_verify_code,
-    mock_update_user,
+    mock_activate_user,
 ):
     mocker.patch('app.user_api_client.get_user', return_value=api_user_pending)
     mocker.patch('app.service_api_client.get_services', return_value={'data': []})
@@ -211,5 +213,113 @@ def test_two_factor_should_activate_pending_user(
         }
     client.post(url_for('main.two_factor'), data={'sms_code': '12345'})
 
-    assert mock_update_user.called
+    assert mock_activate_user.called
     assert api_user_pending.is_active
+
+
+def test_valid_two_factor_email_link_logs_in_user(
+    client,
+    valid_token,
+    mock_get_user,
+    mock_get_services_with_one_service,
+    mocker
+):
+    mocker.patch('app.user_api_client.check_verify_code', return_value=(True, ''))
+
+    response = client.get(
+        url_for('main.two_factor_email', token=valid_token),
+    )
+
+    assert response.status_code == 302
+    assert response.location == url_for('main.service_dashboard', service_id=SERVICE_ONE_ID, _external=True)
+
+
+def test_two_factor_email_link_has_expired(
+    app_,
+    valid_token,
+    client,
+    mock_send_verify_code,
+    fake_uuid
+):
+
+    with set_config(app_, 'EMAIL_2FA_EXPIRY_SECONDS', -1):
+        response = client.get(
+            url_for('main.two_factor_email', token=valid_token),
+            follow_redirects=True,
+        )
+
+    assert response.status_code == 200
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "The link in the email we sent you has expired. We’ve sent you a new one."
+    assert page.h1.text.strip() == 'Email resent'
+    mock_send_verify_code.assert_called_once_with(fake_uuid, 'email', None)
+
+
+def test_two_factor_email_link_is_invalid(
+    client
+):
+    token = 12345
+    response = client.get(
+        url_for('main.two_factor_email', token=token),
+        follow_redirects=True
+    )
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "There’s something wrong with the link you’ve used."
+    assert response.status_code == 404
+
+
+def test_two_factor_email_link_is_already_used(
+    client,
+    valid_token,
+    mocker,
+    mock_send_verify_code
+
+):
+    mocker.patch('app.user_api_client.check_verify_code', return_value=(False, 'Code has expired'))
+
+    response = client.get(
+        url_for('main.two_factor_email', token=valid_token),
+        follow_redirects=True
+    )
+
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "This link has already been used"
+    assert response.status_code == 200
+
+
+def test_two_factor_email_link_when_user_is_locked_out(
+    client,
+    valid_token,
+    mocker,
+    mock_send_verify_code
+):
+    mocker.patch('app.user_api_client.check_verify_code', return_value=(False, 'Code not found'))
+
+    response = client.get(
+        url_for('main.two_factor_email', token=valid_token),
+        follow_redirects=True
+    )
+
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "This link has already been used"
+    assert response.status_code == 200
+
+
+def test_two_factor_email_link_used_when_user_already_logged_in(
+    logged_in_client,
+    valid_token
+):
+    response = logged_in_client.get(
+        url_for('main.two_factor_email', token=valid_token)
+    )
+    assert response.status_code == 302
+    assert response.location == url_for('main.choose_service', _external=True)

tests/app/main/views/test_verify.py

@@ -30,7 +30,7 @@ def test_should_redirect_to_add_service_when_sms_code_is_correct(
     client,
     api_user_active,
     mocker,
-    mock_update_user,
+    mock_update_user_attribute,
     mock_check_verify_code,
     fake_uuid
 ):
@@ -60,14 +60,14 @@ def test_should_activate_user_after_verify(
     api_user_pending,
     mock_send_verify_code,
     mock_check_verify_code,
-    mock_update_user,
+    mock_activate_user,
 ):
     mocker.patch('app.user_api_client.get_user', return_value=api_user_pending)
     with client.session_transaction() as session:
         session['user_details'] = {'email_address': api_user_pending.email_address, 'id': api_user_pending.id}
     client.post(url_for('main.verify'),
                 data={'sms_code': '12345'})
-    assert mock_update_user.called
+    assert mock_activate_user.called
 
 
 def test_should_return_200_when_sms_code_is_wrong(