darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-24 16:24:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

109526036: Persist the verify code to the db.

Browse Source 
The codes are hashed and saved to the db.
The code is marked as used once a valid code is submitted.
The code is valid for 1 hour.
The codes are no longer saved to the session.
This commit is contained in:
Rebecca Law
2015-12-10 14:48:01 +00:00
parent 3b327c9986
commit 588730d594
17 changed files with 306 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tests/app/main/views/__init__.py
View File

@@ -1,16 +0,0 @@
from datetime import datetime
from app.main.dao import users_dao
from app.models import User
def create_test_user():
user = User(name='Test User',
password='somepassword',
email_address='test@user.gov.uk',
mobile_number='+441234123412',
created_at=datetime.now(),
role_id=1,
state='pending')
users_dao.insert_user(user)
return user

16
tests/app/main/views/test_register.py
View File

@@ -1,13 +1,13 @@
def test_render_register_returns_template_with_form(notifications_admin, notifications_admin_db):
def test_render_register_returns_template_with_form(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().get('/register')
assert response.status_code == 200
assert 'Create an account' in response.get_data(as_text=True)
def test_process_register_creates_new_user(notifications_admin, notifications_admin_db, mocker):
def test_process_register_creates_new_user(notifications_admin, notifications_admin_db, mocker, notify_db_session):
_set_up_mocker(mocker)
response = notifications_admin.test_client().post('/register',
@@ -21,7 +21,8 @@ def test_process_register_creates_new_user(notifications_admin, notifications_ad
def test_process_register_returns_400_when_mobile_number_is_invalid(notifications_admin,
notifications_admin_db,
mocker):
mocker,
notify_db_session):
_set_up_mocker(mocker)
response = notifications_admin.test_client().post('/register',
data={'name': 'Bad Mobile',
@@ -33,7 +34,10 @@ def test_process_register_returns_400_when_mobile_number_is_invalid(notification
assert 'Please enter a +44 mobile number' in response.get_data(as_text=True)
def test_should_return_400_when_email_is_not_gov_uk(notifications_admin, notifications_admin_db, mocker):
def test_should_return_400_when_email_is_not_gov_uk(notifications_admin,
notifications_admin_db,
mocker,
notify_db_session):
_set_up_mocker(mocker)
response = notifications_admin.test_client().post('/register',
data={'name': 'Bad Mobile',
@@ -45,7 +49,7 @@ def test_should_return_400_when_email_is_not_gov_uk(notifications_admin, notific
assert 'Please enter a gov.uk email address' in response.get_data(as_text=True)
def test_should_add_verify_codes_on_session(notifications_admin, notifications_admin_db, mocker):
def test_should_add_verify_codes_on_session(notifications_admin, notifications_admin_db, mocker, notify_db_session):
_set_up_mocker(mocker)
with notifications_admin.test_client() as client:
response = client.post('/register',
@@ -62,7 +66,7 @@ def _set_up_mocker(mocker):
mocker.patch("app.admin_api_client.send_email")
def test_should_return_400_if_password_is_blacklisted(notifications_admin, notifications_admin_db):
def test_should_return_400_if_password_is_blacklisted(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().post('/register',
data={'name': 'Bad Mobile',
'email_address': 'bad_mobile@example.not.right',

12
tests/app/main/views/test_sign_in.py
View File

@@ -13,7 +13,7 @@ def test_render_sign_in_returns_sign_in_template(notifications_admin):
assert 'Forgotten password?' in response.get_data(as_text=True)
def test_process_sign_in_return_2fa_template(notifications_admin, notifications_admin_db, mocker):
def test_process_sign_in_return_2fa_template(notifications_admin, notifications_admin_db, mocker, notify_db_session):
_set_up_mocker(mocker)
user = User(email_address='valid@example.gov.uk',
password='val1dPassw0rd!',
@@ -29,7 +29,9 @@ def test_process_sign_in_return_2fa_template(notifications_admin, notifications_
assert response.location == 'http://localhost/two-factor'
def test_should_return_locked_out_true_when_user_is_locked(notifications_admin, notifications_admin_db):
def test_should_return_locked_out_true_when_user_is_locked(notifications_admin,
notifications_admin_db,
notify_db_session):
user = User(email_address='valid@example.gov.uk',
password='val1dPassw0rd!',
mobile_number='+441234123123',
@@ -56,7 +58,9 @@ def test_should_return_locked_out_true_when_user_is_locked(notifications_admin,
assert '"locked_out": true' in response.get_data(as_text=True)
def test_should_return_active_user_is_false_if_user_is_inactive(notifications_admin, notifications_admin_db):
def test_should_return_active_user_is_false_if_user_is_inactive(notifications_admin,
notifications_admin_db,
notify_db_session):
user = User(email_address='inactive_user@example.gov.uk',
password='val1dPassw0rd!',
mobile_number='+441234123123',
@@ -74,7 +78,7 @@ def test_should_return_active_user_is_false_if_user_is_inactive(notifications_ad
assert '"active_user": false' in response.get_data(as_text=True)
def test_should_return_401_when_user_does_not_exist(notifications_admin, notifications_admin_db):
def test_should_return_401_when_user_does_not_exist(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().post('/sign-in',
data={'email_address': 'does_not_exist@gov.uk',
'password': 'doesNotExist!'})

24
tests/app/main/views/test_two_factor.py
View File

@@ -1,21 +1,21 @@
from flask import json
from app.main.encryption import hashpw
from tests.app.main.views import create_test_user
from app.main.dao import verify_codes_dao
from tests.app.main import create_test_user
def test_should_render_two_factor_page(notifications_admin, notifications_admin_db):
def test_should_render_two_factor_page(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().get('/two-factor')
assert response.status_code == 200
assert '''We've sent you a text message with a verification code.''' in response.get_data(as_text=True)
def test_should_login_user_and_redirect_to_dashboard(notifications_admin, notifications_admin_db):
def test_should_login_user_and_redirect_to_dashboard(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post('/two-factor',
data={'sms_code': '12345'})
@@ -23,35 +23,37 @@ def test_should_login_user_and_redirect_to_dashboard(notifications_admin, notifi
assert response.location == 'http://localhost/dashboard'
def test_should_return_400_with_sms_code_error_when_sms_code_is_wrong(notifications_admin, notifications_admin_db):
def test_should_return_400_with_sms_code_error_when_sms_code_is_wrong(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post('/two-factor',
data={'sms_code': '23456'})
assert response.status_code == 400
assert {'sms_code': ['Code does not match']} == json.loads(response.get_data(as_text=True))
def test_should_return_400_when_sms_code_is_empty(notifications_admin, notifications_admin_db):
def test_should_return_400_when_sms_code_is_empty(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post('/two-factor')
assert response.status_code == 400
assert {'sms_code': ['Please enter your code']} == json.loads(response.get_data(as_text=True))
def test_should_return_400_when_sms_code_is_too_short(notifications_admin, notifications_admin_db):
def test_should_return_400_when_sms_code_is_too_short(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('23467')
verify_codes_dao.add_code(user_id=user.id, code='23467', code_type='sms')
response = client.post('/two-factor', data={'sms_code': '2346'})
assert response.status_code == 400
data = json.loads(response.get_data(as_text=True))

96
tests/app/main/views/test_verify.py
View File

@@ -1,23 +1,26 @@
from datetime import datetime, timedelta
from flask import json
from app.main.dao import users_dao
from app.main.encryption import hashpw
from tests.app.main.views import create_test_user
from app.main.dao import users_dao, verify_codes_dao
from tests.app.main import create_test_user
def test_should_return_verify_template(notifications_admin, notifications_admin_db):
def test_should_return_verify_template(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().get('/verify')
assert response.status_code == 200
assert 'Activate your account' in response.get_data(as_text=True)
def test_should_redirect_to_add_service_when_code_are_correct(notifications_admin, notifications_admin_db):
def test_should_redirect_to_add_service_when_code_are_correct(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
session['email_code'] = hashpw('23456')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
response = client.post('/verify',
data={'sms_code': '12345',
'email_code': '23456'})
@@ -25,13 +28,13 @@ def test_should_redirect_to_add_service_when_code_are_correct(notifications_admi
assert response.location == 'http://localhost/add-service'
def test_should_activate_user_after_verify(notifications_admin, notifications_admin_db):
def test_should_activate_user_after_verify(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
session['email_code'] = hashpw('23456')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
client.post('/verify',
data={'sms_code': '12345',
'email_code': '23456'})
@@ -40,13 +43,13 @@ def test_should_activate_user_after_verify(notifications_admin, notifications_ad
assert after_verify.state == 'active'
def test_should_return_400_when_sms_code_is_wrong(notifications_admin, notifications_admin_db):
def test_should_return_400_when_sms_code_is_wrong(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
session['email_code'] = hashpw('23456')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
response = client.post('/verify',
data={'sms_code': '98765',
'email_code': '23456'})
@@ -54,13 +57,13 @@ def test_should_return_400_when_sms_code_is_wrong(notifications_admin, notificat
assert {'sms_code': ['Code does not match']} == json.loads(response.get_data(as_text=True))
def test_should_return_400_when_email_code_is_wrong(notifications_admin, notifications_admin_db):
def test_should_return_400_when_email_code_is_wrong(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
session['email_code'] = hashpw('98456')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='98456', code_type='email')
response = client.post('/verify',
data={'sms_code': '12345',
'email_code': '23456'})
@@ -68,39 +71,39 @@ def test_should_return_400_when_email_code_is_wrong(notifications_admin, notific
assert {'email_code': ['Code does not match']} == json.loads(response.get_data(as_text=True))
def test_should_return_400_when_sms_code_is_missing(notifications_admin, notifications_admin_db):
def test_should_return_400_when_sms_code_is_missing(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('12345')
session['email_code'] = hashpw('98456')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='98456', code_type='email')
response = client.post('/verify',
data={'email_code': '98456'})
assert response.status_code == 400
assert {'sms_code': ['SMS code can not be empty']} == json.loads(response.get_data(as_text=True))
def test_should_return_400_when_email_code_is_missing(notifications_admin, notifications_admin_db):
def test_should_return_400_when_email_code_is_missing(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('23456')
session['email_code'] = hashpw('23456')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
response = client.post('/verify',
data={'sms_code': '23456'})
assert response.status_code == 400
assert {'email_code': ['Email code can not be empty']} == json.loads(response.get_data(as_text=True))
def test_should_return_400_when_email_code_has_letter(notifications_admin, notifications_admin_db):
def test_should_return_400_when_email_code_has_letter(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('23456')
session['email_code'] = hashpw('23456')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
response = client.post('/verify',
data={'sms_code': '23456',
'email_code': 'abcde'})
@@ -112,13 +115,13 @@ def test_should_return_400_when_email_code_has_letter(notifications_admin, notif
assert data['email_code'].sort() == expected['email_code'].sort()
def test_should_return_400_when_sms_code_is_too_short(notifications_admin, notifications_admin_db):
def test_should_return_400_when_sms_code_is_too_short(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('23456')
session['email_code'] = hashpw('23456')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
response = client.post('/verify',
data={'sms_code': '2345',
'email_code': '23456'})
@@ -130,15 +133,46 @@ def test_should_return_400_when_sms_code_is_too_short(notifications_admin, notif
assert data['sms_code'].sort() == expected['sms_code'].sort()
def test_should_return_302_when_email_code_starts_with_zero(notifications_admin, notifications_admin_db):
def test_should_return_302_when_email_code_starts_with_zero(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
session['sms_code'] = hashpw('23456')
session['email_code'] = hashpw('09765')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='09765', code_type='email')
response = client.post('/verify',
data={'sms_code': '23456',
'email_code': '09765'})
assert response.status_code == 302
assert response.location == 'http://localhost/add-service'
def test_should_return_400_when_verify_code_has_expired(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user()
session['user_id'] = user.id
verify_codes_dao.add_code_with_expiry(user_id=user.id,
code='23456',
code_type='email',
expiry=datetime.now() + timedelta(hours=-2))
verify_codes_dao.add_code_with_expiry(user_id=user.id,
code='23456',
code_type='sms',
expiry=datetime.now() + timedelta(hours=-2))
response = client.post('/verify',
data={'sms_code': '23456',
'email_code': '23456'})
assert response.status_code == 400
data = json.loads(response.get_data(as_text=True))
expected = {'sms_code': ['Code has expired'],
'email_code': ['Code has expired']}
assert len(data.keys()) == 2
assert 'sms_code' in data
assert data['sms_code'].sort() == expected['sms_code'].sort()
assert 'email_code' in data
assert data['email_code'].sort() == expected['email_code'].sort()