darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-11 09:28:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Prevent auth type changing for any WebAuthn user

Browse Source 
Previously we applied this restriction to Platform Admins, on the
assumption that all of them use a security key to log in. Rather
than making that assumption, we can explicitly check their login
method, which also supports rolling out the feature to more users.
This commit is contained in:
Ben Thorner
2021-06-30 15:15:00 +01:00
parent 43afcd1064
commit a1b4ccc246
4 changed files with 19 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tests/app/main/views/test_manage_users.py
View File

@@ -742,7 +742,6 @@ def test_cant_edit_non_member_user_permissions(
assert mock_set_user_permissions.called is False
@pytest.mark.parametrize('current_auth_type', ['webauthn_auth', 'email_auth'])
def test_edit_user_permissions_including_authentication_with_email_auth_service(
client_request,
service_one,
@@ -752,9 +751,8 @@ def test_edit_user_permissions_including_authentication_with_email_auth_service(
mock_set_user_permissions,
mock_update_user_attribute,
mock_get_template_folders,
current_auth_type,
):
active_user_with_permissions['auth_type'] = current_auth_type
active_user_with_permissions['auth_type'] = 'email_auth'
service_one['permissions'].append('email_auth')
client_request.post(
@@ -796,39 +794,35 @@ def test_edit_user_permissions_including_authentication_with_email_auth_service(
)
@pytest.mark.parametrize('current_auth_type', ['webauthn_auth', 'email_auth'])
def test_edit_user_permissions_preserves_auth_type_for_platform_admin(
@pytest.mark.parametrize('new_auth_type', ['sms_auth', 'email_auth'])
def test_edit_user_permissions_preserves_auth_type_for_webauthn_user(
client_request,
service_one,
platform_admin_user,
active_user_with_permissions,
mock_get_users_by_service,
mock_get_invites_for_service,
mock_set_user_permissions,
mock_update_user_attribute,
mock_get_template_folders,
current_auth_type,
new_auth_type,
):
platform_admin_user['auth_type'] = current_auth_type
active_user_with_permissions['auth_type'] = 'webauthn_auth'
service_one['permissions'].append('email_auth')
# we're logging in as this user being edited; normally a user can't edit themselves, but since
# the same mock is used to (a) check access and (b) find the user to edit, this is just easier
client_request.login(platform_admin_user)
client_request.post(
'main.edit_user_permissions',
service_id=SERVICE_ONE_ID,
user_id=platform_admin_user['id'],
user_id=active_user_with_permissions['id'],
_data={
'email_address': platform_admin_user['email_address'],
'email_address': active_user_with_permissions['email_address'],
'permissions_field': [],
'login_authentication': 'sms_auth',
'login_authentication': new_auth_type,
},
_expected_status=302,
)
mock_set_user_permissions.assert_called_with(
str(platform_admin_user['id']),
str(active_user_with_permissions['id']),
SERVICE_ONE_ID,
permissions=set(),
folder_permissions=[],