darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-21 14:59:47 -04:00
Code Issues Packages Projects Releases Wiki Activity

Implementation of the new_password endpoint.

Browse Source 
Found a way to create the token that does not need to persist it to the database.
This requires proper error messages, written by people who speak menglis good.
This commit is contained in:
Rebecca Law
2016-01-07 17:13:49 +00:00
parent 8057a138a8
commit a860f713d2
17 changed files with 87 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/app/main/dao/test_password_reset_token.py
View File

@@ -1,12 +0,0 @@
import uuid
from app.main.dao import password_reset_token_dao
from tests.app.main import create_test_user
def test_should_insert_and_return_token(notifications_admin, notifications_admin_db, notify_db_session):
user = create_test_user('active')
token_id = str(uuid.uuid4())
password_reset_token_dao.insert(token=token_id, user_id=user.id)
saved_token = password_reset_token_dao.get_token(token_id)
assert saved_token.token == token_id

2
tests/app/main/dao/test_users_dao.py
View File

@@ -176,7 +176,7 @@ def test_should_update_password(notifications_admin, notifications_admin_db, not
saved = users_dao.get_user_by_id(user.id)
assert check_hash('somepassword', saved.password)
assert saved.password_changed_at is None
users_dao.update_password(saved.id, 'newpassword')
users_dao.update_password(saved.email_address, 'newpassword')
updated = users_dao.get_user_by_id(user.id)
assert check_hash('newpassword', updated.password)
assert updated.password_changed_at < datetime.now()

13
tests/app/main/test_forgot_password_form.py
View File

@@ -1,13 +0,0 @@
from werkzeug.datastructures import MultiDict
from app.main.forms import ForgotPasswordForm
def test_should_return_validation_error_if_email_address_does_not_exist(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_request_context():
form = ForgotPasswordForm(['first@it.gov.uk', 'second@it.gov.uk'],
formdata=MultiDict([('email_address', 'not_found@it.gov.uk')]))
form.validate()
assert {'email_address': ['Please enter the email address that you registered with']} == form.errors

10
tests/app/main/views/test_forgot_password.py
View File

@@ -8,16 +8,6 @@ def test_should_render_forgot_password(notifications_admin, notifications_admin_
in response.get_data(as_text=True)
def test_should_have_validate_error_when_email_does_not_exist(notifications_admin,
notifications_admin_db,
notify_db_session):
create_test_user('active')
response = notifications_admin.test_client().post('/forgot-password',
data={'email_address': 'email_does_not@exist.gov.uk'})
assert response.status_code == 200
assert 'Please enter the email address that you registered with' in response.get_data(as_text=True)
def test_should_redirect_to_password_reset_sent(notifications_admin,
notifications_admin_db,
mocker,

49
tests/app/main/views/test_new_password.py
View File

@@ -1,19 +1,13 @@
from datetime import datetime, timedelta
from app.main.dao import password_reset_token_dao, users_dao
from app.models import PasswordResetToken
from tests.app.main import create_test_user
from app.main.dao import users_dao
from app.main.encryption import check_hash
from app.main.views import generate_token
from tests.app.main import create_test_user
def test_should_render_new_password_template(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
user = create_test_user('active')
password_reset_token_dao.insert('some_token', user.id)
response = client.get('/new-password/some_token')
assert response.status_code == 200
assert ' You can now create a new password for your account.' in response.get_data(as_text=True)
response = notifications_admin.test_client().get('/new-password/some_token')
assert response.status_code == 200
assert ' You can now create a new password for your account.' in response.get_data(as_text=True)
def test_should_redirect_to_two_factor_when_password_reset_is_successful(notifications_admin, notifications_admin_db,
@@ -21,8 +15,8 @@ def test_should_redirect_to_two_factor_when_password_reset_is_successful(notific
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
user = create_test_user('active')
password_reset_token_dao.insert('some_token', user.id)
response = client.post('/new-password/some_token',
token = generate_token(user.email_address)
response = client.post('/new-password/{}'.format(token),
data={'new_password': 'a-new_password'})
assert response.status_code == 302
assert response.location == 'http://localhost/two-factor'
@@ -30,15 +24,26 @@ def test_should_redirect_to_two_factor_when_password_reset_is_successful(notific
assert check_hash('a-new_password', saved_user.password)
def test_should_return_validation_error_that_token_is_expired(notifications_admin, notifications_admin_db,
notify_db_session):
def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_expired(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
notifications_admin.config['TOKEN_MAX_AGE_SECONDS'] = -1000
user = create_test_user('active')
expired_token = PasswordResetToken(id=1, token='some_token', user_id=user.id,
expiry_date=datetime.now() + timedelta(hours=-2))
password_reset_token_dao.insert_token(expired_token)
response = client.post('/new-password/some_token',
token = generate_token(user.email_address)
response = client.post('/new-password/{}'.format(token),
data={'new_password': 'a-new_password'})
assert response.status_code == 200
assert 'token is invalid' in response.get_data(as_text=True)
assert response.status_code == 302
assert response.location == 'http://localhost/forgot-password'
notifications_admin.config['TOKEN_MAX_AGE_SECONDS'] = 86400
def test_should_return_500_error_page_when_email_addres_does_not_exist(notifications_admin, notifications_admin_db,
notify_db_session):
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
token = generate_token('doesnotexist@it.gov.uk')
response = client.post('/new-password/{}'.format(token),
data={'new_password': 'a-new_password'})
assert response.status_code == 500