darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-18 13:39:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

Incrementing of failed logins happens on api side

Browse Source
This commit is contained in:
Adam Shimali
2016-01-26 12:32:08 +00:00
parent d89174f322
commit b394a18b4e
3 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/main/dao/users_dao.py
View File

@@ -38,11 +38,6 @@ def verify_password(user, password):
return user_api_client.verify_password(user, password) return user_api_client.verify_password(user, password)
def increment_failed_login_count(id):
user = get_user_by_id(id)
user.failed_login_count += 1
def activate_user(user): def activate_user(user):
user.state = 'active' user.state = 'active'
return user_api_client.update_user(user) return user_api_client.update_user(user)

31
app/main/views/sign_in.py
View File

@@ -23,20 +23,31 @@ def sign_in():
try: try:
form = LoginForm() form = LoginForm()
if form.validate_on_submit(): if form.validate_on_submit():
user = users_dao.get_user_by_email(form.email_address.data) user = _get_and_verify_user(form.email_address.data, form.password.data)
if user: if user:
if not user.is_locked() and user.is_active() and users_dao.verify_password(user, form.password.data): send_sms_code(user.id, user.mobile_number)
send_sms_code(user.id, user.mobile_number) session['user_email'] = user.email_address
session['user_email'] = user.email_address return redirect(url_for('.two_factor'))
return redirect(url_for('.two_factor')) else:
else: # Vague error message for login in case of user not known, locked, inactive or password not verified
# TODO re wire this increment to api form.password.errors.append('Username or password is incorrect')
users_dao.increment_failed_login_count(user.id)
# Vague error message for login
form.password.errors.append('Username or password is incorrect')
return render_template('views/signin.html', form=form) return render_template('views/signin.html', form=form)
except: except:
import traceback import traceback
traceback.print_exc() traceback.print_exc()
abort(500) abort(500)
def _get_and_verify_user(email_address, password):
user = users_dao.get_user_by_email(email_address)
if not user:
return None
elif user.is_locked():
return None
elif not user.is_active():
return None
elif not users_dao.verify_password(user, password):
return None
else:
return user

6
tests/app/main/dao/test_users_dao.py
View File

@@ -41,12 +41,6 @@ def test_get_all_users_calls_api(db_, db_session, mock_get_all_users_from_api):
assert mock_get_all_users_from_api.called assert mock_get_all_users_from_api.called
def test_increment_failed_login_count_should_increade_count_by_1(db_, db_session, mock_active_user, mock_get_user):
assert mock_active_user.failed_login_count == 0
users_dao.increment_failed_login_count(mock_active_user.id)
assert mock_active_user.failed_login_count == 1
def test_user_is_active_is_false_if_state_is_inactive(db_, db_session, mock_active_user): def test_user_is_active_is_false_if_state_is_inactive(db_, db_session, mock_active_user):
assert mock_active_user.is_active() is True assert mock_active_user.is_active() is True
mock_active_user.state = 'inactive' mock_active_user.state = 'inactive'