darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-04 18:08:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

When the user request a reset password link, the user.state is set to request_password_reset.

Browse Source 
Which means the user will only be able to reset their password, and not sign-in.
Once the user resets the password the user state is set to active once more.
If the link is used a second time they will be redirected to the index page with a message
that the link in the email is not longer valid.
This commit is contained in:
Rebecca Law
2016-01-11 12:06:52 +00:00
parent 0c1592905f
commit bb1db0c345
8 changed files with 53 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
tests/app/main/views/test_new_password.py
View File

@@ -9,9 +9,9 @@ from tests.app.main import create_test_user
def test_should_render_new_password_template(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
user = create_test_user('active')
user = create_test_user('request_password_reset')
token = generate_token(user.email_address)
response = client.get('/new-password/{}'.format(token))
response = client.get(url_for('.new_password', token=token))
assert response.status_code == 200
assert ' You can now create a new password for your account.' in response.get_data(as_text=True)
@@ -20,8 +20,9 @@ def test_should_render_new_password_template_with_message_of_bad_token(notificat
notify_db_session):
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
create_test_user('request_password_reset')
token = generate_token('no_user@d.gov.uk')
response = client.get('/new-password/{}'.format(token))
response = client.get(url_for('.new_password', token=token))
assert response.status_code == 200
assert 'Message about email address does not exist. Some one needs to figure out the words here.' in \
response.get_data(as_text=True)
@@ -34,14 +35,14 @@ def test_should_redirect_to_two_factor_when_password_reset_is_successful(notific
_set_up_mocker(mocker)
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
user = create_test_user('active')
user = create_test_user('request_password_reset')
token = generate_token(user.email_address)
response = client.post('/new-password/{}'.format(token),
data={'new_password': 'a-new_password'})
response = client.post(url_for('.new_password', token=token), data={'new_password': 'a-new_password'})
assert response.status_code == 302
assert response.location == url_for('.two_factor', _external=True)
saved_user = users_dao.get_user_by_id(user.id)
assert check_hash('a-new_password', saved_user.password)
assert saved_user.state == 'active'
def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_expired(notifications_admin,
@@ -50,14 +51,25 @@ def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_exp
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
notifications_admin.config['TOKEN_MAX_AGE_SECONDS'] = -1000
user = create_test_user('active')
user = create_test_user('request_password_reset')
token = generate_token(user.email_address)
response = client.post('/new-password/{}'.format(token),
data={'new_password': 'a-new_password'})
response = client.post(url_for('.new_password', token=token), data={'new_password': 'a-new_password'})
assert response.status_code == 302
assert response.location == url_for('.forgot_password', _external=True)
notifications_admin.config['TOKEN_MAX_AGE_SECONDS'] = 86400
def test_should_redirect_to_forgot_password_when_user_is_active_should_be_request_password_reset(notifications_admin,
notifications_admin_db,
notify_db_session):
with notifications_admin.test_request_context():
with notifications_admin.test_client() as client:
user = create_test_user('active')
token = generate_token(user.email_address)
response = client.post(url_for('.new_password', token=token), data={'new_password': 'a-new_password'})
assert response.status_code == 302
assert response.location == url_for('.index', _external=True)
def _set_up_mocker(mocker):
mocker.patch("app.admin_api_client.send_sms")