darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-09 16:59:49 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #40 from alphagov/form_views_refactor

Browse Source 
Form views refactor
This commit is contained in:
NIcholas Staples
2016-01-06 17:03:36 +00:00
parent 03d81e5b47 52df795743
commit c7f130e503
22 changed files with 411 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/main/dao/users_dao.py
View File

@@ -14,6 +14,8 @@ def insert_user(user):
db.session.commit() db.session.commit()
# TODO Would be better to have a generic get and update for user
# something that replicates the sql functionality.
def get_user_by_id(id): def get_user_by_id(id):
return User.query.filter_by(id=id).first() return User.query.filter_by(id=id).first()

30
app/main/forms.py
View File

@@ -26,6 +26,12 @@ verify_code = '^\d{5}$'
class RegisterUserForm(Form): class RegisterUserForm(Form):
def __init__(self, existing_email_addresses, existing_mobile_numbers, *args, **kwargs):
self.existing_emails = existing_email_addresses
self.existing_mobiles = existing_mobile_numbers
super(RegisterUserForm, self).__init__(*args, **kwargs)
name = StringField('Full name', name = StringField('Full name',
validators=[DataRequired(message='Name can not be empty')]) validators=[DataRequired(message='Name can not be empty')])
email_address = StringField('Email address', validators=[ email_address = StringField('Email address', validators=[
@@ -42,9 +48,21 @@ class RegisterUserForm(Form):
Length(10, 255, message='Password must be at least 10 characters'), Length(10, 255, message='Password must be at least 10 characters'),
Blacklist(message='That password is blacklisted, too common')]) Blacklist(message='That password is blacklisted, too common')])
def validate_email_address(self, field):
# Validate email address is unique.
if field.data in self.existing_emails:
raise ValidationError('Email address already exists')
def validate_mobile_number(self, field):
# Validate mobile number is unique
# Code to re-added later
# if field.data in self.existing_mobiles:
# raise ValidationError('Mobile number already exists')
pass
class TwoFactorForm(Form): class TwoFactorForm(Form):
sms_code = StringField('sms code', validators=[DataRequired(message='Please enter your code'), sms_code = StringField('sms code', validators=[DataRequired(message='Enter verification code'),
Regexp(regex=verify_code, message='Code must be 5 digits')]) Regexp(regex=verify_code, message='Code must be 5 digits')])
def validate_sms_code(self, a): def validate_sms_code(self, a):
@@ -76,9 +94,9 @@ class EmailNotReceivedForm(Form):
class TextNotReceivedForm(Form): class TextNotReceivedForm(Form):
mobile_number = StringField('Mobile phone number', mobile_number = StringField('Mobile phone number', validators=[
validators=[DataRequired(message='Please enter your mobile number'), DataRequired(message='Please enter your mobile number'),
Regexp(regex=mobile_number, message='Please enter a +44 mobile number')]) Regexp(regex=mobile_number, message='Please enter a +44 mobile number')])
class AddServiceForm(Form): class AddServiceForm(Form):
@@ -86,7 +104,8 @@ class AddServiceForm(Form):
self.service_names = service_names self.service_names = service_names
super(AddServiceForm, self).__init__(*args, **kwargs) super(AddServiceForm, self).__init__(*args, **kwargs)
service_name = StringField(validators=[DataRequired(message='Please enter your service name')]) service_name = StringField(validators=[
DataRequired(message='Please enter your service name')])
def validate_service_name(self, a): def validate_service_name(self, a):
if self.service_name.data in self.service_names: if self.service_name.data in self.service_names:
@@ -95,6 +114,7 @@ class AddServiceForm(Form):
def validate_codes(field, code_type): def validate_codes(field, code_type):
codes = verify_codes_dao.get_codes(user_id=session['user_id'], code_type=code_type) codes = verify_codes_dao.get_codes(user_id=session['user_id'], code_type=code_type)
# TODO need to remove this manual logging.
print('validate_codes for user_id: {} are {}'.format(session['user_id'], codes)) print('validate_codes for user_id: {} are {}'.format(session['user_id'], codes))
if not [code for code in codes if validate_code(field, code)]: if not [code for code in codes if validate_code(field, code)]:
raise ValidationError('Code does not match') raise ValidationError('Code does not match')

41
app/main/views/code_not_received.py
View File

@@ -1,4 +1,5 @@
from flask import render_template, redirect, jsonify, session from flask import (
render_template, redirect, jsonify, session, url_for)
from app.main import main from app.main import main
from app.main.dao import users_dao from app.main.dao import users_dao
@@ -6,39 +7,28 @@ from app.main.forms import EmailNotReceivedForm, TextNotReceivedForm
from app.main.views import send_sms_code, send_email_code from app.main.views import send_sms_code, send_email_code
@main.route("/email-not-received", methods=['GET']) @main.route('/email-not-received', methods=['GET', 'POST'])
def email_not_received():
user = users_dao.get_user_by_id(session['user_id'])
return render_template('views/email-not-received.html',
form=EmailNotReceivedForm(email_address=user.email_address))
@main.route('/email-not-received', methods=['POST'])
def check_and_resend_email_code(): def check_and_resend_email_code():
form = EmailNotReceivedForm() # TODO there needs to be a way to regenerate a session id
user = users_dao.get_user_by_id(session['user_id'])
form = EmailNotReceivedForm(email_address=user.email_address)
if form.validate_on_submit(): if form.validate_on_submit():
user = users_dao.get_user_by_id(session['user_id'])
users_dao.update_email_address(id=user.id, email_address=form.email_address.data) users_dao.update_email_address(id=user.id, email_address=form.email_address.data)
send_email_code(user_id=user.id, email=user.email_address) send_email_code(user_id=user.id, email=user.email_address)
return redirect('/verify') return redirect(url_for('.verify'))
return jsonify(form.errors), 400 return render_template('views/email-not-received.html', form=form)
@main.route("/text-not-received", methods=['GET']) @main.route('/text-not-received', methods=['GET', 'POST'])
def text_not_received():
user = users_dao.get_user_by_id(session['user_id'])
return render_template('views/text-not-received.html', form=TextNotReceivedForm(mobile_number=user.mobile_number))
@main.route('/text-not-received', methods=['POST'])
def check_and_resend_text_code(): def check_and_resend_text_code():
form = TextNotReceivedForm() # TODO there needs to be a way to regenerate a session id
user = users_dao.get_user_by_id(session['user_id'])
form = TextNotReceivedForm(mobile_number=user.mobile_number)
if form.validate_on_submit(): if form.validate_on_submit():
user = users_dao.get_user_by_id(session['user_id'])
users_dao.update_mobile_number(id=user.id, mobile_number=form.mobile_number.data) users_dao.update_mobile_number(id=user.id, mobile_number=form.mobile_number.data)
send_sms_code(user_id=user.id, mobile_number=user.mobile_number) send_sms_code(user_id=user.id, mobile_number=user.mobile_number)
return redirect('/verify') return redirect(url_for('.verify'))
return jsonify(form.errors), 400 return render_template('views/text-not-received.html', form=form)
@main.route('/verification-not-received', methods=['GET']) @main.route('/verification-not-received', methods=['GET'])
@@ -48,6 +38,7 @@ def verification_code_not_received():
@main.route('/send-new-code', methods=['GET']) @main.route('/send-new-code', methods=['GET'])
def check_and_resend_verification_code(): def check_and_resend_verification_code():
# TODO there needs to be a way to generate a new session id
user = users_dao.get_user_by_id(session['user_id']) user = users_dao.get_user_by_id(session['user_id'])
send_sms_code(user.id, user.mobile_number) send_sms_code(user.id, user.mobile_number)
return redirect('/two-factor') return redirect(url_for('main.two_factor'))

45
app/main/views/register.py
View File

@@ -12,14 +12,19 @@ from app.main.views import send_sms_code, send_email_code
from app.models import User from app.models import User
@main.route("/register", methods=['GET']) # TODO how do we handle duplicate unverifed email addresses?
def render_register(): # malicious or otherwise.
return render_template('views/register.html', form=RegisterUserForm()) @main.route('/register', methods=['GET', 'POST'])
@main.route('/register', methods=['POST'])
def process_register(): def process_register():
form = RegisterUserForm() try:
existing_emails, existing_mobiles = zip(
*[(x.email_address, x.mobile_number) for x in
users_dao.get_all_users()])
except ValueError:
# Value error is raised if the db is empty.
existing_emails, existing_mobiles = [], []
form = RegisterUserForm(existing_emails, existing_mobiles)
if form.validate_on_submit(): if form.validate_on_submit():
user = User(name=form.name.data, user = User(name=form.name.data,
@@ -28,16 +33,16 @@ def process_register():
password=form.password.data, password=form.password.data,
created_at=datetime.now(), created_at=datetime.now(),
role_id=1) role_id=1)
try: users_dao.insert_user(user)
users_dao.insert_user(user) # TODO possibly there should be some exception handling
send_sms_code(user_id=user.id, mobile_number=form.mobile_number.data) # for sending sms and email codes.
send_email_code(user_id=user.id, email=form.email_address.data) # How do we report to the user there is a problem with
session['expiry_date'] = str(datetime.now() + timedelta(hours=1)) # sending codes apart from service unavailable?
session['user_id'] = user.id # at the moment i believe http 500 is fine.
except AdminApiClientException as e: send_sms_code(user_id=user.id, mobile_number=form.mobile_number.data)
return jsonify(admin_api_client_error=e.value) send_email_code(user_id=user.id, email=form.email_address.data)
except SQLAlchemyError: session['expiry_date'] = str(datetime.now() + timedelta(hours=1))
return jsonify(database_error='encountered database error'), 400 session['user_id'] = user.id
else: return redirect('/verify')
return jsonify(form.errors), 400
return redirect('/verify') return render_template('views/register.html', form=form)

46
app/main/views/sign_in.py
View File

@@ -1,4 +1,5 @@
from flask import render_template, redirect, jsonify from flask import (
render_template, redirect, jsonify, url_for)
from flask import session from flask import session
from app.main import main from app.main import main
@@ -8,28 +9,23 @@ from app.main.forms import LoginForm
from app.main.views import send_sms_code from app.main.views import send_sms_code
@main.route("/sign-in", methods=(['GET'])) @main.route('/sign-in', methods=(['GET', 'POST']))
def render_sign_in(): def sign_in():
return render_template('views/signin.html', form=LoginForm()) try:
form = LoginForm()
if form.validate_on_submit():
user = users_dao.get_user_by_email(form.email_address.data)
if user:
if not user.is_locked() and user.is_active() and check_hash(form.password.data, user.password):
send_sms_code(user.id, user.mobile_number)
session['user_id'] = user.id
return redirect(url_for('.two_factor'))
else:
users_dao.increment_failed_login_count(user.id)
# Vague error message for login
form.password.errors.append('Username or password is incorrect')
return render_template('views/signin.html', form=form)
@main.route('/sign-in', methods=(['POST'])) except:
def process_sign_in(): import traceback
form = LoginForm() traceback.print_exc()
if form.validate_on_submit():
user = users_dao.get_user_by_email(form.email_address.data)
if user is None:
return jsonify(authorization=False), 401
if user.is_locked():
return jsonify(locked_out=True), 401
if not user.is_active():
return jsonify(active_user=False), 401
if check_hash(form.password.data, user.password):
send_sms_code(user.id, user.mobile_number)
session['user_id'] = user.id
else:
users_dao.increment_failed_login_count(user.id)
return jsonify(authorization=False), 401
else:
return jsonify(form.errors), 400
return redirect('/two-factor')

1
app/main/views/sms.py
View File

@@ -3,6 +3,7 @@ from flask_login import login_required
from app.main import main from app.main import main
# TODO move this to the templates directory
message_templates = [ message_templates = [
{ {
'name': 'Reminder', 'name': 'Reminder',

31
app/main/views/two_factor.py
View File

@@ -1,6 +1,7 @@
import traceback
from flask import render_template, redirect, jsonify, session from flask import (
render_template, redirect, jsonify, session, url_for)
from flask_login import login_user from flask_login import login_user
from app.main import main from app.main import main
@@ -8,22 +9,14 @@ from app.main.dao import users_dao, verify_codes_dao
from app.main.forms import TwoFactorForm from app.main.forms import TwoFactorForm
@main.route("/two-factor", methods=['GET']) @main.route('/two-factor', methods=['GET', 'POST'])
def render_two_factor(): def two_factor():
return render_template('views/two-factor.html', form=TwoFactorForm()) form = TwoFactorForm()
if form.validate_on_submit():
user = users_dao.get_user_by_id(session['user_id'])
verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='sms')
login_user(user)
return redirect(url_for('.dashboard'))
@main.route('/two-factor', methods=['POST']) return render_template('views/two-factor.html', form=form)
def process_two_factor():
try:
form = TwoFactorForm()
if form.validate_on_submit():
user = users_dao.get_user_by_id(session['user_id'])
verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='sms')
login_user(user)
return redirect('/dashboard')
else:
return jsonify(form.errors), 400
except:
traceback.print_exc()

37
app/main/views/verify.py
View File

@@ -1,6 +1,6 @@
import traceback from flask import (
render_template, redirect, jsonify, session, url_for)
from flask import render_template, redirect, jsonify, session
from flask_login import login_user from flask_login import login_user
from app.main import main from app.main import main
@@ -8,23 +8,16 @@ from app.main.dao import users_dao, verify_codes_dao
from app.main.forms import VerifyForm from app.main.forms import VerifyForm
@main.route('/verify', methods=['GET']) @main.route('/verify', methods=['GET', 'POST'])
def render_verify(): def verify():
return render_template('views/verify.html', form=VerifyForm()) # TODO there needs to be a way to regenerate a session id
# or handle gracefully.
user = users_dao.get_user_by_id(session['user_id'])
@main.route('/verify', methods=['POST']) form = VerifyForm()
def process_verify(): if form.validate_on_submit():
try: verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='email')
form = VerifyForm() verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='sms')
if form.validate_on_submit(): users_dao.activate_user(user.id)
user = users_dao.get_user_by_id(session['user_id']) login_user(user)
verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='email') return redirect(url_for('.add_service'))
verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='sms') return render_template('views/verify.html', form=form)
users_dao.activate_user(user.id)
login_user(user)
return redirect('/add-service')
else:
return jsonify(form.errors), 400
except:
traceback.print_exc()

1
app/templates/admin_template.html
View File

@@ -1,3 +1,4 @@
{%- from "components/form-field.html" import render_field %}
{% extends "govuk_template.html" %} {% extends "govuk_template.html" %}
{% block head %} {% block head %}

7
app/templates/views/email-not-received.html
View File

@@ -11,17 +11,14 @@ GOV.UK Notify
<h1 class="heading-xlarge">Check your email address</h1> <h1 class="heading-xlarge">Check your email address</h1>
<p>Check your email address is correct and then resend the confirmation code.</p> <p>Check your email address is correct and then resend the confirmation code.</p>
<p> <p>
</p> </p>
<form autocomplete="off" action="" method="post"> <form autocomplete="off" action="" method="post">
{{ form.hidden_tag() }} {{ form.hidden_tag() }}
<label class="form-label">Email address</label> {{ render_field(form.email_address, class='form-control-2-3') }}
{{ form.email_address(class="form-control-2-3", autocomplete="off") }} <br>
<span class="font-xsmall">Your email address must end in .gov.uk</span> <span class="font-xsmall">Your email address must end in .gov.uk</span>
<p> <p>
<button class="button" href="verify" role="button">Resend confirmation code</button> <button class="button" role="button">Resend confirmation code</button>
</p> </p>
</form> </form>
</div> </div>

23
app/templates/views/register.html
View File

@@ -10,28 +10,17 @@ GOV.UK Notify | Create an account
<div class="column-two-thirds"> <div class="column-two-thirds">
<h1 class="heading-xlarge">Create an account</h1> <h1 class="heading-xlarge">Create an account</h1>
<p>If you've used GOV.UK Notify before, <a href="">sign in to your account</a>.</p> <p>If you've used GOV.UK Notify before, <a href="{{ url_for('.sign_in') }}">sign in to your account</a>.</p>
<form autocomplete="off" action="" method="post"> <form autocomplete="off" action="" method="post">
{{ form.hidden_tag() }} {{ form.hidden_tag() }}
<p>
<label class="form-label">Full name </label> {{ render_field(form.name, class='form-control-2-3') }}
{{ form.name(class="form-control-2-3", autocomplete="off") }} <br> {{ render_field(form.email_address, class='form-control-2-3') }}
</p>
<p>
<label class="form-label">Email address </label>
{{ form.email_address(class="form-control-2-3", autocomplete="off") }} <br>
<span class="font-xsmall">Your email address must end in .gov.uk</span> <span class="font-xsmall">Your email address must end in .gov.uk</span>
</p> {{ render_field(form.mobile_number, class='form-control-2-3') }}
<p> {{ render_field(form.password, class='form-control-2-3') }}
<label class="form-label">Mobile phone number</label>
{{ form.mobile_number(class="form-control-1-4", autocomplete="off") }} <br>
</p>
<p>
<label class="form-label">Create a password </label>
{{ form.password(class="form-control-1-4", autocomplete="off") }} <br>
<span class="font-xsmall">Your password must have at least 10 characters</span></label> <span class="font-xsmall">Your password must have at least 10 characters</span></label>
</p>
<p> <p>
<button class="button" role="button">Continue</button> <button class="button" role="button">Continue</button>
</p> </p>

13
app/templates/views/signin.html
View File

@@ -14,20 +14,13 @@ Sign in
<form autocomplete="off" action="" method="post"> <form autocomplete="off" action="" method="post">
{{ form.hidden_tag() }} {{ form.hidden_tag() }}
<p> {{ render_field(form.email_address, class='form-control-2-3') }}
<label class="form-label">Email address</label> {{ render_field(form.password, class='form-control-2-3') }}
{{ form.email_address(class="form-control-2-3", autocomplete="off") }} <br>
</p>
<p>
<label class="form-label">Password</label>
{{ form.password(class="form-control-1-4", autocomplete="off") }} <br>
</p>
<p> <p>
<span class="font-xsmall"><a href="">Forgotten password?</a></span> <span class="font-xsmall"><a href="">Forgotten password?</a></span>
</p> </p>
<p> <p>
<button class="button" href="two-factor" role="button">Continue</button> <button class="button" role="button">Continue</button>
</p> </p>
</form> </form>
</div> </div>

7
app/templates/views/text-not-received.html
View File

@@ -14,12 +14,9 @@ GOV.UK Notify
<form autocomplete="off" action="" method="post"> <form autocomplete="off" action="" method="post">
{{ form.hidden_tag() }} {{ form.hidden_tag() }}
{{ render_field(form.mobile_number, class='form-control-2-3') }}
<p> <p>
<label class="form-label">Mobile phone number</label> <button class="button" role="button">Resend confirmation code</button>
{{ form.mobile_number(class="form-control-1-4", autocomplete="off") }} <br>
</p>
<p>
<button class="button" href="verify" role="button">Resend confirmation code</button>
</p> </p>
</form> </form>
</div> </div>

9
app/templates/views/two-factor.html
View File

@@ -15,13 +15,10 @@ GOV.UK Notify | Text verification
<form autocomplete="off" action="" method="post"> <form autocomplete="off" action="" method="post">
{{ form.hidden_tag() }} {{ form.hidden_tag() }}
{{ render_field(form.sms_code, class='form-control-1-4') }}
<span class="font-xsmall"><a href="{{ url_for('.verification_code_not_received') }}">I haven't received a text</a></span>
<p> <p>
<label class="form-label">Enter verification code</label><br> <button class="button" role="button">Continue</button>
{{ form.sms_code(class="form-control-1-4", autocomplete="off") }} <br>
<span class="font-xsmall"><a href="verification-not-received">I haven't received a text</a></span>
</p>
<p>
<button class="button" href="dashboard" role="button">Continue</button>
</p> </p>
</form> </form>
</div> </div>

2
app/templates/views/verify-mobile.html
View File

@@ -15,7 +15,7 @@ GOV.UK Notify | Confirm mobile number
<p> <p>
<label class="form-label" for="email">Enter confirmation code<br> <label class="form-label" for="email">Enter confirmation code<br>
<input class="form-control-1-4" id="email" type="text"><br> <input class="form-control-1-4" id="email" type="text"><br>
<span class="font-xsmall"><a href="text-not-received-2">I haven't received a text</a></span> <span class="font-xsmall"><a href="{{ url_for('.text-not-received-2') }}">I haven't received a text</a></span>
</p> </p>
<p> <p>

17
app/templates/views/verify.html
View File

@@ -14,19 +14,12 @@ GOV.UK Notify | Confirm email address and mobile number
<form autocomplete="off" action="" method="post"> <form autocomplete="off" action="" method="post">
{{ form.hidden_tag() }} {{ form.hidden_tag() }}
{{ render_field(form.email_code, class='form-control-1-4') }}
<span class="font-xsmall"><a href="{{ url_for('.check_and_resend_email_code')}}">I haven't received an email</a></span>
{{ render_field(form.sms_code, class='form-control-1-4') }}
<span class="font-xsmall"><a href="{{ url_for('.check_and_resend_text_code') }}">I haven't received a text</a></span>
<p> <p>
<label class="form-label">Email confirmation code</label> <button class="button" role="button">Continue</button>
{{ form.email_code(class="form-control-1-4", autocomplete="off") }}<br>
<span class="font-xsmall"><a href="email-not-received">I haven't received an email</a></span>
</p>
<p>
<label class="form-label">Text message confirmation code</label>
{{ form.sms_code(class="form-control-1-4", autocomplete="off") }} <br>
<span class="font-xsmall"><a href="text-not-received">I haven't received a text</a></span>
</p>
<p>
<button class="button" href="add-service" role="button">Continue</button>
</p> </p>
</form> </form>
</div> </div>

9
tests/app/main/test_validators.py
View File

@@ -4,14 +4,11 @@ from app.main.forms import RegisterUserForm
def test_should_raise_validation_error_for_password(notifications_admin): def test_should_raise_validation_error_for_password(notifications_admin):
form = RegisterUserForm() form = RegisterUserForm([], [])
form.name.data = 'test' form.name.data = 'test'
form.email_address.data = 'teset@example.gov.uk' form.email_address.data = 'teset@example.gov.uk'
form.mobile_number.data = '+441231231231' form.mobile_number.data = '+441231231231'
form.password.data = 'password1234' form.password.data = 'password1234'
try: form.validate()
form.validate() assert 'That password is blacklisted, too common' in form.errors['password']
fail()
except:
assert 'That password is blacklisted, too common' in form.errors['password']

202
tests/app/main/views/test_code_not_received.py
View File

@@ -1,151 +1,163 @@
from app.main.dao import verify_codes_dao, users_dao from app.main.dao import verify_codes_dao, users_dao
from tests.app.main import create_test_user from tests.app.main import create_test_user
from flask import url_for
def test_should_render_email_code_not_received_template_and_populate_email_address(notifications_admin, def test_should_render_email_code_not_received_template_and_populate_email_address(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session): notify_db_session,
with notifications_admin.test_client() as client: mocker):
with client.session_transaction() as session: with notifications_admin.test_request_context():
user = create_test_user('pending') with notifications_admin.test_client() as client:
session['user_id'] = user.id with client.session_transaction() as session:
response = client.get('/email-not-received') _set_up_mocker(mocker)
assert response.status_code == 200 user = create_test_user('pending')
assert 'Check your email address is correct and then resend the confirmation code' \ session['user_id'] = user.id
in response.get_data(as_text=True) response = client.get(url_for('main.check_and_resend_email_code'))
assert 'value="test@user.gov.uk"' in response.get_data(as_text=True) assert response.status_code == 200
assert 'Check your email address is correct and then resend the confirmation code' \
in response.get_data(as_text=True)
assert 'value="test@user.gov.uk"' in response.get_data(as_text=True)
def test_should_check_and_resend_email_code_redirect_to_verify(notifications_admin, def test_should_check_and_resend_email_code_redirect_to_verify(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
_set_up_mocker(mocker) with client.session_transaction() as session:
user = create_test_user('pending') _set_up_mocker(mocker)
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user.id, code='12345', code_type='email') session['user_id'] = user.id
response = client.post('/email-not-received', verify_codes_dao.add_code(user.id, code='12345', code_type='email')
data={'email_address': 'test@user.gov.uk'}) response = client.post(url_for('main.check_and_resend_email_code'),
assert response.status_code == 302 data={'email_address': 'test@user.gov.uk'})
assert response.location == 'http://localhost/verify' assert response.status_code == 302
assert response.location == url_for('main.verify', _external=True)
def test_should_render_text_code_not_received_template(notifications_admin, def test_should_render_text_code_not_received_template(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
_set_up_mocker(mocker) with client.session_transaction() as session:
user = create_test_user('pending') _set_up_mocker(mocker)
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user.id, code='12345', code_type='sms') session['user_id'] = user.id
response = client.get('/text-not-received') verify_codes_dao.add_code(user.id, code='12345', code_type='sms')
assert response.status_code == 200 response = client.get(url_for('main.check_and_resend_text_code'))
assert 'Check your mobile phone number is correct and then resend the confirmation code.' \ assert response.status_code == 200
in response.get_data(as_text=True) assert 'Check your mobile phone number is correct and then resend the confirmation code.' \
assert 'value="+441234123412"' in response.get_data(as_text=True)
assert 'value="+441234123412"'
def test_should_check_and_redirect_to_verify(notifications_admin, def test_should_check_and_redirect_to_verify(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
_set_up_mocker(mocker) with client.session_transaction() as session:
user = create_test_user('pending') _set_up_mocker(mocker)
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user.id, code='12345', code_type='sms') session['user_id'] = user.id
response = client.post('/text-not-received', verify_codes_dao.add_code(user.id, code='12345', code_type='sms')
data={'mobile_number': '+441234123412'}) response = client.post(url_for('main.check_and_resend_text_code'),
assert response.status_code == 302 data={'mobile_number': '+441234123412'})
assert response.location == 'http://localhost/verify' assert response.status_code == 302
assert response.location == url_for('main.verify', _external=True)
def test_should_update_email_address_resend_code(notifications_admin, def test_should_update_email_address_resend_code(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
_set_up_mocker(mocker) with client.session_transaction() as session:
user = create_test_user('pending') _set_up_mocker(mocker)
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='email') session['user_id'] = user.id
response = client.post('/email-not-received', verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='email')
data={'email_address': 'new@address.gov.uk'}) response = client.post(url_for('main.check_and_resend_email_code'),
assert response.status_code == 302 data={'email_address': 'new@address.gov.uk'})
assert response.location == 'http://localhost/verify' assert response.status_code == 302
updated_user = users_dao.get_user_by_id(user.id) assert response.location == url_for('main.verify', _external=True)
assert updated_user.email_address == 'new@address.gov.uk' updated_user = users_dao.get_user_by_id(user.id)
assert updated_user.email_address == 'new@address.gov.uk'
def test_should_update_mobile_number_resend_code(notifications_admin, def test_should_update_mobile_number_resend_code(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
_set_up_mocker(mocker) with client.session_transaction() as session:
user = create_test_user('pending') _set_up_mocker(mocker)
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') session['user_id'] = user.id
response = client.post('/text-not-received', verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
data={'mobile_number': '+443456789012'}) response = client.post(url_for('main.check_and_resend_text_code'),
assert response.status_code == 302 data={'mobile_number': '+443456789012'})
assert response.location == 'http://localhost/verify' assert response.status_code == 302
updated_user = users_dao.get_user_by_id(user.id) assert response.location == url_for('main.verify', _external=True)
assert updated_user.mobile_number == '+443456789012' updated_user = users_dao.get_user_by_id(user.id)
assert updated_user.mobile_number == '+443456789012'
def test_should_render_verification_code_not_received(notifications_admin, def test_should_render_verification_code_not_received(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session): notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('active') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('active')
response = client.get('/verification-not-received') session['user_id'] = user.id
assert response.status_code == 200 response = client.get(url_for('main.verification_code_not_received'))
assert 'Resend verification code' in response.get_data(as_text=True) assert response.status_code == 200
assert 'If you no longer have access to the phone with the number you registered for this service, ' \ assert 'Resend verification code' in response.get_data(as_text=True)
'speak to your service manager to reset the number.' in response.get_data(as_text=True) assert 'If you no longer have access to the phone with the number you registered for this service, ' \
'speak to your service manager to reset the number.' in response.get_data(as_text=True)
def test_check_and_redirect_to_two_factor(notifications_admin, def test_check_and_redirect_to_two_factor(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('active') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('active')
_set_up_mocker(mocker) session['user_id'] = user.id
response = client.get('/send-new-code') _set_up_mocker(mocker)
assert response.status_code == 302 response = client.get(url_for('main.check_and_resend_verification_code'))
assert response.location == 'http://localhost/two-factor' assert response.status_code == 302
assert response.location == url_for('main.two_factor', _external=True)
def test_should_create_new_code_for_user(notifications_admin, def test_should_create_new_code_for_user(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session, notify_db_session,
mocker): mocker):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('active') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('active')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') session['user_id'] = user.id
_set_up_mocker(mocker) verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.get('/send-new-code') _set_up_mocker(mocker)
assert response.status_code == 302 response = client.get(url_for('main.check_and_resend_verification_code'))
assert response.location == 'http://localhost/two-factor' assert response.status_code == 302
codes = verify_codes_dao.get_codes(user_id=user.id, code_type='sms') assert response.location == url_for('main.two_factor', _external=True)
assert len(codes) == 2 codes = verify_codes_dao.get_codes(user_id=user.id, code_type='sms')
for x in ([used.code_used for used in codes]): assert len(codes) == 2
assert x is False for x in ([used.code_used for used in codes]):
assert x is False
def _set_up_mocker(mocker): def _set_up_mocker(mocker):

6
tests/app/main/views/test_register.py
View File

@@ -30,7 +30,7 @@ def test_process_register_returns_400_when_mobile_number_is_invalid(notification
'mobile_number': 'not good', 'mobile_number': 'not good',
'password': 'validPassword!'}) 'password': 'validPassword!'})
assert response.status_code == 400 assert response.status_code == 200
assert 'Please enter a +44 mobile number' in response.get_data(as_text=True) assert 'Please enter a +44 mobile number' in response.get_data(as_text=True)
@@ -45,7 +45,7 @@ def test_should_return_400_when_email_is_not_gov_uk(notifications_admin,
'mobile_number': '+44123412345', 'mobile_number': '+44123412345',
'password': 'validPassword!'}) 'password': 'validPassword!'})
assert response.status_code == 400 assert response.status_code == 200
assert 'Please enter a gov.uk email address' in response.get_data(as_text=True) assert 'Please enter a gov.uk email address' in response.get_data(as_text=True)
@@ -73,5 +73,5 @@ def test_should_return_400_if_password_is_blacklisted(notifications_admin, notif
'mobile_number': '+44123412345', 'mobile_number': '+44123412345',
'password': 'password1234'}) 'password': 'password1234'})
response.status_code == 400 response.status_code == 200
assert 'That password is blacklisted, too common' in response.get_data(as_text=True) assert 'That password is blacklisted, too common' in response.get_data(as_text=True)

84
tests/app/main/views/test_sign_in.py
View File

@@ -2,10 +2,12 @@ from datetime import datetime
from app.main.dao import users_dao from app.main.dao import users_dao
from app.models import User from app.models import User
from flask import url_for
def test_render_sign_in_returns_sign_in_template(notifications_admin): def test_render_sign_in_returns_sign_in_template(notifications_admin):
response = notifications_admin.test_client().get('/sign-in') with notifications_admin.test_request_context():
response = notifications_admin.test_client().get(url_for('main.sign_in'))
assert response.status_code == 200 assert response.status_code == 200
assert 'Sign in' in response.get_data(as_text=True) assert 'Sign in' in response.get_data(as_text=True)
assert 'Email address' in response.get_data(as_text=True) assert 'Email address' in response.get_data(as_text=True)
@@ -23,9 +25,11 @@ def test_process_sign_in_return_2fa_template(notifications_admin, notifications_
role_id=1, role_id=1,
state='active') state='active')
users_dao.insert_user(user) users_dao.insert_user(user)
response = notifications_admin.test_client().post('/sign-in', with notifications_admin.test_request_context():
data={'email_address': 'valid@example.gov.uk', response = notifications_admin.test_client().post(
'password': 'val1dPassw0rd!'}) url_for('main.sign_in'), data={
'email_address': 'valid@example.gov.uk',
'password': 'val1dPassw0rd!'})
assert response.status_code == 302 assert response.status_code == 302
assert response.location == 'http://localhost/two-factor' assert response.location == 'http://localhost/two-factor'
@@ -41,23 +45,27 @@ def test_should_return_locked_out_true_when_user_is_locked(notifications_admin,
role_id=1, role_id=1,
state='active') state='active')
users_dao.insert_user(user) users_dao.insert_user(user)
for _ in range(10): with notifications_admin.test_request_context():
notifications_admin.test_client().post('/sign-in', for _ in range(10):
data={'email_address': 'valid@example.gov.uk', notifications_admin.test_client().post(
'password': 'whatIsMyPassword!'}) url_for('main.sign_in'), data={
'email_address': 'valid@example.gov.uk',
'password': 'whatIsMyPassword!'})
response = notifications_admin.test_client().post('/sign-in', response = notifications_admin.test_client().post(
data={'email_address': 'valid@example.gov.uk', url_for('main.sign_in'), data={
'password': 'val1dPassw0rd!'}) 'email_address': 'valid@example.gov.uk',
'password': 'val1dPassw0rd!'})
assert response.status_code == 401 assert response.status_code == 200
assert '"locked_out": true' in response.get_data(as_text=True) assert 'Username or password is incorrect' in response.get_data(as_text=True)
another_bad_attempt = notifications_admin.test_client().post('/sign-in', another_bad_attempt = notifications_admin.test_client().post(
data={'email_address': 'valid@example.gov.uk', url_for('main.sign_in'), data={
'password': 'whatIsMyPassword!'}) 'email_address': 'valid@example.gov.uk',
assert another_bad_attempt.status_code == 401 'password': 'whatIsMyPassword!'})
assert '"locked_out": true' in response.get_data(as_text=True) assert another_bad_attempt.status_code == 200
assert 'Username or password is incorrect' in response.get_data(as_text=True)
def test_should_return_active_user_is_false_if_user_is_inactive(notifications_admin, def test_should_return_active_user_is_false_if_user_is_inactive(notifications_admin,
@@ -72,23 +80,27 @@ def test_should_return_active_user_is_false_if_user_is_inactive(notifications_ad
state='inactive') state='inactive')
users_dao.insert_user(user) users_dao.insert_user(user)
response = notifications_admin.test_client().post('/sign-in', with notifications_admin.test_request_context():
data={'email_address': 'inactive_user@example.gov.uk', response = notifications_admin.test_client().post(
'password': 'val1dPassw0rd!'}) url_for('main.sign_in'), data={
'email_address': 'inactive_user@example.gov.uk',
'password': 'val1dPassw0rd!'})
assert response.status_code == 401 assert response.status_code == 200
assert '"active_user": false' in response.get_data(as_text=True) assert 'Username or password is incorrect' in response.get_data(as_text=True)
def test_should_return_401_when_user_does_not_exist(notifications_admin, notifications_admin_db, notify_db_session): def test_should_return_200_when_user_does_not_exist(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().post('/sign-in', with notifications_admin.test_request_context():
data={'email_address': 'does_not_exist@gov.uk', response = notifications_admin.test_client().post(
'password': 'doesNotExist!'}) url_for('main.sign_in'), data={
'email_address': 'does_not_exist@gov.uk',
assert response.status_code == 401 'password': 'doesNotExist!'})
assert response.status_code == 200
assert 'Username or password is incorrect' in response.get_data(as_text=True)
def test_should_return_400_when_user_is_not_active(notifications_admin, notifications_admin_db, notify_db_session): def test_should_return_200_when_user_is_not_active(notifications_admin, notifications_admin_db, notify_db_session):
user = User(email_address='PendingUser@example.gov.uk', user = User(email_address='PendingUser@example.gov.uk',
password='val1dPassw0rd!', password='val1dPassw0rd!',
mobile_number='+441234123123', mobile_number='+441234123123',
@@ -97,11 +109,13 @@ def test_should_return_400_when_user_is_not_active(notifications_admin, notifica
role_id=1, role_id=1,
state='pending') state='pending')
users_dao.insert_user(user) users_dao.insert_user(user)
response = notifications_admin.test_client().post('/sign-in', with notifications_admin.test_request_context():
data={'email_address': 'PendingUser@example.gov.uk', response = notifications_admin.test_client().post(
'password': 'val1dPassw0rd!'}) url_for('main.sign_in'), data={
assert response.status_code == 401 'email_address': 'PendingUser@example.gov.uk',
assert '"active_user": false' in response.get_data(as_text=True) 'password': 'val1dPassw0rd!'})
assert response.status_code == 200
assert 'Username or password is incorrect' in response.get_data(as_text=True)
def _set_up_mocker(mocker): def _set_up_mocker(mocker):

78
tests/app/main/views/test_two_factor.py
View File

@@ -1,56 +1,60 @@
from flask import json from flask import json, url_for
from app.main.dao import verify_codes_dao from app.main.dao import verify_codes_dao
from tests.app.main import create_test_user from tests.app.main import create_test_user
def test_should_render_two_factor_page(notifications_admin, notifications_admin_db, notify_db_session): def test_should_render_two_factor_page(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().get('/two-factor') with notifications_admin.test_request_context():
assert response.status_code == 200 response = notifications_admin.test_client().get(url_for('main.two_factor'))
assert '''We've sent you a text message with a verification code.''' in response.get_data(as_text=True) assert response.status_code == 200
assert '''We've sent you a text message with a verification code.''' in response.get_data(as_text=True)
def test_should_login_user_and_redirect_to_dashboard(notifications_admin, notifications_admin_db, notify_db_session): def test_should_login_user_and_redirect_to_dashboard(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('active') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('active')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') session['user_id'] = user.id
response = client.post('/two-factor', verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
data={'sms_code': '12345'}) response = client.post(url_for('main.two_factor'),
data={'sms_code': '12345'})
assert response.status_code == 302 assert response.status_code == 302
assert response.location == 'http://localhost/dashboard' assert response.location == url_for('main.dashboard', _external=True)
def test_should_return_400_with_sms_code_error_when_sms_code_is_wrong(notifications_admin, def test_should_return_200_with_sms_code_error_when_sms_code_is_wrong(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session): notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('active') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('active')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') session['user_id'] = user.id
response = client.post('/two-factor', verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
data={'sms_code': '23456'}) response = client.post(url_for('main.two_factor'),
assert response.status_code == 400 data={'sms_code': '23456'})
assert {'sms_code': ['Code does not match']} == json.loads(response.get_data(as_text=True)) assert response.status_code == 200
assert 'Code does not match' in response.get_data(as_text=True)
def test_should_login_user_when_multiple_valid_codes_exist(notifications_admin, def test_should_login_user_when_multiple_valid_codes_exist(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session): notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('active') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('active')
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms') session['user_id'] = user.id
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='34567', code_type='sms') verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
assert len(verify_codes_dao.get_codes(user_id=user.id, code_type='sms')) == 3 verify_codes_dao.add_code(user_id=user.id, code='34567', code_type='sms')
response = client.post('/two-factor', assert len(verify_codes_dao.get_codes(user_id=user.id, code_type='sms')) == 3
data={'sms_code': '23456'}) response = client.post(url_for('main.two_factor'),
assert response.status_code == 302 data={'sms_code': '23456'})
codes = verify_codes_dao.get_codes(user_id=user.id, code_type='sms') assert response.status_code == 302
# query will only return codes where code_used == False codes = verify_codes_dao.get_codes(user_id=user.id, code_type='sms')
assert len(codes) == 0 # query will only return codes where code_used == False
assert len(codes) == 0

126
tests/app/main/views/test_verify.py
View File

@@ -1,79 +1,89 @@
from flask import json from flask import json, url_for
from app.main.dao import users_dao, verify_codes_dao from app.main.dao import users_dao, verify_codes_dao
from tests.app.main import create_test_user from tests.app.main import create_test_user
def test_should_return_verify_template(notifications_admin, notifications_admin_db, notify_db_session): def test_should_return_verify_template(notifications_admin, notifications_admin_db, notify_db_session):
response = notifications_admin.test_client().get('/verify') with notifications_admin.test_request_context():
assert response.status_code == 200 with notifications_admin.test_client() as client:
assert 'Activate your account' in response.get_data(as_text=True) # TODO this lives here until we work out how to
# reassign the session after it is lost mid register process
with client.session_transaction() as session:
user = create_test_user('pending')
session['user_id'] = user.id
response = client.get(url_for('main.verify'))
assert response.status_code == 200
assert (
"We've sent you confirmation codes by email and text message."
" You need to enter both codes here.") in response.get_data(as_text=True)
def test_should_redirect_to_add_service_when_code_are_correct(notifications_admin, def test_should_redirect_to_add_service_when_code_are_correct(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session): notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('pending') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') session['user_id'] = user.id
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email') verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post('/verify', verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
data={'sms_code': '12345', response = client.post(url_for('main.verify'),
'email_code': '23456'}) data={'sms_code': '12345',
assert response.status_code == 302 'email_code': '23456'})
assert response.location == 'http://localhost/add-service' assert response.status_code == 302
assert response.location == url_for('main.add_service', _external=True)
def test_should_activate_user_after_verify(notifications_admin, notifications_admin_db, notify_db_session): def test_should_activate_user_after_verify(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('pending') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') session['user_id'] = user.id
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email') verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
client.post('/verify', verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='email')
data={'sms_code': '12345', client.post(url_for('main.verify'),
'email_code': '23456'}) data={'sms_code': '12345',
'email_code': '23456'})
after_verify = users_dao.get_user_by_id(user.id) after_verify = users_dao.get_user_by_id(user.id)
assert after_verify.state == 'active' assert after_verify.state == 'active'
def test_should_return_400_when_codes_are_wrong(notifications_admin, notifications_admin_db, notify_db_session): def test_should_return_200_when_codes_are_wrong(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('pending') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('pending')
verify_codes_dao.add_code(user_id=user.id, code='23345', code_type='sms') session['user_id'] = user.id
verify_codes_dao.add_code(user_id=user.id, code='98456', code_type='email') verify_codes_dao.add_code(user_id=user.id, code='23345', code_type='sms')
response = client.post('/verify', verify_codes_dao.add_code(user_id=user.id, code='98456', code_type='email')
data={'sms_code': '12345', response = client.post(url_for('main.verify'),
'email_code': '23456'}) data={'sms_code': '12345',
assert response.status_code == 400 'email_code': '23456'})
expected = {'sms_code': ['Code must be 5 digits', 'Code does not match'], assert response.status_code == 200
'email_code': ['Code must be 5 digits', 'Code does not match']} resp_data = response.get_data(as_text=True)
errors = json.loads(response.get_data(as_text=True)) assert resp_data.count('Code does not match') == 2
assert len(errors) == 2
assert set(errors) == set(expected)
def test_should_mark_all_codes_as_used_when_many_codes_exist(notifications_admin, def test_should_mark_all_codes_as_used_when_many_codes_exist(notifications_admin,
notifications_admin_db, notifications_admin_db,
notify_db_session): notify_db_session):
with notifications_admin.test_client() as client: with notifications_admin.test_request_context():
with client.session_transaction() as session: with notifications_admin.test_client() as client:
user = create_test_user('pending') with client.session_transaction() as session:
session['user_id'] = user.id user = create_test_user('pending')
code1 = verify_codes_dao.add_code(user_id=user.id, code='23345', code_type='sms') session['user_id'] = user.id
code2 = verify_codes_dao.add_code(user_id=user.id, code='98456', code_type='email') code1 = verify_codes_dao.add_code(user_id=user.id, code='23345', code_type='sms')
code3 = verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms') code2 = verify_codes_dao.add_code(user_id=user.id, code='98456', code_type='email')
code4 = verify_codes_dao.add_code(user_id=user.id, code='23412', code_type='email') code3 = verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post('/verify', code4 = verify_codes_dao.add_code(user_id=user.id, code='23412', code_type='email')
data={'sms_code': '23345', response = client.post(url_for('main.verify'),
'email_code': '23412'}) data={'sms_code': '23345',
assert response.status_code == 302 'email_code': '23412'})
assert verify_codes_dao.get_code_by_id(code1).code_used is True assert response.status_code == 302
assert verify_codes_dao.get_code_by_id(code2).code_used is True assert verify_codes_dao.get_code_by_id(code1).code_used is True
assert verify_codes_dao.get_code_by_id(code3).code_used is True assert verify_codes_dao.get_code_by_id(code2).code_used is True
assert verify_codes_dao.get_code_by_id(code4).code_used is True assert verify_codes_dao.get_code_by_id(code3).code_used is True
assert verify_codes_dao.get_code_by_id(code4).code_used is True