mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-08-15 07:18:58 -04:00
f14a836baa
when a user enters their 2FA code, the API will store a random UUID
against them in the database - this code is then stored on the cookie
on the front end.
At the beginning of each authenticated request, we do the following
steps:
* Retrieve the user's cookie, and get the user_id from it
* Request that user's details from the database
* populate current_user with the DB model
* run the login_required decorator, which calls
current_user.is_authenticated
is_authenticated now also checks that the database model matches the
cookie for session_id. The potential states and meanings are as follows:
database | cookie | meaning
----------+--------+---------
None | None | New user, or system just been deployed.
| | Redirect to start page.
----------+--------+---------
'abc' | None | New browser (or cleared cookies). Redirect to
| | start page.
----------+--------+---------
None | 'abc' | Invalid state (cookie is set from user obj, so
| | would only happen if DB is cleared)
----------+--------+---------
'abc' | 'abc' | Same browser. Business as usual
----------+--------+---------
'abc' | 'def' | Different browser in cookie - db has been changed
| | since then. Redirect to start
189 lines
6.5 KiB
Python
189 lines
6.5 KiB
Python
import uuid
|
||
|
||
import pytest
|
||
from flask import url_for
|
||
from bs4 import BeautifulSoup
|
||
|
||
|
||
def test_render_sign_in_template_for_new_user(
|
||
client
|
||
):
|
||
response = client.get(url_for('main.sign_in', next=None))
|
||
assert response.status_code == 200
|
||
resp = response.get_data(as_text=True)
|
||
assert 'Sign in' in resp
|
||
assert 'Email address' in resp
|
||
assert 'Password' in resp
|
||
assert 'Forgot your password?' in resp
|
||
assert 'If you do not have an account, you can' in resp
|
||
assert 'Sign in again' not in resp
|
||
|
||
|
||
def test_sign_in_explains_session_timeout(client):
|
||
response = client.get(url_for('main.sign_in', next='/foo'))
|
||
assert response.status_code == 200
|
||
assert 'We signed you out because you haven’t used Notify for a while.' in response.get_data(as_text=True)
|
||
|
||
|
||
def test_sign_in_explains_other_browser(logged_in_client, api_user_active, mocker):
|
||
api_user_active.current_session_id = str(uuid.UUID(int=1))
|
||
mocker.patch('app.user_api_client.get_user', return_value=api_user_active)
|
||
|
||
with logged_in_client.session_transaction() as session:
|
||
session['current_session_id'] = str(uuid.UUID(int=2))
|
||
|
||
response = logged_in_client.get(url_for('main.sign_in', next='/foo'))
|
||
|
||
assert response.status_code == 200
|
||
assert 'We signed you out because you logged in to Notify on another device' in response.get_data(as_text=True)
|
||
|
||
|
||
def test_doesnt_redirect_to_sign_in_if_no_session_info(logged_in_client, api_user_active):
|
||
assert api_user_active.current_session_id is None
|
||
with logged_in_client.session_transaction() as session:
|
||
session['current_session_id'] = None
|
||
|
||
response = logged_in_client.get(url_for('main.choose_service'))
|
||
assert response.status_code == 200
|
||
|
||
|
||
@pytest.mark.parametrize('db_sess_id, cookie_sess_id', [
|
||
pytest.mark.xfail((None, None)), # OK - not used notify since browser signout was implemented
|
||
|
||
(uuid.UUID(int=1), None), # BAD - has used other browsers before but this is a brand new browser with no cookie
|
||
(uuid.UUID(int=1), uuid.UUID(int=2)), # BAD - this person has just signed in on a different browser
|
||
])
|
||
def test_redirect_to_sign_in_if_logged_in_from_other_browser(
|
||
logged_in_client,
|
||
api_user_active,
|
||
mocker,
|
||
db_sess_id,
|
||
cookie_sess_id
|
||
):
|
||
api_user_active.current_session_id = db_sess_id
|
||
mocker.patch('app.user_api_client.get_user', return_value=api_user_active)
|
||
with logged_in_client.session_transaction() as session:
|
||
session['current_session_id'] = str(cookie_sess_id)
|
||
|
||
response = logged_in_client.get(url_for('main.choose_service'))
|
||
assert response.status_code == 302
|
||
assert response.location == url_for('main.sign_in', next='/services', _external=True)
|
||
|
||
|
||
def test_logged_in_user_redirects_to_choose_service(
|
||
logged_in_client
|
||
):
|
||
response = logged_in_client.get(url_for('main.sign_in'))
|
||
assert response.location == url_for('main.choose_service', _external=True)
|
||
|
||
|
||
def test_process_sign_in_return_2fa_template(
|
||
client,
|
||
api_user_active,
|
||
mock_send_verify_code,
|
||
mock_get_user,
|
||
mock_get_user_by_email,
|
||
mock_verify_password,
|
||
):
|
||
response = client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': 'valid@example.gov.uk',
|
||
'password': 'val1dPassw0rd!'})
|
||
assert response.status_code == 302
|
||
assert response.location == url_for('.two_factor', _external=True)
|
||
mock_verify_password.assert_called_with(api_user_active.id, 'val1dPassw0rd!')
|
||
|
||
|
||
def test_should_return_locked_out_true_when_user_is_locked(
|
||
client,
|
||
mock_get_user_by_email_locked,
|
||
):
|
||
resp = client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': 'valid@example.gov.uk',
|
||
'password': 'whatIsMyPassword!'})
|
||
assert resp.status_code == 200
|
||
assert 'The email address or password you entered is incorrect' in resp.get_data(as_text=True)
|
||
|
||
|
||
def test_should_return_200_when_user_does_not_exist(
|
||
client,
|
||
mock_get_user_by_email_not_found,
|
||
):
|
||
response = client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': 'notfound@gov.uk',
|
||
'password': 'doesNotExist!'})
|
||
assert response.status_code == 200
|
||
assert 'The email address or password you entered is incorrect' in response.get_data(as_text=True)
|
||
|
||
|
||
def test_should_return_redirect_when_user_is_pending(
|
||
client,
|
||
mock_get_user_by_email_pending,
|
||
mock_verify_password,
|
||
):
|
||
response = client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': 'pending_user@example.gov.uk',
|
||
'password': 'val1dPassw0rd!'}, follow_redirects=True)
|
||
|
||
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
|
||
assert page.h1.string == 'Sign in'
|
||
assert response.status_code == 200
|
||
|
||
|
||
def test_should_attempt_redirect_when_user_is_pending(
|
||
client,
|
||
mock_get_user_by_email_pending,
|
||
mock_verify_password,
|
||
):
|
||
response = client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': 'pending_user@example.gov.uk',
|
||
'password': 'val1dPassw0rd!'})
|
||
assert response.location == url_for('main.resend_email_verification', _external=True)
|
||
assert response.status_code == 302
|
||
|
||
|
||
def test_not_fresh_session_login_redirects_to_dashboard(
|
||
logged_in_client,
|
||
api_user_active,
|
||
mock_login,
|
||
mock_get_user_by_email,
|
||
mock_verify_password,
|
||
mock_get_services_with_one_service,
|
||
):
|
||
with logged_in_client.session_transaction() as session:
|
||
assert session['_fresh']
|
||
session['_fresh'] = False
|
||
# This should skip the two factor
|
||
response = logged_in_client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': api_user_active.email_address,
|
||
'password': 'val1dPassw0rd!'})
|
||
assert response.status_code == 302
|
||
service_dct = mock_get_services_with_one_service(api_user_active.id)['data'][0]
|
||
assert response.location == url_for(
|
||
'main.service_dashboard', service_id=service_dct['id'], _external=True)
|
||
|
||
|
||
def test_not_fresh_session_login_redirects_to_choose_service(
|
||
logged_in_client,
|
||
api_user_active,
|
||
mock_login,
|
||
mock_get_user_by_email,
|
||
mock_verify_password,
|
||
mock_get_services,
|
||
):
|
||
with logged_in_client.session_transaction() as session:
|
||
assert session['_fresh']
|
||
session['_fresh'] = False
|
||
# This should skip the two factor
|
||
response = logged_in_client.post(
|
||
url_for('main.sign_in'), data={
|
||
'email_address': api_user_active.email_address,
|
||
'password': 'val1dPassw0rd!'})
|
||
assert response.status_code == 302
|
||
assert response.location == url_for('main.choose_service', _external=True)
|