mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-08-04 05:31:44 -04:00
c2d9a56ff4
This is the newest version. Pyup is complaining about vulnerabilities in version 1.0.1, specifically > Werkzeug version 2.0.2 improves the security of the debugger cookies. > "SameSite" attribute is set to "Strict" instead of "None", and the > secure flag is added when on HTTPS. Previously we were using whatever version of Werkzeug that Flask specified this pins it to get rid of the vulnerability without having to upgrade everything at once. This requires a few changes to tests which were relying on importing `session` and `current_user` from Flask. Previously it seemed that importing these in the tests referred to the same object that was being used in the app. This appears to no longer be the case. This commit works around that by: - using a context manager to get the contents of the session, like we already do in most tests - asserting that the mock which logs the user in is being called with the right values, rather than looking at the state of the `current_user` object (which was probably giving false certainty anyway)
67 lines
1.9 KiB
Python
67 lines
1.9 KiB
Python
from flask import url_for
|
|
|
|
from tests.conftest import SERVICE_ONE_ID
|
|
|
|
|
|
def test_render_sign_out_redirects_to_sign_in(
|
|
logged_in_client_with_session
|
|
):
|
|
with logged_in_client_with_session.session_transaction() as session:
|
|
assert session
|
|
response = logged_in_client_with_session.get(
|
|
url_for('main.sign_out'))
|
|
assert response.status_code == 302
|
|
assert response.location == url_for(
|
|
'main.index', _external=True)
|
|
with logged_in_client_with_session.session_transaction() as session:
|
|
assert not session
|
|
|
|
|
|
def test_sign_out_user(
|
|
client_request,
|
|
mock_get_service,
|
|
api_user_active,
|
|
mock_get_user,
|
|
mock_get_user_by_email,
|
|
mock_login,
|
|
mock_get_service_templates,
|
|
mock_has_no_jobs,
|
|
mock_has_permissions,
|
|
mock_get_template_statistics,
|
|
mock_get_service_statistics,
|
|
mock_get_usage,
|
|
mock_get_free_sms_fragment_limit,
|
|
mock_get_inbound_sms_summary,
|
|
mock_get_returned_letter_statistics_with_no_returned_letters
|
|
):
|
|
with client_request.session_transaction() as session:
|
|
assert session.get('user_id') is not None
|
|
# Check we are logged in
|
|
client_request.get(
|
|
'main.service_dashboard',
|
|
service_id=SERVICE_ONE_ID,
|
|
)
|
|
client_request.get(
|
|
'main.sign_out',
|
|
_expected_status=302,
|
|
_expected_redirect=url_for(
|
|
'main.index',
|
|
_external=True,
|
|
)
|
|
)
|
|
with client_request.session_transaction() as session:
|
|
assert session.get('user_id') is None
|
|
|
|
|
|
def test_sign_out_of_two_sessions(
|
|
logged_in_client_with_session
|
|
):
|
|
logged_in_client_with_session.get(
|
|
url_for('main.sign_out'))
|
|
with logged_in_client_with_session.session_transaction() as session:
|
|
assert not session
|
|
response = logged_in_client_with_session.get(
|
|
url_for('main.sign_out'))
|
|
|
|
assert response.status_code == 302
|