notifications-admin/tests/app/main/views/test_verify.py

import json
import uuid
from unittest.mock import Mock

from flask import session as flask_session
from flask import url_for
from itsdangerous import SignatureExpired
from notifications_python_client.errors import HTTPError

from app.main.views.verify import activate_user
from tests.conftest import create_user


def test_should_return_verify_template(
    client_request,
    api_user_active,
    mock_send_verify_code,
):
    client_request.logout()
    # TODO this lives here until we work out how to
    # reassign the session after it is lost mid register process
    with client_request.session_transaction() as session:
        session['user_details'] = {'email_address': api_user_active['email_address'], 'id': api_user_active['id']}
    page = client_request.get('main.verify')

    assert page.h1.text == 'Check your phone'
    message = page.select('main p')[0].text
    assert message == "We’ve sent you a text message with a security code."


def test_should_redirect_to_add_service_when_sms_code_is_correct(
    client_request,
    api_user_active,
    mocker,
    mock_update_user_attribute,
    mock_check_verify_code,
    mock_create_event,
    fake_uuid,
):
    api_user_active['current_session_id'] = str(uuid.UUID(int=1))
    mocker.patch('app.user_api_client.get_user', return_value=api_user_active)

    with client_request.session_transaction() as session:
        session['user_details'] = {'email_address': api_user_active['email_address'], 'id': api_user_active['id']}
        # user's only just created their account so no session in the cookie
        session.pop('current_session_id', None)

    client_request.post(
        'main.verify',
        _data={'sms_code': '123456'},
        _expected_redirect=url_for('main.add_service', first='first'),
    )

    # make sure the current_session_id has changed to what the API returned
    with client_request.session_transaction() as session:
        assert session['current_session_id'] == str(uuid.UUID(int=1))

    mock_check_verify_code.assert_called_once_with(api_user_active['id'], '123456', 'sms')


def test_should_activate_user_after_verify(
    client_request,
    mocker,
    api_user_pending,
    mock_send_verify_code,
    mock_check_verify_code,
    mock_create_event,
    mock_activate_user,
):
    client_request.logout()
    mocker.patch('app.user_api_client.get_user', return_value=api_user_pending)
    with client_request.session_transaction() as session:
        session['user_details'] = {
            'email_address': api_user_pending['email_address'],
            'id': api_user_pending['id']
        }
    client_request.post('main.verify', _data={'sms_code': '123456'})
    assert mock_activate_user.called


def test_should_return_200_when_sms_code_is_wrong(
    client_request,
    api_user_active,
    mock_check_verify_code_code_not_found,
):
    with client_request.session_transaction() as session:
        session['user_details'] = {
            'email_address': api_user_active['email_address'],
            'id': api_user_active['id'],
        }

    page = client_request.post(
        'main.verify',
        _data={'sms_code': '123456'},
        _expected_status=200,
    )

    assert len(page.select('.usa-error-message')) == 1
    assert 'Code not found' in page.select_one('.usa-error-message').text


def test_verify_email_redirects_to_verify_if_token_valid(
    client_request,
    mocker,
    api_user_pending,
    mock_get_user_pending,
    mock_send_verify_code,
    mock_check_verify_code,
):
    token_data = {"user_id": api_user_pending['id'], "secret_code": 'UNUSED'}
    mocker.patch('app.main.views.verify.check_token', return_value=json.dumps(token_data))

    client_request.get(
        'main.verify_email',
        token='notreal',
        _expected_redirect=url_for('main.verify'),
    )

    assert not mock_check_verify_code.called
    mock_send_verify_code.assert_called_once_with(api_user_pending['id'], 'sms', api_user_pending['mobile_number'])

    with client_request.session_transaction() as session:
        assert session['user_details'] == {'email': api_user_pending['email_address'], 'id': api_user_pending['id']}


def test_verify_email_doesnt_verify_sms_if_user_on_email_auth(
    client_request,
    mocker,
    mock_send_verify_code,
    mock_check_verify_code,
    mock_activate_user,
    fake_uuid,
):
    pending_user_with_email_auth = create_user(auth_type='email_auth', state='pending', id=fake_uuid)

    mocker.patch('app.user_api_client.get_user', return_value=pending_user_with_email_auth)
    token_data = {"user_id": pending_user_with_email_auth['id'], "secret_code": 'UNUSED'}
    mocker.patch('app.main.views.verify.check_token', return_value=json.dumps(token_data))

    client_request.get(
        'main.verify_email',
        token='notreal',
        _expected_redirect=url_for('main.add_service', first='first'),
    )

    assert not mock_check_verify_code.called
    assert not mock_send_verify_code.called

    mock_activate_user.assert_called_once_with(pending_user_with_email_auth['id'])

    # user is logged in
    with client_request.session_transaction() as session:
        assert session['user_id'] == pending_user_with_email_auth['id']


def test_verify_email_redirects_to_email_sent_if_token_expired(
    client_request,
    mocker,
    api_user_pending,
):
    client_request.logout()
    mocker.patch('app.main.views.verify.check_token', side_effect=SignatureExpired('expired'))

    client_request.get(
        'main.verify_email',
        token='notreal',
        _expected_redirect=url_for('main.resend_email_verification'),
    )


def test_verify_email_redirects_to_sign_in_if_user_active(
    client_request,
    mocker,
    api_user_active,
    mock_get_user,
    mock_send_verify_code,
    mock_check_verify_code,
):
    client_request.logout()
    token_data = {"user_id": api_user_active['id'], "secret_code": 12345}
    mocker.patch('app.main.views.verify.check_token', return_value=json.dumps(token_data))

    page = client_request.get('main.verify_email', token='notreal', _follow_redirects=True)

    assert page.h1.text == 'Sign in'
    flash_banner = page.find('div', class_='banner-dangerous').string.strip()
    assert flash_banner == "That verification link has expired."


def test_verify_redirects_to_sign_in_if_not_logged_in(
    client_request
):
    client_request.logout()
    client_request.get(
        'main.verify',
        _expected_redirect=url_for('main.sign_in'),
    )


def test_activate_user_redirects_to_service_dashboard_if_user_already_belongs_to_service(
    mocker,
    client_request,
    service_one,
    sample_invite,
    api_user_active,
    mock_login,
    mock_get_service,
    mock_get_invited_user_by_id,
):
    mocker.patch('app.user_api_client.add_user_to_service', side_effect=HTTPError(
        response=Mock(
            status_code=400,
            json={
                "result": "error",
                "message": {f"User id: {api_user_active['id']} already part of service id: {service_one['id']}"}
            },
        ),
        message=f"User id: {api_user_active['id']} already part of service id: {service_one['id']}"
    ))

    # Can't use `with client.session_transaction()...` here since activate_session is not a view function
    flask_session['invited_user_id'] = sample_invite['id']

    response = activate_user(api_user_active['id'])

    assert response.location == url_for('main.service_dashboard', service_id=service_one['id'])

    flask_session.pop('invited_user_id')