Merge pull request #1383 from alphagov/user-mobile-optional

User mobile optional

tests/app/user/test_rest.py

@@ -159,40 +159,53 @@ def test_create_user_missing_attribute_password(client, notify_db, notify_db_ses
     assert {'password': ['Missing data for required field.']} == json_resp['message']
 
 
-def test_put_user(client, sample_service):
-    """
-    Tests PUT endpoint '/' to update a user.
-    """
-    assert User.query.count() == 1
-    sample_user = sample_service.users[0]
-    sample_user.failed_login_count = 1
-    new_email = 'new@digital.cabinet-office.gov.uk'
+def test_can_create_user_with_email_auth_and_no_mobile(admin_request, notify_db_session):
     data = {
-        'name': sample_user.name,
-        'email_address': new_email,
-        'mobile_number': sample_user.mobile_number
+        'name': 'Test User',
+        'email_address': 'user@digital.cabinet-office.gov.uk',
+        'password': 'password',
+        'mobile_number': None,
+        'auth_type': EMAIL_AUTH_TYPE
     }
-    auth_header = create_authorization_header()
-    headers = [('Content-Type', 'application/json'), auth_header]
-    resp = client.put(
-        url_for('user.update_user', user_id=sample_user.id),
-        data=json.dumps(data),
-        headers=headers)
-    assert resp.status_code == 200
-    assert User.query.count() == 1
-    json_resp = json.loads(resp.get_data(as_text=True))
-    assert json_resp['data']['email_address'] == new_email
-    expected_permissions = default_service_permissions
-    fetched = json_resp['data']
 
-    assert str(sample_user.id) == fetched['id']
-    assert sample_user.name == fetched['name']
-    assert sample_user.mobile_number == fetched['mobile_number']
-    assert new_email == fetched['email_address']
-    assert sample_user.state == fetched['state']
-    assert sorted(expected_permissions) == sorted(fetched['permissions'][str(sample_service.id)])
-    # password wasn't updated, so failed_login_count stays the same
-    assert sample_user.failed_login_count == 1
+    json_resp = admin_request.post('user.create_user', _data=data, _expected_status=201)
+
+    assert json_resp['data']['auth_type'] == EMAIL_AUTH_TYPE
+    assert json_resp['data']['mobile_number'] is None
+
+
+def test_cannot_create_user_with_sms_auth_and_no_mobile(admin_request, notify_db_session):
+    data = {
+        'name': 'Test User',
+        'email_address': 'user@digital.cabinet-office.gov.uk',
+        'password': 'password',
+        'mobile_number': None,
+        'auth_type': SMS_AUTH_TYPE
+    }
+
+    json_resp = admin_request.post('user.create_user', _data=data, _expected_status=400)
+
+    assert json_resp['message'] == 'Mobile number must be set if auth_type is set to sms_auth'
+
+
+def test_cannot_create_user_with_empty_strings(admin_request, notify_db_session):
+    data = {
+        'name': '',
+        'email_address': '',
+        'password': 'password',
+        'mobile_number': '',
+        'auth_type': EMAIL_AUTH_TYPE
+    }
+    resp = admin_request.post(
+        'user.create_user',
+        _data=data,
+        _expected_status=400
+    )
+    assert resp['message'] == {
+        'email_address': ['Not a valid email address'],
+        'mobile_number': ['Invalid phone number: Not enough digits'],
+        'name': ['Invalid name']
+    }
 
 
 @pytest.mark.parametrize('user_attribute, user_value', [
@@ -218,63 +231,6 @@ def test_post_user_attribute(client, sample_user, user_attribute, user_value):
     assert json_resp['data'][user_attribute] == user_value
 
 
-def test_put_user_update_password(client, sample_service):
-    """
-    Tests PUT endpoint '/' to update a user including their password.
-    """
-    assert User.query.count() == 1
-    sample_user = sample_service.users[0]
-    new_password = '1234567890'
-    data = {
-        'name': sample_user.name,
-        'email_address': sample_user.email_address,
-        'mobile_number': sample_user.mobile_number,
-        'password': new_password
-    }
-    auth_header = create_authorization_header()
-    headers = [('Content-Type', 'application/json'), auth_header]
-    resp = client.put(
-        url_for('user.update_user', user_id=sample_user.id),
-        data=json.dumps(data),
-        headers=headers)
-    assert resp.status_code == 200
-    assert User.query.count() == 1
-    json_resp = json.loads(resp.get_data(as_text=True))
-    assert json_resp['data']['password_changed_at'] is not None
-    data = {'password': new_password}
-    auth_header = create_authorization_header()
-    headers = [('Content-Type', 'application/json'), auth_header]
-    resp = client.post(
-        url_for('user.verify_user_password', user_id=str(sample_user.id)),
-        data=json.dumps(data),
-        headers=headers)
-    assert resp.status_code == 204
-
-
-def test_put_user_not_exists(client, sample_user, fake_uuid):
-    """
-    Tests PUT endpoint '/' to update a user doesn't exist.
-    """
-    assert User.query.count() == 1
-    new_email = 'new@digital.cabinet-office.gov.uk'
-    data = {'email_address': new_email}
-    auth_header = create_authorization_header()
-    headers = [('Content-Type', 'application/json'), auth_header]
-    resp = client.put(
-        url_for('user.update_user', user_id=fake_uuid),
-        data=json.dumps(data),
-        headers=headers)
-    assert resp.status_code == 404
-    assert User.query.count() == 1
-    user = User.query.filter_by(id=str(sample_user.id)).first()
-    json_resp = json.loads(resp.get_data(as_text=True))
-    assert json_resp['result'] == "error"
-    assert json_resp['message'] == 'No result found'
-
-    assert user == sample_user
-    assert user.email_address != new_email
-
-
 def test_get_user_by_email(client, sample_service):
     sample_user = sample_service.users[0]
     header = create_authorization_header()
@@ -529,37 +485,6 @@ def test_update_user_password_saves_correctly(client, sample_service):
     assert resp.status_code == 204
 
 
-def test_update_user_resets_failed_login_count_if_updating_password(client, sample_service):
-    user = sample_service.users[0]
-    user.failed_login_count = 1
-
-    resp = client.put(
-        url_for('user.update_user', user_id=user.id),
-        data=json.dumps({
-            'name': user.name,
-            'email_address': user.email_address,
-            'mobile_number': user.mobile_number,
-            'password': 'foo'
-        }),
-        headers=[('Content-Type', 'application/json'), create_authorization_header()]
-    )
-
-    assert resp.status_code == 200
-    assert user.failed_login_count == 0
-
-
-def test_update_user_auth_type(admin_request, sample_user):
-    assert sample_user.auth_type == 'sms_auth'
-    resp = admin_request.post(
-        'user.update_user_attribute',
-        user_id=sample_user.id,
-        _data={'auth_type': 'email_auth'},
-    )
-
-    assert resp['data']['id'] == str(sample_user.id)
-    assert resp['data']['auth_type'] == 'email_auth'
-
-
 def test_activate_user(admin_request, sample_user):
     sample_user.state = 'pending'
 
@@ -574,3 +499,78 @@ def test_activate_user_fails_if_already_active(admin_request, sample_user):
     resp = admin_request.post('user.activate_user', user_id=sample_user.id, _expected_status=400)
     assert resp['message'] == 'User already active'
     assert sample_user.state == 'active'
+
+
+def test_update_user_auth_type(admin_request, sample_user):
+    assert sample_user.auth_type == 'sms_auth'
+    resp = admin_request.post(
+        'user.update_user_attribute',
+        user_id=sample_user.id,
+        _data={'auth_type': 'email_auth'},
+    )
+
+    assert resp['data']['id'] == str(sample_user.id)
+    assert resp['data']['auth_type'] == 'email_auth'
+
+
+def test_can_set_email_auth_and_remove_mobile_at_same_time(admin_request, sample_user):
+    sample_user.auth_type = SMS_AUTH_TYPE
+
+    admin_request.post(
+        'user.update_user_attribute',
+        user_id=sample_user.id,
+        _data={
+            'mobile_number': None,
+            'auth_type': EMAIL_AUTH_TYPE,
+        }
+    )
+
+    assert sample_user.mobile_number is None
+    assert sample_user.auth_type == EMAIL_AUTH_TYPE
+
+
+def test_cannot_remove_mobile_if_sms_auth(admin_request, sample_user):
+    sample_user.auth_type = SMS_AUTH_TYPE
+
+    json_resp = admin_request.post(
+        'user.update_user_attribute',
+        user_id=sample_user.id,
+        _data={'mobile_number': None},
+        _expected_status=400
+    )
+
+    assert json_resp['message'] == 'Mobile number must be set if auth_type is set to sms_auth'
+
+
+def test_can_remove_mobile_if_email_auth(admin_request, sample_user):
+    sample_user.auth_type = EMAIL_AUTH_TYPE
+
+    admin_request.post(
+        'user.update_user_attribute',
+        user_id=sample_user.id,
+        _data={'mobile_number': None},
+    )
+
+    assert sample_user.mobile_number is None
+
+
+def test_cannot_update_user_with_mobile_number_as_empty_string(admin_request, sample_user):
+    sample_user.auth_type = EMAIL_AUTH_TYPE
+
+    resp = admin_request.post(
+        'user.update_user_attribute',
+        user_id=sample_user.id,
+        _data={'mobile_number': ''},
+        _expected_status=400
+    )
+    assert resp['message']['mobile_number'] == ['Invalid phone number: Not enough digits']
+
+
+def test_cannot_update_user_password_using_attributes_method(admin_request, sample_user):
+    resp = admin_request.post(
+        'user.update_user_attribute',
+        user_id=sample_user.id,
+        _data={'password': 'foo'},
+        _expected_status=400
+    )
+    assert resp['message']['_schema'] == ['Unknown field name password']