darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-08-24 00:06:16 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2831 from alphagov/email-expiry

Browse Source 
don't expire email sign in codes on use
This commit is contained in:
Leo Hemsted
2020-05-04 12:15:09 +01:00
committed by GitHub
parent a828787514 789112a31f
commit f67625a9fa
3 changed files with 33 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/user/rest.py
View File

@@ -190,7 +190,8 @@ def verify_user_code(user_id):
# only relevant from sms # only relevant from sms
increment_failed_login_count(user_to_verify) increment_failed_login_count(user_to_verify)
raise InvalidRequest("Code not found", status_code=404) raise InvalidRequest("Code not found", status_code=404)
if datetime.utcnow() > code.expiry_datetime or code.code_used: # TODO: Fix email flow so that clicking link doesn't expire emails
if datetime.utcnow() > code.expiry_datetime or (code.code_used and data['code_type'] != 'email'):
# sms and email # sms and email
increment_failed_login_count(user_to_verify) increment_failed_login_count(user_to_verify)
raise InvalidRequest("Code has expired", status_code=400) raise InvalidRequest("Code has expired", status_code=400)

1
pytest.ini
View File

@@ -6,3 +6,4 @@ env =
FIRETEXT_API_KEY=Firetext FIRETEXT_API_KEY=Firetext
NOTIFICATION_QUEUE_PREFIX=testing NOTIFICATION_QUEUE_PREFIX=testing
addopts = -v -p no:warnings addopts = -v -p no:warnings
xfail_strict = true

50
tests/app/user/test_rest_verify.py
View File

@@ -74,25 +74,29 @@ def test_user_verify_code_bad_code_and_increments_failed_login_count(client,
assert User.query.get(sample_sms_code.user.id).failed_login_count == 1 assert User.query.get(sample_sms_code.user.id).failed_login_count == 1
def test_user_verify_code_expired_code_and_increments_failed_login_count( @freeze_time('2020-04-01 12:00')
client, @pytest.mark.parametrize('code_type', [EMAIL_TYPE, SMS_TYPE])
sample_sms_code): def test_user_verify_code_expired_code_and_increments_failed_login_count(code_type, admin_request, sample_user):
assert not VerifyCode.query.first().code_used magic_code = str(uuid.uuid4())
sample_sms_code.expiry_datetime = ( verify_code = create_user_code(sample_user, magic_code, code_type)
datetime.utcnow() - timedelta(hours=1)) verify_code.expiry_datetime = datetime(2020, 4, 1, 11, 59)
db.session.add(sample_sms_code)
db.session.commit() data = {
data = json.dumps({ 'code_type': code_type,
'code_type': sample_sms_code.code_type, 'code': magic_code
'code': sample_sms_code.txt_code}) }
auth_header = create_authorization_header()
resp = client.post( admin_request.post(
url_for('user.verify_user_code', user_id=sample_sms_code.user.id), 'user.verify_user_code',
data=data, user_id=sample_user.id,
headers=[('Content-Type', 'application/json'), auth_header]) _data=data,
assert resp.status_code == 400 _expected_status=400
assert not VerifyCode.query.first().code_used )
assert User.query.get(sample_sms_code.user.id).failed_login_count == 1
assert verify_code.code_used is False
assert sample_user.logged_in_at is None
assert sample_user.current_session_id is None
assert sample_user.failed_login_count == 1
@freeze_time("2016-01-01 10:00:00.000000") @freeze_time("2016-01-01 10:00:00.000000")
@@ -448,7 +452,13 @@ def test_user_verify_email_code(admin_request, sample_user, auth_type):
assert sample_user.current_session_id is not None assert sample_user.current_session_id is not None
@pytest.mark.parametrize('code_type', [EMAIL_TYPE, SMS_TYPE]) @pytest.mark.parametrize('code_type', [
pytest.param(
EMAIL_TYPE,
marks=pytest.mark.xfail(raises=AssertionError, reason='Email code expiry disabled'),
),
SMS_TYPE
])
@freeze_time('2016-01-01T12:00:00') @freeze_time('2016-01-01T12:00:00')
def test_user_verify_email_code_fails_if_code_already_used(admin_request, sample_user, code_type): def test_user_verify_email_code_fails_if_code_already_used(admin_request, sample_user, code_type):
magic_code = str(uuid.uuid4()) magic_code = str(uuid.uuid4())