Here's your email reset code:
+ +Cheers!
\ No newline at end of file diff --git a/backend/templates/password_request.html b/backend/templates/password_request.html new file mode 100644 index 0000000..5528923 --- /dev/null +++ b/backend/templates/password_request.html @@ -0,0 +1,4 @@ +Here's your password reset code:
+ +Cheers!
\ No newline at end of file diff --git a/backend/test/helpers.py b/backend/test/helpers.py index 1b83689..0c5b333 100644 --- a/backend/test/helpers.py +++ b/backend/test/helpers.py @@ -32,7 +32,6 @@ def get_cookie_from_header(response, cookie_name): for header in cookie_headers: attributes = header.split(";") - if cookie_name in attributes[0]: cookie = {} diff --git a/backend/test/profile/profile_test.py b/backend/test/profile/profile_test.py index 9caf6e4..4d99ff1 100644 --- a/backend/test/profile/profile_test.py +++ b/backend/test/profile/profile_test.py @@ -4,7 +4,7 @@ import re # Imports for pytest -from test.helpers import clear_all +from test.helpers import clear_all, db_add_user, generate_csrf_header from test.fixtures import app, client ## HELPER FUNCTIONS @@ -20,40 +20,25 @@ def find_token(contents): def test_profile(client): clear_all() - register_response = client.post("/auth/register", json={ + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + response = client.post("/auth/login", json={ "email": "asdfghjkl@gmail.com", - "username": "asdf", "password": "foobar" }) - - assert register_response.status_code == 200 - - # Check inbox - mailbox = poplib.POP3("pop3.mailtrap.io", 1100) - mailbox.user(os.environ["MAILTRAP_USERNAME"]) - mailbox.pass_(os.environ["MAILTRAP_PASSWORD"]) - - # Check the contents of the email, and harvest the token from there - raw_email = b"\n".join(mailbox.retr(1)[1]) - parsed_email = email.message_from_bytes(raw_email) - - # Assuming there's a HTML part - for part in parsed_email.walk(): - if part.get_content_type() == "text/html": - content = part.get_payload() - - # Extract the token from the HTML - token = find_token(content) - - response = client.post("/auth/register/verify", json={ - "token": token - }) - assert response.status_code == 200 - profile = client.get("/user/profile") - assert profile.status_code == 200 - assert profile.json == { + + profile2 = client.get("/user/profile", headers=generate_csrf_header(response)) + assert profile2.status_code == 200 + assert profile2.json == { "email": "asdfghjkl@gmail.com", "username": "asdf" } +def test_profile_fail(client): + clear_all() + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + profile2 = client.get("/user/profile") + assert profile2.status_code == 401 + diff --git a/backend/test/profile/reset_email_request_test.py b/backend/test/profile/reset_email_request_test.py new file mode 100644 index 0000000..3bea654 --- /dev/null +++ b/backend/test/profile/reset_email_request_test.py @@ -0,0 +1,93 @@ +import email +import os +import poplib +import re + +# Imports for pytest +from test.helpers import clear_all, db_add_user, generate_csrf_header +from test.fixtures import app, client +from test.mock.mock_mail import mailbox +from pytest_mock import mocker + +## HELPER FUNCTIONS + +def find_token(contents): + verify_link = "http://localhost:5001/verify/" + results = re.findall(rf"", contents) + + return results[0] + +### test starts here + +def test_email_request(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + reset = client.post("/user/reset_email/request", json={ + "email": "numail@gmail.com" + },headers=generate_csrf_header(response)) + + assert reset.status_code == 200 + +def test_email_request_invalid_email(client): + clear_all() + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + reset = client.post("/user/reset_email/request", json={ + "email": "chungas" + },headers=generate_csrf_header(response)) + + assert reset.status_code == 400 + +def test_email_request_invalid_token(client): + clear_all() + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + reset = client.post("/user/reset_email/request", json={ + "email": "chungas" + }) + + assert reset.status_code == 401 diff --git a/backend/test/profile/reset_email_test.py b/backend/test/profile/reset_email_test.py new file mode 100644 index 0000000..195577c --- /dev/null +++ b/backend/test/profile/reset_email_test.py @@ -0,0 +1,77 @@ +import email +import os +import poplib +import re + +# Imports for pytest +from test.helpers import clear_all, db_add_user, generate_csrf_header +from test.fixtures import app, client +from test.mock.mock_mail import mailbox +from pytest_mock import mocker + +## HELPER FUNCTIONS + +def find_token(contents): + verify_link = "http://localhost:5001/verify/" + results = re.findall(rf"", contents) + + return results[0] + +### test starts here + +def test_email_reset(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + before = len(mailbox.messages) + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + reset = client.post("/user/reset_email/request", json={ + "email": "numail@gmail.com" + },headers=generate_csrf_header(response)) + + assert reset.status_code == 200 + + after = len(mailbox.messages) + + assert after == before + 1 + + # Verify recipient + parsed_email = mailbox.get_message(-1) + + assert parsed_email["To"] == "numail@gmail.com" + + # Assuming there's a HTML part + for part in parsed_email.walk(): + if part.get_content_type() == "text/html": + content = part.get_payload() + # Extract the token from the HTML + token = find_token(content) + + response = client.post("/user/reset_email/reset", json={ + "reset_code": token, + },headers=generate_csrf_header(response)) + + assert response.status_code == 200 + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "numail@gmail.com", + "username": "asdf" + } + + diff --git a/backend/test/profile/reset_password_request_test.py b/backend/test/profile/reset_password_request_test.py new file mode 100644 index 0000000..442d71b --- /dev/null +++ b/backend/test/profile/reset_password_request_test.py @@ -0,0 +1,68 @@ +import email +import os +import poplib +import re + +# Imports for pytest +from test.helpers import clear_all, db_add_user, generate_csrf_header +from test.fixtures import app, client +from test.mock.mock_mail import mailbox +from pytest_mock import mocker + +## HELPER FUNCTIONS + +def find_token(contents): + verify_link = "http://localhost:5001/verify/" + results = re.findall(rf"", contents) + + return results[0] + +### test starts here + +def test_password_test(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + before = len(mailbox.messages) + + reset = client.post("/user/reset_password/request", json={ + },headers=generate_csrf_header(response)) + + assert reset.status_code == 200 + + after = len(mailbox.messages) + + assert after == before + 1 + +def test_password_request_invalid_token(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + reset = client.post("/user/reset_password/request", json={ + }) + + assert reset.status_code == 401 + \ No newline at end of file diff --git a/backend/test/profile/reset_password_reset_test.py b/backend/test/profile/reset_password_reset_test.py new file mode 100644 index 0000000..21f1b5d --- /dev/null +++ b/backend/test/profile/reset_password_reset_test.py @@ -0,0 +1,173 @@ +import email +import os +import poplib +import re + +# Imports for pytest +from test.helpers import clear_all, db_add_user, generate_csrf_header +from test.fixtures import app, client +from test.mock.mock_mail import mailbox +from pytest_mock import mocker + + +## HELPER FUNCTIONS + +def find_token(contents): + verify_link = "http://localhost:5001/verify/" + results = re.findall(rf"", contents) + + return results[0] + +### test starts here + +def test_password_reset(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + before = len(mailbox.messages) + reset = client.post("/user/reset_password/request", json={ + "email": "asdfghjkl@gmail.com" + },headers=generate_csrf_header(response)) + + assert reset.status_code == 200 + after = len(mailbox.messages) + assert after == before + 1 + + # Check inbox + parsed_email = mailbox.get_message(-1) + assert parsed_email["To"] == "asdfghjkl@gmail.com" + + # Assuming there's a HTML part + for part in parsed_email.walk(): + if part.get_content_type() == "text/html": + content = part.get_payload() + # Extract the token from the HTML + token = find_token(content) + + response2 = client.post("/user/reset_password/reset", json={ + "reset_code": token, + "password": "ghjkl" + }, headers=generate_csrf_header(response)) + + assert response2.status_code == 200 + + response = client.post("/auth/logout") + + assert response.status_code == 200 + + # Check there's no more cookies + assert len(client.cookie_jar) == 0 + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "ghjkl" + }) + + assert response.status_code == 200 + +def test_password_reset_invalid_token(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + before = len(mailbox.messages) + reset = client.post("/user/reset_password/request", json={ + "email": "asdfghjkl@gmail.com" + },headers=generate_csrf_header(response)) + + assert reset.status_code == 200 + after = len(mailbox.messages) + assert after == before + 1 + + # Check inbox + parsed_email = mailbox.get_message(-1) + assert parsed_email["To"] == "asdfghjkl@gmail.com" + + # Assuming there's a HTML part + for part in parsed_email.walk(): + if part.get_content_type() == "text/html": + content = part.get_payload() + # Extract the token from the HTML + token = find_token(content) + + response2 = client.post("/user/reset_password/reset", json={ + "reset_code": token, + "password": "ghjkl" + }) + + response2.status_code == 401 + +def test_password_reset_wrong_code(client, mocker): + clear_all() + mocker.patch("routes.user.mail", mailbox) + + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ + "email": "asdfghjkl@gmail.com", + "password": "foobar" + }) + assert response.status_code == 200 + + profile = client.get("/user/profile") + assert profile.status_code == 200 + assert profile.json == { + "email": "asdfghjkl@gmail.com", + "username": "asdf" + } + + before = len(mailbox.messages) + reset = client.post("/user/reset_password/request", json={ + "email": "asdfghjkl@gmail.com" + },headers=generate_csrf_header(response)) + + assert reset.status_code == 200 + after = len(mailbox.messages) + assert after == before + 1 + + # Check inbox + parsed_email = mailbox.get_message(-1) + assert parsed_email["To"] == "asdfghjkl@gmail.com" + + # Assuming there's a HTML part + for part in parsed_email.walk(): + if part.get_content_type() == "text/html": + content = part.get_payload() + # Extract the token from the HTML + token = find_token(content) + + response2 = client.post("/user/reset_password/reset", json={ + "reset_code": "wrong code wrong code wrong code", + "password": "ghjkl" + },headers=generate_csrf_header(response)) + + response2.status_code == 401 \ No newline at end of file diff --git a/backend/test/profile/set_name_test.py b/backend/test/profile/set_name_test.py index f8fbb29..2c3b1d1 100644 --- a/backend/test/profile/set_name_test.py +++ b/backend/test/profile/set_name_test.py @@ -4,7 +4,7 @@ import re # Imports for pytest -from test.helpers import clear_all, db_add_user +from test.helpers import clear_all, db_add_user, generate_csrf_header from test.fixtures import app, client ## HELPER FUNCTIONS @@ -20,36 +20,14 @@ def find_token(contents): def test_set_name(client): clear_all() - register_response = client.post("/auth/register", json={ + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ "email": "asdfghjkl@gmail.com", - "username": "asdf", "password": "foobar" }) - - assert register_response.status_code == 200 - - # Check inbox - mailbox = poplib.POP3("pop3.mailtrap.io", 1100) - mailbox.user(os.environ["MAILTRAP_USERNAME"]) - mailbox.pass_(os.environ["MAILTRAP_PASSWORD"]) - - # Check the contents of the email, and harvest the token from there - raw_email = b"\n".join(mailbox.retr(1)[1]) - parsed_email = email.message_from_bytes(raw_email) - - # Assuming there's a HTML part - for part in parsed_email.walk(): - if part.get_content_type() == "text/html": - content = part.get_payload() - - # Extract the token from the HTML - token = find_token(content) - - response = client.post("/auth/register/verify", json={ - "token": token - }) - assert response.status_code == 200 + profile = client.get("/user/profile") assert profile.status_code == 200 assert profile.json == { @@ -58,9 +36,8 @@ def test_set_name(client): } change = client.post("/user/set_name", json={ - "token": token, "username": "nunu" - }) + }, headers=generate_csrf_header(response)) assert change.status_code == 200 @@ -74,41 +51,15 @@ def test_set_name(client): def test_set_name_repeated(client): clear_all() - reused_username = "foo" - # Register the user in the database directly db_add_user("a@gmail.com", reused_username, "bar") + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") - register_response = client.post("/auth/register", json={ + response = client.post("/auth/login", json={ "email": "asdfghjkl@gmail.com", - "username": "asdf", "password": "foobar" }) - - assert register_response.status_code == 200 - - # Check inbox - mailbox = poplib.POP3("pop3.mailtrap.io", 1100) - mailbox.user(os.environ["MAILTRAP_USERNAME"]) - mailbox.pass_(os.environ["MAILTRAP_PASSWORD"]) - - # Check the contents of the email, and harvest the token from there - raw_email = b"\n".join(mailbox.retr(1)[1]) - parsed_email = email.message_from_bytes(raw_email) - - # Assuming there's a HTML part - for part in parsed_email.walk(): - if part.get_content_type() == "text/html": - content = part.get_payload() - - # Extract the token from the HTML - token = find_token(content) - - response = client.post("/auth/register/verify", json={ - "token": token - }) - assert response.status_code == 200 profile = client.get("/user/profile") assert profile.status_code == 200 @@ -118,8 +69,6 @@ def test_set_name_repeated(client): } change = client.post("/user/set_name", json={ - "token": token, "username": reused_username - }) - + }, headers=generate_csrf_header(response)) change.status_code == 400 diff --git a/backend/test/profile/stat_test.py b/backend/test/profile/stat_test.py index ea435a1..9c56d63 100644 --- a/backend/test/profile/stat_test.py +++ b/backend/test/profile/stat_test.py @@ -2,10 +2,9 @@ import os import poplib import re -from sqlite3 import paramstyle # Imports for pytest -from test.helpers import clear_all +from test.helpers import clear_all, db_add_user from test.fixtures import app, client ## HELPER FUNCTIONS @@ -21,35 +20,12 @@ def find_token(contents): def test_stats(client): clear_all() - register_response = client.post("/auth/register", json={ + db_add_user("asdfghjkl@gmail.com", "asdf", "foobar") + + response = client.post("/auth/login", json={ "email": "asdfghjkl@gmail.com", - "username": "asdf", "password": "foobar" }) - - assert register_response.status_code == 200 - - # Check inbox - mailbox = poplib.POP3("pop3.mailtrap.io", 1100) - mailbox.user(os.environ["MAILTRAP_USERNAME"]) - mailbox.pass_(os.environ["MAILTRAP_PASSWORD"]) - - # Check the contents of the email, and harvest the token from there - raw_email = b"\n".join(mailbox.retr(1)[1]) - parsed_email = email.message_from_bytes(raw_email) - - # Assuming there's a HTML part - for part in parsed_email.walk(): - if part.get_content_type() == "text/html": - content = part.get_payload() - - # Extract the token from the HTML - token = find_token(content) - - response = client.post("/auth/register/verify", json={ - "token": token - }) - assert response.status_code == 200 profile = client.get("/user/profile") assert profile.status_code == 200