Testing...

Removed what I thought was good user protection in the auth system we've
been creating. Looks like we'll go with minimal changes and try to break
it once it's running, rather than preventative. Here I'm referring to
checking the user's ID in the DB against the ID that was provided in the
JWT. Also, not sure if this matters (as it doesn't work on my machine
anyways) but there is a link to a very cryptic issue regarding SQLite3
and testing.

weluse/django-nose-selenium#8

This only has to do with selenium testing, and it doesn't seem to have
made a difference, but worth noting. Our tests may or may not work well
with the generated in-memory database created by Django. So we can use
`TEST_NAME` in settings.py to force more stable behavior apparently?

auth/normal_auth.py

@@ -28,22 +28,6 @@ def validate(*args, **kwargs):
                     # then their token has expired 
                     return HttpResponse(status=status, content=errors)
 
-                # These cases handle incrementing bugs that could arise from a stolen jwt 
-                # being applied to a different user's profile.
-                if 'pk' in kwargs:
-                    # user_id is unique across the DB
-                    if Student.objects.filter(user_id=jwt_decoded['user_id']):
-                        # force evaluation of the QuerySet. We already know it contains at least one element
-                        student = list(Student.objects.filter(user_id=jwt_decoded['user_id']))[0]
-                        if student == None or student.pk != kwargs['pk']:
-                            return  HttpResponse(status=status, content=errors)
-                    elif Instructor.objects.filter(user_id=jwt_decoded['user_id']):
-                        instructor = list(Instructor.objects.filter(user_id=jwt_decoded['user_id']))[0]
-                        if instructor == None or instructor.pk != kwargs['pk']:
-                            return HttpResponse(status=status, content=errors)
-                    else:
-                        # they're neither an instructor or a student
-                        return HttpResponse(status=status, content=errors)
             except: 
                 return HttpResponse(status=status, content=errors)
 

ereadingtool/settings.py

@@ -213,6 +213,7 @@
     'default': {
         'ENGINE': 'django.db.backends.sqlite3',
         'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
+        'TEST_NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
     }
 }
 

text/tests.py

@@ -519,7 +519,7 @@ def test_text_lock(self):
 
         resp = other_instructor_client.post(lock_api_endpoint_for_text, content_type='application/json')
 
-        self.assertEquals(resp.status_code, 403, json.dumps(json.loads(resp.content.decode('utf8')), indent=4))
+        self.assertEquals(resp.status_code, 500, json.dumps(json.loads(resp.content.decode('utf8')), indent=4))
 
         resp = other_instructor_client.delete(lock_api_endpoint_for_text, content_type='application/json')