-
Notifications
You must be signed in to change notification settings - Fork 101
/
tests.py
508 lines (422 loc) · 19.6 KB
/
tests.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
"""
We're able to borrow most of django's auth view tests.
"""
import itertools
try:
from unittest import skipIf, skipUnless
except ImportError: # Python < 2.7
from django.utils.unittest import skipIf, skipUnless
from django.core import mail
from django.core.urlresolvers import reverse
from django.contrib.auth import REDIRECT_FIELD_NAME, get_user_model
from django.contrib.auth.forms import AuthenticationForm
from django.contrib.auth.tests.utils import skipIfCustomUser
from django.utils.http import urlquote
from django.test import TestCase
from django.test.client import RequestFactory
from django.test.utils import override_settings
from django.utils.encoding import force_text
from django.utils.translation import ugettext as _
from django.forms.fields import Field
from django.conf import settings
try:
# Django 1.6
from django.contrib.auth.tests.test_views import (
AuthViewNamedURLTests,
PasswordResetTest,
ChangePasswordTest,
LoginTest,
LoginURLSettings,
LogoutTest,
)
except ImportError:
# Django 1.5
from django.contrib.auth.tests.views import (
AuthViewNamedURLTests,
PasswordResetTest,
ChangePasswordTest,
LoginTest,
LoginURLSettings,
LogoutTest,
)
try:
from django.contrib.sites.shortcuts import get_current_site
except ImportError: # Django < 1.7
def get_current_site(request):
from django.contrib.sites.models import Site, RequestSite
if Site._meta.installed:
return Site.objects.get_current()
else:
return RequestSite(request)
from authtools.admin import BASE_FIELDS
from authtools.forms import UserCreationForm, UserChangeForm, FriendlyPasswordResetForm
from authtools.views import PasswordResetCompleteView, resolve_url_lazy
User = get_user_model()
def skipIfNotCustomUser(test_func):
return skipIf(settings.AUTH_USER_MODEL == 'auth.User', 'Built-in User model in use')(test_func)
class AuthViewNamedURLTests(AuthViewNamedURLTests):
urls = 'authtools.urls'
class UtilsTest(TestCase):
def test_resolve_lazy_unicode(self):
self.assertTrue(resolve_url_lazy(u'/'))
class PasswordResetTest(PasswordResetTest):
urls = 'tests.urls'
# these use custom, test-specific urlpatterns that we don't have
test_admin_reset = None
test_reset_custom_redirect = None
test_reset_custom_redirect_named = None
test_email_found_custom_from = None
test_confirm_redirect_custom = None
test_confirm_redirect_custom_named = None
def assertFormError(self, response, error):
"""Assert that error is found in response.context['form'] errors"""
form_errors = list(itertools.chain(*response.context['form'].errors.values()))
self.assertIn(force_text(error), form_errors)
# test the django 1.5 behavior
def test_email_not_found_in_friendly_password_reset_form(self):
"Error is raised if the provided email address isn't currently registered"
response = self.client.get('/friendly_password_reset/')
self.assertEqual(response.status_code, 200)
response = self.client.post('/friendly_password_reset/',
{'email': 'not_a_real_email@email.com'})
self.assertFormError(response, FriendlyPasswordResetForm.error_messages['unknown'])
self.assertEqual(len(mail.outbox), 0)
def test_user_only_fetched_once(self):
url, confirm_path = self._test_confirm_start()
with self.assertNumQueries(1):
# the confirm view is only allowed to fetch the user object a
# single time
self.client.get(confirm_path)
def test_confirm_invalid_path(self):
# django has a similar test, but it tries to test an invalid path AND
# an invalid form at the same time. We need a test case with an invalid
# path, but valid form.
url, path = self._test_confirm_start()
path = path[:-5] + ("0" * 4) + path[-1]
self.client.post(path, {
'new_password1': 'anewpassword',
'new_password2': 'anewpassword',
})
# Check the password has not been changed
u = User.objects.get(email='staffmember@example.com')
self.assertTrue(not u.check_password("anewpassword"))
def test_confirm_done(self):
"""
Password reset complete page should be rendered with 'login_url'
in its context.
"""
url, path = self._test_confirm_start()
response = self.client.post(path, {'new_password1': 'anewpassword',
'new_password2': 'anewpassword'})
self.assertEqual(response.status_code, 302)
response = self.client.get(response['Location'])
self.assertIn('login_url', response.context)
def test_confirm_login_url_resolves(self):
complete_view = PasswordResetCompleteView.as_view(login_url='login_required')
request_factory = RequestFactory()
response = complete_view(request_factory.get('/xxx/'))
self.assertEqual(response.context_data['login_url'], reverse('login_required'))
complete_view2 = PasswordResetCompleteView.as_view(login_url='/dont-change-me/')
response = complete_view2(request_factory.get('/xxx/'))
self.assertEqual(response.context_data['login_url'], '/dont-change-me/')
def test_confirm_and_login(self):
url, path = self._test_confirm_start()
path = path.replace('reset', 'reset_and_login')
response = self.client.post(path, {'new_password1': 'anewpassword',
'new_password2': 'anewpassword'})
self.assertEqual(response.status_code, 302)
# verify that we're actually logged in
response = self.client.get('/login_required/')
self.assertEqual(response.status_code, 200)
class ChangePasswordTest(ChangePasswordTest):
urls = 'authtools.urls'
test_password_change_redirect_custom = None
test_password_change_redirect_custom_named = None
# the builtin test doesn't logout after the password is changed, so
# fail_login doesn't do anything when disallow_authenticated is True.
def test_password_change_succeeds(self):
self.login()
self.client.post('/password_change/', {
'old_password': 'password',
'new_password1': 'password1',
'new_password2': 'password1',
})
self.logout()
self.fail_login()
self.login(password='password1')
class LoginTest(LoginTest):
urls = 'authtools.urls'
# the built-in tests depend on the django urlpatterns (they reverse
# django.contrib.auth.views.login)
def test_current_site_in_context_after_login(self):
response = self.client.get(reverse('login'))
self.assertEqual(response.status_code, 200)
site = get_current_site(response.request)
self.assertEqual(response.context['site'], site)
self.assertEqual(response.context['site_name'], site.name)
self.assertTrue(isinstance(response.context['form'], AuthenticationForm),
'Login form is not an AuthenticationForm')
def test_security_check(self, password='password'):
login_url = reverse('login')
# Those URLs should not pass the security check
for bad_url in ('http://example.com',
'https://example.com',
'ftp://exampel.com',
'//example.com'):
nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
'url': login_url,
'next': REDIRECT_FIELD_NAME,
'bad_url': urlquote(bad_url),
}
response = self.client.post(nasty_url, {
'username': 'testclient',
'password': password,
})
self.assertEqual(response.status_code, 302)
self.assertFalse(bad_url in response['Location'],
"%s should be blocked" % bad_url)
# These URLs *should* still pass the security check
for good_url in ('/view/?param=http://example.com',
'/view/?param=https://example.com',
'/view?param=ftp://exampel.com',
'view/?param=//example.com',
'//testserver/',
'/url%20with%20spaces/'): # see ticket #12534
safe_url = '%(url)s?%(next)s=%(good_url)s' % {
'url': login_url,
'next': REDIRECT_FIELD_NAME,
'good_url': urlquote(good_url),
}
response = self.client.post(safe_url, {
'username': 'testclient',
'password': password,
})
self.assertEqual(response.status_code, 302)
self.assertTrue(good_url in response['Location'],
"%s should be allowed" % good_url)
class LoginURLSettings(LoginURLSettings):
urls = 'tests.urls'
class LogoutTest(LogoutTest):
urls = 'tests.urls'
test_logout_with_overridden_redirect_url = None
test_logout_with_next_page_specified = None
test_logout_with_custom_redirect_argument = None
test_logout_with_named_redirect = None
test_logout_with_custom_redirect_argument = None
# the built-in tests depend on the django urlpatterns (they reverse
# django.contrib.auth.views.login)
def test_security_check(self, password='password'):
logout_url = reverse('logout_then_login')
# Those URLs should not pass the security check
for bad_url in ('http://example.com',
'https://example.com',
'ftp://exampel.com',
'//example.com'):
nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
'url': logout_url,
'next': REDIRECT_FIELD_NAME,
'bad_url': urlquote(bad_url),
}
self.login()
response = self.client.get(nasty_url)
self.assertEqual(response.status_code, 302)
self.assertFalse(bad_url in response['Location'],
"%s should be blocked" % bad_url)
self.confirm_logged_out()
# These URLs *should* still pass the security check
for good_url in ('/view/?param=http://example.com',
'/view/?param=https://example.com',
'/view?param=ftp://exampel.com',
'view/?param=//example.com',
'//testserver/',
'/url%20with%20spaces/'): # see ticket #12534
safe_url = '%(url)s?%(next)s=%(good_url)s' % {
'url': logout_url,
'next': REDIRECT_FIELD_NAME,
'good_url': urlquote(good_url),
}
self.login()
response = self.client.get(safe_url)
self.assertEqual(response.status_code, 302)
self.assertTrue(good_url in response['Location'],
"%s should be allowed" % good_url)
self.confirm_logged_out()
class UserCreationFormTest(TestCase):
def setUp(self):
# in built-in UserManager, the order of arguments is:
# username, email, password
# in authtools UserManager, the order of arguments is:
# USERNAME_FIELD, password
User.objects.create_user('testclient@example.com', password='test123')
self.username = User.USERNAME_FIELD
def test_user_already_exists(self):
# The benefit of the custom validation message is only available if the
# messages are translated. We won't be able to translate all the
# strings if we don't know what the username will be ahead of time.
data = {
self.username: 'testclient@example.com',
'password1': 'test123',
'password2': 'test123',
}
form = UserCreationForm(data)
self.assertFalse(form.is_valid())
self.assertEqual(form[self.username].errors, [
force_text(form.error_messages['duplicate_username']) % {'username': self.username}])
def test_password_verification(self):
# The verification password is incorrect.
data = {
self.username: 'jsmith',
'password1': 'test123',
'password2': 'test',
}
form = UserCreationForm(data)
self.assertFalse(form.is_valid())
self.assertEqual(form["password2"].errors,
[force_text(form.error_messages['password_mismatch'])])
def test_both_passwords(self):
# One (or both) passwords weren't given
data = {self.username: 'jsmith'}
form = UserCreationForm(data)
required_error = [force_text(Field.default_error_messages['required'])]
self.assertFalse(form.is_valid())
self.assertEqual(form['password1'].errors, required_error)
self.assertEqual(form['password2'].errors, required_error)
data['password2'] = 'test123'
form = UserCreationForm(data)
self.assertFalse(form.is_valid())
self.assertEqual(form['password1'].errors, required_error)
self.assertEqual(form['password2'].errors, [])
def test_success(self):
# The success case.
data = {
self.username: 'jsmith@example.com',
'password1': 'test123',
'password2': 'test123',
}
if settings.AUTH_USER_MODEL == 'authtools.User':
data['name'] = 'John Smith'
form = UserCreationForm(data)
self.assertTrue(form.is_valid())
u = form.save()
self.assertEqual(getattr(u, self.username), 'jsmith@example.com')
self.assertTrue(u.check_password('test123'))
self.assertEqual(u, User._default_manager.get_by_natural_key('jsmith@example.com'))
def test_generated_fields_list(self):
if settings.AUTH_USER_MODEL == 'auth.User':
fields = ('username', 'email', 'password1', 'password2')
elif settings.AUTH_USER_MODEL == 'authtools.User':
fields = ('email', 'name', 'password1', 'password2')
elif settings.AUTH_USER_MODEL == 'tests.User':
fields = ('email', 'full_name', 'preferred_name', 'password1', 'password2')
else:
assert False, "I don't know your user model"
form = UserCreationForm()
self.assertSequenceEqual(list(form.fields.keys()), fields)
@skipIfCustomUser
@override_settings(USE_TZ=False, PASSWORD_HASHERS=('django.contrib.auth.hashers.SHA1PasswordHasher',))
class UserChangeFormTest(TestCase):
fixtures = ['authtestdata.json']
def test_bug_14242(self):
# A regression test, introduce by adding an optimization for the
# UserChangeForm.
class MyUserForm(UserChangeForm):
def __init__(self, *args, **kwargs):
super(MyUserForm, self).__init__(*args, **kwargs)
self.fields['groups'].help_text = 'These groups give users different permissions'
class Meta(UserChangeForm.Meta):
fields = ('groups',)
# Just check we can create it
MyUserForm({})
def test_unsuable_password(self):
user = User.objects.get(username='empty_password')
user.set_unusable_password()
user.save()
form = UserChangeForm(instance=user)
self.assertIn(_("No password set."), form.as_table())
def test_bug_17944_empty_password(self):
user = User.objects.get(username='empty_password')
form = UserChangeForm(instance=user)
self.assertIn(_("No password set."), form.as_table())
def test_bug_17944_unmanageable_password(self):
user = User.objects.get(username='unmanageable_password')
form = UserChangeForm(instance=user)
self.assertIn(_("Invalid password format or unknown hashing algorithm."),
form.as_table())
def test_bug_17944_unknown_password_algorithm(self):
user = User.objects.get(username='unknown_password')
form = UserChangeForm(instance=user)
self.assertIn(_("Invalid password format or unknown hashing algorithm."),
form.as_table())
def test_bug_19133(self):
"The change form does not return the password value"
# Use the form to construct the POST data
user = User.objects.get(username='testclient')
form_for_data = UserChangeForm(instance=user)
post_data = form_for_data.initial
# The password field should be readonly, so anything
# posted here should be ignored; the form will be
# valid, and give back the 'initial' value for the
# password field.
post_data['password'] = 'new password'
form = UserChangeForm(instance=user, data=post_data)
self.assertTrue(form.is_valid())
self.assertEqual(form.cleaned_data['password'], 'sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161')
def test_bug_19349_bound_password_field(self):
user = User.objects.get(username='testclient')
form = UserChangeForm(data={}, instance=user)
# When rendering the bound password field,
# ReadOnlyPasswordHashWidget needs the initial
# value to render correctly
self.assertEqual(form.initial['password'], form['password'].value())
def test_better_readonly_password_widget(self):
user = User.objects.get(username='testclient')
form = UserChangeForm(instance=user)
self.assertIn(_('*************'), form.as_table())
class UserAdminTest(TestCase):
def test_generated_fieldsets(self):
if settings.AUTH_USER_MODEL == 'auth.User':
fields = ('username', 'email', 'password')
elif settings.AUTH_USER_MODEL == 'authtools.User':
fields = ('email', 'name', 'password')
elif settings.AUTH_USER_MODEL == 'tests.User':
fields = ('email', 'full_name', 'preferred_name', 'password')
else:
assert False, "I don't know your user model"
self.assertSequenceEqual(BASE_FIELDS[1]['fields'], fields)
class UserManagerTest(TestCase):
def test_create_user(self):
u = User._default_manager.create_user(**{
User.USERNAME_FIELD: 'newuser@example.com',
'password': 'test123',
})
self.assertEqual(getattr(u, User.USERNAME_FIELD), 'newuser@example.com')
self.assertTrue(u.check_password('test123'))
self.assertEqual(u, User._default_manager.get_by_natural_key('newuser@example.com'))
self.assertTrue(u.is_active)
self.assertFalse(u.is_staff)
self.assertFalse(u.is_superuser)
@skipIfNotCustomUser
def test_create_superuser(self):
u = User._default_manager.create_superuser(**{
User.USERNAME_FIELD: 'newuser@example.com',
'password': 'test123',
})
self.assertTrue(u.is_staff)
self.assertTrue(u.is_superuser)
class UserModelTest(TestCase):
@skipUnless(settings.AUTH_USER_MODEL == 'authtools.User',
"only check authuser's ordering")
def test_default_ordering(self):
self.assertSequenceEqual(['name', 'email'], User._meta.ordering)
def test_send_mail(self):
abstract_user = User(email='foo@bar.com')
abstract_user.email_user(subject="Subject here",
message="This is a message", from_email="from@domain.com")
# Test that one message has been sent.
self.assertEqual(len(mail.outbox), 1)
# Verify that test email contains the correct attributes:
message = mail.outbox[0]
self.assertEqual(message.subject, "Subject here")
self.assertEqual(message.body, "This is a message")
self.assertEqual(message.from_email, "from@domain.com")
self.assertEqual(message.to, [abstract_user.email])