devplacepy/tests/api/auth/token.py

# retoor <retoor@molodetz.nl>

import time
import pytest
import requests
from tests.conftest import BASE_URL
from devplacepy.database import get_table, refresh_snapshot, set_setting

_counter_token = [0]


@pytest.fixture(scope="module", autouse=True)
def _token_settings(app_server):
    for key, value in {
        "rate_limit_per_minute": "1000000",
        "rate_limit_window_seconds": "60",
        "registration_open": "1",
        "maintenance_mode": "0",
        "session_max_age_days": "7",
    }.items():
        set_setting(key, value)
    yield


def _signup(password="secret123"):
    _counter_token[0] += 1
    name = f"tok{int(time.time() * 1000)}{_counter_token[0]}"
    email = f"{name}@t.dev"
    requests.post(
        f"{BASE_URL}/auth/signup",
        data={
            "username": name,
            "email": email,
            "password": password,
            "confirm_password": password,
            "birth_date": "1990-01-01",
            "accept_terms": "1",
        },
        allow_redirects=True,
    )
    return name, email, password


def test_token_happy_path_with_email(app_server):
    name, email, password = _signup()
    r = requests.post(f"{BASE_URL}/auth/token", data={"email": email, "password": password})
    assert r.status_code == 200, r.text[:300]
    body = r.json()
    assert body["access_token"] and len(body["access_token"]) >= 32
    assert body["token_type"]
    assert isinstance(body["expires_in"], int) and body["expires_in"] > 0


def test_token_accepts_username_as_identifier(app_server):
    name, email, password = _signup()
    r = requests.post(f"{BASE_URL}/auth/token", data={"email": name, "password": password})
    assert r.status_code == 200, r.text[:300]
    assert r.json()["access_token"]


def test_token_via_json_body(app_server):
    name, email, password = _signup()
    r = requests.post(
        f"{BASE_URL}/auth/token",
        json={"email": email, "password": password},
        headers={"Content-Type": "application/json"},
    )
    assert r.status_code == 200, r.text[:300]
    assert r.json()["access_token"]


def test_token_wrong_password_401(app_server):
    name, email, password = _signup()
    r = requests.post(f"{BASE_URL}/auth/token", data={"email": email, "password": "nope!!"})
    assert r.status_code == 401
    assert "access_token" not in r.json()


def test_token_unknown_identifier_401(app_server):
    r = requests.post(
        f"{BASE_URL}/auth/token",
        data={"email": "no_such_user_zzz@t.dev", "password": "whatever"},
    )
    assert r.status_code == 401


def test_token_empty_password_rejected(app_server):
    name, email, password = _signup()
    r = requests.post(
        f"{BASE_URL}/auth/token",
        headers={"Accept": "application/json"},
        data={"email": email, "password": ""},
    )
    assert r.status_code in (400, 401, 422)
    assert "access_token" not in r.json()


def test_token_inactive_account_403(app_server):
    name, email, password = _signup()
    users = get_table("users")
    row = users.find_one(username=name)
    users.update({"uid": row["uid"], "is_active": False}, ["uid"])
    refresh_snapshot()
    try:
        r = requests.post(
            f"{BASE_URL}/auth/token", data={"email": email, "password": password}
        )
        assert r.status_code == 403, r.text[:300]
        assert "access_token" not in r.json()
    finally:
        users.update({"uid": row["uid"], "is_active": True}, ["uid"])
        refresh_snapshot()


def test_token_is_usable_as_bearer_credential(app_server):
    name, email, password = _signup()
    token = requests.post(
        f"{BASE_URL}/auth/token", data={"email": email, "password": password}
    ).json()["access_token"]
    target, _, _ = _signup()
    r = requests.post(
        f"{BASE_URL}/follow/{target}",
        headers={"Authorization": f"Bearer {token}"},
        allow_redirects=False,
    )
    assert r.status_code in (200, 302), r.text[:200]