83 lines
3.1 KiB
Python
83 lines
3.1 KiB
Python
import unittest
|
|
|
|
from patchbay_web import security
|
|
from patchbay_web.conf import Config
|
|
|
|
from .helpers import AppCase
|
|
|
|
|
|
class AuthTest(AppCase):
|
|
def test_sysop_password_hashed_on_start(self):
|
|
conf = Config(self.conf_path)
|
|
self.assertTrue(conf.get("sysoppassword").startswith("$scrypt$"))
|
|
with open(self.conf_path) as f:
|
|
self.assertIn("# test config", f.read())
|
|
|
|
def test_login_2fa(self):
|
|
r = self.login()
|
|
self.assertEqual(r.status_code, 302)
|
|
self.assertEqual(self.mails[-1][0], "admin@example.org")
|
|
self.assertEqual(self.client.get("/patch").status_code, 200)
|
|
|
|
def test_wrong_password(self):
|
|
r = self.login(password="nope")
|
|
self.assertEqual(r.status_code, 401)
|
|
self.assertEqual(self.mails, [])
|
|
|
|
def test_wrong_code_then_expired_attempts(self):
|
|
tok = self.csrf()
|
|
self.client.post("/login", data={"username": "admin", "password": "correct horse battery", "csrf_token": tok})
|
|
tok = self.token_from("/verify")
|
|
for _ in range(5):
|
|
r = self.client.post("/verify", data={"code": "000000", "csrf_token": tok})
|
|
r = self.client.post("/verify", data={"code": "000000", "csrf_token": tok})
|
|
self.assertEqual(r.status_code, 302) # sent back to login
|
|
self.assertEqual(self.client.get("/patch").status_code, 302)
|
|
|
|
def test_csrf_required(self):
|
|
self.login()
|
|
r = self.client.post("/settings/users/add", data={"username": "bob"})
|
|
self.assertEqual(r.status_code, 400)
|
|
|
|
def test_requires_login(self):
|
|
self.assertEqual(self.client.get("/settings").status_code, 302)
|
|
self.assertEqual(self.client.get("/api/graph").status_code, 401)
|
|
|
|
def test_help_page(self):
|
|
self.assertEqual(self.client.get("/help").status_code, 302)
|
|
self.login()
|
|
r = self.client.get("/help")
|
|
self.assertEqual(r.status_code, 200)
|
|
self.assertIn(b"Transparent source spoofing", r.data)
|
|
|
|
def test_user_management_sysop_only(self):
|
|
self.login()
|
|
tok = self.token()
|
|
r = self.client.post("/settings/users/add", data={
|
|
"username": "bob", "email": "bob@example.org", "password": "0123456789x", "csrf_token": tok})
|
|
self.assertEqual(r.status_code, 302)
|
|
self.client.post("/logout", data={"csrf_token": tok})
|
|
|
|
self.assertEqual(self.login("bob", "0123456789x").status_code, 302)
|
|
tok = self.token()
|
|
r = self.client.post("/settings/users/add", data={
|
|
"username": "eve", "email": "e@example.org", "password": "0123456789x", "csrf_token": tok})
|
|
self.assertEqual(r.status_code, 403)
|
|
|
|
def test_rate_limit(self):
|
|
for _ in range(10):
|
|
self.login(password="bad")
|
|
self.assertEqual(self.login().status_code, 429)
|
|
|
|
|
|
class SecurityTest(unittest.TestCase):
|
|
def test_hash_roundtrip(self):
|
|
h = security.hash_password("hunter22")
|
|
self.assertTrue(security.verify_password("hunter22", h))
|
|
self.assertFalse(security.verify_password("hunter23", h))
|
|
self.assertFalse(security.verify_password("x", None))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|