|
|
|
@ -1,5 +1,5 @@
|
|
|
|
|
from app import config
|
|
|
|
|
from flask import url_for
|
|
|
|
|
from flask import url_for, session
|
|
|
|
|
from urllib.parse import parse_qs
|
|
|
|
|
from urllib3.util import parse_url
|
|
|
|
|
from app.auth.views.oidc import create_user
|
|
|
|
@ -10,7 +10,21 @@ from app.models import User
|
|
|
|
|
from app.config import URL, OIDC_CLIENT_ID
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_oidc_login(flask_client):
|
|
|
|
|
mock_well_known_response = {
|
|
|
|
|
"authorization_endpoint": "http://localhost:7777/authorization-endpoint",
|
|
|
|
|
"userinfo_endpoint": "http://localhost:7777/userinfo-endpoint",
|
|
|
|
|
"token_endpoint": "http://localhost:7777/token-endpoint",
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_login(mock_get, flask_client):
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_login"),
|
|
|
|
|
follow_redirects=False,
|
|
|
|
@ -28,8 +42,41 @@ def test_oidc_login(flask_client):
|
|
|
|
|
assert expected_redirect_url == query["redirect_uri"][0]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_oidc_login_no_client_id(flask_client):
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_login_next_url(mock_get, flask_client):
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
with flask_client:
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_login", next="/dashboard/settings/"),
|
|
|
|
|
follow_redirects=False,
|
|
|
|
|
)
|
|
|
|
|
location = r.headers.get("Location")
|
|
|
|
|
assert location is not None
|
|
|
|
|
|
|
|
|
|
parsed = parse_url(location)
|
|
|
|
|
query = parse_qs(parsed.query)
|
|
|
|
|
|
|
|
|
|
expected_redirect_url = f"{URL}/auth/oidc/callback"
|
|
|
|
|
|
|
|
|
|
assert "code" == query["response_type"][0]
|
|
|
|
|
assert OIDC_CLIENT_ID == query["client_id"][0]
|
|
|
|
|
assert expected_redirect_url == query["redirect_uri"][0]
|
|
|
|
|
assert session["oauth_redirect_next"] == "/dashboard/settings/"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_login_no_client_id(mock_get, flask_client):
|
|
|
|
|
config.OIDC_CLIENT_ID = None
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_login"),
|
|
|
|
@ -47,8 +94,14 @@ def test_oidc_login_no_client_id(flask_client):
|
|
|
|
|
config.OIDC_CLIENT_ID = "to_fill"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_oidc_login_no_client_secret(flask_client):
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_login_no_client_secret(mock_get, flask_client):
|
|
|
|
|
config.OIDC_CLIENT_SECRET = None
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_login"),
|
|
|
|
@ -66,9 +119,14 @@ def test_oidc_login_no_client_secret(flask_client):
|
|
|
|
|
config.OIDC_CLIENT_SECRET = "to_fill"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_oidc_callback_no_oauth_state(flask_client):
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_callback_no_oauth_state(mock_get, flask_client):
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
@ -78,11 +136,16 @@ def test_oidc_callback_no_oauth_state(flask_client):
|
|
|
|
|
assert location is None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_oidc_callback_no_client_id(flask_client):
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_callback_no_client_id(mock_get, flask_client):
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
config.OIDC_CLIENT_ID = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
|
follow_redirects=False,
|
|
|
|
@ -97,15 +160,20 @@ def test_oidc_callback_no_client_id(flask_client):
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
|
|
|
|
|
config.OIDC_CLIENT_ID = "to_fill"
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_oidc_callback_no_client_secret(flask_client):
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
def test_oidc_callback_no_client_secret(mock_get, flask_client):
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
config.OIDC_CLIENT_SECRET = None
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
|
follow_redirects=False,
|
|
|
|
@ -120,16 +188,23 @@ def test_oidc_callback_no_client_secret(flask_client):
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
|
|
|
|
|
config.OIDC_CLIENT_SECRET = "to_fill"
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.get")
|
|
|
|
|
def test_oidc_callback_invalid_user(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
mock_get.return_value = MockResponse(400, {})
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
def test_oidc_callback_invalid_user(
|
|
|
|
|
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
|
|
|
|
):
|
|
|
|
|
mock_oauth_get.return_value = MockResponse(400, {})
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
@ -143,18 +218,25 @@ def test_oidc_callback_invalid_user(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
expected_redirect_url = "/auth/login"
|
|
|
|
|
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
assert mock_get.called
|
|
|
|
|
assert mock_oauth_get.called
|
|
|
|
|
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.get")
|
|
|
|
|
def test_oidc_callback_no_email(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
mock_get.return_value = MockResponse(200, {})
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
def test_oidc_callback_no_email(
|
|
|
|
|
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
|
|
|
|
):
|
|
|
|
|
mock_oauth_get.return_value = MockResponse(200, {})
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
@ -168,20 +250,27 @@ def test_oidc_callback_no_email(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
expected_redirect_url = "/auth/login"
|
|
|
|
|
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
assert mock_get.called
|
|
|
|
|
assert mock_oauth_get.called
|
|
|
|
|
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.get")
|
|
|
|
|
def test_oidc_callback_disabled_registration(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
def test_oidc_callback_disabled_registration(
|
|
|
|
|
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
|
|
|
|
):
|
|
|
|
|
config.DISABLE_REGISTRATION = True
|
|
|
|
|
email = random_string()
|
|
|
|
|
mock_get.return_value = MockResponse(200, {"email": email})
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
mock_oauth_get.return_value = MockResponse(200, {"email": email})
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
@ -195,26 +284,33 @@ def test_oidc_callback_disabled_registration(mock_get, mock_fetch_token, flask_c
|
|
|
|
|
expected_redirect_url = "/auth/register"
|
|
|
|
|
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
assert mock_get.called
|
|
|
|
|
assert mock_oauth_get.called
|
|
|
|
|
|
|
|
|
|
config.DISABLE_REGISTRATION = False
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.get")
|
|
|
|
|
def test_oidc_callback_registration(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
def test_oidc_callback_registration(
|
|
|
|
|
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
|
|
|
|
):
|
|
|
|
|
email = random_string()
|
|
|
|
|
mock_get.return_value = MockResponse(
|
|
|
|
|
mock_oauth_get.return_value = MockResponse(
|
|
|
|
|
200,
|
|
|
|
|
{
|
|
|
|
|
"email": email,
|
|
|
|
|
config.OIDC_NAME_FIELD: "name",
|
|
|
|
|
},
|
|
|
|
|
)
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
user = User.get_by(email=email)
|
|
|
|
|
assert user is None
|
|
|
|
@ -231,28 +327,33 @@ def test_oidc_callback_registration(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
expected_redirect_url = "/dashboard/"
|
|
|
|
|
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
assert mock_get.called
|
|
|
|
|
assert mock_oauth_get.called
|
|
|
|
|
|
|
|
|
|
user = User.get_by(email=email)
|
|
|
|
|
assert user is not None
|
|
|
|
|
assert user.email == email
|
|
|
|
|
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.get")
|
|
|
|
|
def test_oidc_callback_login(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
def test_oidc_callback_login(mock_oauth_get, mock_fetch_token, mock_get, flask_client):
|
|
|
|
|
email = random_string()
|
|
|
|
|
mock_get.return_value = MockResponse(
|
|
|
|
|
mock_oauth_get.return_value = MockResponse(
|
|
|
|
|
200,
|
|
|
|
|
{
|
|
|
|
|
"email": email,
|
|
|
|
|
},
|
|
|
|
|
)
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = "state"
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = None
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
user = User.create(
|
|
|
|
|
email=email,
|
|
|
|
@ -275,10 +376,57 @@ def test_oidc_callback_login(mock_get, mock_fetch_token, flask_client):
|
|
|
|
|
expected_redirect_url = "/dashboard/"
|
|
|
|
|
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
assert mock_get.called
|
|
|
|
|
assert mock_oauth_get.called
|
|
|
|
|
|
|
|
|
|
with flask_client.session_transaction() as session:
|
|
|
|
|
session["oauth_state"] = None
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@patch("requests.get")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
|
|
|
|
@patch("requests_oauthlib.OAuth2Session.get")
|
|
|
|
|
def test_oidc_callback_login_with_next_url(
|
|
|
|
|
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
|
|
|
|
):
|
|
|
|
|
email = random_string()
|
|
|
|
|
mock_oauth_get.return_value = MockResponse(
|
|
|
|
|
200,
|
|
|
|
|
{
|
|
|
|
|
"email": email,
|
|
|
|
|
},
|
|
|
|
|
)
|
|
|
|
|
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_redirect_next"] = "/dashboard/settings/"
|
|
|
|
|
sess["oauth_state"] = "state"
|
|
|
|
|
|
|
|
|
|
mock_get.return_value.json.return_value = mock_well_known_response
|
|
|
|
|
|
|
|
|
|
user = User.create(
|
|
|
|
|
email=email,
|
|
|
|
|
name="name",
|
|
|
|
|
password="",
|
|
|
|
|
activated=True,
|
|
|
|
|
)
|
|
|
|
|
user = User.get_by(email=email)
|
|
|
|
|
assert user is not None
|
|
|
|
|
|
|
|
|
|
r = flask_client.get(
|
|
|
|
|
url_for("auth.oidc_callback"),
|
|
|
|
|
follow_redirects=False,
|
|
|
|
|
)
|
|
|
|
|
location = r.headers.get("Location")
|
|
|
|
|
assert location is not None
|
|
|
|
|
|
|
|
|
|
parsed = parse_url(location)
|
|
|
|
|
|
|
|
|
|
expected_redirect_url = "/dashboard/settings/"
|
|
|
|
|
|
|
|
|
|
assert expected_redirect_url == parsed.path
|
|
|
|
|
assert mock_oauth_get.called
|
|
|
|
|
|
|
|
|
|
with flask_client.session_transaction() as sess:
|
|
|
|
|
sess["oauth_state"] = None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_create_user():
|
|
|
|
|