Compare commits
13 Commits
Author | SHA1 | Date |
---|---|---|
Son Nguyen Kim | b5b167479f | |
Adrià Casajús | 8f12fabd81 | |
Daniel Mühlbachler-Pietrzykowski | b6004f3336 | |
Adrià Casajús | 80c8bc820b | |
Son Nguyen Kim | 037bc9da36 | |
Son Nguyen Kim | ee0be3688f | |
Adrià Casajús | 015036b499 | |
Son Nguyen Kim | d5df91aab6 | |
Adrià Casajús | 2eb5feaa8f | |
Adrià Casajús | 3c364da37d | |
Adrià Casajús | 36cf530ef8 | |
Adrià Casajús | 0da1811311 | |
Adrià Casajús | f2fcaa6c60 |
|
@ -68,6 +68,12 @@ For most tests, you will need to have ``redis`` installed and started on your ma
|
|||
sh scripts/run-test.sh
|
||||
```
|
||||
|
||||
You can also run tests using a local Postgres DB to speed things up. This can be done by
|
||||
|
||||
- creating an empty test DB and running the database migration by `dropdb test && createdb test && DB_URI=postgresql://localhost:5432/test alembic upgrade head`
|
||||
|
||||
- replacing the `DB_URI` in `test.env` file by `DB_URI=postgresql://localhost:5432/test`
|
||||
|
||||
## Run the code locally
|
||||
|
||||
Install npm packages
|
||||
|
|
|
@ -46,7 +46,8 @@ class SLModelView(sqla.ModelView):
|
|||
|
||||
def inaccessible_callback(self, name, **kwargs):
|
||||
# redirect to login page if user doesn't have access
|
||||
return redirect(url_for("auth.login", next=request.url))
|
||||
flash("You don't have access to the admin page", "error")
|
||||
return redirect(url_for("dashboard.index", next=request.url))
|
||||
|
||||
def on_model_change(self, form, model, is_created):
|
||||
changes = {}
|
||||
|
|
|
@ -308,28 +308,29 @@ def delete_alias(alias: Alias, user: User):
|
|||
Delete an alias and add it to either global or domain trash
|
||||
Should be used instead of Alias.delete, DomainDeletedAlias.create, DeletedAlias.create
|
||||
"""
|
||||
# save deleted alias to either global or domain trash
|
||||
LOG.i(f"User {user} has deleted alias {alias}")
|
||||
# save deleted alias to either global or domain tra
|
||||
if alias.custom_domain_id:
|
||||
if not DomainDeletedAlias.get_by(
|
||||
email=alias.email, domain_id=alias.custom_domain_id
|
||||
):
|
||||
LOG.d("add %s to domain %s trash", alias, alias.custom_domain_id)
|
||||
Session.add(
|
||||
DomainDeletedAlias(
|
||||
user_id=user.id,
|
||||
email=alias.email,
|
||||
domain_id=alias.custom_domain_id,
|
||||
)
|
||||
domain_deleted_alias = DomainDeletedAlias(
|
||||
user_id=user.id,
|
||||
email=alias.email,
|
||||
domain_id=alias.custom_domain_id,
|
||||
)
|
||||
Session.add(domain_deleted_alias)
|
||||
Session.commit()
|
||||
|
||||
LOG.i(
|
||||
f"Moving {alias} to domain {alias.custom_domain_id} trash {domain_deleted_alias}"
|
||||
)
|
||||
else:
|
||||
if not DeletedAlias.get_by(email=alias.email):
|
||||
LOG.d("add %s to global trash", alias)
|
||||
Session.add(DeletedAlias(email=alias.email))
|
||||
deleted_alias = DeletedAlias(email=alias.email)
|
||||
Session.add(deleted_alias)
|
||||
Session.commit()
|
||||
LOG.i(f"Moving {alias} to global trash {deleted_alias}")
|
||||
|
||||
LOG.i("delete alias %s", alias)
|
||||
Alias.filter(Alias.id == alias.id).delete()
|
||||
Session.commit()
|
||||
|
||||
|
|
|
@ -3,11 +3,13 @@ from flask_login import login_user
|
|||
|
||||
from app.auth.base import auth_bp
|
||||
from app.db import Session
|
||||
from app.extensions import limiter
|
||||
from app.log import LOG
|
||||
from app.models import EmailChange, ResetPasswordCode
|
||||
|
||||
|
||||
@auth_bp.route("/change_email", methods=["GET", "POST"])
|
||||
@limiter.limit("3/hour")
|
||||
def change_email():
|
||||
code = request.args.get("code")
|
||||
|
||||
|
|
|
@ -1,14 +1,13 @@
|
|||
from flask import request, session, redirect, flash, url_for
|
||||
from requests_oauthlib import OAuth2Session
|
||||
|
||||
import requests
|
||||
|
||||
from app import config
|
||||
from app.auth.base import auth_bp
|
||||
from app.auth.views.login_utils import after_login
|
||||
from app.config import (
|
||||
URL,
|
||||
OIDC_AUTHORIZATION_URL,
|
||||
OIDC_USER_INFO_URL,
|
||||
OIDC_TOKEN_URL,
|
||||
OIDC_SCOPES,
|
||||
OIDC_NAME_FIELD,
|
||||
)
|
||||
|
@ -16,14 +15,15 @@ from app.db import Session
|
|||
from app.email_utils import send_welcome_email
|
||||
from app.log import LOG
|
||||
from app.models import User, SocialAuth
|
||||
from app.utils import encode_url, sanitize_email, sanitize_next_url
|
||||
from app.utils import sanitize_email, sanitize_next_url
|
||||
|
||||
|
||||
# need to set explicitly redirect_uri instead of leaving the lib to pre-fill redirect_uri
|
||||
# when served behind nginx, the redirect_uri is localhost... and not the real url
|
||||
_redirect_uri = URL + "/auth/oidc/callback"
|
||||
redirect_uri = URL + "/auth/oidc/callback"
|
||||
|
||||
SESSION_STATE_KEY = "oauth_state"
|
||||
SESSION_NEXT_KEY = "oauth_redirect_next"
|
||||
|
||||
|
||||
@auth_bp.route("/oidc/login")
|
||||
|
@ -32,18 +32,17 @@ def oidc_login():
|
|||
return redirect(url_for("auth.login"))
|
||||
|
||||
next_url = sanitize_next_url(request.args.get("next"))
|
||||
if next_url:
|
||||
redirect_uri = _redirect_uri + "?next=" + encode_url(next_url)
|
||||
else:
|
||||
redirect_uri = _redirect_uri
|
||||
|
||||
auth_url = requests.get(config.OIDC_WELL_KNOWN_URL).json()["authorization_endpoint"]
|
||||
|
||||
oidc = OAuth2Session(
|
||||
config.OIDC_CLIENT_ID, scope=[OIDC_SCOPES], redirect_uri=redirect_uri
|
||||
)
|
||||
authorization_url, state = oidc.authorization_url(OIDC_AUTHORIZATION_URL)
|
||||
authorization_url, state = oidc.authorization_url(auth_url)
|
||||
|
||||
# State is used to prevent CSRF, keep this for later.
|
||||
session[SESSION_STATE_KEY] = state
|
||||
session[SESSION_NEXT_KEY] = next_url
|
||||
return redirect(authorization_url)
|
||||
|
||||
|
||||
|
@ -60,19 +59,23 @@ def oidc_callback():
|
|||
flash("Please use another sign in method then", "warning")
|
||||
return redirect("/")
|
||||
|
||||
oidc_configuration = requests.get(config.OIDC_WELL_KNOWN_URL).json()
|
||||
user_info_url = oidc_configuration["userinfo_endpoint"]
|
||||
token_url = oidc_configuration["token_endpoint"]
|
||||
|
||||
oidc = OAuth2Session(
|
||||
config.OIDC_CLIENT_ID,
|
||||
state=session[SESSION_STATE_KEY],
|
||||
scope=[OIDC_SCOPES],
|
||||
redirect_uri=_redirect_uri,
|
||||
redirect_uri=redirect_uri,
|
||||
)
|
||||
oidc.fetch_token(
|
||||
OIDC_TOKEN_URL,
|
||||
token_url,
|
||||
client_secret=config.OIDC_CLIENT_SECRET,
|
||||
authorization_response=request.url,
|
||||
)
|
||||
|
||||
oidc_user_data = oidc.get(OIDC_USER_INFO_URL)
|
||||
oidc_user_data = oidc.get(user_info_url)
|
||||
if oidc_user_data.status_code != 200:
|
||||
LOG.e(
|
||||
f"cannot get oidc user data {oidc_user_data.status_code} {oidc_user_data.text}"
|
||||
|
@ -111,7 +114,8 @@ def oidc_callback():
|
|||
Session.commit()
|
||||
|
||||
# The activation link contains the original page, for ex authorize page
|
||||
next_url = sanitize_next_url(request.args.get("next")) if request.args else None
|
||||
next_url = session[SESSION_NEXT_KEY]
|
||||
session[SESSION_NEXT_KEY] = None
|
||||
|
||||
return after_login(user, next_url)
|
||||
|
||||
|
|
|
@ -245,9 +245,7 @@ FACEBOOK_CLIENT_ID = os.environ.get("FACEBOOK_CLIENT_ID")
|
|||
FACEBOOK_CLIENT_SECRET = os.environ.get("FACEBOOK_CLIENT_SECRET")
|
||||
|
||||
CONNECT_WITH_OIDC_ICON = os.environ.get("CONNECT_WITH_OIDC_ICON")
|
||||
OIDC_AUTHORIZATION_URL = os.environ.get("OIDC_AUTHORIZATION_URL")
|
||||
OIDC_USER_INFO_URL = os.environ.get("OIDC_USER_INFO_URL")
|
||||
OIDC_TOKEN_URL = os.environ.get("OIDC_TOKEN_URL")
|
||||
OIDC_WELL_KNOWN_URL = os.environ.get("OIDC_WELL_KNOWN_URL")
|
||||
OIDC_CLIENT_ID = os.environ.get("OIDC_CLIENT_ID")
|
||||
OIDC_CLIENT_SECRET = os.environ.get("OIDC_CLIENT_SECRET")
|
||||
OIDC_SCOPES = os.environ.get("OIDC_SCOPES")
|
||||
|
@ -431,9 +429,11 @@ except Exception:
|
|||
HIBP_SCAN_INTERVAL_DAYS = 7
|
||||
HIBP_API_KEYS = sl_getenv("HIBP_API_KEYS", list) or []
|
||||
HIBP_MAX_ALIAS_CHECK = 10_000
|
||||
HIBP_RPM = 100
|
||||
HIBP_RPM = int(os.environ.get("HIBP_API_RPM", 100))
|
||||
HIBP_SKIP_PARTNER_ALIAS = os.environ.get("HIBP_SKIP_PARTNER_ALIAS")
|
||||
|
||||
KEEP_OLD_DATA_DAYS = 30
|
||||
|
||||
POSTMASTER = os.environ.get("POSTMASTER")
|
||||
|
||||
# store temporary files, especially for debugging
|
||||
|
|
|
@ -14,7 +14,7 @@ from app.models import PartnerUser, SocialAuth
|
|||
from app.proton.utils import get_proton_partner
|
||||
from app.utils import sanitize_next_url
|
||||
|
||||
_SUDO_GAP = 900
|
||||
_SUDO_GAP = 120
|
||||
|
||||
|
||||
class LoginForm(FlaskForm):
|
||||
|
|
|
@ -141,7 +141,7 @@ def index():
|
|||
)
|
||||
|
||||
if request.form.get("form-name") == "delete-alias":
|
||||
LOG.d("delete alias %s", alias)
|
||||
LOG.i(f"User {current_user} requested deletion of alias {alias}")
|
||||
email = alias.email
|
||||
alias_utils.delete_alias(alias, current_user)
|
||||
flash(f"Alias {email} has been deleted", "success")
|
||||
|
|
|
@ -11,9 +11,11 @@ from wtforms.fields.html5 import EmailField
|
|||
from app.config import ENFORCE_SPF, MAILBOX_SECRET
|
||||
from app.config import URL
|
||||
from app.dashboard.base import dashboard_bp
|
||||
from app.dashboard.views.enter_sudo import sudo_required
|
||||
from app.db import Session
|
||||
from app.email_utils import email_can_be_used_as_mailbox
|
||||
from app.email_utils import mailbox_already_used, render, send_email
|
||||
from app.extensions import limiter
|
||||
from app.log import LOG
|
||||
from app.models import Alias, AuthorizedAddress
|
||||
from app.models import Mailbox
|
||||
|
@ -29,6 +31,8 @@ class ChangeEmailForm(FlaskForm):
|
|||
|
||||
@dashboard_bp.route("/mailbox/<int:mailbox_id>/", methods=["GET", "POST"])
|
||||
@login_required
|
||||
@sudo_required
|
||||
@limiter.limit("20/minute", methods=["POST"])
|
||||
def mailbox_detail_route(mailbox_id):
|
||||
mailbox: Mailbox = Mailbox.get(mailbox_id)
|
||||
if not mailbox or mailbox.user_id != current_user.id:
|
||||
|
@ -179,8 +183,15 @@ def mailbox_detail_route(mailbox_id):
|
|||
|
||||
elif request.form.get("form-name") == "toggle-pgp":
|
||||
if request.form.get("pgp-enabled") == "on":
|
||||
mailbox.disable_pgp = False
|
||||
flash(f"PGP is enabled on {mailbox.email}", "success")
|
||||
if mailbox.is_proton():
|
||||
mailbox.disable_pgp = True
|
||||
flash(
|
||||
"Enabling PGP for a Proton Mail mailbox is redundant and does not add any security benefit",
|
||||
"info",
|
||||
)
|
||||
else:
|
||||
mailbox.disable_pgp = False
|
||||
flash(f"PGP is enabled on {mailbox.email}", "info")
|
||||
else:
|
||||
mailbox.disable_pgp = True
|
||||
flash(f"PGP is disabled on {mailbox.email}", "info")
|
||||
|
|
|
@ -227,6 +227,21 @@ def setting():
|
|||
Session.commit()
|
||||
flash("Your preference has been updated", "success")
|
||||
return redirect(url_for("dashboard.setting"))
|
||||
elif request.form.get("form-name") == "enable_data_breach_check":
|
||||
if not current_user.is_premium():
|
||||
flash("Only premium plan can enable data breach monitoring", "warning")
|
||||
return redirect(url_for("dashboard.setting"))
|
||||
choose = request.form.get("enable_data_breach_check")
|
||||
if choose == "on":
|
||||
LOG.i("User {current_user} has enabled data breach monitoring")
|
||||
current_user.enable_data_breach_check = True
|
||||
flash("Data breach monitoring is enabled", "success")
|
||||
else:
|
||||
LOG.i("User {current_user} has disabled data breach monitoring")
|
||||
current_user.enable_data_breach_check = False
|
||||
flash("Data breach monitoring is disabled", "info")
|
||||
Session.commit()
|
||||
return redirect(url_for("dashboard.setting"))
|
||||
elif request.form.get("form-name") == "sender-in-ra":
|
||||
choose = request.form.get("enable")
|
||||
if choose == "on":
|
||||
|
|
|
@ -21,6 +21,7 @@ LIST_UNSUBSCRIBE = "List-Unsubscribe"
|
|||
LIST_UNSUBSCRIBE_POST = "List-Unsubscribe-Post"
|
||||
RETURN_PATH = "Return-Path"
|
||||
AUTHENTICATION_RESULTS = "Authentication-Results"
|
||||
SL_QUEUE_ID = "X-SL-Queue-Id"
|
||||
|
||||
# headers used to DKIM sign in order of preference
|
||||
DKIM_HEADERS = [
|
||||
|
|
|
@ -494,9 +494,10 @@ def delete_header(msg: Message, header: str):
|
|||
|
||||
def sanitize_header(msg: Message, header: str):
|
||||
"""remove trailing space and remove linebreak from a header"""
|
||||
header_lowercase = header.lower()
|
||||
for i in reversed(range(len(msg._headers))):
|
||||
header_name = msg._headers[i][0].lower()
|
||||
if header_name == header.lower():
|
||||
if header_name == header_lowercase:
|
||||
# msg._headers[i] is a tuple like ('From', 'hey@google.com')
|
||||
if msg._headers[i][1]:
|
||||
msg._headers[i] = (
|
||||
|
|
|
@ -30,7 +30,9 @@ def apply_dmarc_policy_for_forward_phase(
|
|||
) -> Tuple[Message, Optional[str]]:
|
||||
spam_result = SpamdResult.extract_from_headers(msg, Phase.forward)
|
||||
if not DMARC_CHECK_ENABLED or not spam_result:
|
||||
LOG.i("DMARC check disabled")
|
||||
return msg, None
|
||||
LOG.i(f"Spam check result in {spam_result}")
|
||||
|
||||
from_header = get_header_unicode(msg[headers.FROM])
|
||||
|
||||
|
@ -150,8 +152,10 @@ def apply_dmarc_policy_for_reply_phase(
|
|||
) -> Optional[str]:
|
||||
spam_result = SpamdResult.extract_from_headers(msg, Phase.reply)
|
||||
if not DMARC_CHECK_ENABLED or not spam_result:
|
||||
LOG.i("DMARC check disabled")
|
||||
return None
|
||||
|
||||
LOG.i(f"Spam check result is {spam_result}")
|
||||
if spam_result.dmarc not in (
|
||||
DmarcCheckResult.quarantine,
|
||||
DmarcCheckResult.reject,
|
||||
|
|
|
@ -30,7 +30,10 @@ def handle_batch_import(batch_import: BatchImport):
|
|||
|
||||
LOG.d("Download file %s from %s", batch_import.file, file_url)
|
||||
r = requests.get(file_url)
|
||||
lines = [line.decode("utf-8") for line in r.iter_lines()]
|
||||
# Replace invisible character
|
||||
lines = [
|
||||
line.decode("utf-8").replace("\ufeff", "").strip() for line in r.iter_lines()
|
||||
]
|
||||
|
||||
import_from_csv(batch_import, user, lines)
|
||||
|
||||
|
|
|
@ -525,6 +525,11 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
|
|||
sa.Boolean, default=True, nullable=False, server_default="1"
|
||||
)
|
||||
|
||||
# user opted in for data breach check
|
||||
enable_data_breach_check = sa.Column(
|
||||
sa.Boolean, default=False, nullable=False, server_default="0"
|
||||
)
|
||||
|
||||
# bitwise flags. Allow for future expansion
|
||||
flags = sa.Column(
|
||||
sa.BigInteger,
|
||||
|
@ -2644,10 +2649,15 @@ class Mailbox(Base, ModelMixin):
|
|||
return False
|
||||
|
||||
def nb_alias(self):
|
||||
return (
|
||||
AliasMailbox.filter_by(mailbox_id=self.id).count()
|
||||
+ Alias.filter_by(mailbox_id=self.id).count()
|
||||
alias_ids = set(
|
||||
am.alias_id
|
||||
for am in AliasMailbox.filter_by(mailbox_id=self.id).values(
|
||||
AliasMailbox.alias_id
|
||||
)
|
||||
)
|
||||
for alias in Alias.filter_by(mailbox_id=self.id).values(Alias.id):
|
||||
alias_ids.add(alias.id)
|
||||
return len(alias_ids)
|
||||
|
||||
def is_proton(self) -> bool:
|
||||
if (
|
||||
|
@ -2696,12 +2706,15 @@ class Mailbox(Base, ModelMixin):
|
|||
|
||||
@property
|
||||
def aliases(self) -> [Alias]:
|
||||
ret = Alias.filter_by(mailbox_id=self.id).all()
|
||||
ret = dict(
|
||||
(alias.id, alias) for alias in Alias.filter_by(mailbox_id=self.id).all()
|
||||
)
|
||||
|
||||
for am in AliasMailbox.filter_by(mailbox_id=self.id):
|
||||
ret.append(am.alias)
|
||||
if am.alias_id not in ret:
|
||||
ret[am.alias_id] = am.alias
|
||||
|
||||
return ret
|
||||
return list(ret.values())
|
||||
|
||||
@classmethod
|
||||
def create(cls, **kw):
|
||||
|
|
|
@ -30,7 +30,9 @@ def check_bucket_limit(
|
|||
try:
|
||||
value = lock_redis.incr(bucket_lock_name, bucket_seconds)
|
||||
if value > max_hits:
|
||||
LOG.i(f"Rate limit hit for {bucket_lock_name} -> {value}/{max_hits}")
|
||||
LOG.i(
|
||||
f"Rate limit hit for {lock_name} (bucket id {bucket_id}) -> {value}/{max_hits}"
|
||||
)
|
||||
newrelic.agent.record_custom_event(
|
||||
"BucketRateLimit",
|
||||
{"lock_name": lock_name, "bucket_seconds": bucket_seconds},
|
||||
|
|
59
app/s3.py
59
app/s3.py
|
@ -5,19 +5,9 @@ from typing import Optional
|
|||
import boto3
|
||||
import requests
|
||||
|
||||
from app.config import (
|
||||
AWS_REGION,
|
||||
BUCKET,
|
||||
AWS_ACCESS_KEY_ID,
|
||||
AWS_SECRET_ACCESS_KEY,
|
||||
LOCAL_FILE_UPLOAD,
|
||||
UPLOAD_DIR,
|
||||
URL,
|
||||
AWS_ENDPOINT_URL,
|
||||
)
|
||||
from app import config
|
||||
from app.log import LOG
|
||||
|
||||
|
||||
_s3_client = None
|
||||
|
||||
|
||||
|
@ -25,12 +15,12 @@ def _get_s3client():
|
|||
global _s3_client
|
||||
if _s3_client is None:
|
||||
args = {
|
||||
"aws_access_key_id": AWS_ACCESS_KEY_ID,
|
||||
"aws_secret_access_key": AWS_SECRET_ACCESS_KEY,
|
||||
"region_name": AWS_REGION,
|
||||
"aws_access_key_id": config.AWS_ACCESS_KEY_ID,
|
||||
"aws_secret_access_key": config.AWS_SECRET_ACCESS_KEY,
|
||||
"region_name": config.AWS_REGION,
|
||||
}
|
||||
if AWS_ENDPOINT_URL:
|
||||
args["endpoint_url"] = AWS_ENDPOINT_URL
|
||||
if config.AWS_ENDPOINT_URL:
|
||||
args["endpoint_url"] = config.AWS_ENDPOINT_URL
|
||||
_s3_client = boto3.client("s3", **args)
|
||||
return _s3_client
|
||||
|
||||
|
@ -38,8 +28,8 @@ def _get_s3client():
|
|||
def upload_from_bytesio(key: str, bs: BytesIO, content_type="application/octet-stream"):
|
||||
bs.seek(0)
|
||||
|
||||
if LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(UPLOAD_DIR, key)
|
||||
if config.LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(config.UPLOAD_DIR, key)
|
||||
file_dir = os.path.dirname(file_path)
|
||||
os.makedirs(file_dir, exist_ok=True)
|
||||
with open(file_path, "wb") as f:
|
||||
|
@ -47,7 +37,7 @@ def upload_from_bytesio(key: str, bs: BytesIO, content_type="application/octet-s
|
|||
|
||||
else:
|
||||
_get_s3client().put_object(
|
||||
Bucket=BUCKET,
|
||||
Bucket=config.BUCKET,
|
||||
Key=key,
|
||||
Body=bs,
|
||||
ContentType=content_type,
|
||||
|
@ -57,8 +47,8 @@ def upload_from_bytesio(key: str, bs: BytesIO, content_type="application/octet-s
|
|||
def upload_email_from_bytesio(path: str, bs: BytesIO, filename):
|
||||
bs.seek(0)
|
||||
|
||||
if LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(UPLOAD_DIR, path)
|
||||
if config.LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(config.UPLOAD_DIR, path)
|
||||
file_dir = os.path.dirname(file_path)
|
||||
os.makedirs(file_dir, exist_ok=True)
|
||||
with open(file_path, "wb") as f:
|
||||
|
@ -66,7 +56,7 @@ def upload_email_from_bytesio(path: str, bs: BytesIO, filename):
|
|||
|
||||
else:
|
||||
_get_s3client().put_object(
|
||||
Bucket=BUCKET,
|
||||
Bucket=config.BUCKET,
|
||||
Key=path,
|
||||
Body=bs,
|
||||
# Support saving a remote file using Http header
|
||||
|
@ -77,12 +67,12 @@ def upload_email_from_bytesio(path: str, bs: BytesIO, filename):
|
|||
|
||||
|
||||
def download_email(path: str) -> Optional[str]:
|
||||
if LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(UPLOAD_DIR, path)
|
||||
if config.LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(config.UPLOAD_DIR, path)
|
||||
with open(file_path, "rb") as f:
|
||||
return f.read()
|
||||
resp = _get_s3client().get_object(
|
||||
Bucket=BUCKET,
|
||||
Bucket=config.BUCKET,
|
||||
Key=path,
|
||||
)
|
||||
if not resp or "Body" not in resp:
|
||||
|
@ -96,29 +86,30 @@ def upload_from_url(url: str, upload_path):
|
|||
|
||||
|
||||
def get_url(key: str, expires_in=3600) -> str:
|
||||
if LOCAL_FILE_UPLOAD:
|
||||
return URL + "/static/upload/" + key
|
||||
if config.LOCAL_FILE_UPLOAD:
|
||||
return config.URL + "/static/upload/" + key
|
||||
else:
|
||||
return _get_s3client().generate_presigned_url(
|
||||
ExpiresIn=expires_in,
|
||||
ClientMethod="get_object",
|
||||
Params={"Bucket": BUCKET, "Key": key},
|
||||
Params={"Bucket": config.BUCKET, "Key": key},
|
||||
)
|
||||
|
||||
|
||||
def delete(path: str):
|
||||
if LOCAL_FILE_UPLOAD:
|
||||
os.remove(os.path.join(UPLOAD_DIR, path))
|
||||
if config.LOCAL_FILE_UPLOAD:
|
||||
file_path = os.path.join(config.UPLOAD_DIR, path)
|
||||
os.remove(file_path)
|
||||
else:
|
||||
_get_s3client().delete_object(Bucket=BUCKET, Key=path)
|
||||
_get_s3client().delete_object(Bucket=config.BUCKET, Key=path)
|
||||
|
||||
|
||||
def create_bucket_if_not_exists():
|
||||
s3client = _get_s3client()
|
||||
buckets = s3client.list_buckets()
|
||||
for bucket in buckets["Buckets"]:
|
||||
if bucket["Name"] == BUCKET:
|
||||
if bucket["Name"] == config.BUCKET:
|
||||
LOG.i("Bucket already exists")
|
||||
return
|
||||
s3client.create_bucket(Bucket=BUCKET)
|
||||
LOG.i(f"Bucket {BUCKET} created")
|
||||
s3client.create_bucket(Bucket=config.BUCKET)
|
||||
LOG.i(f"Bucket {config.BUCKET} created")
|
||||
|
|
15
cron.py
15
cron.py
|
@ -61,6 +61,9 @@ from app.pgp_utils import load_public_key_and_check, PGPException
|
|||
from app.proton.utils import get_proton_partner
|
||||
from app.utils import sanitize_email
|
||||
from server import create_light_app
|
||||
from tasks.cleanup_old_imports import cleanup_old_imports
|
||||
from tasks.cleanup_old_jobs import cleanup_old_jobs
|
||||
from tasks.cleanup_old_notifications import cleanup_old_notifications
|
||||
|
||||
DELETE_GRACE_DAYS = 30
|
||||
|
||||
|
@ -1067,6 +1070,7 @@ def get_alias_to_check_hibp(
|
|||
Alias.id >= min_alias_id,
|
||||
Alias.id < max_alias_id,
|
||||
User.disabled == False, # noqa: E712
|
||||
User.enable_data_breach_check,
|
||||
or_(
|
||||
User.lifetime,
|
||||
ManualSubscription.end_at > now,
|
||||
|
@ -1221,6 +1225,13 @@ def clear_users_scheduled_to_be_deleted(dry_run=False):
|
|||
Session.commit()
|
||||
|
||||
|
||||
def delete_old_data():
|
||||
oldest_valid = arrow.now().shift(days=-config.KEEP_OLD_DATA_DAYS)
|
||||
cleanup_old_imports(oldest_valid)
|
||||
cleanup_old_jobs(oldest_valid)
|
||||
cleanup_old_notifications(oldest_valid)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
LOG.d("Start running cronjob")
|
||||
parser = argparse.ArgumentParser()
|
||||
|
@ -1235,6 +1246,7 @@ if __name__ == "__main__":
|
|||
"notify_manual_subscription_end",
|
||||
"notify_premium_end",
|
||||
"delete_logs",
|
||||
"delete_old_data",
|
||||
"poll_apple_subscription",
|
||||
"sanity_check",
|
||||
"delete_old_monitoring",
|
||||
|
@ -1263,6 +1275,9 @@ if __name__ == "__main__":
|
|||
elif args.job == "delete_logs":
|
||||
LOG.d("Deleted Logs")
|
||||
delete_logs()
|
||||
elif args.job == "delete_old_data":
|
||||
LOG.d("Delete old data")
|
||||
delete_old_data()
|
||||
elif args.job == "poll_apple_subscription":
|
||||
LOG.d("Poll Apple Subscriptions")
|
||||
poll_apple_subscription()
|
||||
|
|
|
@ -37,6 +37,12 @@ jobs:
|
|||
schedule: "15 5 * * *"
|
||||
captureStderr: true
|
||||
|
||||
- name: SimpleLogin Delete Old data
|
||||
command: python /code/cron.py -j delete_old_data
|
||||
shell: /bin/bash
|
||||
schedule: "30 5 * * *"
|
||||
captureStderr: true
|
||||
|
||||
- name: SimpleLogin Poll Apple Subscriptions
|
||||
command: python /code/cron.py -j poll_apple_subscription
|
||||
shell: /bin/bash
|
||||
|
|
|
@ -875,6 +875,7 @@ def forward_email_to_mailbox(
|
|||
# References and In-Reply-To are used for keeping the email thread
|
||||
headers.REFERENCES,
|
||||
headers.IN_REPLY_TO,
|
||||
headers.SL_QUEUE_ID,
|
||||
headers.LIST_UNSUBSCRIBE,
|
||||
headers.LIST_UNSUBSCRIBE_POST,
|
||||
] + headers.MIME_HEADERS
|
||||
|
@ -1179,6 +1180,7 @@ def handle_reply(envelope, msg: Message, rcpt_to: str) -> (bool, str):
|
|||
# References and In-Reply-To are used for keeping the email thread
|
||||
headers.REFERENCES,
|
||||
headers.IN_REPLY_TO,
|
||||
headers.SL_QUEUE_ID,
|
||||
]
|
||||
+ headers.MIME_HEADERS,
|
||||
)
|
||||
|
@ -2040,10 +2042,11 @@ def handle(envelope: Envelope, msg: Message) -> str:
|
|||
return status.E204
|
||||
|
||||
# sanitize email headers
|
||||
sanitize_header(msg, "from")
|
||||
sanitize_header(msg, "to")
|
||||
sanitize_header(msg, "cc")
|
||||
sanitize_header(msg, "reply-to")
|
||||
sanitize_header(msg, headers.FROM)
|
||||
sanitize_header(msg, headers.TO)
|
||||
sanitize_header(msg, headers.CC)
|
||||
sanitize_header(msg, headers.REPLY_TO)
|
||||
sanitize_header(msg, headers.MESSAGE_ID)
|
||||
|
||||
LOG.d(
|
||||
"==>> Handle mail_from:%s, rcpt_tos:%s, header_from:%s, header_to:%s, "
|
||||
|
|
|
@ -118,9 +118,7 @@ WORDS_FILE_PATH=local_data/test_words.txt
|
|||
|
||||
# Login with OIDC
|
||||
# CONNECT_WITH_OIDC_ICON=fa-github
|
||||
# OIDC_AUTHORIZATION_URL=to_fill
|
||||
# OIDC_USER_INFO_URL=to_fill
|
||||
# OIDC_TOKEN_URL=to_fill
|
||||
# OIDC_WELL_KNOWN_URL=to_fill
|
||||
# OIDC_SCOPES=openid email profile
|
||||
# OIDC_NAME_FIELD=name
|
||||
# OIDC_CLIENT_ID=to_fill
|
||||
|
|
|
@ -0,0 +1,29 @@
|
|||
"""empty message
|
||||
|
||||
Revision ID: fa2f19bb4e5a
|
||||
Revises: 52510a633d6f
|
||||
Create Date: 2024-04-09 13:12:26.305340
|
||||
|
||||
"""
|
||||
import sqlalchemy_utils
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = 'fa2f19bb4e5a'
|
||||
down_revision = '52510a633d6f'
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade():
|
||||
# ### commands auto generated by Alembic - please adjust! ###
|
||||
op.add_column('users', sa.Column('enable_data_breach_check', sa.Boolean(), server_default='0', nullable=False))
|
||||
# ### end Alembic commands ###
|
||||
|
||||
|
||||
def downgrade():
|
||||
# ### commands auto generated by Alembic - please adjust! ###
|
||||
op.drop_column('users', 'enable_data_breach_check')
|
||||
# ### end Alembic commands ###
|
|
@ -0,0 +1,19 @@
|
|||
import arrow
|
||||
|
||||
from app import s3
|
||||
from app.log import LOG
|
||||
from app.models import BatchImport
|
||||
|
||||
|
||||
def cleanup_old_imports(oldest_allowed: arrow.Arrow):
|
||||
LOG.i(f"Deleting imports older than {oldest_allowed}")
|
||||
for batch_import in (
|
||||
BatchImport.filter(BatchImport.created_at < oldest_allowed).yield_per(500).all()
|
||||
):
|
||||
LOG.i(
|
||||
f"Deleting batch import {batch_import} with file {batch_import.file.path}"
|
||||
)
|
||||
file = batch_import.file
|
||||
if file is not None:
|
||||
s3.delete(file.path)
|
||||
BatchImport.delete(batch_import.id, commit=True)
|
|
@ -0,0 +1,24 @@
|
|||
import arrow
|
||||
from sqlalchemy import or_, and_
|
||||
|
||||
from app import config
|
||||
from app.db import Session
|
||||
from app.log import LOG
|
||||
from app.models import Job, JobState
|
||||
|
||||
|
||||
def cleanup_old_jobs(oldest_allowed: arrow.Arrow):
|
||||
LOG.i(f"Deleting jobs older than {oldest_allowed}")
|
||||
count = Job.filter(
|
||||
or_(
|
||||
Job.state == JobState.done.value,
|
||||
Job.state == JobState.error.value,
|
||||
and_(
|
||||
Job.state == JobState.taken.value,
|
||||
Job.attempts >= config.JOB_MAX_ATTEMPTS,
|
||||
),
|
||||
),
|
||||
Job.updated_at < oldest_allowed,
|
||||
).delete()
|
||||
Session.commit()
|
||||
LOG.i(f"Deleted {count} jobs")
|
|
@ -0,0 +1,12 @@
|
|||
import arrow
|
||||
|
||||
from app.db import Session
|
||||
from app.log import LOG
|
||||
from app.models import Notification
|
||||
|
||||
|
||||
def cleanup_old_notifications(oldest_allowed: arrow.Arrow):
|
||||
LOG.i(f"Deleting notifications older than {oldest_allowed}")
|
||||
count = Notification.filter(Notification.created_at < oldest_allowed).delete()
|
||||
Session.commit()
|
||||
LOG.i(f"Deleted {count} notifications")
|
|
@ -249,6 +249,42 @@
|
|||
</div>
|
||||
</div>
|
||||
<!-- END Random alias -->
|
||||
<!-- Data breach check -->
|
||||
<div class="card" id="data-breach">
|
||||
<div class="card-body">
|
||||
<div class="card-title">Data breach monitoring</div>
|
||||
<div class="mt-1 mb-3">
|
||||
{% if not current_user.is_premium() %}
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
This feature is only available on Premium plan.
|
||||
<a href="{{ url_for('dashboard.pricing') }}"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer">
|
||||
Upgrade<i class="fe fe-external-link"></i>
|
||||
</a>
|
||||
</div>
|
||||
{% endif %}
|
||||
If enabled, we will inform you via email if one of your aliases appears in a data breach.
|
||||
<br>
|
||||
SimpleLogin uses <a href="https://haveibeenpwned.com/">HaveIBeenPwned</a> API for checking for data breaches.
|
||||
</div>
|
||||
<form method="post" action="#data-breach">
|
||||
{{ csrf_form.csrf_token }}
|
||||
<input type="hidden" name="form-name" value="enable_data_breach_check">
|
||||
<div class="form-check">
|
||||
<input type="checkbox"
|
||||
id="enable_data_breach_check"
|
||||
name="enable_data_breach_check"
|
||||
{% if current_user.enable_data_breach_check %} checked{% endif %}
|
||||
class="form-check-input">
|
||||
<label for="enable_data_breach_check">Enable data breach monitoring</label>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-outline-primary">Update</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<!-- END Data breach check -->
|
||||
<!-- Sender Format -->
|
||||
<div class="card" id="sender-format">
|
||||
<div class="card-body">
|
||||
|
@ -285,7 +321,9 @@
|
|||
No Name (i.e. only reverse-alias)
|
||||
</option>
|
||||
</select>
|
||||
<button class="btn btn-outline-primary mt-3">Update</button>
|
||||
<button class="btn btn-outline-primary mt-3">
|
||||
Update
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
|
@ -295,7 +333,9 @@
|
|||
<div class="card-body">
|
||||
<div class="card-title">
|
||||
Reverse Alias Replacement
|
||||
<div class="badge badge-warning">Experimental</div>
|
||||
<div class="badge badge-warning">
|
||||
Experimental
|
||||
</div>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
When replying to a forwarded email, the <b>reverse-alias</b> can be automatically included
|
||||
|
@ -312,9 +352,13 @@
|
|||
name="replace-ra"
|
||||
{% if current_user.replace_reverse_alias %} checked{% endif %}
|
||||
class="form-check-input">
|
||||
<label for="replace-ra">Enable replacing reverse alias</label>
|
||||
<label for="replace-ra">
|
||||
Enable replacing reverse alias
|
||||
</label>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-outline-primary">Update</button>
|
||||
<button type="submit" class="btn btn-outline-primary">
|
||||
Update
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
from app import config
|
||||
from flask import url_for
|
||||
from flask import url_for, session
|
||||
from urllib.parse import parse_qs
|
||||
from urllib3.util import parse_url
|
||||
from app.auth.views.oidc import create_user
|
||||
|
@ -10,7 +10,21 @@ from app.models import User
|
|||
from app.config import URL, OIDC_CLIENT_ID
|
||||
|
||||
|
||||
def test_oidc_login(flask_client):
|
||||
mock_well_known_response = {
|
||||
"authorization_endpoint": "http://localhost:7777/authorization-endpoint",
|
||||
"userinfo_endpoint": "http://localhost:7777/userinfo-endpoint",
|
||||
"token_endpoint": "http://localhost:7777/token-endpoint",
|
||||
}
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
def test_oidc_login(mock_get, flask_client):
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_login"),
|
||||
follow_redirects=False,
|
||||
|
@ -28,8 +42,41 @@ def test_oidc_login(flask_client):
|
|||
assert expected_redirect_url == query["redirect_uri"][0]
|
||||
|
||||
|
||||
def test_oidc_login_no_client_id(flask_client):
|
||||
@patch("requests.get")
|
||||
def test_oidc_login_next_url(mock_get, flask_client):
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
with flask_client:
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_login", next="/dashboard/settings/"),
|
||||
follow_redirects=False,
|
||||
)
|
||||
location = r.headers.get("Location")
|
||||
assert location is not None
|
||||
|
||||
parsed = parse_url(location)
|
||||
query = parse_qs(parsed.query)
|
||||
|
||||
expected_redirect_url = f"{URL}/auth/oidc/callback"
|
||||
|
||||
assert "code" == query["response_type"][0]
|
||||
assert OIDC_CLIENT_ID == query["client_id"][0]
|
||||
assert expected_redirect_url == query["redirect_uri"][0]
|
||||
assert session["oauth_redirect_next"] == "/dashboard/settings/"
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
def test_oidc_login_no_client_id(mock_get, flask_client):
|
||||
config.OIDC_CLIENT_ID = None
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_login"),
|
||||
|
@ -47,8 +94,14 @@ def test_oidc_login_no_client_id(flask_client):
|
|||
config.OIDC_CLIENT_ID = "to_fill"
|
||||
|
||||
|
||||
def test_oidc_login_no_client_secret(flask_client):
|
||||
@patch("requests.get")
|
||||
def test_oidc_login_no_client_secret(mock_get, flask_client):
|
||||
config.OIDC_CLIENT_SECRET = None
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_login"),
|
||||
|
@ -66,9 +119,14 @@ def test_oidc_login_no_client_secret(flask_client):
|
|||
config.OIDC_CLIENT_SECRET = "to_fill"
|
||||
|
||||
|
||||
def test_oidc_callback_no_oauth_state(flask_client):
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
@patch("requests.get")
|
||||
def test_oidc_callback_no_oauth_state(mock_get, flask_client):
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
|
@ -78,11 +136,16 @@ def test_oidc_callback_no_oauth_state(flask_client):
|
|||
assert location is None
|
||||
|
||||
|
||||
def test_oidc_callback_no_client_id(flask_client):
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
@patch("requests.get")
|
||||
def test_oidc_callback_no_client_id(mock_get, flask_client):
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
config.OIDC_CLIENT_ID = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
follow_redirects=False,
|
||||
|
@ -97,15 +160,20 @@ def test_oidc_callback_no_client_id(flask_client):
|
|||
assert expected_redirect_url == parsed.path
|
||||
|
||||
config.OIDC_CLIENT_ID = "to_fill"
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
def test_oidc_callback_no_client_secret(flask_client):
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
@patch("requests.get")
|
||||
def test_oidc_callback_no_client_secret(mock_get, flask_client):
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
config.OIDC_CLIENT_SECRET = None
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
follow_redirects=False,
|
||||
|
@ -120,16 +188,23 @@ def test_oidc_callback_no_client_secret(flask_client):
|
|||
assert expected_redirect_url == parsed.path
|
||||
|
||||
config.OIDC_CLIENT_SECRET = "to_fill"
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
||||
@patch("requests_oauthlib.OAuth2Session.get")
|
||||
def test_oidc_callback_invalid_user(mock_get, mock_fetch_token, flask_client):
|
||||
mock_get.return_value = MockResponse(400, {})
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
def test_oidc_callback_invalid_user(
|
||||
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
||||
):
|
||||
mock_oauth_get.return_value = MockResponse(400, {})
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
|
@ -143,18 +218,25 @@ def test_oidc_callback_invalid_user(mock_get, mock_fetch_token, flask_client):
|
|||
expected_redirect_url = "/auth/login"
|
||||
|
||||
assert expected_redirect_url == parsed.path
|
||||
assert mock_get.called
|
||||
assert mock_oauth_get.called
|
||||
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
||||
@patch("requests_oauthlib.OAuth2Session.get")
|
||||
def test_oidc_callback_no_email(mock_get, mock_fetch_token, flask_client):
|
||||
mock_get.return_value = MockResponse(200, {})
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
def test_oidc_callback_no_email(
|
||||
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
||||
):
|
||||
mock_oauth_get.return_value = MockResponse(200, {})
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
|
@ -168,20 +250,27 @@ def test_oidc_callback_no_email(mock_get, mock_fetch_token, flask_client):
|
|||
expected_redirect_url = "/auth/login"
|
||||
|
||||
assert expected_redirect_url == parsed.path
|
||||
assert mock_get.called
|
||||
assert mock_oauth_get.called
|
||||
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
||||
@patch("requests_oauthlib.OAuth2Session.get")
|
||||
def test_oidc_callback_disabled_registration(mock_get, mock_fetch_token, flask_client):
|
||||
def test_oidc_callback_disabled_registration(
|
||||
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
||||
):
|
||||
config.DISABLE_REGISTRATION = True
|
||||
email = random_string()
|
||||
mock_get.return_value = MockResponse(200, {"email": email})
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
mock_oauth_get.return_value = MockResponse(200, {"email": email})
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
|
@ -195,26 +284,33 @@ def test_oidc_callback_disabled_registration(mock_get, mock_fetch_token, flask_c
|
|||
expected_redirect_url = "/auth/register"
|
||||
|
||||
assert expected_redirect_url == parsed.path
|
||||
assert mock_get.called
|
||||
assert mock_oauth_get.called
|
||||
|
||||
config.DISABLE_REGISTRATION = False
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
||||
@patch("requests_oauthlib.OAuth2Session.get")
|
||||
def test_oidc_callback_registration(mock_get, mock_fetch_token, flask_client):
|
||||
def test_oidc_callback_registration(
|
||||
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
||||
):
|
||||
email = random_string()
|
||||
mock_get.return_value = MockResponse(
|
||||
mock_oauth_get.return_value = MockResponse(
|
||||
200,
|
||||
{
|
||||
"email": email,
|
||||
config.OIDC_NAME_FIELD: "name",
|
||||
},
|
||||
)
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
user = User.get_by(email=email)
|
||||
assert user is None
|
||||
|
@ -231,28 +327,33 @@ def test_oidc_callback_registration(mock_get, mock_fetch_token, flask_client):
|
|||
expected_redirect_url = "/dashboard/"
|
||||
|
||||
assert expected_redirect_url == parsed.path
|
||||
assert mock_get.called
|
||||
assert mock_oauth_get.called
|
||||
|
||||
user = User.get_by(email=email)
|
||||
assert user is not None
|
||||
assert user.email == email
|
||||
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
||||
@patch("requests_oauthlib.OAuth2Session.get")
|
||||
def test_oidc_callback_login(mock_get, mock_fetch_token, flask_client):
|
||||
def test_oidc_callback_login(mock_oauth_get, mock_fetch_token, mock_get, flask_client):
|
||||
email = random_string()
|
||||
mock_get.return_value = MockResponse(
|
||||
mock_oauth_get.return_value = MockResponse(
|
||||
200,
|
||||
{
|
||||
"email": email,
|
||||
},
|
||||
)
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = "state"
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = None
|
||||
sess["oauth_state"] = "state"
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
user = User.create(
|
||||
email=email,
|
||||
|
@ -275,10 +376,57 @@ def test_oidc_callback_login(mock_get, mock_fetch_token, flask_client):
|
|||
expected_redirect_url = "/dashboard/"
|
||||
|
||||
assert expected_redirect_url == parsed.path
|
||||
assert mock_get.called
|
||||
assert mock_oauth_get.called
|
||||
|
||||
with flask_client.session_transaction() as session:
|
||||
session["oauth_state"] = None
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
@patch("requests.get")
|
||||
@patch("requests_oauthlib.OAuth2Session.fetch_token")
|
||||
@patch("requests_oauthlib.OAuth2Session.get")
|
||||
def test_oidc_callback_login_with_next_url(
|
||||
mock_oauth_get, mock_fetch_token, mock_get, flask_client
|
||||
):
|
||||
email = random_string()
|
||||
mock_oauth_get.return_value = MockResponse(
|
||||
200,
|
||||
{
|
||||
"email": email,
|
||||
},
|
||||
)
|
||||
config.OIDC_WELL_KNOWN_URL = "http://localhost:7777/well-known-url"
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_redirect_next"] = "/dashboard/settings/"
|
||||
sess["oauth_state"] = "state"
|
||||
|
||||
mock_get.return_value.json.return_value = mock_well_known_response
|
||||
|
||||
user = User.create(
|
||||
email=email,
|
||||
name="name",
|
||||
password="",
|
||||
activated=True,
|
||||
)
|
||||
user = User.get_by(email=email)
|
||||
assert user is not None
|
||||
|
||||
r = flask_client.get(
|
||||
url_for("auth.oidc_callback"),
|
||||
follow_redirects=False,
|
||||
)
|
||||
location = r.headers.get("Location")
|
||||
assert location is not None
|
||||
|
||||
parsed = parse_url(location)
|
||||
|
||||
expected_redirect_url = "/dashboard/settings/"
|
||||
|
||||
assert expected_redirect_url == parsed.path
|
||||
assert mock_oauth_get.called
|
||||
|
||||
with flask_client.session_transaction() as sess:
|
||||
sess["oauth_state"] = None
|
||||
|
||||
|
||||
def test_create_user():
|
||||
|
|
|
@ -28,9 +28,10 @@ def test_get_alias_for_free_user_has_no_alias():
|
|||
assert len(aliases) == 0
|
||||
|
||||
|
||||
def test_get_alias_for_lifetime():
|
||||
def test_get_alias_for_lifetime_with_null_hibp_date():
|
||||
user = create_new_user()
|
||||
user.lifetime = True
|
||||
user.enable_data_breach_check = True
|
||||
alias_id = Alias.create_new_random(user).id
|
||||
Session.commit()
|
||||
aliases = list(
|
||||
|
@ -39,6 +40,20 @@ def test_get_alias_for_lifetime():
|
|||
assert alias_id == aliases[0].id
|
||||
|
||||
|
||||
def test_get_alias_for_lifetime_with_old_hibp_date():
|
||||
user = create_new_user()
|
||||
user.lifetime = True
|
||||
user.enable_data_breach_check = True
|
||||
alias = Alias.create_new_random(user)
|
||||
alias.hibp_last_check = arrow.now().shift(days=-1)
|
||||
alias_id = alias.id
|
||||
Session.commit()
|
||||
aliases = list(
|
||||
cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
|
||||
)
|
||||
assert alias_id == aliases[0].id
|
||||
|
||||
|
||||
def create_partner_sub(user: User):
|
||||
pu = PartnerUser.create(
|
||||
partner_id=get_proton_partner().id,
|
||||
|
@ -84,6 +99,7 @@ sub_generator_list = [
|
|||
@pytest.mark.parametrize("sub_generator", sub_generator_list)
|
||||
def test_get_alias_for_sub(sub_generator):
|
||||
user = create_new_user()
|
||||
user.enable_data_breach_check = True
|
||||
sub_generator(user)
|
||||
alias_id = Alias.create_new_random(user).id
|
||||
Session.commit()
|
||||
|
@ -114,3 +130,39 @@ def test_skipped_user_is_not_checked():
|
|||
cron.get_alias_to_check_hibp(arrow.now(), [user.id], alias_id, alias_id + 1)
|
||||
)
|
||||
assert len(aliases) == 0
|
||||
|
||||
|
||||
def test_already_checked_is_not_checked():
|
||||
user = create_new_user()
|
||||
user.lifetime = True
|
||||
alias = Alias.create_new_random(user)
|
||||
alias.hibp_last_check = arrow.now().shift(days=1)
|
||||
alias_id = alias.id
|
||||
Session.commit()
|
||||
aliases = list(
|
||||
cron.get_alias_to_check_hibp(arrow.now(), [user.id], alias_id, alias_id + 1)
|
||||
)
|
||||
assert len(aliases) == 0
|
||||
|
||||
|
||||
def test_outed_in_user_is_checked():
|
||||
user = create_new_user()
|
||||
user.lifetime = True
|
||||
user.enable_data_breach_check = True
|
||||
alias_id = Alias.create_new_random(user).id
|
||||
Session.commit()
|
||||
aliases = list(
|
||||
cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
|
||||
)
|
||||
assert len(aliases) == 1
|
||||
|
||||
|
||||
def test_outed_out_user_is_not_checked():
|
||||
user = create_new_user()
|
||||
user.lifetime = True
|
||||
alias_id = Alias.create_new_random(user).id
|
||||
Session.commit()
|
||||
aliases = list(
|
||||
cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
|
||||
)
|
||||
assert len(aliases) == 0
|
||||
|
|
|
@ -0,0 +1,35 @@
|
|||
import tempfile
|
||||
from io import BytesIO
|
||||
|
||||
import arrow
|
||||
|
||||
from app import s3, config
|
||||
from app.models import File, BatchImport
|
||||
from tasks.cleanup_old_imports import cleanup_old_imports
|
||||
from tests.utils import random_token, create_new_user
|
||||
|
||||
|
||||
def test_cleanup_old_imports():
|
||||
BatchImport.filter().delete()
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
config.UPLOAD_DIR = tmpdir
|
||||
user = create_new_user()
|
||||
path = random_token()
|
||||
s3.upload_from_bytesio(path, BytesIO("data".encode("utf-8")))
|
||||
file = File.create(path=path, commit=True) # noqa: F821
|
||||
now = arrow.now()
|
||||
delete_batch_import_id = BatchImport.create(
|
||||
user_id=user.id,
|
||||
file_id=file.id,
|
||||
created_at=now.shift(minutes=-1),
|
||||
flush=True,
|
||||
).id
|
||||
keep_batch_import_id = BatchImport.create(
|
||||
user_id=user.id,
|
||||
file_id=file.id,
|
||||
created_at=now.shift(minutes=+1),
|
||||
commit=True,
|
||||
).id
|
||||
cleanup_old_imports(now)
|
||||
assert BatchImport.get(id=delete_batch_import_id) is None
|
||||
assert BatchImport.get(id=keep_batch_import_id) is not None
|
|
@ -0,0 +1,72 @@
|
|||
import arrow
|
||||
|
||||
from app import config
|
||||
from app.models import Job, JobState
|
||||
from tasks.cleanup_old_jobs import cleanup_old_jobs
|
||||
|
||||
|
||||
def test_cleanup_old_jobs():
|
||||
Job.filter().delete()
|
||||
now = arrow.now()
|
||||
delete_ids = [
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=-1),
|
||||
state=JobState.done.value,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=-1),
|
||||
state=JobState.error.value,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=-1),
|
||||
state=JobState.taken.value,
|
||||
attempts=config.JOB_MAX_ATTEMPTS,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
]
|
||||
|
||||
keep_ids = [
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=+1),
|
||||
state=JobState.done.value,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=+1),
|
||||
state=JobState.error.value,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=+1),
|
||||
state=JobState.taken.value,
|
||||
attempts=config.JOB_MAX_ATTEMPTS,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
Job.create(
|
||||
updated_at=now.shift(minutes=-1),
|
||||
state=JobState.taken.value,
|
||||
attempts=config.JOB_MAX_ATTEMPTS - 1,
|
||||
name="",
|
||||
payload="",
|
||||
flush=True,
|
||||
).id,
|
||||
]
|
||||
cleanup_old_jobs(now)
|
||||
for delete_id in delete_ids:
|
||||
assert Job.get(id=delete_id) is None
|
||||
for keep_id in keep_ids:
|
||||
assert Job.get(id=keep_id) is not None
|
|
@ -0,0 +1,26 @@
|
|||
import arrow
|
||||
|
||||
from app.models import Notification
|
||||
from tasks.cleanup_old_notifications import cleanup_old_notifications
|
||||
from tests.utils import create_new_user
|
||||
|
||||
|
||||
def test_cleanup_old_notifications():
|
||||
Notification.filter().delete()
|
||||
user = create_new_user()
|
||||
now = arrow.now()
|
||||
delete_id = Notification.create(
|
||||
user_id=user.id,
|
||||
created_at=now.shift(minutes=-1),
|
||||
message="",
|
||||
flush=True,
|
||||
).id
|
||||
keep_id = Notification.create(
|
||||
user_id=user.id,
|
||||
created_at=now.shift(minutes=+1),
|
||||
message="",
|
||||
flush=True,
|
||||
).id
|
||||
cleanup_old_notifications(now)
|
||||
assert Notification.get(id=delete_id) is None
|
||||
assert Notification.get(id=keep_id) is not None
|
|
@ -51,9 +51,7 @@ FACEBOOK_CLIENT_SECRET=to_fill
|
|||
|
||||
# Login with OIDC
|
||||
CONNECT_WITH_OIDC_ICON=fa-github
|
||||
OIDC_AUTHORIZATION_URL=to_fill
|
||||
OIDC_USER_INFO_URL=to_fill
|
||||
OIDC_TOKEN_URL=to_fill
|
||||
OIDC_WELL_KNOWN_URL=to_fill
|
||||
OIDC_SCOPES=openid email profile
|
||||
OIDC_NAME_FIELD=name
|
||||
OIDC_CLIENT_ID=to_fill
|
||||
|
|
|
@ -384,3 +384,30 @@ def test_break_loop_alias_as_mailbox(flask_client):
|
|||
msg[headers.SUBJECT] = random_string()
|
||||
result = email_handler.handle(envelope, msg)
|
||||
assert result == status.E525
|
||||
|
||||
|
||||
@mail_sender.store_emails_test_decorator
|
||||
def test_preserve_headers(flask_client):
|
||||
headers_to_keep = [
|
||||
headers.SUBJECT,
|
||||
headers.DATE,
|
||||
headers.MESSAGE_ID,
|
||||
headers.REFERENCES,
|
||||
headers.IN_REPLY_TO,
|
||||
headers.SL_QUEUE_ID,
|
||||
] + headers.MIME_HEADERS
|
||||
user = create_new_user()
|
||||
alias = Alias.create_new_random(user)
|
||||
envelope = Envelope()
|
||||
envelope.mail_from = "somewhere@lo.cal"
|
||||
envelope.rcpt_tos = [alias.email]
|
||||
msg = EmailMessage()
|
||||
for header in headers_to_keep:
|
||||
msg[header] = header + "keep"
|
||||
result = email_handler.handle(envelope, msg)
|
||||
assert result == status.E200
|
||||
sent_mails = mail_sender.get_stored_emails()
|
||||
assert len(sent_mails) == 1
|
||||
msg = sent_mails[0].msg
|
||||
for header in headers_to_keep:
|
||||
assert msg[header] == header + "keep"
|
||||
|
|
Loading…
Reference in New Issue