75 lines
2.2 KiB
Python
75 lines
2.2 KiB
Python
|
import json
|
||
|
|
import unittest
|
||
|
|
from unittest.mock import patch
|
||
|
|
|
||
|
|
from flowers import create_app
|
||
|
|
|
||
|
|
|
||
|
|
class FakeVault:
|
||
|
|
def __init__(self, *args):
|
||
|
|
pass
|
||
|
|
|
||
|
|
def authenticate(self):
|
||
|
|
return True
|
||
|
|
|
||
|
|
def all(self):
|
||
|
|
return [
|
||
|
|
{
|
||
|
|
"organization": "Acme",
|
||
|
|
"myID": "alice@example.test",
|
||
|
|
"dateCreated": "2024-02-03 12:00:00",
|
||
|
|
}
|
||
|
|
]
|
||
|
|
|
||
|
|
|
||
|
|
class AppTests(unittest.TestCase):
|
||
|
|
def setUp(self):
|
||
|
|
self.app = create_app({"TESTING": True, "SECRET_KEY": "test-secret"})
|
||
|
|
self.client = self.app.test_client()
|
||
|
|
|
||
|
|
def csrf(self):
|
||
|
|
self.client.get("/")
|
||
|
|
with self.client.session_transaction() as browser_session:
|
||
|
|
return browser_session["csrf_token"]
|
||
|
|
|
||
|
|
def test_login_form_requires_csrf(self):
|
||
|
|
response = self.client.post(
|
||
|
|
"/browser",
|
||
|
|
data={"action": "login", "name": "alice", "password": "legacy_pwd"},
|
||
|
|
)
|
||
|
|
self.assertEqual(response.status_code, 400)
|
||
|
|
|
||
|
|
@patch("flower_vase.Flower", FakeVault)
|
||
|
|
def test_login_renders_existing_entries(self):
|
||
|
|
response = self.client.post(
|
||
|
|
"/browser",
|
||
|
|
data={
|
||
|
|
"csrf_token": self.csrf(),
|
||
|
|
"action": "login",
|
||
|
|
"name": "alice",
|
||
|
|
"password": "legacy_pwd",
|
||
|
|
},
|
||
|
|
follow_redirects=True,
|
||
|
|
)
|
||
|
|
self.assertEqual(response.status_code, 200)
|
||
|
|
self.assertIn(b"Acme", response.data)
|
||
|
|
with self.client.session_transaction() as browser_session:
|
||
|
|
self.assertNotIn("dbpwd", browser_session)
|
||
|
|
self.assertNotIn("password", browser_session)
|
||
|
|
self.assertIn("auth_token", browser_session)
|
||
|
|
|
||
|
|
@patch("flower_vase.Flower", FakeVault)
|
||
|
|
def test_legacy_api_keeps_double_encoded_list(self):
|
||
|
|
response = self.client.post(
|
||
|
|
"/app",
|
||
|
|
data={"action": "list", "name": "alice", "password": "legacy_pwd"},
|
||
|
|
)
|
||
|
|
payload = response.get_json()
|
||
|
|
nested = json.loads(payload["list"])
|
||
|
|
self.assertEqual(payload["result"], 1)
|
||
|
|
self.assertEqual(nested[0]["organization"], "Acme")
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|