Synnefo

from astakos.im.tests.common import *

class ShibbolethTests(TestCase):

    """

        # shibboleth views validation

        # eepn required

        self.assertContains(r, messages.SHIBBOLETH_MISSING_EPPN % {

            'domain': astakos_settings.BASE_URL,

            'contact_email': settings.CONTACT_EMAIL

        astakos_settings.SHIBBOLETH_REQUIRE_NAME_INFO = True

        # shibboleth user info required

        self.assertContains(r, messages.SHIBBOLETH_MISSING_NAME)

        astakos_settings.SHIBBOLETH_REQUIRE_NAME_INFO = False

        client.set_tokens(mail="kpap@synnefo.org", eppn="kpapeppn",

                          cn="Kostas Papadimitriou",

                          ep_affiliation="Test Affiliation")

        token = PendingThirdPartyUser.objects.get().token

        self.assertEqual(r.status_code, 200)

        # a new pending user created

        client.reset_tokens()

        # this is the old way, it should fail, to avoid pending user take over

        self.assertEqual(r.status_code, 404)

        # this is the signup unique url associated with the pending user

        # created

        identifier = pending_user.third_party_identifier

        post_data = {'third_party_identifier': identifier,

                     'first_name': 'Kostas',

        # login (not activated yet)

        client.set_tokens(mail="kpap@synnefo.org", eppn="kpapeppn",

                          cn="Kostas Papadimitriou", )

        self.assertContains(r, 'is pending moderation')

        # admin activates the user

        self.assertEqual(u.is_active, True)

        # we see our profile

        self.assertEqual(r.status_code, 200)

    def test_existing(self):

        # shibboleth logged us in, notice that we use different email

        client.set_tokens(mail="kpap@shibboleth.gr", eppn="kpapeppn",

                          cn="Kostas Papadimitriou", )

        # a new pending user created

        pending_user = PendingThirdPartyUser.objects.get()

        self.assertEqual(PendingThirdPartyUser.objects.count(), 1)

        pending_key = pending_user.token

        client.reset_tokens()

        form = r.context['login_form']

        signupdata = copy.copy(form.initial)

        signupdata.pop('id', None)

        # the email exists to another user

        self.assertContains(r, "There is already an account with this email "

                               "address")

        # change the case, still cannot create

        signupdata['email'] = 'KPAP@synnefo.org'

        self.assertContains(r, "There is already an account with this email "

                               "address")

        # inactive user

        signupdata['email'] = 'KPAP-inactive@synnefo.org'

        self.assertContains(r, "There is already an account with this email "

                               "address")

        # unverified user, this should pass, old entry will be deleted

        signupdata['email'] = 'KAPAP-unverified@synnefo.org'

        post_data = {'password': 'password',

                     'username': 'kpap@synnefo.org'}

        self.assertTrue(r.context['request'].user.is_authenticated())

        client.set_tokens(mail="kpap@shibboleth.gr", eppn="kpapeppn",

                          cn="Kostas Papadimitriou", )

        self.assertContains(r, "enabled for this account")

        client.reset_tokens()

        # look Ma, i can login with both my shibboleth and local account

        client.set_tokens(mail="kpap@shibboleth.gr", eppn="kpapeppn",

                          cn="Kostas Papadimitriou")

        self.assertTrue(r.context['request'].user.is_authenticated())

        self.assertTrue(r.context['request'].user.email == "kpap@synnefo.org")

        self.assertEqual(r.status_code, 200)

        client.logout()

        client.reset_tokens()

        # logged out

        self.assertFalse(r.context['request'].user.is_authenticated())

        # login with local account also works

        post_data = {'password': 'password',

                     'username': 'kpap@synnefo.org'}

        self.assertTrue(r.context['request'].user.is_authenticated())

        self.assertTrue(r.context['request'].user.email == "kpap@synnefo.org")

        self.assertEqual(r.status_code, 200)

        # cannot add the same eppn

        client.set_tokens(mail="secondary@shibboleth.gr", eppn="kpapeppn",

                          cn="Kostas Papadimitriou", )

        self.assertTrue(r.status_code, 200)

        self.assertEquals(existing_user.auth_providers.count(), 2)

        client.set_tokens(mail="secondary@shibboleth.gr", eppn="kpapeppn2",

                          cn="Kostas Papadimitriou", ep_affiliation="affil2")

        prov = auth_providers.get_provider('shibboleth')

        self.assertContains(r, "Failed to add")

        self.assertTrue(r.status_code, 200)

        self.assertEquals(existing_user.auth_providers.count(), 2)

        client.logout()

        # cannot login with another eppn

        client.set_tokens(mail="kpap@synnefo.org", eppn="kpapeppninvalid",

                          cn="Kostas Papadimitriou")

        self.assertFalse(r.context['request'].user.is_authenticated())

        # cannot

                                                   'kpapeppn').get_remove_url

        client.set_tokens(mail="kpap@shibboleth.gr", eppn="kpapeppn",

                          cn="Kostas Papadimtriou")

        client.reset_tokens()

        # only POST is allowed (for CSRF protection)

        # cannot login using local credentials (notice we use another client)

        post_data = {'password': 'password',

                     'username': 'kpap@synnefo.org'}

        self.assertFalse(r.context['request'].user.is_authenticated())

        # we can reenable the local provider by setting a password

                                                'new_password2': '111'},

                        follow=True)

        user = r.context['request'].user

        # now we can login

        post_data = {'password': '111',

                     'username': 'kpap@synnefo.org'}

        self.assertTrue(r.context['request'].user.is_authenticated())

        client.reset_tokens()

        # login

        client.set_tokens(mail="kpap@shibboleth.gr", eppn="kpapeppn",

                          cn="Kostas Papadimitriou")

        # try to assign existing shibboleth identifier of another user

        client.set_tokens(mail="kpap_second@shibboleth.gr",

                          eppn="existingeppn", cn="Kostas Papadimitriou")

        self.assertContains(r, "is already in use")

        astakos_settings.MODERATION_ENABLED = False

        # create a new user

        self.assertEqual(r.status_code, 200)

        data = {'email': 'kpap@synnefo.org', 'password1': 'password',

                'password2': 'password', 'first_name': 'Kostas',

                'last_name': 'Mitroglou', 'provider': 'local'}

        # user created

        self.assertEqual(AstakosUser.objects.count(), 1)

        self.helpdesk_email = astakos_settings.HELPDESK[0][1]

        # create a user

        self.assertEqual(r.status_code, 200)

        data = {'email': 'kpap@synnefo.org', 'password1': 'password',

                'password2': 'password', 'first_name': 'Kostas',

                'last_name': 'Mitroglou', 'provider': 'local'}

        # user created

        self.assertEqual(AstakosUser.objects.count(), 1)

        # admin gets notified and activates the user from the command line

        self.assertEqual(len(get_mailbox('kpap@synnefo.org')), 1)

                                           'password': 'password'},

                             follow=True)

        self.assertContains(r, messages.VERIFICATION_SENT)

        data = {'email': 'KPAP@synnefo.org', 'password1': 'password',

                'password2': 'password', 'first_name': 'Kostas',

                'last_name': 'Mitroglou', 'provider': 'local'}

        self.assertRedirects(r, reverse('index'))

        self.assertContains(r, messages.VERIFICATION_SENT)

        self.assertEqual(len(get_mailbox('KPAP@synnefo.org')), 1)

        # hmmm, email exists; lets request a password change

        self.assertEqual(r.status_code, 200)

        data = {'email': 'kpap@synnefo.org'}

        # she can't because account is not active yet

        self.assertContains(r, 'pending activation')

        # moderation is enabled and an activation email has already been sent

        # so user can trigger resend of the activation email

        self.assertContains(r, 'has been sent to your email address.')

        self.assertEqual(len(get_mailbox('KPAP@synnefo.org')), 2)

        # also she cannot login

        data = {'username': 'kpap@synnefo.org', 'password': 'password'}

        self.assertContains(r, 'Resend activation')

        self.assertFalse(r.context['request'].user.is_authenticated())

        self.assertFalse('_pithos2_a' in self.client.cookies)

        # user sees the message and resends activation

        self.assertEqual(len(get_mailbox('KPAP@synnefo.org')), 3)

        # logged in user cannot activate another account

        self.assertEqual(len(get_mailbox(self.helpdesk_email)), 2)

        user = AstakosUser.objects.get(email="KPAP@synnefo.org")

        self.assertFalse(r.context['request'].user.is_authenticated())

        self.assertFalse('_pithos2_a' in self.client.cookies)

        self.assertEqual(len(get_mailbox('KPAP@synnefo.org')), 4)

        user = AstakosUser.objects.get(pk=user.pk)

                             follow=True)

        # user activated and logged in, token cookie set

        self.assertTrue(r.context['request'].user.is_authenticated())

        cookies = self.client.cookies

        self.assertTrue(quote(user.auth_token) in

                        cookies.get('_pithos2_a').value)

        # user logged out, token cookie removed

        self.assertFalse(r.context['request'].user.is_authenticated())

        self.assertFalse(self.client.cookies.get('_pithos2_a').value)

        del self.client.cookies['_pithos2_a']

        # user can login

                             follow=True)

        self.assertTrue(r.context['request'].user.is_authenticated())

        self.assertTrue('_pithos2_a' in self.client.cookies)

        cookies = self.client.cookies

        self.assertTrue(quote(user.auth_token) in

                        cookies.get('_pithos2_a').value)

        # user forgot password

        old_pass = user.password

        self.assertEqual(r.status_code, 200)

        self.assertEqual(r.status_code, 302)

        # email sent

        self.assertEqual(len(get_mailbox('KPAP@synnefo.org')), 5)

        self.assertNotEqual(old_pass, user.password)

        # old pass is not usable

        self.assertContains(r, 'Please enter a correct username and password')

                             follow=True)

        self.assertTrue(r.context['request'].user.is_authenticated())

        self.client.logout()

        user.save()

        # non astakos local backends do not support password reset

        self.assertEqual(r.status_code, 200)

        # she can't because account is not active yet

        self.assertContains(r, "Changing password is not")

        # login as kpap

        self.client.login(username='kpap@synnefo.org', password='password')

        user = r.context['request'].user

        self.assertTrue(user.is_authenticated())

        # change email is enabled

        self.assertEqual(r.status_code, 200)

        self.assertFalse(user.email_change_is_pending())

        # request email change to an existing email fails

        data = {'new_email_address': 'existing@synnefo.org'}

        self.assertContains(r, messages.EMAIL_USED)

        # proper email change

        data = {'new_email_address': 'kpap@gmail.com'}

        self.assertContains(r, messages.EMAIL_CHANGE_REGISTERED)

        change1 = EmailChange.objects.get()

        # user sees a warning

        self.assertEqual(r.status_code, 200)

        self.assertContains(r, messages.PENDING_EMAIL_CHANGE_REQUEST)

        self.assertTrue(user.email_change_is_pending())

        # proper email change

        data = {'new_email_address': 'kpap@yahoo.com'}

        self.assertContains(r, messages.EMAIL_CHANGE_REGISTERED)

        self.assertEqual(len(get_mailbox('kpap@synnefo.org')), 0)

        self.assertEqual(len(get_mailbox('kpap@yahoo.com')), 1)

        self.client.logout()

        invalid_client = Client()

                                {'username': 'existing@synnefo.org',

                                 'password': 'password'})

        r = invalid_client.get(change2.get_url(), follow=True)

        self.assertEquals(r.status_code, 403)

                             {'username': 'kpap@synnefo.org',

                              'password': 'password',

                              'next': change2.get_url()},

                             follow=True)

        user = r.context['request'].user

        self.assertEquals(user.email, 'kpap@yahoo.com')

        self.assertEquals(user.username, 'kpap@yahoo.com')

        self.client.logout()

                             {'username': 'kpap@synnefo.org',

                              'password': 'password',

                              'next': change2.get_url()},

        self.assertContains(r, "Please enter a correct username and password")

        self.assertEqual(user.emailchanges.count(), 0)

class TestAuthProviderViews(TestCase):

        # new academic user

        self.assertFalse(academic_users.filter(email='newuser@synnefo.org'))

        cl_newuser.set_tokens(eppn="newusereppn")

        pending = Pending.objects.get()

        identifier = pending.third_party_identifier

        signup_data = {'third_party_identifier': identifier,

                       'third_party_token': pending.token,

                       'last_name': 'New User',

                       'provider': 'shibboleth'}

        self.assertContains(r, "This field is required", )

        signup_data['email'] = 'olduser@synnefo.org'

        self.assertContains(r, "already an account with this email", )

        signup_data['email'] = 'newuser@synnefo.org'

        self.assertEqual(r.status_code, 404)

        newuser = User.objects.get(email="newuser@synnefo.org")

        activation_link = newuser.get_activation_url()

                       'password1': 'password',

                       'password2': 'password'}

        signup_data['email'] = 'olduser@synnefo.org'

        self.assertContains(r, 'There is already an account with this '

                               'email address')

        signup_data['email'] = 'newuser@synnefo.org'

        self.assertFalse(academic_users.filter(email='newuser@synnefo.org'))

        r = self.client.get(activation_link, follow=True)

        self.assertEqual(r.status_code, 404)

        # activation sent, user didn't open verification url so additional

        # registrations invalidate the previous signups.

        self.assertFalse(academic_users.filter(email='newuser@synnefo.org'))

        pending = Pending.objects.get()

        identifier = pending.third_party_identifier

        signup_data = {'third_party_identifier': identifier,

                       'last_name': 'New User',

                       'provider': 'shibboleth'}

        signup_data['email'] = 'newuser@synnefo.org'

        self.assertEqual(r.status_code, 302)

        newuser = User.objects.get(email="newuser@synnefo.org")

        self.assertTrue(newuser.activation_sent)

        activation_link = newuser.get_activation_url()

        self.assertTrue(academic_users.get(email='newuser@synnefo.org'))

        r = cl_newuser.get(newuser.get_activation_url(), follow=True)

        newuser = User.objects.get(email="newuser@synnefo.org")

        self.assertEqual(newuser.is_active, True)

        self.assertEqual(newuser.email_verified, True)

        newuser.is_active = True

        newuser.save()

        local = auth.get_provider('local', newuser)

        self.assertEqual(local.get_add_policy, False)

        self.assertEqual(local.get_login_policy, False)

        r = cl_newuser.get(local.get_add_url, follow=True)

        self.assertContains(r, 'disabled for your')

        cl_olduser.login(username='olduser@synnefo.org', password="password")

        self.assertEqual(r.status_code, 200)

        self.assertContains(r, 'Your request is missing a unique token')

        cl_olduser.set_tokens(eppn="newusereppn")

        self.assertContains(r, 'already in use')

        cl_olduser.set_tokens(eppn="oldusereppn")

        self.assertContains(r, 'Academic login enabled for this account')

        user = User.objects.get(email="olduser@synnefo.org")

        cl_olduser.logout()

        login_data = {'username': 'olduser@synnefo.org',

                      'password': 'password'}

        Group.objects.all().delete()

    def setUp(self):

        # dummy call to pass through logging middleware

    @im_settings(RE_USER_EMAIL_PATTERNS=['.*@synnefo.org'])

    @shibboleth_settings(AUTOMODERATE_POLICY=True)