authentik/passbook/flows/tests.py

"""passbook Core Authentication Test"""
import string
from random import SystemRandom

from django.contrib.auth.models import AnonymousUser
from django.contrib.sessions.middleware import SessionMiddleware
from django.test import RequestFactory, TestCase
from django.urls import reverse

from passbook.core.models import User
from passbook.factors.dummy.models import DummyFactor
from passbook.factors.password.models import PasswordFactor
from passbook.flows.view import AuthenticationView


class TestFactorAuthentication(TestCase):
    """passbook Core Authentication Test"""

    def setUp(self):
        super().setUp()
        self.password = "".join(
            SystemRandom().choice(string.ascii_uppercase + string.digits)
            for _ in range(8)
        )
        self.factor, _ = PasswordFactor.objects.get_or_create(
            slug="password",
            defaults={
                "name": "password",
                "slug": "password",
                "order": 0,
                "backends": ["django.contrib.auth.backends.ModelBackend"],
            },
        )
        self.user = User.objects.create_user(
            username="test", email="test@test.test", password=self.password
        )

    def test_unauthenticated_raw(self):
        """test direct call to AuthenticationView"""
        response = self.client.get(reverse("passbook_flows:auth-process"))
        # Response should be 400 since no pending user is set
        self.assertEqual(response.status_code, 400)

    def test_unauthenticated_prepared(self):
        """test direct call but with pending_uesr in session"""
        request = RequestFactory().get(reverse("passbook_flows:auth-process"))
        request.user = AnonymousUser()
        request.session = {}
        request.session[AuthenticationView.SESSION_PENDING_USER] = self.user.pk

        response = AuthenticationView.as_view()(request)
        self.assertEqual(response.status_code, 200)

    def test_no_factors(self):
        """Test with all factors disabled"""
        self.factor.enabled = False
        self.factor.save()
        request = RequestFactory().get(reverse("passbook_flows:auth-process"))
        request.user = AnonymousUser()
        request.session = {}
        request.session[AuthenticationView.SESSION_PENDING_USER] = self.user.pk

        response = AuthenticationView.as_view()(request)
        self.assertEqual(response.status_code, 302)
        self.assertEqual(response.url, reverse("passbook_flows:auth-denied"))
        self.factor.enabled = True
        self.factor.save()

    def test_authenticated(self):
        """Test with already logged in user"""
        self.client.force_login(self.user)
        response = self.client.get(reverse("passbook_flows:auth-process"))
        # Response should be 400 since no pending user is set
        self.assertEqual(response.status_code, 400)
        self.client.logout()

    def test_unauthenticated_post(self):
        """Test post request as unauthenticated user"""
        request = RequestFactory().post(
            reverse("passbook_flows:auth-process"), data={"password": self.password}
        )
        request.user = AnonymousUser()
        middleware = SessionMiddleware()
        middleware.process_request(request)
        request.session.save()  # pylint: disable=no-member
        request.session[AuthenticationView.SESSION_PENDING_USER] = self.user.pk

        response = AuthenticationView.as_view()(request)
        self.assertEqual(response.status_code, 302)
        self.assertEqual(response.url, reverse("passbook_core:overview"))
        self.client.logout()

    def test_unauthenticated_post_invalid(self):
        """Test post request as unauthenticated user"""
        request = RequestFactory().post(
            reverse("passbook_flows:auth-process"),
            data={"password": self.password + "a"},
        )
        request.user = AnonymousUser()
        middleware = SessionMiddleware()
        middleware.process_request(request)
        request.session.save()  # pylint: disable=no-member
        request.session[AuthenticationView.SESSION_PENDING_USER] = self.user.pk

        response = AuthenticationView.as_view()(request)
        self.assertEqual(response.status_code, 200)
        self.client.logout()

    def test_multifactor(self):
        """Test view with multiple active factors"""
        DummyFactor.objects.get_or_create(name="dummy", slug="dummy", order=1)
        request = RequestFactory().post(
            reverse("passbook_flows:auth-process"), data={"password": self.password}
        )
        request.user = AnonymousUser()
        middleware = SessionMiddleware()
        middleware.process_request(request)
        request.session.save()  # pylint: disable=no-member
        request.session[AuthenticationView.SESSION_PENDING_USER] = self.user.pk

        response = AuthenticationView.as_view()(request)
        session_copy = request.session.items()
        self.assertEqual(response.status_code, 302)
        # Verify view redirects to itself after auth
        self.assertEqual(response.url, reverse("passbook_flows:auth-process"))

        # Run another request with same session which should result in a logged in user
        request = RequestFactory().post(reverse("passbook_flows:auth-process"))
        request.user = AnonymousUser()
        middleware = SessionMiddleware()
        middleware.process_request(request)
        for key, value in session_copy:
            request.session[key] = value
        request.session.save()  # pylint: disable=no-member
        response = AuthenticationView.as_view()(request)
        self.assertEqual(response.status_code, 302)
        self.assertEqual(response.url, reverse("passbook_core:overview"))