The server could not verify that you are authorized to access the URL requested. You either supplied the wrong credentials (e.g. a bad password), or your browser doesn't understand how to supply the credentials required.
""" BasicAuth = namedtuple('BasicAuth', 'username, password') def _get_unauthorized_response(text=None, headers=None): text = text or _default_unauthorized_html headers = headers or {} return Response(text, 401, headers) def _get_unauthorized_view(): cv = utils.get_url(utils.config_value('UNAUTHORIZED_VIEW')) utils.do_flash(*utils.get_message('UNAUTHORIZED')) return redirect(cv or request.referrer or '/') def _check_token(): header_key = _security.token_authentication_header args_key = _security.token_authentication_key header_token = request.headers.get(header_key, None) token = request.args.get(args_key, header_token) if request.get_json(silent=True): if not isinstance(request.json, list): token = request.json.get(args_key, token) user = _security.login_manager.token_callback(token) if user and user.is_authenticated: app = current_app._get_current_object() _request_ctx_stack.top.user = user identity_changed.send(app, identity=Identity(user.id)) return True return False def _check_http_auth(): auth = request.authorization or BasicAuth(username=None, password=None) user = _security.datastore.find_user(email=auth.username) if user and utils.verify_and_update_password(auth.password, user): _security.datastore.commit() app = current_app._get_current_object() _request_ctx_stack.top.user = user identity_changed.send(app, identity=Identity(user.id)) return True return False def http_auth_required(realm): """Decorator that protects endpoints using Basic HTTP authentication. The username should be set to the user's email address. :param realm: optional realm name""" def decorator(fn): @wraps(fn) def wrapper(*args, **kwargs): if _check_http_auth(): return fn(*args, **kwargs) if _security._unauthorized_callback: return _security._unauthorized_callback() else: r = _security.default_http_auth_realm if callable(realm) else realm h = {'WWW-Authenticate': 'Basic realm="%s"' % r} return _get_unauthorized_response(headers=h) return wrapper if callable(realm): return decorator(realm) return decorator def auth_token_required(fn): """Decorator that protects endpoints using token authentication. The token should be added to the request by the client by using a query string variable with a name equal to the configuration value of `SECURITY_TOKEN_AUTHENTICATION_KEY` or in a request header named that of the configuration value of `SECURITY_TOKEN_AUTHENTICATION_HEADER` """ @wraps(fn) def decorated(*args, **kwargs): if _check_token(): return fn(*args, **kwargs) if _security._unauthorized_callback: return _security._unauthorized_callback() else: return _get_unauthorized_response() return decorated def auth_required(*auth_methods): """ Decorator that protects enpoints through multiple mechanisms Example:: @app.route('/dashboard') @auth_required('token', 'session') def dashboard(): return 'Dashboard' :param auth_methods: Specified mechanisms. """ login_mechanisms = { 'token': lambda: _check_token(), 'basic': lambda: _check_http_auth(), 'session': lambda: current_user.is_authenticated } def wrapper(fn): @wraps(fn) def decorated_view(*args, **kwargs): h = {} mechanisms = [(method, login_mechanisms.get(method)) for method in auth_methods] for method, mechanism in mechanisms: if mechanism and mechanism(): return fn(*args, **kwargs) elif method == 'basic': r = _security.default_http_auth_realm h['WWW-Authenticate'] = 'Basic realm="%s"' % r if _security._unauthorized_callback: return _security._unauthorized_callback() else: return _get_unauthorized_response(headers=h) return decorated_view return wrapper def roles_required(*roles): """Decorator which specifies that a user must have all the specified roles. Example:: @app.route('/dashboard') @roles_required('admin', 'editor') def dashboard(): return 'Dashboard' The current user must have both the `admin` role and `editor` role in order to view the page. :param args: The required roles. """ def wrapper(fn): @wraps(fn) def decorated_view(*args, **kwargs): perms = [Permission(RoleNeed(role)) for role in roles] for perm in perms: if not perm.can(): if _security._unauthorized_callback: return _security._unauthorized_callback() else: return _get_unauthorized_view() return fn(*args, **kwargs) return decorated_view return wrapper def roles_accepted(*roles): """Decorator which specifies that a user must have at least one of the specified roles. Example:: @app.route('/create_post') @roles_accepted('editor', 'author') def create_post(): return 'Create Post' The current user must have either the `editor` role or `author` role in order to view the page. :param args: The possible roles. """ def wrapper(fn): @wraps(fn) def decorated_view(*args, **kwargs): perm = Permission(*[RoleNeed(role) for role in roles]) if perm.can(): return fn(*args, **kwargs) if _security._unauthorized_callback: return _security._unauthorized_callback() else: return _get_unauthorized_view() return decorated_view return wrapper def anonymous_user_required(f): @wraps(f) def wrapper(*args, **kwargs): if current_user.is_authenticated: return redirect(utils.get_url(_security.post_login_view)) return f(*args, **kwargs) return wrapper Flask-Security-1.7.5/flask_security/forms.py 0000644 0000765 0000024 00000022156 12627667222 021232 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ flask_security.forms ~~~~~~~~~~~~~~~~~~~~ Flask-Security forms module :copyright: (c) 2012 by Matt Wright. :license: MIT, see LICENSE for more details. """ import inspect from flask import request, current_app, flash from flask_wtf import Form as BaseForm from wtforms import StringField, PasswordField, validators, \ SubmitField, HiddenField, BooleanField, ValidationError, Field from flask_login import current_user from werkzeug.local import LocalProxy from .confirmable import requires_confirmation from .utils import verify_and_update_password, get_message, config_value, validate_redirect_url # Convenient reference _datastore = LocalProxy(lambda: current_app.extensions['security'].datastore) _default_field_labels = { 'email': 'Email Address', 'password': 'Password', 'remember_me': 'Remember Me', 'login': 'Login', 'retype_password': 'Retype Password', 'register': 'Register', 'send_confirmation': 'Resend Confirmation Instructions', 'recover_password': 'Recover Password', 'reset_password': 'Reset Password', 'retype_password': 'Retype Password', 'new_password': 'New Password', 'change_password': 'Change Password', 'send_login_link': 'Send Login Link' } class ValidatorMixin(object): def __call__(self, form, field): if self.message and self.message.isupper(): self.message = get_message(self.message)[0] return super(ValidatorMixin, self).__call__(form, field) class EqualTo(ValidatorMixin, validators.EqualTo): pass class Required(ValidatorMixin, validators.Required): pass class Email(ValidatorMixin, validators.Email): pass class Length(ValidatorMixin, validators.Length): pass email_required = Required(message='EMAIL_NOT_PROVIDED') email_validator = Email(message='INVALID_EMAIL_ADDRESS') password_required = Required(message='PASSWORD_NOT_PROVIDED') password_length = Length(min=6, max=128, message='PASSWORD_INVALID_LENGTH') def get_form_field_label(key): return _default_field_labels.get(key, '') def unique_user_email(form, field): if _datastore.get_user(field.data) is not None: msg = get_message('EMAIL_ALREADY_ASSOCIATED', email=field.data)[0] raise ValidationError(msg) def valid_user_email(form, field): form.user = _datastore.get_user(field.data) if form.user is None: raise ValidationError(get_message('USER_DOES_NOT_EXIST')[0]) class Form(BaseForm): def __init__(self, *args, **kwargs): if current_app.testing: self.TIME_LIMIT = None super(Form, self).__init__(*args, **kwargs) class EmailFormMixin(): email = StringField( get_form_field_label('email'), validators=[email_required, email_validator]) class UserEmailFormMixin(): user = None email = StringField( get_form_field_label('email'), validators=[email_required, email_validator, valid_user_email]) class UniqueEmailFormMixin(): email = StringField( get_form_field_label('email'), validators=[email_required, email_validator, unique_user_email]) class PasswordFormMixin(): password = PasswordField( get_form_field_label('password'), validators=[password_required]) class NewPasswordFormMixin(): password = PasswordField( get_form_field_label('password'), validators=[password_required, password_length]) class PasswordConfirmFormMixin(): password_confirm = PasswordField( get_form_field_label('retype_password'), validators=[EqualTo('password', message='RETYPE_PASSWORD_MISMATCH')]) class NextFormMixin(): next = HiddenField() def validate_next(self, field): if field.data and not validate_redirect_url(field.data): field.data = '' flash(*get_message('INVALID_REDIRECT')) raise ValidationError(get_message('INVALID_REDIRECT')[0]) class RegisterFormMixin(): submit = SubmitField(get_form_field_label('register')) def to_dict(form): def is_field_and_user_attr(member): return isinstance(member, Field) and \ hasattr(_datastore.user_model, member.name) fields = inspect.getmembers(form, is_field_and_user_attr) return dict((key, value.data) for key, value in fields) class SendConfirmationForm(Form, UserEmailFormMixin): """The default forgot password form""" submit = SubmitField(get_form_field_label('send_confirmation')) def __init__(self, *args, **kwargs): super(SendConfirmationForm, self).__init__(*args, **kwargs) if request.method == 'GET': self.email.data = request.args.get('email', None) def validate(self): if not super(SendConfirmationForm, self).validate(): return False if self.user.confirmed_at is not None: self.email.errors.append(get_message('ALREADY_CONFIRMED')[0]) return False return True class ForgotPasswordForm(Form, UserEmailFormMixin): """The default forgot password form""" submit = SubmitField(get_form_field_label('recover_password')) def validate(self): if not super(ForgotPasswordForm, self).validate(): return False if requires_confirmation(self.user): self.email.errors.append(get_message('CONFIRMATION_REQUIRED')[0]) return False return True class PasswordlessLoginForm(Form, UserEmailFormMixin): """The passwordless login form""" submit = SubmitField(get_form_field_label('send_login_link')) def __init__(self, *args, **kwargs): super(PasswordlessLoginForm, self).__init__(*args, **kwargs) def validate(self): if not super(PasswordlessLoginForm, self).validate(): return False if not self.user.is_active: self.email.errors.append(get_message('DISABLED_ACCOUNT')[0]) return False return True class LoginForm(Form, NextFormMixin): """The default login form""" email = StringField(get_form_field_label('email')) password = PasswordField(get_form_field_label('password')) remember = BooleanField(get_form_field_label('remember_me')) submit = SubmitField(get_form_field_label('login')) def __init__(self, *args, **kwargs): super(LoginForm, self).__init__(*args, **kwargs) if not self.next.data: self.next.data = request.args.get('next', '') self.remember.default = config_value('DEFAULT_REMEMBER_ME') def validate(self): if not super(LoginForm, self).validate(): return False if self.email.data.strip() == '': self.email.errors.append(get_message('EMAIL_NOT_PROVIDED')[0]) return False if self.password.data.strip() == '': self.password.errors.append(get_message('PASSWORD_NOT_PROVIDED')[0]) return False self.user = _datastore.get_user(self.email.data) if self.user is None: self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0]) return False if not self.user.password: self.password.errors.append(get_message('PASSWORD_NOT_SET')[0]) return False if not verify_and_update_password(self.password.data, self.user): self.password.errors.append(get_message('INVALID_PASSWORD')[0]) return False if requires_confirmation(self.user): self.email.errors.append(get_message('CONFIRMATION_REQUIRED')[0]) return False if not self.user.is_active: self.email.errors.append(get_message('DISABLED_ACCOUNT')[0]) return False return True class ConfirmRegisterForm(Form, RegisterFormMixin, UniqueEmailFormMixin, NewPasswordFormMixin): pass class RegisterForm(ConfirmRegisterForm, PasswordConfirmFormMixin, NextFormMixin): def __init__(self, *args, **kwargs): super(RegisterForm, self).__init__(*args, **kwargs) if not self.next.data: self.next.data = request.args.get('next', '') class ResetPasswordForm(Form, NewPasswordFormMixin, PasswordConfirmFormMixin): """The default reset password form""" submit = SubmitField(get_form_field_label('reset_password')) class ChangePasswordForm(Form, PasswordFormMixin): """The default change password form""" new_password = PasswordField( get_form_field_label('new_password'), validators=[password_required, password_length]) new_password_confirm = PasswordField( get_form_field_label('retype_password'), validators=[EqualTo('new_password', message='RETYPE_PASSWORD_MISMATCH')]) submit = SubmitField(get_form_field_label('change_password')) def validate(self): if not super(ChangePasswordForm, self).validate(): return False if not verify_and_update_password(self.password.data, current_user): self.password.errors.append(get_message('INVALID_PASSWORD')[0]) return False if self.password.data.strip() == self.new_password.data.strip(): self.password.errors.append(get_message('PASSWORD_IS_THE_SAME')[0]) return False return True Flask-Security-1.7.5/flask_security/passwordless.py 0000644 0000765 0000024 00000003123 12627667222 022626 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ flask_security.passwordless ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Flask-Security passwordless module :copyright: (c) 2012 by Matt Wright. :license: MIT, see LICENSE for more details. """ from flask import current_app as app from werkzeug.local import LocalProxy from .signals import login_instructions_sent from .utils import send_mail, url_for_security, get_token_status, \ config_value # Convenient references _security = LocalProxy(lambda: app.extensions['security']) _datastore = LocalProxy(lambda: _security.datastore) def send_login_instructions(user): """Sends the login instructions email for the specified user. :param user: The user to send the instructions to :param token: The login token """ token = generate_login_token(user) login_link = url_for_security('token_login', token=token, _external=True) send_mail(config_value('EMAIL_SUBJECT_PASSWORDLESS'), user.email, 'login_instructions', user=user, login_link=login_link) login_instructions_sent.send(app._get_current_object(), user=user, login_token=token) def generate_login_token(user): """Generates a unique login token for the specified user. :param user: The user the token belongs to """ return _security.login_serializer.dumps([str(user.id)]) def login_token_status(token): """Returns the expired status, invalid status, and user of a login token. For example:: expired, invalid, user = login_token_status('...') :param token: The login token """ return get_token_status(token, 'login', 'LOGIN') Flask-Security-1.7.5/flask_security/recoverable.py 0000644 0000765 0000024 00000005515 12627667222 022375 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ flask_security.recoverable ~~~~~~~~~~~~~~~~~~~~~~~~~~ Flask-Security recoverable module :copyright: (c) 2012 by Matt Wright. :license: MIT, see LICENSE for more details. """ from flask import current_app as app from werkzeug.local import LocalProxy from werkzeug.security import safe_str_cmp from .signals import password_reset, reset_password_instructions_sent from .utils import send_mail, md5, encrypt_password, url_for_security, \ get_token_status, config_value # Convenient references _security = LocalProxy(lambda: app.extensions['security']) _datastore = LocalProxy(lambda: _security.datastore) def send_reset_password_instructions(user): """Sends the reset password instructions email for the specified user. :param user: The user to send the instructions to """ token = generate_reset_password_token(user) reset_link = url_for_security('reset_password', token=token, _external=True) send_mail(config_value('EMAIL_SUBJECT_PASSWORD_RESET'), user.email, 'reset_instructions', user=user, reset_link=reset_link) reset_password_instructions_sent.send(app._get_current_object(), user=user, token=token) def send_password_reset_notice(user): """Sends the password reset notice email for the specified user. :param user: The user to send the notice to """ if config_value('SEND_PASSWORD_RESET_NOTICE_EMAIL'): send_mail(config_value('EMAIL_SUBJECT_PASSWORD_NOTICE'), user.email, 'reset_notice', user=user) def generate_reset_password_token(user): """Generates a unique reset password token for the specified user. :param user: The user to work with """ password_hash = md5(user.password) if user.password else None data = [str(user.id), password_hash] return _security.reset_serializer.dumps(data) def reset_password_token_status(token): """Returns the expired status, invalid status, and user of a password reset token. For example:: expired, invalid, user, data = reset_password_token_status('...') :param token: The password reset token """ expired, invalid, user, data = get_token_status(token, 'reset', 'RESET_PASSWORD', return_data=True) if not invalid: if user.password: password_hash = md5(user.password) if not safe_str_cmp(password_hash, data[1]): invalid = True return expired, invalid, user def update_password(user, password): """Update the specified user's password :param user: The user to update_password :param password: The unencrypted new password """ user.password = encrypt_password(password) _datastore.put(user) send_password_reset_notice(user) password_reset.send(app._get_current_object(), user=user) Flask-Security-1.7.5/flask_security/registerable.py 0000644 0000765 0000024 00000002443 12627667222 022551 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ flask_security.registerable ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Flask-Security registerable module :copyright: (c) 2012 by Matt Wright. :license: MIT, see LICENSE for more details. """ from flask import current_app as app from werkzeug.local import LocalProxy from .confirmable import generate_confirmation_link from .signals import user_registered from .utils import do_flash, get_message, send_mail, encrypt_password, \ config_value # Convenient references _security = LocalProxy(lambda: app.extensions['security']) _datastore = LocalProxy(lambda: _security.datastore) def register_user(**kwargs): confirmation_link, token = None, None kwargs['password'] = encrypt_password(kwargs['password']) user = _datastore.create_user(**kwargs) _datastore.commit() if _security.confirmable: confirmation_link, token = generate_confirmation_link(user) do_flash(*get_message('CONFIRM_REGISTRATION', email=user.email)) user_registered.send(app._get_current_object(), user=user, confirm_token=token) if config_value('SEND_REGISTER_EMAIL'): send_mail(config_value('EMAIL_SUBJECT_REGISTER'), user.email, 'welcome', user=user, confirmation_link=confirmation_link) return user Flask-Security-1.7.5/flask_security/script.py 0000644 0000765 0000024 00000006634 12627667222 021413 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ flask_security.script ~~~~~~~~~~~~~~~~~~~~~ Flask-Security script module :copyright: (c) 2012 by Matt Wright. :license: MIT, see LICENSE for more details. """ from __future__ import print_function try: import simplejson as json except ImportError: import json import re from flask import current_app from flask_script import Command, Option from werkzeug.local import LocalProxy from .utils import encrypt_password _datastore = LocalProxy(lambda: current_app.extensions['security'].datastore) def pprint(obj): print(json.dumps(obj, sort_keys=True, indent=4)) def commit(fn): def wrapper(*args, **kwargs): fn(*args, **kwargs) _datastore.commit() return wrapper class CreateUserCommand(Command): """Create a user""" option_list = ( Option('-e', '--email', dest='email', default=None), Option('-p', '--password', dest='password', default=None), Option('-a', '--active', dest='active', default=''), ) @commit def run(self, **kwargs): # sanitize active input ai = re.sub(r'\s', '', str(kwargs['active'])) kwargs['active'] = ai.lower() in ['', 'y', 'yes', '1', 'active'] from flask_security.forms import ConfirmRegisterForm from werkzeug.datastructures import MultiDict form = ConfirmRegisterForm(MultiDict(kwargs), csrf_enabled=False) if form.validate(): kwargs['password'] = encrypt_password(kwargs['password']) _datastore.create_user(**kwargs) print('User created successfully.') kwargs['password'] = '****' pprint(kwargs) else: print('Error creating user') pprint(form.errors) class CreateRoleCommand(Command): """Create a role""" option_list = ( Option('-n', '--name', dest='name', default=None), Option('-d', '--desc', dest='description', default=None), ) @commit def run(self, **kwargs): _datastore.create_role(**kwargs) print('Role "%(name)s" created successfully.' % kwargs) class _RoleCommand(Command): option_list = ( Option('-u', '--user', dest='user_identifier'), Option('-r', '--role', dest='role_name'), ) class AddRoleCommand(_RoleCommand): """Add a role to a user""" @commit def run(self, user_identifier, role_name): _datastore.add_role_to_user(user_identifier, role_name) print("Role '%s' added to user '%s' successfully" % (role_name, user_identifier)) class RemoveRoleCommand(_RoleCommand): """Remove a role from a user""" @commit def run(self, user_identifier, role_name): _datastore.remove_role_from_user(user_identifier, role_name) print("Role '%s' removed from user '%s' successfully" % (role_name, user_identifier)) class _ToggleActiveCommand(Command): option_list = ( Option('-u', '--user', dest='user_identifier'), ) class DeactivateUserCommand(_ToggleActiveCommand): """Deactivate a user""" @commit def run(self, user_identifier): _datastore.deactivate_user(user_identifier) print("User '%s' has been deactivated" % user_identifier) class ActivateUserCommand(_ToggleActiveCommand): """Activate a user""" @commit def run(self, user_identifier): _datastore.activate_user(user_identifier) print("User '%s' has been activated" % user_identifier) Flask-Security-1.7.5/flask_security/signals.py 0000644 0000765 0000024 00000001272 12627667222 021540 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ flask_security.signals ~~~~~~~~~~~~~~~~~~~~~~ Flask-Security signals module :copyright: (c) 2012 by Matt Wright. :license: MIT, see LICENSE for more details. """ import blinker signals = blinker.Namespace() user_registered = signals.signal("user-registered") user_confirmed = signals.signal("user-confirmed") confirm_instructions_sent = signals.signal("confirm-instructions-sent") login_instructions_sent = signals.signal("login-instructions-sent") password_reset = signals.signal("password-reset") password_changed = signals.signal("password-changed") reset_password_instructions_sent = signals.signal("password-reset-instructions-sent") Flask-Security-1.7.5/flask_security/templates/ 0000755 0000765 0000024 00000000000 12627667302 021521 5 ustar matt staff 0000000 0000000 Flask-Security-1.7.5/flask_security/templates/.DS_Store 0000644 0000765 0000024 00000014004 12052511622 023164 0 ustar matt staff 0000000 0000000 Bud1 r i t ybwsp s e c u r i t ybwspblob bplist00 \WindowBounds[ShowSidebar]ShowStatusBar[ShowPathbar[ShowToolbar\SidebarWidth_{{316, 89}, {839, 1024}} ".{{ field(**kwargs)|safe }}
{% endmacro %} Flask-Security-1.7.5/flask_security/templates/security/_menu.html 0000644 0000765 0000024 00000001327 12417007016 025347 0 ustar matt staff 0000000 0000000 {% if security.registerable or security.recoverable or security.confirmable %}Your password has been changed.
{% if security.recoverable %}If you did not change your password, click here to reset it.
{% endif %} Flask-Security-1.7.5/flask_security/templates/security/email/change_notice.txt 0000644 0000765 0000024 00000000312 12120140042 027751 0 ustar matt staff 0000000 0000000 Your password has been changed {% if security.recoverable %} If you did not change your password, click the link below to reset it. {{ url_for_security('forgot_password', _external=True) }} {% endif %} Flask-Security-1.7.5/flask_security/templates/security/email/confirmation_instructions.html 0000644 0000765 0000024 00000000171 12052511622 032641 0 ustar matt staff 0000000 0000000Please confirm your email through the link below:
Flask-Security-1.7.5/flask_security/templates/security/email/confirmation_instructions.txt 0000644 0000765 0000024 00000000112 12052511622 032507 0 ustar matt staff 0000000 0000000 Please confirm your email through the link below: {{ confirmation_link }} Flask-Security-1.7.5/flask_security/templates/security/email/login_instructions.html 0000644 0000765 0000024 00000000207 12052511622 031261 0 ustar matt staff 0000000 0000000Welcome {{ user.email }}!
You can log into your through the link below:
Flask-Security-1.7.5/flask_security/templates/security/email/login_instructions.txt 0000644 0000765 0000024 00000000132 12052511622 031131 0 ustar matt staff 0000000 0000000 Welcome {{ user.email }}! You can log into your through the link below: {{ login_link }} Flask-Security-1.7.5/flask_security/templates/security/email/reset_instructions.html 0000644 0000765 0000024 00000000107 12052511622 031272 0 ustar matt staff 0000000 0000000Click here to reset your password
Flask-Security-1.7.5/flask_security/templates/security/email/reset_instructions.txt 0000644 0000765 0000024 00000000076 12052511622 031152 0 ustar matt staff 0000000 0000000 Click the link below to reset your password: {{ reset_link }} Flask-Security-1.7.5/flask_security/templates/security/email/reset_notice.html 0000644 0000765 0000024 00000000043 12052511622 030006 0 ustar matt staff 0000000 0000000Your password has been reset
Flask-Security-1.7.5/flask_security/templates/security/email/reset_notice.txt 0000644 0000765 0000024 00000000034 12052511622 027661 0 ustar matt staff 0000000 0000000 Your password has been reset Flask-Security-1.7.5/flask_security/templates/security/email/welcome.html 0000644 0000765 0000024 00000000306 12052511622 026760 0 ustar matt staff 0000000 0000000Welcome {{ user.email }}!
{% if security.confirmable %}You can confirm your email through the link below:
{% endif %} Flask-Security-1.7.5/flask_security/templates/security/email/welcome.txt 0000644 0000765 0000024 00000000220 12052511622 026626 0 ustar matt staff 0000000 0000000 Welcome {{ user.email }}! {% if security.confirmable %} You can confirm your email through the link below: {{ confirmation_link }} {% endif %} Flask-Security-1.7.5/flask_security/templates/security/forgot_password.html 0000644 0000765 0000024 00000000714 12052511622 027463 0 ustar matt staff 0000000 0000000 {% from "security/_macros.html" import render_field_with_errors, render_field %} {% include "security/_messages.html" %}/Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt index. s s /profilec S s t d d d S( Ns index.htmlR s Profile Page( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt profile2 s s /post_loginc S s t d d d S( Ns index.htmlR s Post Login( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt post_login7 s s /httpc S s d S( Ns HTTP Authentication( ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt http< s s /http_custom_realms My Realmc S s t d d d S( Ns index.htmlR s HTTP Authentication( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt http_custom_realmA s s /tokent methodst GETt POSTc S s t d d d S( Ns index.htmlR s Token Authentication( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt tokenF s s /multi_autht sessionR( t basicc S s t d d d S( Ns index.htmlR s Session, Token, Basic auth( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt multi_authK s s /post_logoutc S s t d d d S( Ns index.htmlR s Post Logout( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt post_logoutP s s /post_registerc S s t d d d S( Ns index.htmlR s Post Register( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt post_registerT s s /admint adminc S s t d d d S( Ns index.htmlR s Admin Page( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyR. X s s /admin_and_editort editorc S s t d d d S( Ns index.htmlR s Admin and Editor Page( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt admin_and_editor] s s /admin_or_editorc S s t d d d S( Ns index.htmlR s Admin or Editor Page( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt admin_or_editorb s s /unauthorizedc S s t d S( Ns unauthorized.html( R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt unauthorizedg s s /page1c S s d S( Ns Page 1( ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt page_1k s ( R t __name__R t response_classt Truet debugt configt Falset keywordst uppert kwargst itemsR t mailt routeR R R R R R ( t requestt appt optt keyt valueR> R R! R" R# R$ R( R+ R, R- R. R0 R1 R2 R3 ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRA sN $# c s d d l m } d t t j j d d i d 6d d 6d d 6 d 6| j d <| | d j t f f d Y d j t f f d Y} | j f d t | S( Ni( t MongoEngines flask_security_test_%st .t _t dbt localhostt hostii t portt aliast MONGODB_SETTINGSt Rolec sE e Z j d e d e d d Z j d d Z i d 6Z RS( t requiredt uniquet max_lengthiP i t db_alias( R4 t __module__t StringFieldR6 t namet descriptiont meta( ( RH t db_name( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRN s t Userc s e Z j d e d d Z j d d Z j d e d d Z j Z j Z j d d Z j d d Z j Z j d e Z j Z j j d g Z i d 6Z RS( RP RQ i RO id t defaultRR ( R4 RS RT R6 t emailt usernameR9 t passwordt DateTimeFieldt last_login_att current_login_att last_login_ipt current_login_ipt IntFieldt login_countt BooleanFieldt activet confirmed_att ListFieldt ReferenceFieldt rolesRW ( ( RN RH RX ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRY s c s j j S( N( t connectiont drop_database( ( RH RX ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyts ( t flask_mongoengineRE t strt timet replaceR8 t DocumentR R t addfinalizerR ( R@ RA RE RY ( ( RN RH RX s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt mongoengine_datastoreq s " %(c s2 d d l m } t j d d d d d t | \ } d | j d <| | j d j d j j d j d j j d d j t f f d Y} d j t f f d Y} | j j Wd QX| j f d t | | S( Ni( t SQLAlchemyt prefixs flask-security-test-dbt suffixs .dbt dirs sqlite:///t SQLALCHEMY_DATABASE_URIt roles_userst user_ids user.idt role_ids role.idRN c sY e Z j j d e Z j j d d e Z j j d Z RS( t primary_keyiP RP i ( R4 RS t Columnt IntegerR6 t idt StringRU RV ( ( RH ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRN s RY c s. e Z j j d e Z j j d d e Z j j d Z j j d Z j j Z j j Z j j d Z j j d Z j j Z j j Z j j Z j d d d j d d d Z RS( R} i RP id RN t secondaryt backreft userst lazyt dynamic( R4 RS R~ R R6 R R R[ R\ R] t DateTimeR_ R` Ra Rb Rd t BooleanRf Rg t relationshipR Rj ( ( RH Rz ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRY s c s t j S( N( t ost remove( ( t path( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRm s ( t flask_sqlalchemyRu t tempfilet mkstempRo R8 t TableR~ R t ForeignKeyt ModelR R t app_contextt create_allRs R ( R@ RA t tmpdirRu t fRN RY ( ( RH R Rz s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt sqlalchemy_datastore s * !'"% c s[ d d l m m m m m d d l m } t j d d d d d t | \ } i d 6d d 6| j d <| | } d | j t f f d Y d | j t f f d Y d | j f f d Y} | j ) x! | f D] } | j qWWd QX| j f d t | | S( Ni( t TextFieldR^ t IntegerFieldRe t ForeignKeyField( t DatabaseRv s flask-security-test-dbRw s .dbRx RU s peewee.SqliteDatabaset enginet DATABASERN c s& e Z d e Z d e Z RS( RP t null( R4 RS R6 RU RV ( ( R ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRN s RY c s e Z Z Z d e Z d e Z d e Z d e Z d e Z d e Z d e Z d e Z RS( R RZ ( R4 RS R[ R\ R6 R] R_ R` Ra Rb Rd Rf Rg ( ( Re R^ R R ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRY s t UserRolesc sP e Z d Z d d Z d d Z e d Z e d Z RS( s| Peewee does not have built-in many-to-many support, so we have to create this mapping class to link users to roles.t related_nameRj R c S s | j j S( N( t roleRU ( t self( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRm s c S s | j j S( N( R RV ( R ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRm s ( R4 RS t __doc__t userR t propertyRU RV ( ( R RN RY ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyR s c s t j S( N( R R ( ( R ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyRm s ( t peeweeR R^ R Re R t flask_peewee.dbR R R Ro R8 R R R R t create_tableRs R ( R@ RA R R R RH R R ( ( Re R^ R R RN R RY R s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt peewee_datastore s (* "+ % c s f d } | S( Nc s t d _ S( Nt datastore( R t security( ( RA R ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt create s ( ( RA R R ( ( RA R s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt sqlalchemy_app s c s f d } | S( Nc s t d _ S( NR ( R R ( ( RA R ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyR s ( ( RA R R ( ( RA R s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt peewee_app s c s f d } | S( Nc s t d _ S( NR ( R R ( ( RA Rt ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyR s ( ( RA Rt R ( ( RA Rt s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt mongoengine_app s c C s | } t | | j S( N( R t test_client( R@ R RA ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt client s c s f d } | S( Nc s& j d | d | } | j d S( Nt SECURITY_MSG_i s utf-8( R8 t encode( RC R< t rv( RA ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt fn s ( ( RA R ( ( RA s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt get_message s t paramst sqlalchemyt mongoengineR c C sL | j d k r | } n0 | j d k r0 | } n | j d k rH | } n | S( NR R R ( t param( R@ R Rt R R ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyR s (% R R R Rp t pytestt flaskR R t flask_mailR t flask_securityR R R R R R R R R R R R t utilsR R t fixtureRA Rt R R R R R R R R ( ( ( s> /Users/matt/Workspaces/Python/flask-security/tests/conftest.pyt s$ RX&*/ Flask-Security-1.7.5/tests/templates/ 0000755 0000765 0000024 00000000000 12627667302 017634 5 ustar matt staff 0000000 0000000 Flask-Security-1.7.5/tests/templates/_messages.html 0000644 0000765 0000024 00000000405 12332222110 022440 0 ustar matt staff 0000000 0000000 {%- with messages = get_flashed_messages(with_categories=true) -%} {% if messages %} {% for category, message in messages %}
{% endif %} {%- endwith %} Flask-Security-1.7.5/tests/templates/_nav.html 0000644 0000765 0000024 00000001306 12627667222 021446 0 ustar matt staff 0000000 0000000 {%- if current_user.is_authenticated -%}- {{ message }}
{% endfor %}Hello {{ current_user.email }}
{%- endif %}Flask-Security-1.7.5/tests/templates/custom_security/ 0000755 0000765 0000024 00000000000 12627667302 023075 5 ustar matt staff 0000000 0000000 Flask-Security-1.7.5/tests/templates/custom_security/change_password.html 0000644 0000765 0000024 00000000056 12417007016 027116 0 ustar matt staff 0000000 0000000 CUSTOM CHANGE PASSWORD {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/custom_security/forgot_password.html 0000644 0000765 0000024 00000000056 12417007016 027171 0 ustar matt staff 0000000 0000000 CUSTOM FORGOT PASSWORD {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/custom_security/login_user.html 0000644 0000765 0000024 00000000051 12417007016 026110 0 ustar matt staff 0000000 0000000 CUSTOM LOGIN USER {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/custom_security/register_user.html 0000644 0000765 0000024 00000000054 12417007016 026627 0 ustar matt staff 0000000 0000000 CUSTOM REGISTER USER {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/custom_security/reset_password.html 0000644 0000765 0000024 00000000055 12417007016 027012 0 ustar matt staff 0000000 0000000 CUSTOM RESET PASSWORD {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/custom_security/send_confirmation.html 0000644 0000765 0000024 00000000060 12417007016 027443 0 ustar matt staff 0000000 0000000 CUSTOM SEND CONFIRMATION {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/custom_security/send_login.html 0000644 0000765 0000024 00000000051 12417007016 026063 0 ustar matt staff 0000000 0000000 CUSTOM SEND LOGIN {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/index.html 0000644 0000765 0000024 00000000115 12332222110 021577 0 ustar matt staff 0000000 0000000 {% include "_messages.html" %} {% include "_nav.html" %}
- Index
- Profile
{% if current_user.has_role('admin') -%}- Admin
{% endif -%} {% if current_user.has_role('admin') or current_user.has_role('editor') -%}- Admin or Editor
{% endif -%}- {%- if current_user.is_authenticated -%} Log out {%- else -%} Log in {%- endif -%}
{{ content }}
Flask-Security-1.7.5/tests/templates/register.html 0000644 0000765 0000024 00000001005 12332222110 022313 0 ustar matt staff 0000000 0000000 {% include "_messages.html" %} {% include "_nav.html" %}Register
{{ content }}
Flask-Security-1.7.5/tests/templates/security/ 0000755 0000765 0000024 00000000000 12627667302 021503 5 ustar matt staff 0000000 0000000 Flask-Security-1.7.5/tests/templates/security/email/ 0000755 0000765 0000024 00000000000 12627667302 022572 5 ustar matt staff 0000000 0000000 Flask-Security-1.7.5/tests/templates/security/email/reset_instructions.html 0000644 0000765 0000024 00000000061 12417007016 027406 0 ustar matt staff 0000000 0000000 CUSTOM RESET INSTRUCTIONS {{ global }} {{ foo }} Flask-Security-1.7.5/tests/templates/unauthorized.html 0000644 0000765 0000024 00000000166 12332222110 023217 0 ustar matt staff 0000000 0000000 {% include "_messages.html" %} {% include "_nav.html" %}You are not allowed to access the requested resouce
Flask-Security-1.7.5/tests/test_changeable.py 0000644 0000765 0000024 00000010076 12627667222 021325 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_changeable ~~~~~~~~~~~~~~~ Changeable tests """ import pytest from flask import Flask from flask_security.core import UserMixin from flask_security.signals import password_changed from utils import authenticate pytestmark = pytest.mark.changeable() def test_recoverable_flag(app, client, get_message): recorded = [] @password_changed.connect_via(app) def on_password_changed(app, user): assert isinstance(app, Flask) assert isinstance(user, UserMixin) recorded.append(user) authenticate(client) # Test change view response = client.get('/change', follow_redirects=True) assert b'Change password' in response.data # Test wrong original password response = client.post('/change', data={ 'password': 'notpassword', 'new_password': 'newpassword', 'new_password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('INVALID_PASSWORD') in response.data # Test mismatch response = client.post('/change', data={ 'password': 'password', 'new_password': 'newpassword', 'new_password_confirm': 'notnewpassword' }, follow_redirects=True) assert get_message('RETYPE_PASSWORD_MISMATCH') in response.data # Test missing password response = client.post('/change', data={ 'password': ' ', 'new_password': '', 'new_password_confirm': '' }, follow_redirects=True) assert get_message('PASSWORD_NOT_PROVIDED') in response.data # Test bad password response = client.post('/change', data={ 'password': 'password', 'new_password': 'a', 'new_password_confirm': 'a' }, follow_redirects=True) assert get_message('PASSWORD_INVALID_LENGTH') in response.data # Test same as previous response = client.post('/change', data={ 'password': 'password', 'new_password': 'password', 'new_password_confirm': 'password' }, follow_redirects=True) assert get_message('PASSWORD_IS_THE_SAME') in response.data # Test successful submit sends email notification with app.mail.record_messages() as outbox: response = client.post('/change', data={ 'password': 'password', 'new_password': 'newpassword', 'new_password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('PASSWORD_CHANGE') in response.data assert b'Home Page' in response.data assert len(recorded) == 1 assert len(outbox) == 1 assert "Your password has been changed" in outbox[0].html # Test JSON data = ('{"password": "newpassword", "new_password": "newpassword2", ' '"new_password_confirm": "newpassword2"}') response = client.post('/change', data=data, headers={'Content-Type': 'application/json'}) assert response.status_code == 200 assert response.headers['Content-Type'] == 'application/json' @pytest.mark.settings(change_url='/custom_change') def test_custom_change_url(client): authenticate(client) response = client.get('/custom_change') assert response.status_code == 200 @pytest.mark.settings(change_password_template='custom_security/change_password.html') def test_custom_change_template(client): authenticate(client) response = client.get('/change') assert b'CUSTOM CHANGE PASSWORD' in response.data @pytest.mark.settings(send_password_change_email=False) def test_disable_change_emails(app, client): with app.mail.record_messages() as outbox: client.post('/change', data={ 'password': 'password', 'new_password': 'newpassword', 'new_password_confirm': 'newpassword' }, follow_redirects=True) assert len(outbox) == 0 @pytest.mark.settings(post_change_view='/profile') def test_custom_post_change_view(client): authenticate(client) response = client.post('/change', data={ 'password': 'password', 'new_password': 'newpassword', 'new_password_confirm': 'newpassword' }, follow_redirects=True) assert b'Profile Page' in response.data Flask-Security-1.7.5/tests/test_common.py 0000644 0000765 0000024 00000023344 12627667222 020546 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_common ~~~~~~~~~~~ Test common functionality """ import base64 try: from cookielib import Cookie except ImportError: from http.cookiejar import Cookie from utils import authenticate, json_authenticate, logout def test_login_view(client): response = client.get('/login') assert b'Login
' in response.data def test_authenticate(client): response = authenticate(client) assert response.status_code == 302 response = authenticate(client, follow_redirects=True) assert b'Hello matt@lp.com' in response.data def test_authenticate_with_next(client): data = dict(email='matt@lp.com', password='password') response = client.post('/login?next=/page1', data=data, follow_redirects=True) assert b'Page 1' in response.data def test_authenticate_with_invalid_next(client, get_message): data = dict(email='matt@lp.com', password='password') response = client.post('/login?next=http://google.com', data=data) assert get_message('INVALID_REDIRECT') in response.data def test_authenticate_with_invalid_malformed_next(client, get_message): data = dict(email='matt@lp.com', password='password') response = client.post('/login?next=http:///google.com', data=data) assert get_message('INVALID_REDIRECT') in response.data def test_authenticate_case_insensitive_email(app, client): response = authenticate(client, 'MATT@lp.com', follow_redirects=True) assert b'Hello matt@lp.com' in response.data def test_unprovided_username(client, get_message): response = authenticate(client, "") assert get_message('EMAIL_NOT_PROVIDED') in response.data def test_unprovided_password(client, get_message): response = authenticate(client, password="") assert get_message('PASSWORD_NOT_PROVIDED') in response.data def test_invalid_user(client, get_message): response = authenticate(client, email="bogus@bogus.com") assert get_message('USER_DOES_NOT_EXIST') in response.data def test_bad_password(client, get_message): response = authenticate(client, password="bogus") assert get_message('INVALID_PASSWORD') in response.data def test_inactive_user(client, get_message): response = authenticate(client, "tiya@lp.com", "password") assert get_message('DISABLED_ACCOUNT') in response.data def test_unset_password(client, get_message): response = authenticate(client, "jess@lp.com", "password") assert get_message('PASSWORD_NOT_SET') in response.data def test_logout(client): authenticate(client) response = logout(client, follow_redirects=True) assert b'Home Page' in response.data def test_missing_session_access(client, get_message): response = client.get('/profile', follow_redirects=True) assert get_message('LOGIN') in response.data def test_has_session_access(client): authenticate(client) response = client.get("/profile", follow_redirects=True) assert b'profile' in response.data def test_authorized_access(client): authenticate(client) response = client.get("/admin") assert b'Admin Page' in response.data def test_unauthorized_access(client, get_message): authenticate(client, "joe@lp.com") response = client.get("/admin", follow_redirects=True) assert get_message('UNAUTHORIZED') in response.data def test_roles_accepted(client): for user in ("matt@lp.com", "joe@lp.com"): authenticate(client, user) response = client.get("/admin_or_editor") assert b'Admin or Editor Page' in response.data logout(client) authenticate(client, "jill@lp.com") response = client.get("/admin_or_editor", follow_redirects=True) assert b'Home Page' in response.data def test_unauthenticated_role_required(client, get_message): response = client.get('/admin', follow_redirects=True) assert get_message('UNAUTHORIZED') in response.data def test_multiple_role_required(client): for user in ("matt@lp.com", "joe@lp.com"): authenticate(client, user) response = client.get("/admin_and_editor", follow_redirects=True) assert b'Home Page' in response.data client.get('/logout') authenticate(client, 'dave@lp.com') response = client.get("/admin_and_editor", follow_redirects=True) assert b'Admin and Editor Page' in response.data def test_ok_json_auth(client): response = json_authenticate(client) assert response.jdata['meta']['code'] == 200 assert 'authentication_token' in response.jdata['response']['user'] def test_invalid_json_auth(client): response = json_authenticate(client, password='junk') assert b'"code": 400' in response.data def test_token_auth_via_querystring_valid_token(client): response = json_authenticate(client) token = response.jdata['response']['user']['authentication_token'] response = client.get('/token?auth_token=' + token) assert b'Token Authentication' in response.data def test_token_auth_via_header_valid_token(client): response = json_authenticate(client) token = response.jdata['response']['user']['authentication_token'] headers = {"Authentication-Token": token} response = client.get('/token', headers=headers) assert b'Token Authentication' in response.data def test_token_auth_via_querystring_invalid_token(client): response = client.get('/token?auth_token=X') assert 401 == response.status_code def test_token_auth_via_header_invalid_token(client): response = client.get('/token', headers={"Authentication-Token": 'X'}) assert 401 == response.status_code def test_http_auth(client): response = client.get('/http', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:password").decode('utf-8') }) assert b'HTTP Authentication' in response.data def test_http_auth_no_authorization(client): response = client.get('/http', headers={}) assert b'Unauthorized
' in response.data assert 'WWW-Authenticate' in response.headers assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate'] def test_invalid_http_auth_invalid_username(client): response = client.get('/http', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"bogus:bogus").decode('utf-8') }) assert b'Unauthorized
' in response.data assert 'WWW-Authenticate' in response.headers assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate'] def test_invalid_http_auth_bad_password(client): response = client.get('/http', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus").decode('utf-8') }) assert b'Unauthorized
' in response.data assert 'WWW-Authenticate' in response.headers assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate'] def test_custom_http_auth_realm(client): response = client.get('/http_custom_realm', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus").decode('utf-8') }) assert b'Unauthorized
' in response.data assert 'WWW-Authenticate' in response.headers assert 'Basic realm="My Realm"' == response.headers['WWW-Authenticate'] def test_multi_auth_basic(client): response = client.get('/multi_auth', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:password").decode('utf-8') }) assert b'Basic' in response.data response = client.get('/multi_auth') assert response.status_code == 401 def test_multi_auth_basic_invalid(client): response = client.get('/multi_auth', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"bogus:bogus").decode('utf-8') }) assert b'Unauthorized
' in response.data assert 'WWW-Authenticate' in response.headers assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate'] response = client.get('/multi_auth') print(response.headers) assert response.status_code == 401 def test_multi_auth_token(client): response = json_authenticate(client) token = response.jdata['response']['user']['authentication_token'] response = client.get('/multi_auth?auth_token=' + token) assert b'Token' in response.data def test_multi_auth_session(client): authenticate(client, ) response = client.get('/multi_auth') assert b'Session' in response.data def test_user_deleted_during_session_reverts_to_anonymous_user(app, client): authenticate(client) with app.test_request_context('/'): user = app.security.datastore.find_user(email='matt@lp.com') app.security.datastore.delete_user(user) app.security.datastore.commit() response = client.get('/') assert b'Hello matt@lp.com' not in response.data def test_remember_token(client): response = authenticate(client, follow_redirects=False) client.cookie_jar.clear_session_cookies() response = client.get('/profile') assert b'profile' in response.data def test_token_loader_does_not_fail_with_invalid_token(client): c = Cookie(version=0, name='remember_token', value='None', port=None, port_specified=False, domain='www.example.com', domain_specified=False, domain_initial_dot=False, path='/', path_specified=True, secure=False, expires=None, discard=True, comment=None, comment_url=None, rest={'HttpOnly': None}, rfc2109=False) client.cookie_jar.set_cookie(c) response = client.get('/') assert b'BadSignature' not in response.data def test_sending_auth_token_with_json(client): response = json_authenticate(client) token = response.jdata['response']['user']['authentication_token'] data = '{"auth_token": "%s"}' % token response = client.post('/token', data=data, headers={'Content-Type': 'application/json'}) assert b'Token Authentication' in response.data Flask-Security-1.7.5/tests/test_configuration.py 0000644 0000765 0000024 00000002543 12345635310 022111 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_configuration ~~~~~~~~~~~~~~~~~~ Basic configuration tests """ import base64 import pytest from utils import authenticate, logout @pytest.mark.settings( logout_url='/custom_logout', login_url='/custom_login', post_login_view='/post_login', post_logout_view='/post_logout', default_http_auth_realm='Custom Realm') def test_view_configuration(client): response = client.get('/custom_login') assert b"Login
" in response.data response = authenticate(client, endpoint='/custom_login') assert 'location' in response.headers assert response.headers['Location'] == 'http://localhost/post_login' response = logout(client, endpoint='/custom_logout') assert 'location' in response.headers assert response.headers['Location'] == 'http://localhost/post_logout' response = client.get('/http', headers={ 'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus") }) assert b'Unauthorized
' in response.data assert 'WWW-Authenticate' in response.headers assert 'Basic realm="Custom Realm"' == response.headers['WWW-Authenticate'] @pytest.mark.settings(login_user_template='custom_security/login_user.html') def test_template_configuration(client): response = client.get('/login') assert b'CUSTOM LOGIN USER' in response.data Flask-Security-1.7.5/tests/test_confirmable.py 0000644 0000765 0000024 00000013175 12627667222 021540 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_confirmable ~~~~~~~~~~~~~~~~ Confirmable tests """ import time import pytest from flask import Flask from flask_security.core import UserMixin from flask_security.signals import user_confirmed, confirm_instructions_sent from flask_security.utils import capture_registrations from utils import authenticate, logout pytestmark = pytest.mark.confirmable() @pytest.mark.registerable() def test_confirmable_flag(app, client, sqlalchemy_datastore, get_message): recorded_confirms = [] recorded_instructions_sent = [] @user_confirmed.connect_via(app) def on_confirmed(app, user): assert isinstance(app, Flask) assert isinstance(user, UserMixin) recorded_confirms.append(user) @confirm_instructions_sent.connect_via(app) def on_instructions_sent(app, user): assert isinstance(app, Flask) assert isinstance(user, UserMixin) recorded_instructions_sent.append(user) # Test login before confirmation email = 'dude@lp.com' with capture_registrations() as registrations: data = dict(email=email, password='password', next='') response = client.post('/register', data=data) assert response.status_code == 302 response = authenticate(client, email=email) assert get_message('CONFIRMATION_REQUIRED') in response.data # Test invalid token response = client.get('/confirm/bogus', follow_redirects=True) assert get_message('INVALID_CONFIRMATION_TOKEN') in response.data # Test JSON response = client.post('/confirm', data='{"email": "matt@lp.com"}', headers={ 'Content-Type': 'application/json' }) assert response.status_code == 200 assert response.headers['Content-Type'] == 'application/json' assert 'user' in response.jdata['response'] assert len(recorded_instructions_sent) == 1 # Test ask for instructions with invalid email response = client.post('/confirm', data=dict(email='bogus@bogus.com')) assert get_message('USER_DOES_NOT_EXIST') in response.data # Test resend instructions response = client.post('/confirm', data=dict(email=email)) assert get_message('CONFIRMATION_REQUEST', email=email) in response.data assert len(recorded_instructions_sent) == 2 # Test confirm token = registrations[0]['confirm_token'] response = client.get('/confirm/' + token, follow_redirects=True) assert get_message('EMAIL_CONFIRMED') in response.data assert len(recorded_confirms) == 1 # Test already confirmed response = client.get('/confirm/' + token, follow_redirects=True) assert get_message('ALREADY_CONFIRMED') in response.data # Test already confirmed when asking for confirmation instructions logout(client) response = client.get('/confirm') assert response.status_code == 200 response = client.post('/confirm', data=dict(email=email)) assert get_message('ALREADY_CONFIRMED') in response.data # Test user was deleted before confirmation with capture_registrations() as registrations: data = dict(email='mary@lp.com', password='password', next='') client.post('/register', data=data) user = registrations[0]['user'] token = registrations[0]['confirm_token'] with app.app_context(): sqlalchemy_datastore.delete(user) sqlalchemy_datastore.commit() response = client.get('/confirm/' + token, follow_redirects=True) assert get_message('INVALID_CONFIRMATION_TOKEN') in response.data @pytest.mark.registerable() @pytest.mark.settings(confirm_email_within='1 milliseconds') def test_expired_confirmation_token(client, get_message): with capture_registrations() as registrations: data = dict(email='mary@lp.com', password='password', next='') client.post('/register', data=data, follow_redirects=True) user = registrations[0]['user'] token = registrations[0]['confirm_token'] time.sleep(1) response = client.get('/confirm/' + token, follow_redirects=True) msg = get_message('CONFIRMATION_EXPIRED', within='1 milliseconds', email=user.email) assert msg in response.data @pytest.mark.registerable() @pytest.mark.settings(login_without_confirmation=True) def test_login_when_unconfirmed(client, get_message): data = dict(email='mary@lp.com', password='password', next='') response = client.post('/register', data=data, follow_redirects=True) assert b'mary@lp.com' in response.data @pytest.mark.registerable() @pytest.mark.settings(login_without_confirmation=True) def test_confirmation_different_user_when_logged_in(client, get_message): e1 = 'dude@lp.com' e2 = 'lady@lp.com' with capture_registrations() as registrations: for e in e1, e2: data = dict(email=e, password='password', next='') client.post('/register', data=data) logout(client) token1 = registrations[0]['confirm_token'] token2 = registrations[1]['confirm_token'] client.get('/confirm/' + token1, follow_redirects=True) logout(client) authenticate(client, email=e1) response = client.get('/confirm/' + token2, follow_redirects=True) assert get_message('EMAIL_CONFIRMED') in response.data assert b'Hello lady@lp.com' in response.data @pytest.mark.registerable() @pytest.mark.settings(recoverable=True) def test_cannot_reset_password_when_email_is_not_confirmed(client, get_message): email = 'dude@lp.com' data = dict(email=email, password='password', next='') response = client.post('/register', data=data, follow_redirects=True) response = client.post('/reset', data=dict(email=email), follow_redirects=True) assert get_message('CONFIRMATION_REQUIRED') in response.data Flask-Security-1.7.5/tests/test_context_processors.py 0000644 0000765 0000024 00000005445 12627667222 023226 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_context_processors ~~~~~~~~~~~~~~~~~~~~~~~ Context processor tests """ import pytest from utils import authenticate @pytest.mark.recoverable() @pytest.mark.registerable() @pytest.mark.confirmable() @pytest.mark.changeable() @pytest.mark.settings( login_without_confirmation=True, change_password_template='custom_security/change_password.html', login_user_template='custom_security/login_user.html', reset_password_template='custom_security/reset_password.html', forgot_password_template='custom_security/forgot_password.html', send_confirmation_template='custom_security/send_confirmation.html', register_user_template='custom_security/register_user.html') def test_context_processors(client, app): @app.security.context_processor def default_ctx_processor(): return {'global': 'global'} @app.security.forgot_password_context_processor def forgot_password(): return {'foo': 'bar'} response = client.get('/reset') assert b'global' in response.data assert b'bar' in response.data @app.security.login_context_processor def login(): return {'foo': 'bar'} response = client.get('/login') assert b'global' in response.data assert b'bar' in response.data @app.security.register_context_processor def register(): return {'foo': 'bar'} response = client.get('/register') assert b'global' in response.data assert b'bar' in response.data @app.security.reset_password_context_processor def reset_password(): return {'foo': 'bar'} response = client.get('/reset') assert b'global' in response.data assert b'bar' in response.data @app.security.change_password_context_processor def change_password(): return {'foo': 'bar'} authenticate(client) response = client.get('/change') assert b'global' in response.data assert b'bar' in response.data @app.security.send_confirmation_context_processor def send_confirmation(): return {'foo': 'bar'} response = client.get('/confirm') assert b'global' in response.data assert b'bar' in response.data @app.security.mail_context_processor def mail(): return {'foo': 'bar'} client.get('/logout') with app.mail.record_messages() as outbox: client.post('/reset', data=dict(email='matt@lp.com')) email = outbox[0] assert 'global' in email.html assert 'bar' in email.html @pytest.mark.passwordless() @pytest.mark.settings(send_login_template='custom_security/send_login.html') def test_passwordless_login_context_processor(app, client): @app.security.send_login_context_processor def send_login(): return {'foo': 'bar'} response = client.get('/login') assert b'bar' in response.data Flask-Security-1.7.5/tests/test_datastore.py 0000644 0000765 0000024 00000007716 12332222110 021221 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_datastore ~~~~~~~~~~~~~~ Datastore tests """ from pytest import raises from flask_security import UserMixin, RoleMixin from flask_security.datastore import Datastore, UserDatastore from utils import init_app_with_options class User(UserMixin): pass class Role(RoleMixin): pass def test_unimplemented_datastore_methods(): datastore = Datastore(None) assert datastore.db is None with raises(NotImplementedError): datastore.put(None) with raises(NotImplementedError): datastore.delete(None) assert not datastore.commit() def test_unimplemented_user_datastore_methods(): datastore = UserDatastore(None, None) with raises(NotImplementedError): datastore.find_user(None) with raises(NotImplementedError): datastore.find_role(None) with raises(NotImplementedError): datastore.get_user(None) def test_toggle_active(): datastore = UserDatastore(None, None) user = User() user.active = True assert datastore.toggle_active(user) is True assert not user.active assert datastore.toggle_active(user) is True assert user.active is True def test_deactivate_user(): datastore = UserDatastore(None, None) user = User() user.active = True assert datastore.deactivate_user(user) is True assert not user.active def test_activate_user(): datastore = UserDatastore(None, None) user = User() user.active = False assert datastore.activate_user(user) is True assert user.active is True def test_deactivate_returns_false_if_already_false(): datastore = UserDatastore(None, None) user = User() user.active = False assert not datastore.deactivate_user(user) def test_activate_returns_false_if_already_true(): datastore = UserDatastore(None, None) user = User() user.active = True assert not datastore.activate_user(user) def test_get_user(app, datastore): init_app_with_options(app, datastore, **{ 'SECURITY_USER_IDENTITY_ATTRIBUTES': ('email', 'username') }) with app.app_context(): user_id = datastore.find_user(email='matt@lp.com').id user = datastore.get_user(user_id) assert user is not None user = datastore.get_user('matt@lp.com') assert user is not None user = datastore.get_user('matt') assert user is not None def test_find_role(app, datastore): init_app_with_options(app, datastore) role = datastore.find_role('admin') assert role is not None role = datastore.find_role('bogus') assert role is None def test_add_role_to_user(app, datastore): init_app_with_options(app, datastore) # Test with user object user = datastore.find_user(email='matt@lp.com') assert user.has_role('editor') is False assert datastore.add_role_to_user(user, 'editor') is True assert datastore.add_role_to_user(user, 'editor') is False assert user.has_role('editor') is True # Test with email assert datastore.add_role_to_user('jill@lp.com', 'editor') is True user = datastore.find_user(email='jill@lp.com') assert user.has_role('editor') is True # Test remove role assert datastore.remove_role_from_user(user, 'editor') is True assert datastore.remove_role_from_user(user, 'editor') is False def test_create_user_with_roles(app, datastore): init_app_with_options(app, datastore) role = datastore.find_role('admin') datastore.commit() user = datastore.create_user(email='dude@lp.com', username='dude', password='password', roles=[role]) datastore.commit() user = datastore.find_user(email='dude@lp.com') assert user.has_role('admin') is True def test_delete_user(app, datastore): init_app_with_options(app, datastore) user = datastore.find_user(email='matt@lp.com') datastore.delete_user(user) datastore.commit() user = datastore.find_user(email='matt@lp.com') assert user is None Flask-Security-1.7.5/tests/test_entities.py 0000644 0000765 0000024 00000001664 12332222110 021053 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_entities ~~~~~~~~~~~~~ Entity tests """ from flask_security import RoleMixin, UserMixin, AnonymousUser class Role(RoleMixin): def __init__(self, name): self.name = name class User(UserMixin): def __init__(self, roles): self.roles = roles def test_role_mixin_equal(): admin1 = Role('admin') admin2 = Role('admin') assert admin1 == admin2 def test_role_mixin_not_equal(): admin = Role('admin') editor = Role('editor') assert admin != editor def test_user_mixin_has_role_with_string(): admin = Role('admin') editor = Role('editor') user = User([admin, editor]) assert user.has_role('admin') is True assert user.has_role('editor') is True assert user.has_role(admin) is True assert user.has_role(editor) is True def test_anonymous_user_has_no_roles(): user = AnonymousUser() assert not user.has_role('admin') Flask-Security-1.7.5/tests/test_hashing.py 0000644 0000765 0000024 00000002071 12332222110 020641 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_hashing ~~~~~~~~~~~~ hashing tests """ from pytest import raises from flask_security.utils import verify_password, encrypt_password from utils import authenticate, init_app_with_options def test_verify_password_bcrypt(app, sqlalchemy_datastore): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_PASSWORD_HASH': 'bcrypt', 'SECURITY_PASSWORD_SALT': 'salty' }) with app.app_context(): assert verify_password('pass', encrypt_password('pass')) def test_login_with_bcrypt_enabled(app, sqlalchemy_datastore): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_PASSWORD_HASH': 'bcrypt', 'SECURITY_PASSWORD_SALT': 'salty' }) response = authenticate(app.test_client(), follow_redirects=True) assert b'Home Page' in response.data def test_missing_hash_salt_option(app, sqlalchemy_datastore): with raises(RuntimeError): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_PASSWORD_HASH': 'bcrypt', }) Flask-Security-1.7.5/tests/test_misc.py 0000644 0000765 0000024 00000015707 12627667222 020215 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_emails ~~~~~~~~~~~ Email functionality tests """ import pytest from flask_security import Security from flask_security.forms import LoginForm, RegisterForm, ConfirmRegisterForm, \ SendConfirmationForm, PasswordlessLoginForm, ForgotPasswordForm, ResetPasswordForm, \ ChangePasswordForm, StringField, PasswordField, email_required, email_validator, \ valid_user_email from flask_security.utils import capture_reset_password_requests, md5, string_types from utils import authenticate, init_app_with_options, populate_data @pytest.mark.recoverable() def test_async_email_task(app, client): app.mail_sent = False @app.security.send_mail_task def send_email(msg): app.mail_sent = True client.post('/reset', data=dict(email='matt@lp.com')) assert app.mail_sent is True def test_register_blueprint_flag(app, sqlalchemy_datastore): app.security = Security(app, datastore=Security, register_blueprint=False) client = app.test_client() response = client.get('/login') assert response.status_code == 404 @pytest.mark.registerable() @pytest.mark.recoverable() @pytest.mark.changeable() def test_basic_custom_forms(app, sqlalchemy_datastore): class MyLoginForm(LoginForm): email = StringField('My Login Email Address Field') class MyRegisterForm(RegisterForm): email = StringField('My Register Email Address Field') class MyForgotPasswordForm(ForgotPasswordForm): email = StringField('My Forgot Email Address Field', validators=[email_required, email_validator, valid_user_email]) class MyResetPasswordForm(ResetPasswordForm): password = StringField('My Reset Password Field') class MyChangePasswordForm(ChangePasswordForm): password = PasswordField('My Change Password Field') app.security = Security(app, datastore=sqlalchemy_datastore, login_form=MyLoginForm, register_form=MyRegisterForm, forgot_password_form=MyForgotPasswordForm, reset_password_form=MyResetPasswordForm, change_password_form=MyChangePasswordForm) populate_data(app) client = app.test_client() response = client.get('/login') assert b'My Login Email Address Field' in response.data response = client.get('/register') assert b'My Register Email Address Field' in response.data response = client.get('/reset') assert b'My Forgot Email Address Field' in response.data with capture_reset_password_requests() as requests: response = client.post('/reset', data=dict(email='matt@lp.com')) token = requests[0]['token'] response = client.get('/reset/' + token) assert b'My Reset Password Field' in response.data authenticate(client) response = client.get('/change') assert b'My Change Password Field' in response.data @pytest.mark.registerable() @pytest.mark.confirmable() def test_confirmable_custom_form(app, sqlalchemy_datastore): app.config['SECURITY_REGISTERABLE'] = True app.config['SECURITY_CONFIRMABLE'] = True class MyRegisterForm(ConfirmRegisterForm): email = StringField('My Register Email Address Field') class MySendConfirmationForm(SendConfirmationForm): email = StringField('My Send Confirmation Email Address Field') app.security = Security(app, datastore=sqlalchemy_datastore, send_confirmation_form=MySendConfirmationForm, confirm_register_form=MyRegisterForm) client = app.test_client() response = client.get('/register') assert b'My Register Email Address Field' in response.data response = client.get('/confirm') assert b'My Send Confirmation Email Address Field' in response.data def test_passwordless_custom_form(app, sqlalchemy_datastore): app.config['SECURITY_PASSWORDLESS'] = True class MyPasswordlessLoginForm(PasswordlessLoginForm): email = StringField('My Passwordless Email Address Field') app.security = Security(app, datastore=sqlalchemy_datastore, passwordless_login_form=MyPasswordlessLoginForm) client = app.test_client() response = client.get('/login') assert b'My Passwordless Email Address Field' in response.data def test_addition_identity_attributes(app, sqlalchemy_datastore): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_USER_IDENTITY_ATTRIBUTES': ('email', 'username') }) client = app.test_client() response = authenticate(client, email='matt', follow_redirects=True) assert b'Hello matt@lp.com' in response.data def test_flash_messages_off(app, sqlalchemy_datastore, get_message): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_FLASH_MESSAGES': False }) client = app.test_client() response = client.get('/profile') assert get_message('LOGIN') not in response.data def test_invalid_hash_scheme(app, sqlalchemy_datastore, get_message): with pytest.raises(ValueError): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_PASSWORD_HASH': 'bogus' }) def test_change_hash_type(app, sqlalchemy_datastore): init_app_with_options(app, sqlalchemy_datastore, **{ 'SECURITY_PASSWORD_SCHEMES': ['bcrypt', 'plaintext'] }) app.config['SECURITY_PASSWORD_HASH'] = 'bcrypt' app.config['SECURITY_PASSWORD_SALT'] = 'salty' app.security = Security(app, datastore=sqlalchemy_datastore, register_blueprint=False) client = app.test_client() response = client.post('/login', data=dict(email='matt@lp.com', password='password')) assert response.status_code == 302 response = client.get('/logout') response = client.post('/login', data=dict(email='matt@lp.com', password='password')) assert response.status_code == 302 def test_md5(): data = md5(b'hello') assert isinstance(data, string_types) data = md5(u'hellö') assert isinstance(data, string_types) @pytest.mark.settings(password_salt=u'öööööööööööööööööööööööööööööööööö', password_hash='bcrypt') def test_password_unicode_password_salt(client): response = authenticate(client) assert response.status_code == 302 response = authenticate(client, follow_redirects=True) assert b'Hello matt@lp.com' in response.data def test_set_unauthorized_handler(app, client): @app.security.unauthorized_handler def unauthorized(): app.unauthorized_handler_set = True return 'unauthorized-handler-set', 401 app.unauthorized_handler_set = False authenticate(client, "joe@lp.com") response = client.get("/admin", follow_redirects=True) assert app.unauthorized_handler_set is True assert b'unauthorized-handler-set' in response.data assert response.status_code == 401 Flask-Security-1.7.5/tests/test_passwordless.py 0000644 0000765 0000024 00000006213 12627667222 022003 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_passwordless ~~~~~~~~~~~~~~~~~ Passwordless tests """ import time import pytest from flask import Flask from flask_security.core import UserMixin from flask_security.signals import login_instructions_sent from flask_security.utils import capture_passwordless_login_requests, string_types from utils import logout pytestmark = pytest.mark.passwordless() def test_trackable_flag(app, client, get_message): recorded = [] @login_instructions_sent.connect_via(app) def on_instructions_sent(app, user, login_token): assert isinstance(app, Flask) assert isinstance(user, UserMixin) assert isinstance(login_token, string_types) recorded.append(user) # Test disabled account response = client.post('/login', data=dict(email='tiya@lp.com'), follow_redirects=True) assert get_message('DISABLED_ACCOUNT') in response.data # Test login with json and valid email data = '{"email": "matt@lp.com", "password": "password"}' response = client.post('/login', data=data, headers={'Content-Type': 'application/json'}) assert response.status_code == 200 assert len(recorded) == 1 # Test login with json and invalid email data = '{"email": "nobody@lp.com", "password": "password"}' response = client.post('/login', data=data, headers={'Content-Type': 'application/json'}) assert b'errors' in response.data # Test sends email and shows appropriate response with capture_passwordless_login_requests() as requests: with app.mail.record_messages() as outbox: response = client.post('/login', data=dict(email='matt@lp.com'), follow_redirects=True) assert len(recorded) == 2 assert len(requests) == 1 assert len(outbox) == 1 assert 'user' in requests[0] assert 'login_token' in requests[0] user = requests[0]['user'] assert get_message('LOGIN_EMAIL_SENT', email=user.email) in response.data token = requests[0]['login_token'] response = client.get('/login/' + token, follow_redirects=True) assert get_message('PASSWORDLESS_LOGIN_SUCCESSFUL') in response.data # Test already authenticated response = client.get('/login/' + token, follow_redirects=True) assert get_message('PASSWORDLESS_LOGIN_SUCCESSFUL') not in response.data logout(client) # Test invalid token response = client.get('/login/bogus', follow_redirects=True) assert get_message('INVALID_LOGIN_TOKEN') in response.data # Test login request with invalid email response = client.post('/login', data=dict(email='bogus@bogus.com')) assert get_message('USER_DOES_NOT_EXIST') in response.data @pytest.mark.settings(login_within='1 milliseconds') def test_expired_login_token(client, app, get_message): e = 'matt@lp.com' with capture_passwordless_login_requests() as requests: client.post('/login', data=dict(email=e), follow_redirects=True) token = requests[0]['login_token'] user = requests[0]['user'] time.sleep(1) response = client.get('/login/' + token, follow_redirects=True) assert get_message('LOGIN_EXPIRED', within='1 milliseconds', email=user.email) in response.data Flask-Security-1.7.5/tests/test_recoverable.py 0000644 0000765 0000024 00000013666 12627667222 021555 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_recoverable ~~~~~~~~~~~~~~~~ Recoverable functionality tests """ import time import pytest from flask import Flask from flask_security.core import UserMixin from flask_security.signals import reset_password_instructions_sent, password_reset from flask_security.utils import capture_reset_password_requests, string_types from utils import authenticate, logout pytestmark = pytest.mark.recoverable() def test_recoverable_flag(app, client, get_message): recorded_resets = [] recorded_instructions_sent = [] @password_reset.connect_via(app) def on_password_reset(app, user): recorded_resets.append(user) @reset_password_instructions_sent.connect_via(app) def on_instructions_sent(app, user, token): assert isinstance(app, Flask) assert isinstance(user, UserMixin) assert isinstance(token, string_types) recorded_instructions_sent.append(user) # Test the reset view response = client.get('/reset') assert b'Send password reset instructions
' in response.data # Test submitting email to reset password creates a token and sends email with capture_reset_password_requests() as requests: with app.mail.record_messages() as outbox: response = client.post('/reset', data=dict(email='joe@lp.com'), follow_redirects=True) assert len(recorded_instructions_sent) == 1 assert len(outbox) == 1 assert response.status_code == 200 assert get_message('PASSWORD_RESET_REQUEST', email='joe@lp.com') in response.data token = requests[0]['token'] # Test view for reset token response = client.get('/reset/' + token) assert b'Reset password
' in response.data # Test submitting a new password response = client.post('/reset/' + token, data={ 'password': 'newpassword', 'password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('PASSWORD_RESET') in response.data assert len(recorded_resets) == 1 logout(client) # Test logging in with the new password response = authenticate(client, 'joe@lp.com', 'newpassword', follow_redirects=True) assert b'Hello joe@lp.com' in response.data logout(client) # Test submitting JSON response = client.post('/reset', data='{"email": "joe@lp.com"}', headers={ 'Content-Type': 'application/json' }) assert response.headers['Content-Type'] == 'application/json' assert 'user' not in response.jdata['response'] logout(client) # Test invalid email response = client.post('/reset', data=dict(email='bogus@lp.com'), follow_redirects=True) assert get_message('USER_DOES_NOT_EXIST') in response.data logout(client) # Test invalid token response = client.post('/reset/bogus', data={ 'password': 'newpassword', 'password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('INVALID_RESET_PASSWORD_TOKEN') in response.data # Test mangled token token = ("WyIxNjQ2MzYiLCIxMzQ1YzBlZmVhM2VhZjYwODgwMDhhZGU2YzU0MzZjMiJd.BZEw_Q.lQyo3npdPZtcJ" "_sNHVHP103syjM&url_id=fbb89a8328e58c181ea7d064c2987874bc54a23d") response = client.post('/reset/' + token, data={ 'password': 'newpassword', 'password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('INVALID_RESET_PASSWORD_TOKEN') in response.data @pytest.mark.settings(reset_password_within='1 milliseconds') def test_expired_reset_token(client, get_message): with capture_reset_password_requests() as requests: client.post('/reset', data=dict(email='joe@lp.com'), follow_redirects=True) user = requests[0]['user'] token = requests[0]['token'] time.sleep(1) response = client.post('/reset/' + token, data={ 'password': 'newpassword', 'password_confirm': 'newpassword' }, follow_redirects=True) msg = get_message('PASSWORD_RESET_EXPIRED', within='1 milliseconds', email=user.email) assert msg in response.data def test_used_reset_token(client, get_message): with capture_reset_password_requests() as requests: client.post('/reset', data=dict(email='joe@lp.com'), follow_redirects=True) token = requests[0]['token'] # use the token response = client.post('/reset/' + token, data={ 'password': 'newpassword', 'password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('PASSWORD_RESET') in response.data logout(client) # attempt to use it a second time response2 = client.post('/reset/' + token, data={ 'password': 'otherpassword', 'password_confirm': 'otherpassword' }, follow_redirects=True) msg = get_message('INVALID_RESET_PASSWORD_TOKEN') assert msg in response2.data def test_reset_passwordless_user(client, get_message): with capture_reset_password_requests() as requests: client.post('/reset', data=dict(email='jess@lp.com'), follow_redirects=True) token = requests[0]['token'] # use the token response = client.post('/reset/' + token, data={ 'password': 'newpassword', 'password_confirm': 'newpassword' }, follow_redirects=True) assert get_message('PASSWORD_RESET') in response.data @pytest.mark.settings(reset_url='/custom_reset') def test_custom_reset_url(client): response = client.get('/custom_reset') assert response.status_code == 200 @pytest.mark.settings(reset_password_template='custom_security/reset_password.html', forgot_password_template='custom_security/forgot_password.html') def test_custom_reset_templates(client): response = client.get('/reset') assert b'CUSTOM FORGOT PASSWORD' in response.data with capture_reset_password_requests() as requests: client.post('/reset', data=dict(email='joe@lp.com'), follow_redirects=True) token = requests[0]['token'] response = client.get('/reset/' + token) assert b'CUSTOM RESET PASSWORD' in response.data Flask-Security-1.7.5/tests/test_registerable.py 0000644 0000765 0000024 00000010044 12627667222 021717 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_registerable ~~~~~~~~~~~~~~~~~ Registerable tests """ import pytest from flask import Flask from flask_security.core import UserMixin from flask_security.signals import user_registered from utils import authenticate, logout pytestmark = pytest.mark.registerable() @pytest.mark.settings(post_register_view='/post_register') def test_registerable_flag(client, app, get_message): recorded = [] # Test the register view response = client.get('/register') assert b"Register
" in response.data # Test registering is successful, sends email, and fires signal @user_registered.connect_via(app) def on_user_registerd(app, user, confirm_token): assert isinstance(app, Flask) assert isinstance(user, UserMixin) assert confirm_token is None recorded.append(user) data = dict( email='dude@lp.com', password='password', password_confirm='password', next='' ) with app.mail.record_messages() as outbox: response = client.post('/register', data=data, follow_redirects=True) assert len(recorded) == 1 assert len(outbox) == 1 assert b'Post Register' in response.data logout(client) # Test user can login after registering response = authenticate(client, email='dude@lp.com', password='password') assert response.status_code == 302 logout(client) # Test registering with an existing email data = dict( email='dude@lp.com', password='password', password_confirm='password', next='' ) response = client.post('/register', data=data, follow_redirects=True) assert get_message('EMAIL_ALREADY_ASSOCIATED', email='dude@lp.com') in response.data # Test registering with an existing email but case insensitive data = dict( email='Dude@lp.com', password='password', password_confirm='password', next='' ) response = client.post('/register', data=data, follow_redirects=True) assert get_message('EMAIL_ALREADY_ASSOCIATED', email='Dude@lp.com') in response.data # Test registering with JSON data = '{ "email": "dude2@lp.com", "password": "password"}' response = client.post('/register', data=data, headers={'Content-Type': 'application/json'}) assert response.headers['content-type'] == 'application/json' assert response.jdata['meta']['code'] == 200 logout(client) # Test registering with invalid JSON data = '{ "email": "bogus", "password": "password"}' response = client.post('/register', data=data, headers={'Content-Type': 'application/json'}) assert response.headers['content-type'] == 'application/json' assert response.jdata['meta']['code'] == 400 logout(client) # Test ?next param data = dict(email='dude3@lp.com', password='password', password_confirm='password', next='') response = client.post('/register?next=/page1', data=data, follow_redirects=True) assert b'Page 1' in response.data @pytest.mark.settings(register_url='/custom_register', post_register_view='/post_register') def test_custom_register_url(client): response = client.get('/custom_register') assert b"Register
" in response.data data = dict(email='dude@lp.com', password='password', password_confirm='password', next='') response = client.post('/custom_register', data=data, follow_redirects=True) assert b'Post Register' in response.data @pytest.mark.settings(register_user_template='custom_security/register_user.html') def test_custom_register_tempalate(client): response = client.get('/register') assert b'CUSTOM REGISTER USER' in response.data @pytest.mark.settings(send_register_email=False) def test_disable_register_emails(client, app): data = dict( email='dude@lp.com', password='password', password_confirm='password', next='' ) with app.mail.record_messages() as outbox: client.post('/register', data=data, follow_redirects=True) assert len(outbox) == 0 Flask-Security-1.7.5/tests/test_trackable.py 0000644 0000765 0000024 00000002352 12627667222 021202 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ test_trackable ~~~~~~~~~~~~~~ Trackable tests """ import pytest from utils import authenticate, logout pytestmark = pytest.mark.trackable() def test_trackable_flag(app, client): e = 'matt@lp.com' authenticate(client, email=e) logout(client) authenticate(client, email=e, headers={'X-Forwarded-For': '127.0.0.1'}) with app.app_context(): user = app.security.datastore.find_user(email=e) assert user.last_login_at is not None assert user.current_login_at is not None assert user.last_login_ip == 'untrackable' assert user.current_login_ip == '127.0.0.1' assert user.login_count == 2 def test_trackable_with_multiple_ips_in_headers(app, client): e = 'matt@lp.com' authenticate(client, email=e) logout(client) authenticate(client, email=e, headers={ 'X-Forwarded-For': '99.99.99.99, 88.88.88.88'}) with app.app_context(): user = app.security.datastore.find_user(email=e) assert user.last_login_at is not None assert user.current_login_at is not None assert user.last_login_ip == 'untrackable' assert user.current_login_ip == '88.88.88.88' assert user.login_count == 2 Flask-Security-1.7.5/tests/utils.py 0000644 0000765 0000024 00000004765 12345615124 017354 0 ustar matt staff 0000000 0000000 # -*- coding: utf-8 -*- """ utils ~~~~~ Test utils """ from flask import Response as BaseResponse, json from flask_security import Security from flask_security.utils import encrypt_password _missing = object def authenticate(client, email="matt@lp.com", password="password", endpoint=None, **kwargs): data = dict(email=email, password=password, remember='y') return client.post(endpoint or '/login', data=data, **kwargs) def json_authenticate(client, email="matt@lp.com", password="password", endpoint=None): data = '{"email": "%s", "password": "%s"}' % (email, password) return client.post(endpoint or '/login', content_type="application/json", data=data) def logout(client, endpoint=None, **kwargs): return client.get(endpoint or '/logout', **kwargs) def create_roles(ds): for role in ('admin', 'editor', 'author'): ds.create_role(name=role) ds.commit() def create_users(ds, count=None): users = [('matt@lp.com', 'matt', 'password', ['admin'], True), ('joe@lp.com', 'joe', 'password', ['editor'], True), ('dave@lp.com', 'dave', 'password', ['admin', 'editor'], True), ('jill@lp.com', 'jill', 'password', ['author'], True), ('tiya@lp.com', 'tiya', 'password', [], False), ('jess@lp.com', 'jess', None, [], True)] count = count or len(users) for u in users[:count]: pw = u[2] if pw is not None: pw = encrypt_password(pw) roles = [ds.find_or_create_role(rn) for rn in u[3]] ds.commit() user = ds.create_user(email=u[0], username=u[1], password=pw, active=u[4]) ds.commit() for role in roles: ds.add_role_to_user(user, role) ds.commit() def populate_data(app, user_count=None): ds = app.security.datastore with app.app_context(): create_roles(ds) create_users(ds, user_count) class Response(BaseResponse): # pragma: no cover @property def jdata(self): rv = getattr(self, '_cached_jdata', _missing) if rv is not _missing: return rv try: self._cached_jdata = json.loads(self.data) except ValueError: raise Exception('Invalid JSON response') return self._cached_jdata def init_app_with_options(app, datastore, **options): security_args = options.pop('security_args', {}) app.config.update(**options) app.security = Security(app, datastore=datastore, **security_args) populate_data(app) Flask-Security-1.7.5/tests/utils.pyc 0000644 0000765 0000024 00000007505 12345626651 017521 0 ustar matt staff 0000000 0000000 TSc @ s d Z d d l m Z m Z d d l m Z d d l m Z e Z d d d d Z d d d d Z d d Z d Z d d Z d d Z d e f d YZ d Z d S( s% utils ~~~~~ Test utils i( t Responset json( t Security( t encrypt_passwords matt@lp.comt passwordc K s7 t d | d | d d } | j | p* d d | | S( Nt emailR t remembert ys /logint data( t dictt post( t clientR R t endpointt kwargsR ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt authenticate s c C s/ d | | f } | j | p d d d d | S( Ns! {"email": "%s", "password": "%s"}s /logint content_types application/jsonR ( R ( R R R R R ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt json_authenticate s c K s | j | p d | S( Ns /logout( t get( R R R ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt logout s c C s/ x d D] } | j d | q W| j d S( Nt admint editort authort name( s admins editorR ( t create_rolet commit( t dst role( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt create_roles s c C sf d d d d g t f d d d d g t f d d d d d g t f d d d d g t f d d d g t f d d d g t f g } | p t | } x | | D] } | d } | d k r t | } n g | d D] } | j | ^ q } | j | j d | d d | d d | d | d } | j x | D] } | j | | q:W| j q Wd S( Ns matt@lp.comt mattR R s joe@lp.comt joeR s dave@lp.comt daves jill@lp.comt jillR s tiya@lp.comt tiyas jess@lp.comt jessi i R i t usernamei t activei ( t Truet Falset Nonet lenR t find_or_create_roleR t create_usert add_role_to_user( R t countt userst ut pwt rnt rolest userR ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt create_users% s$ & 0 c C s: | j j } | j t | t | | Wd QXd S( N( t securityt datastoret app_contextR R2 ( t appt user_countR ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt populate_data; s R c B s e Z e d Z RS( c C sb t | d t } | t k r" | Sy t j | j | _ Wn t k rZ t d n X| j S( Nt _cached_jdatas Invalid JSON response( t getattrt _missingR t loadsR R9 t ValueErrort Exception( t selft rv( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt jdataD s ( t __name__t __module__t propertyRA ( ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyR B s c K sH | j d i } | j j | t | d | | | _ t | d S( Nt security_argsR4 ( t popt configt updateR R3 R8 ( R6 R4 t optionsRE ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyt init_app_with_optionsP s N( t __doc__t flaskR t BaseResponseR t flask_securityR t flask_security.utilsR t objectR; R& R R R R R2 R8 RJ ( ( ( s; /Users/matt/Workspaces/Python/flask-security/tests/utils.pyts Flask-Security-1.7.5/tox.ini 0000644 0000765 0000024 00000000264 12627667222 016012 0 ustar matt staff 0000000 0000000 [tox] envlist = py26, py27, py33, py34, py35, pypy [testenv] deps = -r{toxinidir}/requirements.txt -r{toxinidir}/requirements-dev.txt commands = python setup.py test