73 lines
2.1 KiB
Python
73 lines
2.1 KiB
Python
from sqlalchemy import select
|
|
|
|
from app.auth.models import User
|
|
|
|
|
|
def register(client, **overrides):
|
|
data = {
|
|
"username": "steady_user",
|
|
"email": "person@example.com",
|
|
"password": "a calm secure password",
|
|
"confirm_password": "a calm secure password",
|
|
}
|
|
data.update(overrides)
|
|
return client.post("/auth/register", data=data, follow_redirects=True)
|
|
|
|
|
|
def test_registration_hashes_password(client, db):
|
|
response = register(client)
|
|
user = db.session.scalar(select(User).where(User.email == "person@example.com"))
|
|
|
|
assert response.status_code == 200
|
|
assert b"Your account is ready" in response.data
|
|
assert user is not None
|
|
assert user.password_hash != "a calm secure password"
|
|
assert user.check_password("a calm secure password")
|
|
|
|
|
|
def test_registration_rejects_duplicate_identity(client):
|
|
register(client)
|
|
response = register(client, email="another@example.com")
|
|
|
|
assert b"That username or email is already registered" in response.data
|
|
|
|
|
|
def test_login_and_logout(client):
|
|
register(client)
|
|
|
|
login_response = client.post(
|
|
"/auth/login",
|
|
data={
|
|
"email": "person@example.com",
|
|
"password": "a calm secure password",
|
|
},
|
|
follow_redirects=True,
|
|
)
|
|
assert b"Hi, steady_user" in login_response.data
|
|
|
|
logout_response = client.post("/auth/logout", follow_redirects=True)
|
|
assert b"You have been signed out" in logout_response.data
|
|
assert b"Create account" in logout_response.data
|
|
|
|
|
|
def test_login_uses_generic_failure_message(client):
|
|
response = client.post(
|
|
"/auth/login",
|
|
data={"email": "missing@example.com", "password": "incorrect"},
|
|
)
|
|
|
|
assert b"Email or password is incorrect" in response.data
|
|
|
|
|
|
def test_external_next_url_is_not_used(client):
|
|
register(client)
|
|
response = client.post(
|
|
"/auth/login?next=https://attacker.example/",
|
|
data={
|
|
"email": "person@example.com",
|
|
"password": "a calm secure password",
|
|
},
|
|
)
|
|
|
|
assert response.headers["Location"] == "/"
|
|
|