-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathlogin_test.py
143 lines (99 loc) · 3.52 KB
/
login_test.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
from datetime import datetime, timedelta
import pytest
from freezegun import freeze_time
# Import for pytest
from flask.testing import FlaskClient
from test.helpers import clear_all, db_add_user, generate_csrf_header
from test.fixtures import app, client
from test.mock.mock_redis import fake_redis
def test_no_users(client):
clear_all()
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobar"
})
assert response.status_code == 401
def test_invalid_email(client):
clear_all()
db_add_user("[email protected]", "asdf", "foobar")
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobaz"
})
assert response.status_code == 401
def test_wrong_password(client):
clear_all()
db_add_user("[email protected]", "asdf", "foobar")
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobaz"
})
assert response.status_code == 401
def test_success(client):
clear_all()
db_add_user("[email protected]", "asdf", "foobar")
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobar"
})
assert response.status_code == 200
def test_lockout(client):
clear_all()
db_add_user("[email protected]", "asdf", "foobar")
# Incorrect login 3 times
for _ in range(3):
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobaz"
})
assert response.status_code == 401
# Now when we login, it should lock user out
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobar"
})
assert response.status_code == 401
def test_lockout_timing(client):
clear_all()
db_add_user("[email protected]", "asdf", "foobar")
# Incorrect login 3 times
for _ in range(3):
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobaz"
})
assert response.status_code == 401
timeout_over = datetime.now() + timedelta(minutes=1, seconds=5)
# Incorrect login again
with freeze_time(timeout_over):
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobaz"
})
assert response.status_code == 401
still_timeout = timeout_over + timedelta(minutes=1)
# Timeout is now 2 minutes
with freeze_time(still_timeout):
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobar"
})
assert response.status_code == 401
second_timeout_over = still_timeout + timedelta(minutes=1, seconds=5)
# Timeout is now 2 minutes
with freeze_time(second_timeout_over):
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobar"
})
assert response.status_code == 200
def test_protected_route(client: FlaskClient):
clear_all()
db_add_user("[email protected]", "asdf", "foobar")
response = client.post("/auth/login", json={
"email": "[email protected]",
"password": "foobar"
})
assert response.status_code == 200
response = client.post("/auth/protected", headers=generate_csrf_header(response))
assert response.status_code == 200