|
1 |
| -from unittest import TestCase |
2 | 1 | from unittest.mock import MagicMock
|
3 | 2 |
|
4 | 3 | import pytest
|
5 | 4 | from axes.models import AccessAttempt
|
6 |
| -from django.conf import settings |
7 | 5 | from django.contrib.auth import authenticate
|
8 | 6 | from django.http import HttpRequest
|
| 7 | +from pytest_django.fixtures import SettingsWrapper |
9 | 8 | from rest_framework.exceptions import AuthenticationFailed
|
10 | 9 |
|
11 | 10 | from environments.authentication import EnvironmentKeyAuthentication
|
12 | 11 | from environments.models import Environment
|
13 | 12 | from organisations.models import Organisation
|
14 |
| -from projects.models import Project |
15 |
| - |
16 |
| - |
17 |
| -@pytest.mark.django_db |
18 |
| -class EnvironmentKeyAuthenticationTestCase(TestCase): |
19 |
| - def setUp(self) -> None: |
20 |
| - self.organisation = Organisation.objects.create(name="Test org") |
21 |
| - self.project = Project.objects.create( |
22 |
| - name="Test project", organisation=self.organisation |
23 |
| - ) |
24 |
| - self.environment = Environment.objects.create( |
25 |
| - name="Test environment", project=self.project |
26 |
| - ) |
27 |
| - |
28 |
| - self.authenticator = EnvironmentKeyAuthentication() |
29 |
| - |
30 |
| - def test_authentication_passes_if_valid_api_key_passed(self): |
31 |
| - # Given |
32 |
| - request = MagicMock() |
33 |
| - request.META.get.return_value = self.environment.api_key |
34 |
| - |
35 |
| - # When |
36 |
| - self.authenticator.authenticate(request) |
37 |
| - |
38 |
| - # Then - authentication passes |
39 |
| - pass |
40 |
| - |
41 |
| - def test_authenticate_raises_authentication_failed_if_request_missing_environment_key( |
42 |
| - self, |
43 |
| - ): |
44 |
| - # Given |
45 |
| - request = MagicMock() |
46 |
| - |
47 |
| - # When / Then |
48 |
| - with pytest.raises(AuthenticationFailed): |
49 |
| - self.authenticator.authenticate(request) |
50 |
| - |
51 |
| - def test_authenticate_raises_authentication_failed_if_request_environment_key_not_found( |
52 |
| - self, |
53 |
| - ): |
54 |
| - # Given |
55 |
| - request = MagicMock() |
56 |
| - request.META.get.return_value = "some-invalid-key" |
57 |
| - |
58 |
| - # When / Then |
59 |
| - with pytest.raises(AuthenticationFailed): |
60 |
| - self.authenticator.authenticate(request) |
61 |
| - |
62 |
| - def test_authenticate_raises_authentication_failed_if_organisation_set_to_stop_serving_flags( |
63 |
| - self, |
64 |
| - ): |
65 |
| - # Given |
66 |
| - self.organisation.stop_serving_flags = True |
67 |
| - self.organisation.save() |
68 |
| - |
69 |
| - request = MagicMock() |
70 |
| - request.META.get.return_value = self.environment.api_key |
71 |
| - |
72 |
| - # When / Then |
73 |
| - with pytest.raises(AuthenticationFailed): |
74 |
| - self.authenticator.authenticate(request) |
75 |
| - |
76 |
| - |
77 |
| -@pytest.mark.django_db |
78 |
| -class TestBruteForceAttempts(TestCase): |
79 |
| - def test_brute_force_attempts(self): |
80 |
| - invalid_user_name = "invalid_user" |
81 |
| - login_attempts_to_make = settings.AXES_FAILURE_LIMIT + 1 |
82 |
| - |
83 |
| - assert AccessAttempt.objects.all().count() == 0 |
84 |
| - |
85 |
| - for _ in range(login_attempts_to_make): |
86 |
| - request = HttpRequest() |
87 |
| - authenticate( |
88 |
| - request, username=invalid_user_name, password="invalid_password" |
89 |
| - ) |
90 |
| - |
91 |
| - assert AccessAttempt.objects.filter(username=invalid_user_name).count() == 1 |
| 13 | + |
| 14 | + |
| 15 | +def test_authentication_passes_if_valid_api_key_passed( |
| 16 | + environment: Environment, |
| 17 | +) -> None: |
| 18 | + # Given |
| 19 | + request = MagicMock() |
| 20 | + request.META.get.return_value = environment.api_key |
| 21 | + authenticator = EnvironmentKeyAuthentication() |
| 22 | + |
| 23 | + # When / Then - authentication passes |
| 24 | + authenticator.authenticate(request) |
| 25 | + |
| 26 | + |
| 27 | +def test_authenticate_raises_authentication_failed_if_request_missing_environment_key( |
| 28 | + db: None, |
| 29 | +) -> None: |
| 30 | + # Given |
| 31 | + request = MagicMock() |
| 32 | + authenticator = EnvironmentKeyAuthentication() |
| 33 | + |
| 34 | + # When / Then |
| 35 | + with pytest.raises(AuthenticationFailed): |
| 36 | + authenticator.authenticate(request) |
| 37 | + |
| 38 | + |
| 39 | +def test_authenticate_raises_authentication_failed_if_request_environment_key_not_found( |
| 40 | + db: None, |
| 41 | +) -> None: |
| 42 | + # Given |
| 43 | + request = MagicMock() |
| 44 | + request.META.get.return_value = "some-invalid-key" |
| 45 | + authenticator = EnvironmentKeyAuthentication() |
| 46 | + |
| 47 | + # When / Then |
| 48 | + with pytest.raises(AuthenticationFailed): |
| 49 | + authenticator.authenticate(request) |
| 50 | + |
| 51 | + |
| 52 | +def test_authenticate_raises_authentication_failed_if_organisation_set_to_stop_serving_flags( |
| 53 | + organisation: Organisation, |
| 54 | + environment: Environment, |
| 55 | +) -> None: |
| 56 | + # Given |
| 57 | + organisation.stop_serving_flags = True |
| 58 | + organisation.save() |
| 59 | + |
| 60 | + request = MagicMock() |
| 61 | + request.META.get.return_value = environment.api_key |
| 62 | + authenticator = EnvironmentKeyAuthentication() |
| 63 | + |
| 64 | + # When / Then |
| 65 | + with pytest.raises(AuthenticationFailed): |
| 66 | + authenticator.authenticate(request) |
| 67 | + |
| 68 | + |
| 69 | +def test_brute_force_access_attempts(db: None, settings: SettingsWrapper) -> None: |
| 70 | + invalid_user_name = "invalid_user" |
| 71 | + login_attempts_to_make = settings.AXES_FAILURE_LIMIT + 1 |
| 72 | + |
| 73 | + assert AccessAttempt.objects.all().count() == 0 |
| 74 | + |
| 75 | + for _ in range(login_attempts_to_make): |
| 76 | + request = HttpRequest() |
| 77 | + authenticate(request, username=invalid_user_name, password="invalid_password") |
| 78 | + |
| 79 | + assert AccessAttempt.objects.filter(username=invalid_user_name).count() == 1 |
0 commit comments