mediagoblin/tests/test_basic_auth.py

   1 # GNU MediaGoblin -- federated, autonomous media hosting
   2 # Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
   3 #
   4 # This program is free software: you can redistribute it and/or modify
   5 # it under the terms of the GNU Affero General Public License as published by
   6 # the Free Software Foundation, either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU Affero General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU Affero General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 import urlparse
  17
  18 from mediagoblin.db.models import User
  19 from mediagoblin.plugins.basic_auth import tools as auth_tools
  20 from mediagoblin.tests.tools import fixture_add_user
  21 from mediagoblin.tools import template
  22 from mediagoblin.tools.testing import _activate_testing
  23
  24 _activate_testing()
  25
  26
  27 ########################
  28 # Test bcrypt auth funcs
  29 ########################
  30
  31
  32 def test_bcrypt_check_password():
  33     # Check known 'lollerskates' password against check function
  34     assert auth_tools.bcrypt_check_password(
  35         'lollerskates',
  36         '$2a$12$PXU03zfrVCujBhVeICTwtOaHTUs5FFwsscvSSTJkqx/2RQ0Lhy/nO')
  37
  38     assert not auth_tools.bcrypt_check_password(
  39         'notthepassword',
  40         '$2a$12$PXU03zfrVCujBhVeICTwtOaHTUs5FFwsscvSSTJkqx/2RQ0Lhy/nO')
  41
  42     # Same thing, but with extra fake salt.
  43     assert not auth_tools.bcrypt_check_password(
  44         'notthepassword',
  45         '$2a$12$ELVlnw3z1FMu6CEGs/L8XO8vl0BuWSlUHgh0rUrry9DUXGMUNWwl6',
  46         '3><7R45417')
  47
  48
  49 def test_bcrypt_gen_password_hash():
  50     pw = 'youwillneverguessthis'
  51
  52     # Normal password hash generation, and check on that hash
  53     hashed_pw = auth_tools.bcrypt_gen_password_hash(pw)
  54     assert auth_tools.bcrypt_check_password(
  55         pw, hashed_pw)
  56     assert not auth_tools.bcrypt_check_password(
  57         'notthepassword', hashed_pw)
  58
  59     # Same thing, extra salt.
  60     hashed_pw = auth_tools.bcrypt_gen_password_hash(pw, '3><7R45417')
  61     assert auth_tools.bcrypt_check_password(
  62         pw, hashed_pw, '3><7R45417')
  63     assert not auth_tools.bcrypt_check_password(
  64         'notthepassword', hashed_pw, '3><7R45417')
  65
  66
  67 def test_change_password(test_app):
  68         """Test changing password correctly and incorrectly"""
  69         test_user = fixture_add_user(
  70             password=u'toast',
  71             privileges=[u'active'])
  72
  73         test_app.post(
  74             '/auth/login/', {
  75                 'username': u'chris',
  76                 'password': u'toast'})
  77
  78         # test that the password can be changed
  79         res = test_app.post(
  80             '/edit/password/', {
  81                 'old_password': 'toast',
  82                 'new_password': '123456',
  83                 })
  84         res.follow()
  85
  86         # Did we redirect to the correct page?
  87         assert urlparse.urlsplit(res.location)[2] == '/edit/account/'
  88
  89         # test_user has to be fetched again in order to have the current values
  90         test_user = User.query.filter_by(username=u'chris').first()
  91         assert auth_tools.bcrypt_check_password('123456', test_user.pw_hash)
  92
  93         # test that the password cannot be changed if the given
  94         # old_password is wrong
  95         template.clear_test_template_context()
  96         test_app.post(
  97             '/edit/password/', {
  98                 'old_password': 'toast',
  99                 'new_password': '098765',
 100                 })
 101
 102         test_user = User.query.filter_by(username=u'chris').first()
 103         assert not auth_tools.bcrypt_check_password('098765', test_user.pw_hash)