from rest_framework import status from desecapi.models import Token from desecapi.tests.base import DomainOwnerTestCase class TokenPermittedTestCase(DomainOwnerTestCase): def setUp(self): super().setUp() self.token.perm_manage_tokens = True self.token.save() self.token2 = self.create_token(self.owner, name='testtoken') self.other_token = self.create_token(self.user) def test_token_last_used(self): self.assertIsNone(Token.objects.get(pk=self.token.id).last_used) self.client.get(self.reverse('v1:root')) self.assertIsNotNone(Token.objects.get(pk=self.token.id).last_used) def test_list_tokens(self): response = self.client.get(self.reverse('v1:token-list')) self.assertStatus(response, status.HTTP_200_OK) self.assertEqual(len(response.data), 2) self.assertIn('id', response.data[0]) self.assertFalse(any(field in response.data[0] for field in ['token', 'key', 'value'])) self.assertFalse(any(token.encode() in response.content for token in [self.token.plain, self.token2.plain])) self.assertNotContains(response, self.token.plain) def test_delete_my_token(self): token_id = Token.objects.get(user=self.owner, name='testtoken').id url = self.reverse('v1:token-detail', pk=token_id) response = self.client.delete(url) self.assertStatus(response, status.HTTP_204_NO_CONTENT) self.assertFalse(Token.objects.filter(pk=token_id).exists()) response = self.client.get(url) self.assertStatus(response, status.HTTP_404_NOT_FOUND) def test_retrieve_my_token(self): token_id = Token.objects.get(user=self.owner, name='testtoken').id url = self.reverse('v1:token-detail', pk=token_id) response = self.client.get(url) self.assertStatus(response, status.HTTP_200_OK) self.assertEqual( set(response.data.keys()), {'id', 'created', 'last_used', 'max_age', 'max_unused_period', 'name', 'perm_manage_tokens', 'allowed_subnets', 'is_valid'} ) self.assertFalse(any(token.encode() in response.content for token in [self.token.plain, self.token2.plain])) def test_retrieve_other_token(self): token_id = Token.objects.get(user=self.user).id url = self.reverse('v1:token-detail', pk=token_id) response = self.client.get(url) self.assertStatus(response, status.HTTP_404_NOT_FOUND) def test_update_my_token(self): url = self.reverse('v1:token-detail', pk=self.token.id) for method in [self.client.patch, self.client.put]: datas = [ {'name': method.__name__}, {'allowed_subnets': ['127.0.0.0/8']}, {'allowed_subnets': ['127.0.0.0/8', '::/0']}, {'max_age': '365 00:10:33.123456'}, {'max_age': None}, {'max_unused_period': '365 00:10:33.123456'}, {'max_unused_period': None}, ] for data in datas: response = method(url, data=data) self.assertStatus(response, status.HTTP_200_OK) for k, v in data.items(): self.assertEqual(response.data[k], v) # Revoke token management permission response = self.client.patch(url, data={'perm_manage_tokens': False}) self.assertStatus(response, status.HTTP_200_OK) # Verify that the change cannot be undone response = self.client.patch(url, data={'perm_manage_tokens': True}) self.assertStatus(response, status.HTTP_403_FORBIDDEN) def test_create_token(self): n = len(Token.objects.filter(user=self.owner).all()) datas = [ {}, {'name': '', 'perm_manage_tokens': True}, {'name': 'foobar'}, {'allowed_subnets': ['1.2.3.32/28', 'bade::affe/128']}, ] for data in datas: response = self.client.post(self.reverse('v1:token-list'), data=data) self.assertStatus(response, status.HTTP_201_CREATED) self.assertEqual( set(response.data.keys()), {'id', 'created', 'last_used', 'max_age', 'max_unused_period', 'name', 'perm_manage_tokens', 'allowed_subnets', 'is_valid', 'token'} ) self.assertEqual(response.data['name'], data.get('name', '')) self.assertEqual(response.data['allowed_subnets'], data.get('allowed_subnets', ['0.0.0.0/0', '::/0'])) self.assertEqual(response.data['perm_manage_tokens'], data.get('perm_manage_tokens', False)) self.assertIsNone(response.data['last_used']) self.assertEqual(len(Token.objects.filter(user=self.owner).all()), n + len(datas)) class TokenForbiddenTestCase(DomainOwnerTestCase): def setUp(self): super().setUp() self.token2 = self.create_token(self.owner, name='testtoken') self.other_token = self.create_token(self.user) def test_token_last_used(self): self.assertIsNone(Token.objects.get(pk=self.token.id).last_used) self.client.get(self.reverse('v1:root')) self.assertIsNotNone(Token.objects.get(pk=self.token.id).last_used) def test_list_tokens(self): response = self.client.get(self.reverse('v1:token-list')) self.assertStatus(response, status.HTTP_403_FORBIDDEN) def test_delete_my_token(self): for token_id in [Token.objects.get(user=self.owner, name='testtoken').id, self.token.id]: url = self.reverse('v1:token-detail', pk=token_id) response = self.client.delete(url) self.assertStatus(response, status.HTTP_403_FORBIDDEN) def test_retrieve_my_token(self): for token_id in [Token.objects.get(user=self.owner, name='testtoken').id, self.token.id]: url = self.reverse('v1:token-detail', pk=token_id) response = self.client.get(url) self.assertStatus(response, status.HTTP_403_FORBIDDEN) def test_retrieve_other_token(self): token_id = Token.objects.get(user=self.user).id url = self.reverse('v1:token-detail', pk=token_id) response = self.client.get(url) self.assertStatus(response, status.HTTP_403_FORBIDDEN) def test_update_my_token(self): url = self.reverse('v1:token-detail', pk=self.token.id) for method in [self.client.patch, self.client.put]: datas = [{'name': method.__name__}, {'allowed_subnets': ['127.0.0.0/8']}] for data in datas: response = method(url, data=data) self.assertStatus(response, status.HTTP_403_FORBIDDEN) def test_create_token(self): datas = [{}, {'name': ''}, {'name': 'foobar'}] for data in datas: response = self.client.post(self.reverse('v1:token-list'), data=data) self.assertStatus(response, status.HTTP_403_FORBIDDEN)