desec-stack/api/desecapi/tests/test_tokens.py

from rest_framework import status

from desecapi.models import Token
from desecapi.tests.base import DomainOwnerTestCase


class TokenPermittedTestCase(DomainOwnerTestCase):
    def setUp(self):
        super().setUp()
        self.token.perm_manage_tokens = True
        self.token.save()
        self.token2 = self.create_token(self.owner, name="testtoken")
        self.other_token = self.create_token(self.user)

    def test_token_last_used(self):
        self.assertIsNone(Token.objects.get(pk=self.token.id).last_used)
        self.client.get(self.reverse("v1:root"))
        self.assertIsNotNone(Token.objects.get(pk=self.token.id).last_used)

    def test_list_tokens(self):
        response = self.client.get(self.reverse("v1:token-list"))
        self.assertStatus(response, status.HTTP_200_OK)
        self.assertEqual(len(response.data), 2)
        self.assertIn("id", response.data[0])
        self.assertFalse(
            any(field in response.data[0] for field in ["token", "key", "value"])
        )
        self.assertFalse(
            any(
                token.encode() in response.content
                for token in [self.token.plain, self.token2.plain]
            )
        )
        self.assertNotContains(response, self.token.plain)

    def test_delete_my_token(self):
        token_id = Token.objects.get(user=self.owner, name="testtoken").id
        url = self.reverse("v1:token-detail", pk=token_id)

        response = self.client.delete(url)
        self.assertStatus(response, status.HTTP_204_NO_CONTENT)
        self.assertFalse(Token.objects.filter(pk=token_id).exists())

        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_404_NOT_FOUND)

    def test_retrieve_my_token(self):
        token_id = Token.objects.get(user=self.owner, name="testtoken").id
        url = self.reverse("v1:token-detail", pk=token_id)

        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_200_OK)
        self.assertEqual(
            set(response.data.keys()),
            {
                "id",
                "created",
                "last_used",
                "max_age",
                "max_unused_period",
                "name",
                "perm_manage_tokens",
                "allowed_subnets",
                "is_valid",
            },
        )
        self.assertFalse(
            any(
                token.encode() in response.content
                for token in [self.token.plain, self.token2.plain]
            )
        )

    def test_retrieve_other_token(self):
        token_id = Token.objects.get(user=self.user).id
        url = self.reverse("v1:token-detail", pk=token_id)

        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_404_NOT_FOUND)

    def test_update_my_token(self):
        url = self.reverse("v1:token-detail", pk=self.token.id)

        for method in [self.client.patch, self.client.put]:
            datas = [
                {"name": method.__name__},
                {"allowed_subnets": ["127.0.0.0/8"]},
                {"allowed_subnets": ["127.0.0.0/8", "::/0"]},
                {"max_age": "365 00:10:33.123456"},
                {"max_age": None},
                {"max_unused_period": "365 00:10:33.123456"},
                {"max_unused_period": None},
            ]
            for data in datas:
                response = method(url, data=data)
                self.assertStatus(response, status.HTTP_200_OK)
                for k, v in data.items():
                    self.assertEqual(response.data[k], v)

        # Revoke token management permission
        response = self.client.patch(url, data={"perm_manage_tokens": False})
        self.assertStatus(response, status.HTTP_200_OK)

        # Verify that the change cannot be undone
        response = self.client.patch(url, data={"perm_manage_tokens": True})
        self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_create_token(self):
        n = len(Token.objects.filter(user=self.owner).all())

        datas = [
            {},
            {"name": "", "perm_manage_tokens": True},
            {"name": "foobar"},
            {"allowed_subnets": ["1.2.3.32/28", "bade::affe/128"]},
        ]
        for data in datas:
            response = self.client.post(self.reverse("v1:token-list"), data=data)
            self.assertStatus(response, status.HTTP_201_CREATED)
            self.assertEqual(
                set(response.data.keys()),
                {
                    "id",
                    "created",
                    "last_used",
                    "max_age",
                    "max_unused_period",
                    "name",
                    "perm_manage_tokens",
                    "allowed_subnets",
                    "is_valid",
                    "token",
                },
            )
            self.assertEqual(response.data["name"], data.get("name", ""))
            self.assertEqual(
                response.data["allowed_subnets"],
                data.get("allowed_subnets", ["0.0.0.0/0", "::/0"]),
            )
            self.assertEqual(
                response.data["perm_manage_tokens"],
                data.get("perm_manage_tokens", False),
            )
            self.assertIsNone(response.data["last_used"])

        self.assertEqual(
            len(Token.objects.filter(user=self.owner).all()), n + len(datas)
        )


class TokenForbiddenTestCase(DomainOwnerTestCase):
    def setUp(self):
        super().setUp()
        self.token2 = self.create_token(self.owner, name="testtoken")
        self.other_token = self.create_token(self.user)

    def test_token_last_used(self):
        self.assertIsNone(Token.objects.get(pk=self.token.id).last_used)
        self.client.get(self.reverse("v1:root"))
        self.assertIsNotNone(Token.objects.get(pk=self.token.id).last_used)

    def test_list_tokens(self):
        response = self.client.get(self.reverse("v1:token-list"))
        self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_delete_my_token(self):
        for token_id in [
            Token.objects.get(user=self.owner, name="testtoken").id,
            self.token.id,
        ]:
            url = self.reverse("v1:token-detail", pk=token_id)
            response = self.client.delete(url)
            self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_retrieve_my_token(self):
        for token_id in [
            Token.objects.get(user=self.owner, name="testtoken").id,
            self.token.id,
        ]:
            url = self.reverse("v1:token-detail", pk=token_id)
            response = self.client.get(url)
            self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_retrieve_other_token(self):
        token_id = Token.objects.get(user=self.user).id
        url = self.reverse("v1:token-detail", pk=token_id)
        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_update_my_token(self):
        url = self.reverse("v1:token-detail", pk=self.token.id)
        for method in [self.client.patch, self.client.put]:
            datas = [{"name": method.__name__}, {"allowed_subnets": ["127.0.0.0/8"]}]
            for data in datas:
                response = method(url, data=data)
                self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_create_token(self):
        datas = [{}, {"name": ""}, {"name": "foobar"}]
        for data in datas:
            response = self.client.post(self.reverse("v1:token-list"), data=data)
            self.assertStatus(response, status.HTTP_403_FORBIDDEN)