desec-stack/api/desecapi/tests/test_tokens.py

from ipaddress import IPv4Network

from rest_framework import status

from desecapi.models import Token
from desecapi.tests.base import DomainOwnerTestCase


class TokenPermittedTestCase(DomainOwnerTestCase):

    def setUp(self):
        super().setUp()
        self.token.perm_manage_tokens = True
        self.token.save()
        self.token2 = self.create_token(self.owner, name='testtoken')
        self.other_token = self.create_token(self.user)

    def test_token_last_used(self):
        self.assertIsNone(Token.objects.get(pk=self.token.id).last_used)
        self.client.get(self.reverse('v1:root'))
        self.assertIsNotNone(Token.objects.get(pk=self.token.id).last_used)

    def test_list_tokens(self):
        response = self.client.get(self.reverse('v1:token-list'))
        self.assertStatus(response, status.HTTP_200_OK)
        self.assertEqual(len(response.data), 2)
        self.assertIn('id', response.data[0])
        self.assertFalse(any(field in response.data[0] for field in ['token', 'key', 'value']))
        self.assertFalse(any(token.encode() in response.content for token in [self.token.plain, self.token2.plain]))
        self.assertNotContains(response, self.token.plain)

    def test_delete_my_token(self):
        token_id = Token.objects.get(user=self.owner, name='testtoken').id
        url = self.reverse('v1:token-detail', pk=token_id)

        response = self.client.delete(url)
        self.assertStatus(response, status.HTTP_204_NO_CONTENT)
        self.assertFalse(Token.objects.filter(pk=token_id).exists())

        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_404_NOT_FOUND)

    def test_retrieve_my_token(self):
        token_id = Token.objects.get(user=self.owner, name='testtoken').id
        url = self.reverse('v1:token-detail', pk=token_id)

        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_200_OK)
        self.assertEqual(
            set(response.data.keys()),
            {'id', 'created', 'last_used', 'max_age', 'max_unused_period', 'name', 'perm_manage_tokens',
             'allowed_subnets', 'is_valid'}
        )
        self.assertFalse(any(token.encode() in response.content for token in [self.token.plain, self.token2.plain]))

    def test_retrieve_other_token(self):
        token_id = Token.objects.get(user=self.user).id
        url = self.reverse('v1:token-detail', pk=token_id)

        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_404_NOT_FOUND)

    def test_update_my_token(self):
        url = self.reverse('v1:token-detail', pk=self.token.id)

        for method in [self.client.patch, self.client.put]:
            datas = [
                {'name': method.__name__},
                {'allowed_subnets': ['127.0.0.0/8']},
                {'allowed_subnets': ['127.0.0.0/8', '::/0']},
                {'max_age': '365 00:10:33.123456'},
                {'max_age': None},
                {'max_unused_period': '365 00:10:33.123456'},
                {'max_unused_period': None},
            ]
            for data in datas:
                response = method(url, data=data)
                self.assertStatus(response, status.HTTP_200_OK)
                for k, v in data.items():
                    self.assertEqual(response.data[k], v)

        # Revoke token management permission
        response = self.client.patch(url, data={'perm_manage_tokens': False})
        self.assertStatus(response, status.HTTP_200_OK)

        # Verify that the change cannot be undone
        response = self.client.patch(url, data={'perm_manage_tokens': True})
        self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_create_token(self):
        n = len(Token.objects.filter(user=self.owner).all())

        datas = [
            {},
            {'name': '', 'perm_manage_tokens': True},
            {'name': 'foobar'},
            {'allowed_subnets': ['1.2.3.32/28', 'bade::affe/128']},
        ]
        for data in datas:
            response = self.client.post(self.reverse('v1:token-list'), data=data)
            self.assertStatus(response, status.HTTP_201_CREATED)
            self.assertEqual(
                set(response.data.keys()),
                {'id', 'created', 'last_used', 'max_age', 'max_unused_period', 'name', 'perm_manage_tokens',
                 'allowed_subnets', 'is_valid', 'token'}
            )
            self.assertEqual(response.data['name'], data.get('name', ''))
            self.assertEqual(response.data['allowed_subnets'], data.get('allowed_subnets', ['0.0.0.0/0', '::/0']))
            self.assertEqual(response.data['perm_manage_tokens'], data.get('perm_manage_tokens', False))
            self.assertIsNone(response.data['last_used'])

        self.assertEqual(len(Token.objects.filter(user=self.owner).all()), n + len(datas))


class TokenForbiddenTestCase(DomainOwnerTestCase):

    def setUp(self):
        super().setUp()
        self.token2 = self.create_token(self.owner, name='testtoken')
        self.other_token = self.create_token(self.user)

    def test_token_last_used(self):
        self.assertIsNone(Token.objects.get(pk=self.token.id).last_used)
        self.client.get(self.reverse('v1:root'))
        self.assertIsNotNone(Token.objects.get(pk=self.token.id).last_used)

    def test_list_tokens(self):
        response = self.client.get(self.reverse('v1:token-list'))
        self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_delete_my_token(self):
        for token_id in [Token.objects.get(user=self.owner, name='testtoken').id, self.token.id]:
            url = self.reverse('v1:token-detail', pk=token_id)
            response = self.client.delete(url)
            self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_retrieve_my_token(self):
        for token_id in [Token.objects.get(user=self.owner, name='testtoken').id, self.token.id]:
            url = self.reverse('v1:token-detail', pk=token_id)
            response = self.client.get(url)
            self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_retrieve_other_token(self):
        token_id = Token.objects.get(user=self.user).id
        url = self.reverse('v1:token-detail', pk=token_id)
        response = self.client.get(url)
        self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_update_my_token(self):
        url = self.reverse('v1:token-detail', pk=self.token.id)
        for method in [self.client.patch, self.client.put]:
            datas = [{'name': method.__name__}, {'allowed_subnets': ['127.0.0.0/8']}]
            for data in datas:
                response = method(url, data=data)
                self.assertStatus(response, status.HTTP_403_FORBIDDEN)

    def test_create_token(self):
        datas = [{}, {'name': ''}, {'name': 'foobar'}]
        for data in datas:
            response = self.client.post(self.reverse('v1:token-list'), data=data)
            self.assertStatus(response, status.HTTP_403_FORBIDDEN)