66 lines
2.2 KiB
Python
66 lines
2.2 KiB
Python
from datetime import UTC, datetime
|
|
|
|
import pytest
|
|
from httpx import AsyncClient
|
|
|
|
from porchlight.authn.password import PasswordHasher, PasswordService
|
|
from porchlight.models import PasswordCredential, User
|
|
from tests.conftest import get_csrf_token
|
|
|
|
|
|
async def _create_inactive_user_with_password(client: AsyncClient) -> None:
|
|
"""Create an inactive user with a password credential."""
|
|
app = client._transport.app
|
|
user_repo = app.state.user_repo
|
|
cred_repo = app.state.credential_repo
|
|
|
|
user = User(
|
|
userid="inactive-01",
|
|
username="inactive",
|
|
active=False,
|
|
created_at=datetime.now(UTC),
|
|
updated_at=datetime.now(UTC),
|
|
)
|
|
await user_repo.create(user)
|
|
|
|
svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192))
|
|
await cred_repo.create_password(
|
|
PasswordCredential(user_id=user.userid, password_hash=svc.hash("password123!Secure"))
|
|
)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_inactive_user_cannot_login_password(client: AsyncClient) -> None:
|
|
await _create_inactive_user_with_password(client)
|
|
token = await get_csrf_token(client)
|
|
|
|
response = await client.post(
|
|
"/login/password",
|
|
data={"username": "inactive", "password": "password123!Secure"},
|
|
headers={"HX-Request": "true", "X-CSRF-Token": token},
|
|
)
|
|
|
|
assert "Invalid username or password" in response.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_inactive_user_cannot_register_magic_link(client: AsyncClient) -> None:
|
|
"""If an inactive user exists, magic link registration should reject them."""
|
|
app = client._transport.app
|
|
user_repo = app.state.user_repo
|
|
magic_link_service = app.state.magic_link_service
|
|
|
|
user = User(
|
|
userid="inactive-02",
|
|
username="deactivated",
|
|
active=False,
|
|
created_at=datetime.now(UTC),
|
|
updated_at=datetime.now(UTC),
|
|
)
|
|
await user_repo.create(user)
|
|
|
|
link = await magic_link_service.create(username="deactivated", created_by="admin", note="test")
|
|
|
|
response = await client.get(f"/register/{link.token}", follow_redirects=False)
|
|
|
|
assert response.status_code == 400 or "deactivated" in response.text.lower() or "Invalid" in response.text
|