mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
8c0fbff8f7
The Logs page shows who added, changed or deleted a compute, from web or API, and every login, failed login, lockout and logout, with the client address and a Result column (Done, Failed, Unknown for older rows). A failed change is recorded with its reason and the error still reaches the user; a refused one is recorded too. - logs.audit.write saves each row in its own savepoint and never raises, so a log write cannot break or undo the action it records. The audit() context manager writes one row when the change ends. - Logs gains success and ip; user, host and instance are wider and date is indexed. The page orders by date then id. - A compute edit names the changed fields; an edit that changes nothing writes no row, and an empty password field is no change. - A compute's VMs leaving the panel get a system row each: owners kept on the Removed VMs page, moved to another compute, restored, left without owners, or the removed record expired. - Job rows carry the result. A job's log entry that cannot be computed is logged and skipped instead of rolling back the finish (test_service.py changes this on purpose). - Logins are recorded by signal receivers; CustomLoginView is removed and the plain LoginView is used. A wrong OTP code is a failed login, counted by django-axes toward the lockout. Panel records and host-side objects follow in the next layers.
51 lines
2.2 KiB
Python
51 lines
2.2 KiB
Python
"""Logins, failed logins, lockouts and logouts write rows on the Logs page."""
|
|
|
|
from appsettings.models import AppSettings
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase, override_settings
|
|
from django.urls import reverse
|
|
|
|
from logs.models import Logs
|
|
|
|
|
|
def rows():
|
|
return list(Logs.objects.order_by("id").values_list("user", "host", "message", "success", "ip"))
|
|
|
|
|
|
@override_settings(OTP_ENABLED=False)
|
|
class LoginRowsTests(TestCase):
|
|
def setUp(self):
|
|
get_user_model().objects.create_user("bob", password="right-pass-1")
|
|
AppSettings.objects.filter(key="LOGIN_FAILURE_LIMIT").update(value="3")
|
|
|
|
def login(self, password, username="bob"):
|
|
return self.client.post(reverse("accounts:login"), {"username": username, "password": password})
|
|
|
|
def test_a_login_and_a_logout_write_rows(self):
|
|
self.assertEqual(self.login("right-pass-1").status_code, 302)
|
|
self.client.post(reverse("accounts:logout"))
|
|
self.assertEqual(rows(), [
|
|
("bob", "-", "Login", True, "127.0.0.1"),
|
|
("bob", "-", "Logout", True, "127.0.0.1"),
|
|
])
|
|
|
|
def test_a_failed_login_writes_the_typed_username(self):
|
|
self.assertEqual(self.login("wrong").status_code, 200)
|
|
self.assertEqual(rows(), [("bob", "-", "Login failed", False, "127.0.0.1")])
|
|
|
|
def test_an_empty_username_is_no_attempt(self):
|
|
# the form stops it before authentication: no row and no error
|
|
self.assertEqual(self.login("wrong", username="").status_code, 200)
|
|
self.assertEqual(rows(), [])
|
|
|
|
def test_the_attempt_at_the_limit_and_one_while_locked(self):
|
|
self.login("wrong")
|
|
self.login("wrong")
|
|
self.assertEqual(self.login("wrong").status_code, 429)
|
|
# django-axes sends the lockout from its own failure receiver, before ours
|
|
messages = [r[2] for r in rows()]
|
|
self.assertEqual(messages, ["Login failed", "Login failed", "Locked out", "Login failed"])
|
|
|
|
self.assertEqual(self.login("right-pass-1").status_code, 429)
|
|
self.assertEqual([r[2] for r in rows()][4:], ["Locked out", "Login failed"])
|
|
self.assertTrue(all(r[0] == "bob" and r[3] is False for r in rows()))
|