mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
84dfbd5884
The page where a user changes their own password and the one where an administrator sets a user's password shared an old card: a horizontal form, a blue Cancel and a green Change. The administrator's had Django's "Password-based authentication: Enabled/Disabled" with a paragraph about other backends, and its password fields stayed while Disabled was chosen. Both pages now have the user and group forms' layout, each its own template. The administrator chooses how the user signs in, With a password or Without a password (such as LDAP), and the password fields and "must change it" show only with a password; Cancel goes back to the user. A user's own page says that their other sessions end, or, when they must change it, that they choose one before going on, without a Cancel. A refused password is said at its field only, without the general "Wrong Data Provided". The section styles of these forms move into webvirtcloud.css.
157 lines
9.8 KiB
Python
157 lines
9.8 KiB
Python
"""The Users pages: an administrator cannot lock their own account out, the
|
||
user form says what its fields mean, and a password set by an administrator
|
||
can be one the user must change."""
|
||
|
||
from accounts.models import UserAttributes
|
||
from django.contrib.auth import get_user_model
|
||
from django.contrib.messages import get_messages
|
||
from django.test import TestCase
|
||
from django.urls import reverse
|
||
from lxml import html
|
||
|
||
|
||
class UserPagesTests(TestCase):
|
||
def setUp(self):
|
||
User = get_user_model()
|
||
self.admin = User.objects.create_superuser("up-admin", "up@example.com", "pw")
|
||
self.alice = User.objects.create_user("up-alice", password="Alice-pw-123")
|
||
UserAttributes.objects.get_or_create(user=self.alice)
|
||
self.client.force_login(self.admin)
|
||
|
||
def messages(self, response):
|
||
return [str(m) for m in get_messages(response.wsgi_request)]
|
||
|
||
def form_data(self, user, **changes):
|
||
data = {"username": user.username, "is_active": "on", "role": "superuser" if user.is_superuser else "user",
|
||
"max_instances": "2", "max_cpus": "2", "max_memory": "2", "max_disk_size": "20", **changes}
|
||
return {key: value for key, value in data.items() if value != ""}
|
||
|
||
def test_an_administrator_cannot_block_delete_or_demote_themselves(self):
|
||
own = self.admin.pk
|
||
for response in (self.client.post(reverse("admin:user_block", args=[own])),
|
||
self.client.post(reverse("admin:user_delete", args=[own]))):
|
||
self.assertIn("You cannot block, delete or demote your own account", self.messages(response))
|
||
for change in ({"role": "user"}, {"is_active": ""}):
|
||
response = self.client.post(reverse("admin:user_update", args=[own]), self.form_data(self.admin, **change))
|
||
self.assertContains(response, "You cannot block, delete or demote your own account")
|
||
self.admin.refresh_from_db()
|
||
self.assertTrue(self.admin.is_active and self.admin.is_superuser)
|
||
# another user's account is theirs to change
|
||
self.client.post(reverse("admin:user_block", args=[self.alice.pk]))
|
||
self.alice.refresh_from_db()
|
||
self.assertFalse(self.alice.is_active)
|
||
|
||
def test_the_form_tells_the_password_state_and_links_its_page(self):
|
||
page = html.fromstring(self.client.get(reverse("admin:user_update", args=[self.alice.pk])).content)
|
||
text = " ".join(page.text_content().split())
|
||
self.assertIn("Password Set Change password", text)
|
||
self.assertNotIn("No password set", text)
|
||
self.assertEqual(page.xpath("//a[normalize-space()='Change password']/@href"),
|
||
[reverse("admin:user_update_password", args=[self.alice.pk])])
|
||
self.assertEqual(page.xpath("//a[@href='../password/']"), [])
|
||
|
||
def test_roles_say_what_they_mean(self):
|
||
page = self.client.get(reverse("admin:user_update", args=[self.alice.pk])).content.decode()
|
||
self.assertIn("Template editor", page)
|
||
self.assertIn("May change and delete the template VMs given to them", page)
|
||
self.assertIn("Manages the panel: every permission, no quota.", page)
|
||
self.assertNotIn("log into this admin site", page)
|
||
|
||
def test_the_password_page_says_how_the_user_signs_in(self):
|
||
url = reverse("admin:user_update_password", args=[self.alice.pk])
|
||
page = self.client.get(url).content.decode()
|
||
self.assertIn("With a password", page)
|
||
self.assertIn("Signs in another way, such as LDAP. The current password is removed.", page)
|
||
self.assertIn(f'href="{reverse("admin:user_update", args=[self.alice.pk])}">Cancel', page)
|
||
# a mismatch is said at its field only
|
||
response = self.client.post(url, {"usable_password": "true", "password1": "Ab-123456x", "password2": "other"})
|
||
self.assertContains(response, "The two password fields didn’t match.")
|
||
self.assertNotIn("Wrong Data Provided", self.messages(response))
|
||
|
||
def test_a_refused_choice_is_said_beside_its_field(self):
|
||
url = reverse("admin:user_update", args=[self.alice.pk])
|
||
response = self.client.post(url, {"username": "up-alice", "is_active": "on", "groups": "99999", "user_permissions": "99999",
|
||
"role": "user", "max_instances": 1, "max_cpus": 1, "max_memory": 1, "max_disk_size": 1})
|
||
page = html.fromstring(response.content)
|
||
self.assertEqual(len(page.xpath("//fieldset//div[contains(@class, 'invalid-feedback')]")), 2)
|
||
|
||
def test_the_quota_shows_no_limit_and_memory_in_gib(self):
|
||
UserAttributes.objects.filter(user=self.alice).update(max_instances=-1, max_cpus=1, max_memory=1536, max_disk_size=-1)
|
||
page = html.fromstring(self.client.get(reverse("admin:user_update", args=[self.alice.pk])).content)
|
||
shown = {box.get("name"): (box.get("value"), box.get("disabled") is not None) for box in page.xpath("//input[@type='number']")}
|
||
self.assertEqual(shown, {"max_instances": ("", True), "max_cpus": ("1", False), "max_memory": ("1.5", False),
|
||
"max_disk_size": ("", True)})
|
||
self.assertEqual(page.xpath("//input[@checked][@data-no-limit]/@name"), ["max_instances_unlimited", "max_disk_size_unlimited"])
|
||
|
||
def test_a_new_user_starts_with_the_default_quota(self):
|
||
page = html.fromstring(self.client.get(reverse("admin:user_create")).content)
|
||
shown = {box.get("name"): box.get("value") for box in page.xpath("//input[@type='number']")}
|
||
self.assertEqual(shown, {"max_instances": "2", "max_cpus": "2", "max_memory": "2", "max_disk_size": "20"})
|
||
self.assertEqual(page.xpath("//input[@name='role'][@checked]/@value"), ["user"])
|
||
|
||
def test_no_limit_is_kept_as_minus_one_and_gib_as_mib(self):
|
||
response = self.client.post(reverse("admin:user_update", args=[self.alice.pk]),
|
||
self.form_data(self.alice, max_cpus_unlimited="on", max_memory="0.75"))
|
||
self.assertRedirects(response, reverse("admin:user_list"))
|
||
quota = UserAttributes.objects.get(user=self.alice)
|
||
self.assertEqual((quota.max_instances, quota.max_cpus, quota.max_memory, quota.max_disk_size), (2, -1, 768, 20))
|
||
|
||
def test_a_limit_needs_a_number_or_no_limit(self):
|
||
for value in ("", "-1"):
|
||
with self.subTest(value=value):
|
||
response = self.client.post(reverse("admin:user_update", args=[self.alice.pk]),
|
||
self.form_data(self.alice, max_cpus=value) | {"max_cpus": value})
|
||
self.assertEqual(response.status_code, 200)
|
||
self.assertEqual(len(html.fromstring(response.content).xpath("//input[@name='max_cpus'][contains(@class, 'is-invalid')]")), 1)
|
||
|
||
def test_a_role_sets_staff_and_superuser(self):
|
||
url = reverse("admin:user_update", args=[self.alice.pk])
|
||
for role, flags in (("template_editor", (True, False)), ("superuser", (True, True)), ("user", (False, False))):
|
||
with self.subTest(role=role):
|
||
self.assertRedirects(self.client.post(url, self.form_data(self.alice, role=role)), reverse("admin:user_list"))
|
||
self.alice.refresh_from_db()
|
||
self.assertEqual((self.alice.is_staff, self.alice.is_superuser), flags)
|
||
|
||
def test_a_missing_users_profile_is_not_found(self):
|
||
self.assertEqual(self.client.get(reverse("accounts:account", args=[99999])).status_code, 404)
|
||
|
||
def test_a_user_who_never_logged_in_says_never(self):
|
||
page = html.fromstring(self.client.get(reverse("admin:user_list")).content)
|
||
(row,) = page.xpath("//div[contains(@class, 'list-group-item')][.//a[normalize-space()='up-alice']]")
|
||
self.assertIn("Last login: never", " ".join(row.text_content().split()))
|
||
|
||
def test_the_search_finds_a_user_by_role_and_status(self):
|
||
self.alice.is_active = False
|
||
self.alice.save()
|
||
page = html.fromstring(self.client.get(reverse("admin:user_list")).content)
|
||
(row,) = page.xpath("//div[contains(@class, 'list-group-item')][.//a[normalize-space()='up-alice']]")
|
||
self.assertIn("User Blocked", row.get("data-search"))
|
||
|
||
def test_a_password_set_by_an_administrator_can_be_one_to_change(self):
|
||
url = reverse("admin:user_update_password", args=[self.alice.pk])
|
||
self.client.post(url, {"password1": "New-pw-4567x", "password2": "New-pw-4567x", "must_change_password": "on"})
|
||
self.assertTrue(UserAttributes.objects.get(user=self.alice).must_change_password)
|
||
# the user is sent to the change form until they choose their own
|
||
self.alice.refresh_from_db() # the new password's hash, or the session is not hers
|
||
self.client.force_login(self.alice)
|
||
self.assertRedirects(self.client.get(reverse("instances:index")), reverse("accounts:change_password"),
|
||
fetch_redirect_response=False)
|
||
self.client.force_login(self.admin)
|
||
self.client.post(url, {"password1": "New-pw-4567y", "password2": "New-pw-4567y"})
|
||
self.assertFalse(UserAttributes.objects.get(user=self.alice).must_change_password)
|
||
|
||
def test_a_user_without_a_password_cannot_be_made_to_change_it(self):
|
||
# the change form asks for the old password: one they never had
|
||
url = reverse("admin:user_update_password", args=[self.alice.pk])
|
||
response = self.client.post(url, {"usable_password": "false", "must_change_password": "on"})
|
||
self.assertContains(response, "A user without a password cannot be made to change it")
|
||
self.alice.refresh_from_db()
|
||
self.assertTrue(self.alice.has_usable_password())
|
||
|
||
def test_an_administrator_keeps_their_own_password(self):
|
||
url = reverse("admin:user_update_password", args=[self.admin.pk])
|
||
response = self.client.post(url, {"usable_password": "false"})
|
||
self.assertContains(response, "You cannot block, delete or demote your own account")
|
||
self.admin.refresh_from_db()
|
||
self.assertTrue(self.admin.has_usable_password())
|
||
|