Add single-use identity password setup

identity-provisioner/tests/test_password_setup.py

@@ -0,0 +1,49 @@
+import pathlib
+import sys
+import unittest
+
+sys.path.insert(0, str(pathlib.Path(__file__).parents[1]))
+from password_setup import PasswordSetupGrants
+
+
+class PasswordSetupGrantTests(unittest.TestCase):
+    def setUp(self):
+        self.now = 100.0
+        self.calls = []
+        self.grants = PasswordSetupGrants(
+            public_url="https://kc.example/setup/password",
+            setter=lambda subject, password: self.calls.append((subject, password)),
+            ttl_seconds=60,
+            clock=lambda: self.now,
+        )
+
+    def token(self, url):
+        return url.partition("token=")[2]
+
+    def test_grant_is_single_use(self):
+        token = self.token(self.grants.issue("binky-admin"))
+        self.assertTrue(self.grants.valid(token))
+        self.grants.consume(token, "a-secure-password")
+        self.assertEqual([("binky-admin", "a-secure-password")], self.calls)
+        self.assertFalse(self.grants.valid(token))
+        with self.assertRaisesRegex(ValueError, "invalid or expired"):
+            self.grants.consume(token, "a-secure-password")
+
+    def test_new_grant_revokes_previous_subject_grant(self):
+        first = self.token(self.grants.issue("binky-admin"))
+        second = self.token(self.grants.issue("binky-admin"))
+        self.assertFalse(self.grants.valid(first))
+        self.assertTrue(self.grants.valid(second))
+
+    def test_expired_grant_fails_closed(self):
+        token = self.token(self.grants.issue("binky-admin"))
+        self.now = 161.0
+        self.assertFalse(self.grants.valid(token))
+        with self.assertRaisesRegex(ValueError, "invalid or expired"):
+            self.grants.consume(token, "a-secure-password")
+
+    def test_password_policy_precedes_consumption(self):
+        token = self.token(self.grants.issue("binky-admin"))
+        with self.assertRaisesRegex(ValueError, "12 characters"):
+            self.grants.consume(token, "too-short")
+        self.assertTrue(self.grants.valid(token))