49 lines
1.9 KiB
Python
49 lines
1.9 KiB
Python
import pathlib
|
|
import sys
|
|
import unittest
|
|
|
|
sys.path.insert(0, str(pathlib.Path(__file__).parents[1]))
|
|
from password_setup import PasswordSetupGrants
|
|
|
|
|
|
class PasswordSetupGrantTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.now = 100.0
|
|
self.calls = []
|
|
self.grants = PasswordSetupGrants(
|
|
public_url="https://kc.example/setup/password",
|
|
setter=lambda subject, password: self.calls.append((subject, password)),
|
|
ttl_seconds=60,
|
|
clock=lambda: self.now,
|
|
)
|
|
|
|
def token(self, url):
|
|
return url.partition("token=")[2]
|
|
|
|
def test_grant_is_single_use(self):
|
|
token = self.token(self.grants.issue("binky-admin"))
|
|
self.assertTrue(self.grants.valid(token))
|
|
self.grants.consume(token, "a-secure-password")
|
|
self.assertEqual([("binky-admin", "a-secure-password")], self.calls)
|
|
self.assertFalse(self.grants.valid(token))
|
|
with self.assertRaisesRegex(ValueError, "invalid or expired"):
|
|
self.grants.consume(token, "a-secure-password")
|
|
|
|
def test_new_grant_revokes_previous_subject_grant(self):
|
|
first = self.token(self.grants.issue("binky-admin"))
|
|
second = self.token(self.grants.issue("binky-admin"))
|
|
self.assertFalse(self.grants.valid(first))
|
|
self.assertTrue(self.grants.valid(second))
|
|
|
|
def test_expired_grant_fails_closed(self):
|
|
token = self.token(self.grants.issue("binky-admin"))
|
|
self.now = 161.0
|
|
self.assertFalse(self.grants.valid(token))
|
|
with self.assertRaisesRegex(ValueError, "invalid or expired"):
|
|
self.grants.consume(token, "a-secure-password")
|
|
|
|
def test_password_policy_precedes_consumption(self):
|
|
token = self.token(self.grants.issue("binky-admin"))
|
|
with self.assertRaisesRegex(ValueError, "12 characters"):
|
|
self.grants.consume(token, "too-short")
|
|
self.assertTrue(self.grants.valid(token))
|