Add public registration browser journey

tests/test_web.py

@@ -1,5 +1,6 @@
 import io
 import json
+import re
 import unittest
 from dataclasses import replace
 from datetime import timedelta
@@ -29,7 +30,7 @@ SECRET = "test-proxy-secret-with-adequate-length"
 
 def invoke(
     app, path, *, method="GET", claims=None, marker=SECRET, body=None,
-    form=None, cookie=None, headers=None,
+    form=None, cookie=None, headers=None, query="",
 ):
     payload = (
         urlencode(form).encode()
@@ -39,7 +40,7 @@ def invoke(
     environ = {
         "REQUEST_METHOD": method,
         "PATH_INFO": path,
-        "QUERY_STRING": "",
+        "QUERY_STRING": query,
         "CONTENT_LENGTH": str(len(payload)),
         "wsgi.input": io.BytesIO(payload),
         "HTTP_X_REQUEST_ID": "corr_test",
@@ -239,6 +240,49 @@ class PortalApplicationTests(unittest.TestCase):
             provision.idempotency_key,
         )
 
+    def test_public_registration_browser_journey_uses_csrf_and_confirmation(self):
+        verifier = FakeRegistrationVerification()
+        self.app.registration_verification = verifier
+        self.app.provisioning = FakeProvisioning()
+        self.app.registration_clients = frozenset({"coulomb-social"})
+        self.app.registration_tenants = frozenset({"tenant:coulomb"})
+        self.app.registration_oidc_issuer = "https://kc.example"
+        self.app.registration_password_setup_origins = frozenset({"https://kc.example"})
+
+        page, html = invoke(self.app, "/register")
+        self.assertEqual("200 OK", page["status"])
+        self.assertIn(b"Create your account", html)
+        cookie = page["headers"]["Set-Cookie"]
+        token = re.search(rb'name="csrf_token" value="([^"]+)"', html).group(1).decode()
+        denied, _ = invoke(self.app, "/register", method="POST", form={
+            "csrf_token": "wrong", "username": "new.person",
+            "email": "new@example.test", "client_id": "coulomb-social",
+            "tenant": "tenant:coulomb",
+        }, cookie=cookie)
+        self.assertEqual("403 Forbidden", denied["status"])
+        started, html = invoke(self.app, "/register", method="POST", form={
+            "csrf_token": token, "username": "new.person",
+            "email": "new@example.test", "display_name": "New Person",
+            "client_id": "coulomb-social", "tenant": "tenant:coulomb",
+        }, cookie=cookie)
+        self.assertEqual("200 OK", started["status"])
+        self.assertIn(b"Check your email", html)
+
+        verifier.registration_id = verifier.requested.registration_id
+        confirmation, html = invoke(
+            self.app, "/registration/verify", query="handle=" + "x" * 32
+        )
+        self.assertEqual("200 OK", confirmation["status"])
+        self.assertIn(b"Verify and continue", html)
+        cookie = confirmation["headers"]["Set-Cookie"]
+        token = re.search(rb'name="csrf_token" value="([^"]+)"', html).group(1).decode()
+        completed, html = invoke(
+            self.app, "/registration/verify", method="POST", cookie=cookie,
+            form={"csrf_token": token, "handle": "x" * 32},
+        )
+        self.assertEqual("200 OK", completed["status"])
+        self.assertIn(b"Create password", html)
+
     def test_public_registration_rejects_untrusted_password_setup_origin(self):
         verifier = FakeRegistrationVerification()
         self.app.registration_verification = verifier