Make public registration provisioning resumable

tests/test_web.py

@@ -271,6 +271,44 @@ class PortalApplicationTests(unittest.TestCase):
         )
         self.assertEqual("400 Bad Request", result["status"])
 
+    def test_public_registration_resumes_after_provider_outage(self):
+        verifier = FakeRegistrationVerification()
+        provisioning = FailingOnceProvisioning()
+        self.app.registration_verification = verifier
+        self.app.provisioning = provisioning
+        self.app.registration_clients = frozenset({"coulomb-social"})
+        self.app.registration_tenants = frozenset({"tenant:coulomb"})
+        self.app.registration_oidc_issuer = "https://kc.example"
+        self.app.registration_password_setup_origins = frozenset({"https://kc.example"})
+        invoke(self.app, "/api/v1/public/registrations", method="POST", body={
+            "username": "retry.person", "email": "retry@example.test",
+            "client_id": "coulomb-social", "tenant": "tenant:coulomb",
+        })
+        verifier.registration_id = verifier.requested.registration_id
+        pending, payload = invoke(
+            self.app, "/api/v1/public/registrations/verify", method="POST",
+            body={"handle": "x" * 32},
+        )
+        self.assertEqual("202 Accepted", pending["status"])
+        recovery = json.loads(payload)
+        resumed, _ = invoke(
+            self.app, "/api/v1/public/registrations/resume", method="POST",
+            body={"registration_id": recovery["registration_id"],
+                  "resume_handle": recovery["resume_handle"]},
+        )
+        self.assertEqual("303 See Other", resumed["status"])
+        self.assertEqual(2, len(provisioning.requests))
+        self.assertEqual(
+            provisioning.requests[0].idempotency_key,
+            provisioning.requests[1].idempotency_key,
+        )
+        replay, _ = invoke(
+            self.app, "/api/v1/public/registrations/resume", method="POST",
+            body={"registration_id": recovery["registration_id"],
+                  "resume_handle": recovery["resume_handle"]},
+        )
+        self.assertEqual("403 Forbidden", replay["status"])
+
     def test_public_registration_rejects_unregistered_client(self):
         self.app.registration_verification = FakeRegistrationVerification()
         self.app.registration_clients = frozenset({"coulomb-social"})
@@ -772,6 +810,19 @@ class FakeProvisioning:
         )
 
 
+class FailingOnceProvisioning(FakeProvisioning):
+    def provision(self, request):
+        self.requests.append(request)
+        if len(self.requests) == 1:
+            raise RuntimeError("provider unavailable")
+        return ProvisioningResult(
+            provider="netkingdom-lldap",
+            external_subject=request.preferred_username,
+            status="password_setup_required",
+            password_setup_url=self.password_setup_url,
+        )
+
+
 class FakeTenantManagement:
     def create_tenant(self, *, tenant, display_name, idempotency_key, correlation_id):
         return TenantProvisioningResult(tenant=tenant, status="created")