GitHub Social Login + Auth flow fixes. Password reset, email verification, etc.
This commit is contained in:
boris committed
1 parent
f7cf22f970
commit
921b760f80
23 files changed
+1087
-228
No files matched your search
@@ -1,11 +1,21 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from types import SimpleNamespace
|
||||
|
||||
from allauth.exceptions import ImmediateHttpResponse
|
||||
from django.contrib.auth.models import AnonymousUser
|
||||
from django.contrib.messages.storage.fallback import FallbackStorage
|
||||
from django.contrib.sessions.middleware import SessionMiddleware
|
||||
from django.contrib.auth import get_user_model
|
||||
from django.core.exceptions import ValidationError
|
||||
from django.test import TestCase
|
||||
from django.core import signing
|
||||
from django.test import RequestFactory, TestCase
|
||||
from django.urls import reverse
|
||||
|
||||
from apps.accounts.forms import NativePasswordResetForm
|
||||
from apps.accounts.identity import build_unique_username, normalize_email
|
||||
from apps.accounts.models import ExternalIdentity
|
||||
from apps.accounts.models import ExternalIdentity, NativeAccountSecurity
|
||||
from apps.accounts.social_auth import KeywardenSocialAccountAdapter
|
||||
|
||||
|
||||
class IdentityHelpersTests(TestCase):
|
||||
@@ -42,3 +52,222 @@ class ExternalIdentityTests(TestCase):
|
||||
email_at_link="charlie@example.com",
|
||||
)
|
||||
self.assertIn("corporate-sso", str(identity))
|
||||
|
||||
|
||||
class _DummySocialLogin:
|
||||
def __init__(
|
||||
self,
|
||||
*,
|
||||
email: str,
|
||||
provider: str = "github",
|
||||
uid: str = "subject-1",
|
||||
state: dict | None = None,
|
||||
is_existing: bool = False,
|
||||
existing_user=None,
|
||||
email_verified: bool = True,
|
||||
):
|
||||
self.account = SimpleNamespace(
|
||||
provider=provider,
|
||||
uid=uid,
|
||||
extra_data={"email": email, "name": "Test User"},
|
||||
)
|
||||
self.user = existing_user or SimpleNamespace(email=email, pk=None)
|
||||
self.state = state or {}
|
||||
self.is_existing = is_existing
|
||||
self.email_addresses = [SimpleNamespace(email=email, verified=email_verified)]
|
||||
self.connected_user = None
|
||||
|
||||
def connect(self, request, user) -> None:
|
||||
self.connected_user = user
|
||||
self.user = user
|
||||
self.is_existing = True
|
||||
|
||||
|
||||
class SocialAdapterTests(TestCase):
|
||||
def setUp(self):
|
||||
super().setUp()
|
||||
self.factory = RequestFactory()
|
||||
self.adapter = KeywardenSocialAccountAdapter()
|
||||
|
||||
def _request(self, *, user=None, path: str = "/accounts/sso/github/login/callback/"):
|
||||
request = self.factory.get(path)
|
||||
session_middleware = SessionMiddleware(lambda r: None)
|
||||
session_middleware.process_request(request)
|
||||
request.session.save()
|
||||
request._messages = FallbackStorage(request)
|
||||
request.user = user or AnonymousUser()
|
||||
return request
|
||||
|
||||
def test_login_requires_prelinked_github_identity(self):
|
||||
User = get_user_model()
|
||||
User.objects.create_user(username="social1", email="social1@example.com", password="pass12345")
|
||||
request = self._request()
|
||||
sociallogin = _DummySocialLogin(
|
||||
email="social1@example.com",
|
||||
state={"process": "login"},
|
||||
)
|
||||
|
||||
with self.assertRaises(ImmediateHttpResponse):
|
||||
self.adapter.pre_social_login(request, sociallogin)
|
||||
|
||||
self.assertFalse(
|
||||
ExternalIdentity.objects.filter(
|
||||
provider_type=ExternalIdentity.ProviderType.SOCIAL,
|
||||
provider_id="github",
|
||||
).exists()
|
||||
)
|
||||
|
||||
def test_connect_flow_links_github_to_current_user(self):
|
||||
User = get_user_model()
|
||||
user = User.objects.create_user(
|
||||
username="social2",
|
||||
email="social2@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
request = self._request(user=user)
|
||||
sociallogin = _DummySocialLogin(
|
||||
email="gh-social2@example.net",
|
||||
uid="github-sub-2",
|
||||
state={"process": "connect"},
|
||||
)
|
||||
|
||||
self.adapter.pre_social_login(request, sociallogin)
|
||||
|
||||
identity = ExternalIdentity.objects.get(
|
||||
provider_type=ExternalIdentity.ProviderType.SOCIAL,
|
||||
provider_id="github",
|
||||
subject="github-sub-2",
|
||||
)
|
||||
self.assertEqual(identity.user_id, user.id)
|
||||
self.assertEqual(identity.email_at_link, "gh-social2@example.net")
|
||||
self.assertEqual(sociallogin.connected_user, user)
|
||||
|
||||
def test_login_succeeds_when_github_identity_is_linked(self):
|
||||
User = get_user_model()
|
||||
user = User.objects.create_user(
|
||||
username="social3",
|
||||
email="social3@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
ExternalIdentity.objects.create(
|
||||
user=user,
|
||||
provider_type=ExternalIdentity.ProviderType.SOCIAL,
|
||||
provider_id="github",
|
||||
subject="github-sub-3",
|
||||
email_at_link="gh-social3@example.net",
|
||||
)
|
||||
request = self._request()
|
||||
sociallogin = _DummySocialLogin(
|
||||
email="gh-social3@example.net",
|
||||
uid="github-sub-3",
|
||||
state={"process": "login"},
|
||||
)
|
||||
|
||||
self.adapter.pre_social_login(request, sociallogin)
|
||||
|
||||
self.assertEqual(sociallogin.connected_user, user)
|
||||
identity = ExternalIdentity.objects.get(
|
||||
provider_type=ExternalIdentity.ProviderType.SOCIAL,
|
||||
provider_id="github",
|
||||
subject="github-sub-3",
|
||||
)
|
||||
self.assertIsNotNone(identity.last_login_at)
|
||||
|
||||
def test_connect_flow_allows_local_and_github_email_mismatch(self):
|
||||
User = get_user_model()
|
||||
user = User.objects.create_user(
|
||||
username="social4",
|
||||
email="social4@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
request = self._request(user=user)
|
||||
sociallogin = _DummySocialLogin(
|
||||
email="different@example.com",
|
||||
uid="github-sub-4",
|
||||
state={"process": "connect"},
|
||||
)
|
||||
|
||||
self.adapter.pre_social_login(request, sociallogin)
|
||||
identity = ExternalIdentity.objects.get(
|
||||
provider_type=ExternalIdentity.ProviderType.SOCIAL,
|
||||
provider_id="github",
|
||||
subject="github-sub-4",
|
||||
)
|
||||
self.assertEqual(identity.user_id, user.id)
|
||||
self.assertEqual(identity.email_at_link, "different@example.com")
|
||||
|
||||
|
||||
class NativePasswordResetFormTests(TestCase):
|
||||
def test_native_password_reset_excludes_sso_accounts(self):
|
||||
User = get_user_model()
|
||||
native_user = User.objects.create_user(
|
||||
username="native-user",
|
||||
email="native@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
sso_user = User.objects.create_user(
|
||||
username="sso-user",
|
||||
email="sso@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
ExternalIdentity.objects.create(
|
||||
user=sso_user,
|
||||
provider_type=ExternalIdentity.ProviderType.OIDC,
|
||||
provider_id="oidc",
|
||||
subject="oidc-subject",
|
||||
email_at_link="sso@example.com",
|
||||
)
|
||||
|
||||
native_form = NativePasswordResetForm(data={"email": "native@example.com"})
|
||||
self.assertTrue(native_form.is_valid())
|
||||
native_users = list(native_form.get_users("native@example.com"))
|
||||
self.assertEqual([user.pk for user in native_users], [native_user.pk])
|
||||
|
||||
sso_form = NativePasswordResetForm(data={"email": "sso@example.com"})
|
||||
self.assertTrue(sso_form.is_valid())
|
||||
sso_users = list(sso_form.get_users("sso@example.com"))
|
||||
self.assertEqual(sso_users, [])
|
||||
|
||||
|
||||
class NativeEmailVerificationTests(TestCase):
|
||||
def test_email_verification_marks_native_account_verified(self):
|
||||
User = get_user_model()
|
||||
user = User.objects.create_user(
|
||||
username="verify-native",
|
||||
email="verify-native@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
token = signing.dumps(
|
||||
{"uid": user.pk, "email": "verify-native@example.com"},
|
||||
salt="accounts.native-email-verification",
|
||||
)
|
||||
|
||||
response = self.client.get(reverse("accounts:email_verify", kwargs={"token": token}))
|
||||
self.assertEqual(response.status_code, 302)
|
||||
|
||||
security = NativeAccountSecurity.objects.get(user=user)
|
||||
self.assertTrue(security.email_verified)
|
||||
self.assertIsNotNone(security.email_verified_at)
|
||||
|
||||
def test_email_verification_does_not_verify_sso_account(self):
|
||||
User = get_user_model()
|
||||
user = User.objects.create_user(
|
||||
username="verify-sso",
|
||||
email="verify-sso@example.com",
|
||||
password="pass12345",
|
||||
)
|
||||
ExternalIdentity.objects.create(
|
||||
user=user,
|
||||
provider_type=ExternalIdentity.ProviderType.OIDC,
|
||||
provider_id="oidc",
|
||||
subject="sso-subject-verify",
|
||||
email_at_link="verify-sso@example.com",
|
||||
)
|
||||
token = signing.dumps(
|
||||
{"uid": user.pk, "email": "verify-sso@example.com"},
|
||||
salt="accounts.native-email-verification",
|
||||
)
|
||||
|
||||
response = self.client.get(reverse("accounts:email_verify", kwargs={"token": token}))
|
||||
self.assertEqual(response.status_code, 302)
|
||||
self.assertFalse(NativeAccountSecurity.objects.filter(user=user).exists())
|
||||
Reference in new issue
Block a user