summaryrefslogtreecommitdiff
path: root/service/test/unit/test_authentication.py
blob: cebb65436a8631f0db5d9eed59bb1e59b73071e8 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
from twisted.cred.error import UnauthorizedLogin
from twisted.internet.defer import inlineCallbacks
from twisted.trial import unittest

from leap.bitmask.bonafide._srp import SRPAuthError

from mock import patch, Mock

from pixelated.authentication import Authenticator
from pixelated.bitmask_libraries.provider import LeapProvider


PROVIDER_JSON = {
    "api_uri": "https://api.domain.org:4430",
    "api_version": "1",
    "ca_cert_fingerprint": "SHA256: some_stub_sha",
    "ca_cert_uri": "https://domain.org/ca.crt",
    "domain": "domain.org",
}


class AuthenticatorTest(unittest.TestCase):
    def setUp(self):
        with patch.object(LeapProvider, 'fetch_provider_json', return_value=PROVIDER_JSON):
            self._leap_provider = LeapProvider('domain.org')

    @inlineCallbacks
    def test_bonafide_srp_exceptions_should_raise_unauthorized_login(self):
        auth = Authenticator(self._leap_provider)
        mock_bonafide_session = Mock()
        mock_bonafide_session.authenticate = Mock(side_effect=SRPAuthError())
        with patch('pixelated.config.leap.Session', return_value=mock_bonafide_session):
            with self.assertRaises(UnauthorizedLogin):
                yield auth.authenticate('username', 'password')

    @inlineCallbacks
    def test_auth_username_with_domain_only_makes_bonafide_auth_with_username(self):
        auth = Authenticator(self._leap_provider)
        with patch('pixelated.authentication.authenticate') as mock_leap_authenticate:
            yield auth.authenticate('username@domain.org', 'password')
            mock_leap_authenticate.assert_called_once_with(self._leap_provider, 'username', 'password')

    def test_validate_username_accepts_username(self):
        auth = Authenticator(self._leap_provider)
        self.assertTrue(auth.validate_username('username'))

    def test_validate_username_accepts_email_address(self):
        auth = Authenticator(self._leap_provider)
        self.assertTrue(auth.validate_username('username@domain.org'))

    def test_validate_username_denies_other_domains(self):
        auth = Authenticator(self._leap_provider)
        self.assertFalse(auth.validate_username('username@wrongdomain.org'))

    def test_username_with_domain(self):
        auth = Authenticator(self._leap_provider)
        self.assertEqual('user@domain.org', auth.username_with_domain('user'))

    def test_extract_username_extracts_from_plain_username(self):
        auth = Authenticator(self._leap_provider)
        self.assertEqual(auth.extract_username('user'), 'user')

    def test_extract_username_extracts_from_email_address(self):
        auth = Authenticator(self._leap_provider)
        self.assertEqual(auth.extract_username('user@domain.org'), 'user')