Alec Perkins
1af217f6fb
Sign-in via django-allauth: emailed one-time codes, GitHub, Discord, and Forgejo instances as OpenID Connect apps registered in admin. Regular users never have a password; sysadmins sign in only at /admin/ and are redirected there from the normal sign-in. Organizations at the URL root with owner and collaborator roles, a per-member project-create grant, and invites by username or email. Email invites carry a bearer token stored only as a hash. The last owner can't leave, be removed or be demoted. Permission checks live in intent/access.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
import re
|
|
|
|
import pytest
|
|
from django.core import mail
|
|
from django.core.exceptions import ValidationError
|
|
from django.urls import reverse
|
|
|
|
from intent.accounts.validators import username_validators
|
|
|
|
|
|
def _sign_in_with_code(client, email):
|
|
client.post(reverse("account_request_login_code"), {"email": email})
|
|
code = re.search(r"^\s*([A-Z0-9-]{6,})\s*$", mail.outbox[-1].body, re.MULTILINE).group(1)
|
|
return client.post(reverse("account_confirm_login_code"), {"code": code})
|
|
|
|
|
|
def test_login_page_offers_code_not_password(client, db):
|
|
html = client.get(reverse("account_login")).content.decode()
|
|
assert 'type="password"' not in html
|
|
assert reverse("account_request_login_code") in html
|
|
|
|
|
|
def test_signup_has_no_password(client, db):
|
|
html = client.get(reverse("account_signup")).content.decode()
|
|
assert 'type="password"' not in html
|
|
|
|
|
|
def test_sign_in_with_emailed_code(client, make_user):
|
|
user = make_user("ada")
|
|
response = _sign_in_with_code(client, "ada@example.com")
|
|
assert response.status_code == 302
|
|
assert client.session["_auth_user_id"] == user.pk
|
|
|
|
|
|
def test_staff_cannot_sign_in_through_allauth(client, make_user):
|
|
make_user("root", is_staff=True)
|
|
response = _sign_in_with_code(client, "root@example.com")
|
|
assert response["Location"].startswith(reverse("admin:login"))
|
|
assert "_auth_user_id" not in client.session
|
|
|
|
|
|
@pytest.mark.parametrize("value", ["ada", "ada-lovelace", "a_1"])
|
|
def test_valid_usernames(value):
|
|
for validator in username_validators:
|
|
validator(value)
|
|
|
|
|
|
@pytest.mark.parametrize("value", ["ada@example.com", "-ada", "ada.l", "x" * 40])
|
|
def test_invalid_usernames(value):
|
|
with pytest.raises(ValidationError):
|
|
for validator in username_validators:
|
|
validator(value)
|