bvandeusenandClaude Opus 5.5
f944cdb9b0
#5036 "SSO and LDAP: users keep their auth source, no merging into local accounts, is_active checked, LDAP TLS real and filter escaped". - users gain auth_source (local/ldap/oidc) and external_id (migration 0027). A provider account is found by (source, subject) only: the LDAP entry DN or the OIDC sub. A first sign-in whose username or email another account holds is refused with a message naming why; a disabled user stays out. - Local passwords sign in local accounts only. - LDAP: port 636 is LDAPS, otherwise StartTLS before any bind; the server certificate is checked against the system CAs or a CA pasted in Settings -> Auth. The login name is escaped into the filter (RFC 4515), and an empty password is refused before the directory sees it. - OIDC: the ID token must carry this sign-in's nonce and the userinfo sub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
2.4 KiB
Python
68 lines
2.4 KiB
Python
import pytest
|
|
import bcrypt
|
|
from unittest.mock import AsyncMock, patch
|
|
from steward.models.users import User, UserRole
|
|
|
|
|
|
def make_user(role=UserRole.admin):
|
|
return User(
|
|
id="test-id",
|
|
username="admin",
|
|
email="admin@example.com",
|
|
password_hash=bcrypt.hashpw(b"password", bcrypt.gensalt()).decode(),
|
|
role=role,
|
|
is_active=True,
|
|
auth_source="local",
|
|
)
|
|
|
|
|
|
async def with_csrf(client) -> dict:
|
|
"""Seed the session's forged-request token; returns the header to send."""
|
|
async with client.session_transaction() as sess:
|
|
sess["_csrf"] = "test-token"
|
|
return {"X-CSRF-Token": "test-token"}
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_page_returns_200(client):
|
|
response = await client.get("/login")
|
|
assert response.status_code == 200
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_redirects_to_setup_when_no_users(client, app):
|
|
with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=0)):
|
|
response = await client.get("/login")
|
|
assert response.status_code == 302
|
|
assert "/setup" in response.headers["Location"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_success_redirects_to_dashboard(client, app):
|
|
user = make_user()
|
|
headers = await with_csrf(client)
|
|
with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
|
|
patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
|
|
response = await client.post("/login", form={"username": "admin", "password": "password"},
|
|
headers=headers)
|
|
assert response.status_code == 302
|
|
assert "/" in response.headers["Location"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_failure_returns_400(client, app):
|
|
user = make_user()
|
|
headers = await with_csrf(client)
|
|
with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
|
|
patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
|
|
response = await client.post("/login", form={"username": "admin", "password": "wrong"},
|
|
headers=headers)
|
|
assert response.status_code == 400
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_require_role_redirects_unauthenticated(client):
|
|
response = await client.get("/")
|
|
assert response.status_code == 302
|
|
assert "/login" in response.headers["Location"]
|