kitos
bbe7f49c86
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
- A lead opening a test with a pending procedure suggestion awaiting
their review now gets a blocking popup (approve/reject only) instead
of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
ever active at a time (no permission mixing) and a top-bar switcher
lets the user swap which one, taking effect immediately since role
is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
contract ({to, subject, body} with the platform's standard greeting
and signature template) and supports an admin-configured API key
sent as an x-api-key header.
160 lines
6.3 KiB
Python
160 lines
6.3 KiB
Python
"""End-to-end coverage for the passwordless user creation + emailed
|
|
set-password-link flow (also reused for password resets).
|
|
"""
|
|
|
|
import uuid
|
|
from unittest.mock import patch
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture
|
|
def new_user_id(api, auth_headers):
|
|
resp = api(
|
|
"post", "/api/v1/users", auth_headers,
|
|
json={"full_name": "Set Password User", "email": "setpw@test.com", "role": "viewer"},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
return resp.json()["id"]
|
|
|
|
|
|
def test_send_password_email_requires_webhook_configured(api, auth_headers, new_user_id):
|
|
resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
|
|
assert resp.status_code == 400
|
|
assert "webhook" in resp.text.lower()
|
|
|
|
|
|
def test_admin_can_configure_password_webhook(api, auth_headers):
|
|
resp = api(
|
|
"patch", "/api/v1/system/password-webhook-config", auth_headers,
|
|
json={"url": "https://example.com/power-automate-hook"},
|
|
)
|
|
assert resp.status_code == 200, resp.text
|
|
assert resp.json()["configured"] is True
|
|
|
|
get_resp = api("get", "/api/v1/system/password-webhook-config", auth_headers)
|
|
assert get_resp.json()["url"] == "https://example.com/power-automate-hook"
|
|
|
|
|
|
def test_admin_can_configure_webhook_api_key(api, auth_headers):
|
|
resp = api(
|
|
"patch", "/api/v1/system/password-webhook-config", auth_headers,
|
|
json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
|
|
)
|
|
assert resp.status_code == 200, resp.text
|
|
assert resp.json()["api_key_set"] is True
|
|
# The key itself is never echoed back.
|
|
assert "api_key" not in resp.json()
|
|
assert "super-secret-key" not in resp.text
|
|
|
|
|
|
def test_send_password_email_sends_api_key_header(api, db, auth_headers, new_user_id):
|
|
api(
|
|
"patch", "/api/v1/system/password-webhook-config", auth_headers,
|
|
json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
|
|
)
|
|
with patch("app.services.password_setup_service.requests.post") as mock_post:
|
|
api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
|
|
call_kwargs = mock_post.call_args
|
|
assert call_kwargs.kwargs["headers"] == {"x-api-key": "super-secret-key"}
|
|
|
|
|
|
def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_headers, new_user_id):
|
|
api(
|
|
"patch", "/api/v1/system/password-webhook-config", auth_headers,
|
|
json={"url": "https://example.com/power-automate-hook"},
|
|
)
|
|
|
|
with patch("app.services.password_setup_service.requests.post") as mock_post:
|
|
resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
|
|
assert resp.status_code == 200, resp.text
|
|
mock_post.assert_called_once()
|
|
call_kwargs = mock_post.call_args
|
|
assert call_kwargs.args[0] == "https://example.com/power-automate-hook"
|
|
payload = call_kwargs.kwargs["json"]
|
|
assert payload["to"] == "setpw@test.com"
|
|
assert payload["subject"] == "Set Your Password"
|
|
assert "HI Set Password User" in payload["body"]
|
|
assert "token=" in payload["body"]
|
|
assert "Purple Team Engineering" in payload["body"]
|
|
|
|
from app.models.password_setup_token import PasswordSetupToken
|
|
token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
|
|
assert token_row is not None
|
|
assert token_row.used_at is None
|
|
|
|
|
|
def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_id):
|
|
api(
|
|
"patch", "/api/v1/system/password-webhook-config", auth_headers,
|
|
json={"url": "https://example.com/power-automate-hook"},
|
|
)
|
|
with patch("app.services.password_setup_service.requests.post"):
|
|
api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
|
|
|
|
from app.models.password_setup_token import PasswordSetupToken
|
|
token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
|
|
|
|
validate = api("get", f"/api/v1/auth/set-password/validate?token={token_row.token}", {})
|
|
assert validate.status_code == 200
|
|
assert validate.json()["valid"] is True
|
|
assert validate.json()["full_name"] == "Set Password User"
|
|
|
|
resp = api(
|
|
"post", "/api/v1/auth/set-password", {},
|
|
json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
|
|
)
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
login = api(
|
|
"post", "/api/v1/auth/login", {},
|
|
data={"username": "setpw@test.com", "password": "BrandNewPass123!@#"},
|
|
)
|
|
assert login.status_code == 200, login.text
|
|
|
|
|
|
def test_set_password_token_cannot_be_reused(api, db, auth_headers, new_user_id):
|
|
api(
|
|
"patch", "/api/v1/system/password-webhook-config", auth_headers,
|
|
json={"url": "https://example.com/power-automate-hook"},
|
|
)
|
|
with patch("app.services.password_setup_service.requests.post"):
|
|
api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
|
|
|
|
from app.models.password_setup_token import PasswordSetupToken
|
|
token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
|
|
|
|
first = api(
|
|
"post", "/api/v1/auth/set-password", {},
|
|
json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
|
|
)
|
|
assert first.status_code == 200
|
|
|
|
second = api(
|
|
"post", "/api/v1/auth/set-password", {},
|
|
json={"token": token_row.token, "new_password": "AnotherPass456!@#"},
|
|
)
|
|
assert second.status_code == 400
|
|
|
|
|
|
def test_set_password_invalid_token_rejected(api):
|
|
validate = api("get", "/api/v1/auth/set-password/validate?token=not-a-real-token", {})
|
|
assert validate.status_code == 200
|
|
assert validate.json()["valid"] is False
|
|
|
|
resp = api(
|
|
"post", "/api/v1/auth/set-password", {},
|
|
json={"token": "not-a-real-token", "new_password": "BrandNewPass123!@#"},
|
|
)
|
|
assert resp.status_code == 404
|
|
|
|
|
|
def test_password_webhook_config_requires_admin(api, red_lead_headers):
|
|
resp = api("get", "/api/v1/system/password-webhook-config", red_lead_headers)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_send_password_email_requires_admin(api, red_lead_headers, new_user_id):
|
|
resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", red_lead_headers)
|
|
assert resp.status_code == 403
|