View | Details | Raw Unified | Return to bug 32739
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/password_validation.t (-61 / +94 lines)
Lines 18-24 Link Here
18
18
19
use Modern::Perl;
19
use Modern::Perl;
20
20
21
use Test::More tests => 6;
21
use Test::More tests => 4;
22
use Test::Mojo;
22
use Test::Mojo;
23
23
24
use t::lib::TestBuilder;
24
use t::lib::TestBuilder;
Lines 45-68 my $password = 'thePassword123'; Link Here
45
$librarian->set_password( { password => $password, skip_validation => 1 } );
45
$librarian->set_password( { password => $password, skip_validation => 1 } );
46
my $userid = $librarian->userid;
46
my $userid = $librarian->userid;
47
47
48
subtest 'password validation - success' => sub {
49
50
    plan tests => 3;
51
52
    $schema->storage->txn_begin;
53
54
    my $json = {
55
        "userid"   => $userid,
56
        "password" => $password,
57
    };
58
59
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
60
      ->status_is(204)
61
      ->content_is(q{});
62
63
    $schema->storage->txn_rollback;
64
};
65
66
subtest 'password validation - account lock out' => sub {
48
subtest 'password validation - account lock out' => sub {
67
49
68
    plan tests => 6;
50
    plan tests => 6;
Lines 72-79 subtest 'password validation - account lock out' => sub { Link Here
72
    t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
54
    t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
73
55
74
    my $json = {
56
    my $json = {
75
        "userid"   => $userid,
57
        identifier => $userid,
76
        "password" => "bad",
58
        password   => "bad",
77
    };
59
    };
78
60
79
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
61
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
Lines 89-172 subtest 'password validation - account lock out' => sub { Link Here
89
    $schema->storage->txn_rollback;
71
    $schema->storage->txn_rollback;
90
};
72
};
91
73
92
74
subtest 'password validation - unauthorized user' => sub {
93
subtest 'password validation - bad userid' => sub {
94
75
95
    plan tests => 3;
76
    plan tests => 3;
96
77
97
    $schema->storage->txn_begin;
78
    $schema->storage->txn_begin;
98
79
80
    my $patron = $builder->build_object(
81
        {
82
            class => 'Koha::Patrons',
83
            value => { flags => 2 ** 2 } # catalogue flag = 2
84
        }
85
    );
86
    my $password = 'thePassword123';
87
    $patron->set_password( { password => $password, skip_validation => 1 } );
88
    my $userid = $patron->userid;
89
99
    my $json = {
90
    my $json = {
100
        "userid"   => '1234567890abcdefghijklmnopqrstuvwxyz@koha-community.org',
91
        identifier => $userid,
101
        "password" => $password,
92
        password   => "test",
102
    };
93
    };
103
94
104
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
95
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
105
      ->status_is(400)
96
      ->status_is(403)
106
      ->json_is({ error => q{Validation failed} });
97
      ->json_is('/error' => 'Authorization failure. Missing required permission(s).');
107
98
108
    $schema->storage->txn_rollback;
99
    $schema->storage->txn_rollback;
109
};
100
};
110
101
111
subtest 'password validation - bad password' => sub {
102
subtest 'password validation - unauthenticated user' => sub {
112
113
    plan tests => 3;
103
    plan tests => 3;
114
104
115
    $schema->storage->txn_begin;
105
    $schema->storage->txn_begin;
116
106
117
    my $json = {
107
    my $json = {
118
        "userid"   => $userid,
108
        identifier => "banana",
119
        "password" => 'bad',
109
        password   => "test",
120
    };
110
    };
121
111
122
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
112
    $t->post_ok( "/api/v1/auth/password/validation" => json => $json )
123
      ->status_is(400)
113
      ->json_is( '/error' => 'Authentication failure.' )
124
      ->json_is({ error => q{Validation failed} });
114
      ->status_is(401);
125
115
126
    $schema->storage->txn_rollback;
116
    $schema->storage->txn_rollback;
127
};
117
};
128
118
129
subtest 'password validation - unauthorized user' => sub {
119
subtest 'Password validation - authorized requests tests' => sub {
130
120
131
    plan tests => 3;
121
    plan tests => 24;
132
122
133
    $schema->storage->txn_begin;
123
    $schema->storage->txn_begin;
134
124
135
    my $patron = $builder->build_object(
125
    # generate a random unused userid
136
        {
126
    my $patron_to_delete = $builder->build_object( { class => 'Koha::Patrons' } );
137
            class => 'Koha::Patrons',
127
138
            value => { flags => 2 ** 2 } # catalogue flag = 2
128
    my $deleted_userid     = $patron_to_delete->userid;
139
        }
129
    my $deleted_cardnumber = $patron_to_delete->cardnumber;
140
    );
130
141
    my $password = 'thePassword123';
131
    $patron_to_delete->delete;
142
    $patron->set_password( { password => $password, skip_validation => 1 } );
143
    my $userid = $patron->userid;
144
132
145
    my $json = {
133
    my $json = {
146
        "userid"   => $userid,
134
        identifier => $librarian->userid,
147
        "password" => "test",
135
        password   => $password,
148
    };
136
    };
149
137
150
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
138
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
151
      ->status_is(403)
139
      ->status_is(204, 'Validating using `cardnumber` works')
152
      ->json_is('/error' => 'Authorization failure. Missing required permission(s).');
140
      ->content_is(q{});
153
141
154
    $schema->storage->txn_rollback;
142
    $json = {
155
};
143
        identifier => $librarian->cardnumber,
144
        password   => $password,
145
    };
156
146
157
subtest 'password validation - unauthenticated user' => sub {
147
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
158
    plan tests => 3;
148
      ->status_is(204, 'Validating using `cardnumber` works')
149
      ->content_is(q{});
159
150
160
    $schema->storage->txn_begin;
151
    $json = {
152
        identifier => $deleted_cardnumber,
153
        password   => $password,
154
    };
161
155
162
    my $json = {
156
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
163
        "userid"   => "banana",
157
      ->status_is(400, 'Validating using and invalid identifier fails')
164
        "password" => "test",
158
      ->json_is({ error => 'Validation failed' });
159
160
    $json = {
161
        identifier => $deleted_userid,
162
        password   => $password,
165
    };
163
    };
166
164
167
    $t->post_ok( "/api/v1/auth/password/validation" => json => $json )
165
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
168
      ->json_is( '/error' => 'Authentication failure.' )
166
      ->status_is(400, 'Validating using and invalid identifier fails')
169
      ->status_is(401);
167
      ->json_is({ error => 'Validation failed' });
168
169
    $json = {
170
        password => $password,
171
        userid   => $deleted_userid,
172
    };
173
174
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
175
      ->status_is(400, 'Validating using and invalid userid fails')
176
      ->json_is({ error => 'Validation failed' });
177
178
    $json = {
179
        password => $password,
180
        userid   => $userid,
181
    };
182
183
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
184
      ->status_is(204, 'Validating using the `userid` attribute works')
185
      ->content_is(q{});
186
187
    $json = {
188
        password => $password,
189
        userid   => $librarian->cardnumber,
190
    };
191
192
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
193
        ->status_is( 400, 'Validating using a cardnumber as userid fails' )->json_is( { error => 'Validation failed' } );
194
195
    $json = {
196
        identifier => $userid,
197
        password   => $password,
198
        userid     => $userid,
199
    };
200
201
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
202
      ->status_is(400, 'Passing both parameters forbidden')
203
      ->json_is({ error => 'Bad request. Only one identifier attribute can be passed.' });
170
204
171
    $schema->storage->txn_rollback;
205
    $schema->storage->txn_rollback;
172
};
206
};
173
- 

Return to bug 32739