Server IP : 85.214.239.14 / Your IP : 18.222.179.96 Web Server : Apache/2.4.62 (Debian) System : Linux h2886529.stratoserver.net 4.9.0 #1 SMP Tue Jan 9 19:45:01 MSK 2024 x86_64 User : www-data ( 33) PHP Version : 7.4.18 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : OFF | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : OFF Directory : /proc/3/task/3/cwd/lib/python3/dist-packages/passlib/tests/ |
Upload File : |
"""test passlib.ext.django""" #============================================================================= # imports #============================================================================= # core from __future__ import absolute_import, division, print_function import logging; log = logging.getLogger(__name__) import sys import re # site # pkg from passlib import apps as _apps, exc, registry from passlib.apps import django10_context, django14_context, django16_context from passlib.context import CryptContext from passlib.ext.django.utils import ( DJANGO_VERSION, MIN_DJANGO_VERSION, DjangoTranslator, quirks, ) from passlib.utils.compat import iteritems, get_method_function, u from passlib.utils.decor import memoized_property # tests from passlib.tests.utils import TestCase, TEST_MODE, handler_derived_from from passlib.tests.test_handlers import get_handler_case # local __all__ = [ "DjangoBehaviorTest", "ExtensionBehaviorTest", "DjangoExtensionTest", "_ExtensionSupport", "_ExtensionTest", ] #============================================================================= # configure django settings for testcases #============================================================================= # whether we have supported django version has_min_django = DJANGO_VERSION >= MIN_DJANGO_VERSION # import and configure empty django settings # NOTE: we don't want to set up entirety of django, so not using django.setup() directly. # instead, manually configuring the settings, and setting it up w/ no apps installed. # in future, may need to alter this so we call django.setup() after setting # DJANGO_SETTINGS_MODULE to a custom settings module w/ a dummy django app. if has_min_django: # # initialize django settings manually # from django.conf import settings, LazySettings if not isinstance(settings, LazySettings): # this probably means django globals have been configured already, # which we don't want, since test cases reset and manipulate settings. raise RuntimeError("expected django.conf.settings to be LazySettings: %r" % (settings,)) # else configure a blank settings instance for the unittests if not settings.configured: settings.configure() # # init django apps w/ NO installed apps. # NOTE: required for django >= 1.9 # from django.apps import apps apps.populate(["django.contrib.contenttypes", "django.contrib.auth"]) # log a warning if tested w/ newer version. # NOTE: this is mainly here as place to mark what version it was run against before release. if DJANGO_VERSION >= (3, 2): log.info("this release hasn't been tested against Django %r", DJANGO_VERSION) #============================================================================= # support funcs #============================================================================= # flag for update_settings() to remove specified key entirely UNSET = object() def update_settings(**kwds): """helper to update django settings from kwds""" for k,v in iteritems(kwds): if v is UNSET: if hasattr(settings, k): delattr(settings, k) else: setattr(settings, k, v) if has_min_django: from django.contrib.auth.models import User class FakeUser(User): """mock user object for use in testing""" # NOTE: this mainly just overrides .save() to test commit behavior. # NOTE: .Meta.app_label required for django >= 1.9 class Meta: app_label = __name__ @memoized_property def saved_passwords(self): return [] def pop_saved_passwords(self): try: return self.saved_passwords[:] finally: del self.saved_passwords[:] def save(self, update_fields=None): # NOTE: ignoring update_fields for test purposes self.saved_passwords.append(self.password) def create_mock_setter(): state = [] def setter(password): state.append(password) def popstate(): try: return state[:] finally: del state[:] setter.popstate = popstate return setter def check_django_hasher_has_backend(name): """ check whether django hasher is available; or if it should be skipped because django lacks third-party library. """ assert name from django.contrib.auth.hashers import make_password try: make_password("", hasher=name) return True except ValueError as err: if re.match("Couldn't load '.*?' algorithm .* No module named .*", str(err)): return False raise #============================================================================= # work up stock django config #============================================================================= def _modify_django_config(kwds, sha_rounds=None): """ helper to build django CryptContext config matching expected setup for stock django deploy. :param kwds: :param sha_rounds: :return: """ # make sure we have dict if hasattr(kwds, "to_dict"): # type: CryptContext kwds = kwds.to_dict() # update defaults kwds.update( # TODO: push this to passlib.apps django contexts deprecated="auto", ) # fill in default rounds for current django version, so our sample hashes come back # unchanged, instead of being upgraded in-place by check_password(). if sha_rounds is None and has_min_django: from django.contrib.auth.hashers import PBKDF2PasswordHasher sha_rounds = PBKDF2PasswordHasher.iterations # modify rounds if sha_rounds: kwds.update( django_pbkdf2_sha1__default_rounds=sha_rounds, django_pbkdf2_sha256__default_rounds=sha_rounds, ) return kwds #---------------------------------------------------- # build config dict that matches stock django #---------------------------------------------------- # XXX: replace this with code that interrogates default django config directly? # could then separate out "validation of djangoXX_context objects" # and "validation that individual hashers match django". # or maybe add a "get_django_context(django_version)" helper to passlib.apps? if DJANGO_VERSION >= (2, 1): stock_config = _modify_django_config(_apps.django21_context) elif DJANGO_VERSION >= (1, 10): stock_config = _modify_django_config(_apps.django110_context) else: # assert DJANGO_VERSION >= (1, 8) stock_config = _modify_django_config(_apps.django16_context) #---------------------------------------------------- # override sample hashes used in test cases #---------------------------------------------------- from passlib.hash import django_pbkdf2_sha256 sample_hashes = dict( django_pbkdf2_sha256=("not a password", django_pbkdf2_sha256 .using(rounds=stock_config.get("django_pbkdf2_sha256__default_rounds")) .hash("not a password")) ) #============================================================================= # test utils #============================================================================= class _ExtensionSupport(object): """ test support funcs for loading/unloading extension. this class is mixed in to various TestCase subclasses. """ #=================================================================== # support funcs #=================================================================== @classmethod def _iter_patch_candidates(cls): """helper to scan for monkeypatches. returns tuple containing: * object (module or class) * attribute of object * value of attribute * whether it should or should not be patched """ # XXX: this and assert_unpatched() could probably be refactored to use # the PatchManager class to do the heavy lifting. from django.contrib.auth import models, hashers user_attrs = ["check_password", "set_password"] model_attrs = ["check_password", "make_password"] hasher_attrs = ["check_password", "make_password", "get_hasher", "identify_hasher", "get_hashers"] objs = [(models, model_attrs), (models.User, user_attrs), (hashers, hasher_attrs), ] for obj, patched in objs: for attr in dir(obj): if attr.startswith("_"): continue value = obj.__dict__.get(attr, UNSET) # can't use getattr() due to GAE if value is UNSET and attr not in patched: continue value = get_method_function(value) source = getattr(value, "__module__", None) if source: yield obj, attr, source, (attr in patched) #=================================================================== # verify current patch state #=================================================================== def assert_unpatched(self): """ test that django is in unpatched state """ # make sure we aren't currently patched mod = sys.modules.get("passlib.ext.django.models") self.assertFalse(mod and mod.adapter.patched, "patch should not be enabled") # make sure no objects have been replaced, by checking __module__ for obj, attr, source, patched in self._iter_patch_candidates(): if patched: self.assertTrue(source.startswith("django.contrib.auth."), "obj=%r attr=%r was not reverted: %r" % (obj, attr, source)) else: self.assertFalse(source.startswith("passlib."), "obj=%r attr=%r should not have been patched: %r" % (obj, attr, source)) def assert_patched(self, context=None): """ helper to ensure django HAS been patched, and is using specified config """ # make sure we're currently patched mod = sys.modules.get("passlib.ext.django.models") self.assertTrue(mod and mod.adapter.patched, "patch should have been enabled") # make sure only the expected objects have been patched for obj, attr, source, patched in self._iter_patch_candidates(): if patched: self.assertTrue(source == "passlib.ext.django.utils", "obj=%r attr=%r should have been patched: %r" % (obj, attr, source)) else: self.assertFalse(source.startswith("passlib."), "obj=%r attr=%r should not have been patched: %r" % (obj, attr, source)) # check context matches if context is not None: context = CryptContext._norm_source(context) self.assertEqual(mod.password_context.to_dict(resolve=True), context.to_dict(resolve=True)) #=================================================================== # load / unload the extension (and verify it worked) #=================================================================== _config_keys = ["PASSLIB_CONFIG", "PASSLIB_CONTEXT", "PASSLIB_GET_CATEGORY"] def load_extension(self, check=True, **kwds): """ helper to load extension with specified config & patch django """ self.unload_extension() if check: config = kwds.get("PASSLIB_CONFIG") or kwds.get("PASSLIB_CONTEXT") for key in self._config_keys: kwds.setdefault(key, UNSET) update_settings(**kwds) import passlib.ext.django.models if check: self.assert_patched(context=config) def unload_extension(self): """ helper to remove patches and unload extension """ # remove patches and unload module mod = sys.modules.get("passlib.ext.django.models") if mod: mod.adapter.remove_patch() del sys.modules["passlib.ext.django.models"] # wipe config from django settings update_settings(**dict((key, UNSET) for key in self._config_keys)) # check everything's gone self.assert_unpatched() #=================================================================== # eoc #=================================================================== # XXX: rename to ExtensionFixture? # NOTE: would roll this into _ExtensionSupport class; # but we have to mix that one into django's TestCase classes as well; # and our TestCase class (and this setUp() method) would foul things up. class _ExtensionTest(TestCase, _ExtensionSupport): """ TestCase mixin which makes sure extension is unloaded before test; and make sure it's unloaded after test as well. """ #============================================================================= # setup #============================================================================= def setUp(self): super(_ExtensionTest, self).setUp() self.require_TEST_MODE("default") if not DJANGO_VERSION: raise self.skipTest("Django not installed") elif not has_min_django: raise self.skipTest("Django version too old") # reset to baseline, and verify it worked self.unload_extension() # and do the same when the test exits self.addCleanup(self.unload_extension) #============================================================================= # eoc #============================================================================= #============================================================================= # extension tests #============================================================================= #: static passwords used by DjangoBehaviorTest methods PASS1 = "toomanysecrets" WRONG1 = "letmein" class DjangoBehaviorTest(_ExtensionTest): """ tests model to verify it matches django's behavior. running this class verifies the tests correctly assert what Django itself does. running the ExtensionBehaviorTest subclass below verifies "passlib.ext.django" matches what the tests assert. """ #============================================================================= # class attrs #============================================================================= descriptionPrefix = "verify django behavior" #: tracks whether tests should assume "passlib.ext.django" monkeypatch is applied. #: (set to True by ExtensionBehaviorTest subclass) patched = False #: dict containing CryptContext() config which should match current django deploy. #: used by tests to verify expected behavior. config = stock_config # NOTE: if this test fails, it means we're not accounting for # some part of django's hashing logic, or that this is # running against an untested version of django with a new # hashing policy. #============================================================================= # test helpers #============================================================================= @memoized_property def context(self): """ per-test CryptContext() created from .config. """ return CryptContext._norm_source(self.config) def assert_unusable_password(self, user): """ check that user object is set to 'unusable password' constant """ self.assertTrue(user.password.startswith("!")) self.assertFalse(user.has_usable_password()) self.assertEqual(user.pop_saved_passwords(), []) def assert_valid_password(self, user, hash=UNSET, saved=None): """ check that user object has a usable password hash. :param hash: optionally check it has this exact hash :param saved: check that mock commit history for user.password matches this list """ if hash is UNSET: self.assertNotEqual(user.password, "!") self.assertNotEqual(user.password, None) else: self.assertEqual(user.password, hash) self.assertTrue(user.has_usable_password(), "hash should be usable: %r" % (user.password,)) self.assertEqual(user.pop_saved_passwords(), [] if saved is None else [saved]) #============================================================================= # test hashing interface #----------------------------------------------------------------------------- # these functions are run against both the actual django code, # to verify the assumptions of the unittests are correct; # and run against the passlib extension, to verify it matches those assumptions. # # these tests check the following django methods: # User.set_password() # User.check_password() # make_password() -- 1.4 only # check_password() # identify_hasher() # User.has_usable_password() # User.set_unusable_password() # # XXX: this take a while to run. what could be trimmed? # # TODO: add get_hasher() checks where appropriate in tests below. #============================================================================= def test_extension_config(self): """ test extension config is loaded correctly """ if not self.patched: raise self.skipTest("extension not loaded") ctx = self.context # contexts should match from django.contrib.auth.hashers import check_password from passlib.ext.django.models import password_context self.assertEqual(password_context.to_dict(resolve=True), ctx.to_dict(resolve=True)) # should have patched both places from django.contrib.auth.models import check_password as check_password2 self.assertEqual(check_password2, check_password) def test_default_algorithm(self): """ test django's default algorithm """ ctx = self.context # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import make_password # User.set_password() should use default alg user = FakeUser() user.set_password(PASS1) self.assertTrue(ctx.handler().verify(PASS1, user.password)) self.assert_valid_password(user) # User.check_password() - n/a # make_password() should use default alg hash = make_password(PASS1) self.assertTrue(ctx.handler().verify(PASS1, hash)) # check_password() - n/a def test_empty_password(self): """ test how methods handle empty string as password """ ctx = self.context # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import ( check_password, make_password, is_password_usable, identify_hasher, ) # User.set_password() should use default alg user = FakeUser() user.set_password('') hash = user.password self.assertTrue(ctx.handler().verify('', hash)) self.assert_valid_password(user, hash) # User.check_password() should return True self.assertTrue(user.check_password("")) self.assert_valid_password(user, hash) # XXX: test make_password() ? # TODO: is_password_usable() # identify_hasher() -- na # check_password() should return True self.assertTrue(check_password("", hash)) def test_unusable_flag(self): """ test how methods handle 'unusable flag' in hash """ # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import ( check_password, make_password, is_password_usable, identify_hasher, ) # sanity check via user.set_unusable_password() user = FakeUser() user.set_unusable_password() self.assert_unusable_password(user) # ensure User.set_password() sets unusable flag user = FakeUser() user.set_password(None) self.assert_unusable_password(user) # User.check_password() should always fail self.assertFalse(user.check_password(None)) self.assertFalse(user.check_password('None')) self.assertFalse(user.check_password('')) self.assertFalse(user.check_password(PASS1)) self.assertFalse(user.check_password(WRONG1)) self.assert_unusable_password(user) # make_password() should also set flag self.assertTrue(make_password(None).startswith("!")) # check_password() should return False (didn't handle disabled under 1.3) self.assertFalse(check_password(PASS1, '!')) # identify_hasher() and is_password_usable() should reject it self.assertFalse(is_password_usable(user.password)) self.assertRaises(ValueError, identify_hasher, user.password) def test_none_hash_value(self): """ test how methods handle None as hash value """ patched = self.patched # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import ( check_password, make_password, is_password_usable, identify_hasher, ) # User.set_password() - n/a # User.check_password() - returns False user = FakeUser() user.password = None if quirks.none_causes_check_password_error and not patched: # django 2.1+ self.assertRaises(TypeError, user.check_password, PASS1) else: self.assertFalse(user.check_password(PASS1)) self.assertEqual(user.has_usable_password(), quirks.empty_is_usable_password) # TODO: is_password_usable() # make_password() - n/a # check_password() - error if quirks.none_causes_check_password_error and not patched: self.assertRaises(TypeError, check_password, PASS1, None) else: self.assertFalse(check_password(PASS1, None)) # identify_hasher() - error self.assertRaises(TypeError, identify_hasher, None) def test_empty_hash_value(self): """ test how methods handle empty string as hash value """ # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import ( check_password, make_password, is_password_usable, identify_hasher, ) # User.set_password() - n/a # User.check_password() # As of django 1.5, blank hash returns False (django issue 18453) user = FakeUser() user.password = "" self.assertFalse(user.check_password(PASS1)) # verify hash wasn't changed/upgraded during check_password() call self.assertEqual(user.password, "") self.assertEqual(user.pop_saved_passwords(), []) # User.has_usable_password() self.assertEqual(user.has_usable_password(), quirks.empty_is_usable_password) # TODO: is_password_usable() # make_password() - n/a # check_password() self.assertFalse(check_password(PASS1, "")) # identify_hasher() - throws error self.assertRaises(ValueError, identify_hasher, "") def test_invalid_hash_values(self): """ test how methods handle invalid hash values. """ for hash in [ "$789$foo", # empty identifier ]: with self.subTest(hash=hash): self._do_test_invalid_hash_value(hash) def _do_test_invalid_hash_value(self, hash): # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import ( check_password, make_password, is_password_usable, identify_hasher, ) # User.set_password() - n/a # User.check_password() # As of django 1.5, invalid hash returns False (side effect of django issue 18453) user = FakeUser() user.password = hash self.assertFalse(user.check_password(PASS1)) # verify hash wasn't changed/upgraded during check_password() call self.assertEqual(user.password, hash) self.assertEqual(user.pop_saved_passwords(), []) # User.has_usable_password() self.assertEqual(user.has_usable_password(), quirks.invalid_is_usable_password) # TODO: is_password_usable() # make_password() - n/a # check_password() self.assertFalse(check_password(PASS1, hash)) # identify_hasher() - throws error self.assertRaises(ValueError, identify_hasher, hash) def test_available_schemes(self): """ run a bunch of subtests for each hasher available in the default django setup (as determined by reading self.context) """ for scheme in self.context.schemes(): with self.subTest(scheme=scheme): self._do_test_available_scheme(scheme) def _do_test_available_scheme(self, scheme): """ helper to test how specific hasher behaves. :param scheme: *passlib* name of hasher (e.g. "django_pbkdf2_sha256") """ log = self.getLogger() ctx = self.context patched = self.patched setter = create_mock_setter() # NOTE: import has to be done w/in method, in case monkeypatching is applied by setUp() from django.contrib.auth.hashers import ( check_password, make_password, is_password_usable, identify_hasher, ) #------------------------------------------------------- # setup constants & imports, pick a sample secret/hash combo #------------------------------------------------------- handler = ctx.handler(scheme) log.debug("testing scheme: %r => %r", scheme, handler) deprecated = ctx.handler(scheme).deprecated assert not deprecated or scheme != ctx.default_scheme() try: testcase = get_handler_case(scheme) except exc.MissingBackendError: raise self.skipTest("backend not available") assert handler_derived_from(handler, testcase.handler) if handler.is_disabled: raise self.skipTest("skip disabled hasher") # verify that django has a backend available # (since our hasher may use different set of backends, # get_handler_case() above may work, but django will have nothing) if not patched and not check_django_hasher_has_backend(handler.django_name): assert scheme in ["django_bcrypt", "django_bcrypt_sha256", "django_argon2"], \ "%r scheme should always have active backend" % scheme log.warning("skipping scheme %r due to missing django dependency", scheme) raise self.skipTest("skip due to missing dependency") # find a sample (secret, hash) pair to test with try: secret, hash = sample_hashes[scheme] except KeyError: get_sample_hash = testcase("setUp").get_sample_hash while True: secret, hash = get_sample_hash() if secret: # don't select blank passwords break other = 'dontletmein' #------------------------------------------------------- # User.set_password() - not tested here #------------------------------------------------------- #------------------------------------------------------- # User.check_password()+migration against known hash #------------------------------------------------------- user = FakeUser() user.password = hash # check against invalid password self.assertFalse(user.check_password(None)) ##self.assertFalse(user.check_password('')) self.assertFalse(user.check_password(other)) self.assert_valid_password(user, hash) # check against valid password self.assertTrue(user.check_password(secret)) # check if it upgraded the hash # NOTE: needs_update kept separate in case we need to test rounds. needs_update = deprecated if needs_update: self.assertNotEqual(user.password, hash) self.assertFalse(handler.identify(user.password)) self.assertTrue(ctx.handler().verify(secret, user.password)) self.assert_valid_password(user, saved=user.password) else: self.assert_valid_password(user, hash) # don't need to check rest for most deployments if TEST_MODE(max="default"): return #------------------------------------------------------- # make_password() correctly selects algorithm #------------------------------------------------------- alg = DjangoTranslator().passlib_to_django_name(scheme) hash2 = make_password(secret, hasher=alg) self.assertTrue(handler.verify(secret, hash2)) #------------------------------------------------------- # check_password()+setter against known hash #------------------------------------------------------- # should call setter only if it needs_update self.assertTrue(check_password(secret, hash, setter=setter)) self.assertEqual(setter.popstate(), [secret] if needs_update else []) # should not call setter self.assertFalse(check_password(other, hash, setter=setter)) self.assertEqual(setter.popstate(), []) ### check preferred kwd is ignored (feature we don't currently support fully) ##self.assertTrue(check_password(secret, hash, setter=setter, preferred='fooey')) ##self.assertEqual(setter.popstate(), [secret]) # TODO: get_hasher() #------------------------------------------------------- # identify_hasher() recognizes known hash #------------------------------------------------------- self.assertTrue(is_password_usable(hash)) name = DjangoTranslator().django_to_passlib_name(identify_hasher(hash).algorithm) self.assertEqual(name, scheme) #=================================================================== # eoc #=================================================================== #=================================================================== # extension fidelity tests #=================================================================== class ExtensionBehaviorTest(DjangoBehaviorTest): """ test that "passlib.ext.django" conforms to behavioral assertions in DjangoBehaviorTest """ descriptionPrefix = "verify extension behavior" config = dict( schemes="sha256_crypt,md5_crypt,des_crypt", deprecated="des_crypt", ) def setUp(self): super(ExtensionBehaviorTest, self).setUp() # always load extension before each test self.load_extension(PASSLIB_CONFIG=self.config) self.patched = True #=================================================================== # extension internal tests #=================================================================== class DjangoExtensionTest(_ExtensionTest): """ test the ``passlib.ext.django`` plugin """ #=================================================================== # class attrs #=================================================================== descriptionPrefix = "passlib.ext.django plugin" #=================================================================== # monkeypatch testing #=================================================================== def test_00_patch_control(self): """test set_django_password_context patch/unpatch""" # check config="disabled" self.load_extension(PASSLIB_CONFIG="disabled", check=False) self.assert_unpatched() # check legacy config=None with self.assertWarningList("PASSLIB_CONFIG=None is deprecated"): self.load_extension(PASSLIB_CONFIG=None, check=False) self.assert_unpatched() # try stock django 1.0 context self.load_extension(PASSLIB_CONFIG="django-1.0", check=False) self.assert_patched(context=django10_context) # try to remove patch self.unload_extension() # patch to use stock django 1.4 context self.load_extension(PASSLIB_CONFIG="django-1.4", check=False) self.assert_patched(context=django14_context) # try to remove patch again self.unload_extension() def test_01_overwrite_detection(self): """test detection of foreign monkeypatching""" # NOTE: this sets things up, and spot checks two methods, # this should be enough to verify patch manager is working. # TODO: test unpatch behavior honors flag. # configure plugin to use sample context config = "[passlib]\nschemes=des_crypt\n" self.load_extension(PASSLIB_CONFIG=config) # setup helpers import django.contrib.auth.models as models from passlib.ext.django.models import adapter def dummy(): pass # mess with User.set_password, make sure it's detected orig = models.User.set_password models.User.set_password = dummy with self.assertWarningList("another library has patched.*User\.set_password"): adapter._manager.check_all() models.User.set_password = orig # mess with models.check_password, make sure it's detected orig = models.check_password models.check_password = dummy with self.assertWarningList("another library has patched.*models:check_password"): adapter._manager.check_all() models.check_password = orig def test_02_handler_wrapper(self): """test Hasher-compatible handler wrappers""" from django.contrib.auth import hashers passlib_to_django = DjangoTranslator().passlib_to_django # should return native django hasher if available if DJANGO_VERSION > (1, 10): self.assertRaises(ValueError, passlib_to_django, "hex_md5") else: hasher = passlib_to_django("hex_md5") self.assertIsInstance(hasher, hashers.UnsaltedMD5PasswordHasher) # should return native django hasher # NOTE: present but not enabled by default in django as of 2.1 # (see _builtin_django_hashers) hasher = passlib_to_django("django_bcrypt") self.assertIsInstance(hasher, hashers.BCryptPasswordHasher) # otherwise should return wrapper from passlib.hash import sha256_crypt hasher = passlib_to_django("sha256_crypt") self.assertEqual(hasher.algorithm, "passlib_sha256_crypt") # and wrapper should return correct hash encoded = hasher.encode("stub") self.assertTrue(sha256_crypt.verify("stub", encoded)) self.assertTrue(hasher.verify("stub", encoded)) self.assertFalse(hasher.verify("xxxx", encoded)) # test wrapper accepts options encoded = hasher.encode("stub", "abcd"*4, rounds=1234) self.assertEqual(encoded, "$5$rounds=1234$abcdabcdabcdabcd$" "v2RWkZQzctPdejyRqmmTDQpZN6wTh7.RUy9zF2LftT6") self.assertEqual(hasher.safe_summary(encoded), {'algorithm': 'sha256_crypt', 'salt': u('abcdab**********'), 'rounds': 1234, 'hash': u('v2RWkZ*************************************'), }) # made up name should throw error # XXX: should this throw ValueError instead, to match django? self.assertRaises(KeyError, passlib_to_django, "does_not_exist") #=================================================================== # PASSLIB_CONFIG settings #=================================================================== def test_11_config_disabled(self): """test PASSLIB_CONFIG='disabled'""" # test config=None (deprecated) with self.assertWarningList("PASSLIB_CONFIG=None is deprecated"): self.load_extension(PASSLIB_CONFIG=None, check=False) self.assert_unpatched() # test disabled config self.load_extension(PASSLIB_CONFIG="disabled", check=False) self.assert_unpatched() def test_12_config_presets(self): """test PASSLIB_CONFIG='<preset>'""" # test django presets self.load_extension(PASSLIB_CONTEXT="django-default", check=False) ctx = django16_context self.assert_patched(ctx) self.load_extension(PASSLIB_CONFIG="django-1.0", check=False) self.assert_patched(django10_context) self.load_extension(PASSLIB_CONFIG="django-1.4", check=False) self.assert_patched(django14_context) def test_13_config_defaults(self): """test PASSLIB_CONFIG default behavior""" # check implicit default from passlib.ext.django.utils import PASSLIB_DEFAULT default = CryptContext.from_string(PASSLIB_DEFAULT) self.load_extension() self.assert_patched(PASSLIB_DEFAULT) # check default preset self.load_extension(PASSLIB_CONTEXT="passlib-default", check=False) self.assert_patched(PASSLIB_DEFAULT) # check explicit string self.load_extension(PASSLIB_CONTEXT=PASSLIB_DEFAULT, check=False) self.assert_patched(PASSLIB_DEFAULT) def test_14_config_invalid(self): """test PASSLIB_CONFIG type checks""" update_settings(PASSLIB_CONTEXT=123, PASSLIB_CONFIG=UNSET) self.assertRaises(TypeError, __import__, 'passlib.ext.django.models') self.unload_extension() update_settings(PASSLIB_CONFIG="missing-preset", PASSLIB_CONTEXT=UNSET) self.assertRaises(ValueError, __import__, 'passlib.ext.django.models') #=================================================================== # PASSLIB_GET_CATEGORY setting #=================================================================== def test_21_category_setting(self): """test PASSLIB_GET_CATEGORY parameter""" # define config where rounds can be used to detect category config = dict( schemes = ["sha256_crypt"], sha256_crypt__default_rounds = 1000, staff__sha256_crypt__default_rounds = 2000, superuser__sha256_crypt__default_rounds = 3000, ) from passlib.hash import sha256_crypt def run(**kwds): """helper to take in user opts, return rounds used in password""" user = FakeUser(**kwds) user.set_password("stub") return sha256_crypt.from_string(user.password).rounds # test default get_category self.load_extension(PASSLIB_CONFIG=config) self.assertEqual(run(), 1000) self.assertEqual(run(is_staff=True), 2000) self.assertEqual(run(is_superuser=True), 3000) # test patch uses explicit get_category function def get_category(user): return user.first_name or None self.load_extension(PASSLIB_CONTEXT=config, PASSLIB_GET_CATEGORY=get_category) self.assertEqual(run(), 1000) self.assertEqual(run(first_name='other'), 1000) self.assertEqual(run(first_name='staff'), 2000) self.assertEqual(run(first_name='superuser'), 3000) # test patch can disable get_category entirely def get_category(user): return None self.load_extension(PASSLIB_CONTEXT=config, PASSLIB_GET_CATEGORY=get_category) self.assertEqual(run(), 1000) self.assertEqual(run(first_name='other'), 1000) self.assertEqual(run(first_name='staff', is_staff=True), 1000) self.assertEqual(run(first_name='superuser', is_superuser=True), 1000) # test bad value self.assertRaises(TypeError, self.load_extension, PASSLIB_CONTEXT=config, PASSLIB_GET_CATEGORY='x') #=================================================================== # eoc #=================================================================== #============================================================================= # eof #=============================================================================