Ic
@ s d Z d d k Z d d k l Z d d k l Z d d k l Z d d k l
Z
d d k l Z d d k
l Z d d k l Z l Z d d
k l Z l Z l Z d d d
d g Z e d Z d e f d YZ d e f d YZ e d Z d d e d Z d S( s3 Test utilities for repoze.who-powered applications.iN( t INFO( t compile( t
implements( t HTTPUnauthorized( t asbool( t! PluggableAuthenticationMiddleware( t WhoConfigt make_middleware_with_config( t IIdentifiert IAuthenticatort IChallengert AuthenticationForgerPlugint AuthenticationForgerMiddlewaret make_middlewareR s# ^(?P[0-9]{3}) (?P.*)$c B sZ e Z d Z e e e e d d d Z d Z d Z d Z
d Z d Z RS( sQ
:mod:`repoze.who` plugin to forge authentication easily and bypass
:mod:`repoze.who` challenges.
This plugin enables you to write identifier and challenger-independent
tests. As a result, your protected areas will be easier to test:
#. To forge authentication, without bypassing identification (i.e., running
MD providers), you can use the following WebTest-powered test::
def test_authorization_granted(self):
'''The right subject must get what she requested'''
environ = {'REMOTE_USER': 'manager'}
resp = self.app.get('/admin/', extra_environ=environ, status=200)
assert 'some text' in resp.body
As you can see, this is an identifier-independent way to forge
authentication.
#. To check that authorization was denied, in a challenger-independent way,
you can use::
def test_authorization_denied_anonymous(self):
'''Anonymous users must get a 401 page'''
self.app.get('/admin/', status=401)
def test_authorization_denied_authenticated(self):
'''Authenticated users must get a 403 page'''
environ = {'REMOTE_USER': 'editor'}
self.app.get('/admin/', extra_environ=environ, status=403)
t REMOTE_USERs repoze.who.testutil.useridc C s | | _ | | _ d S( sJ
:param fake_user_key: The key for the item in the ``environ`` which
will contain the forged user Id.
:type fake_user_key: str
:param remote_user_key: The actual "external" ``remote_user_key``
used by :mod:`repoze.who`.
:type remote_user_key: str
N( t
fake_user_keyt remote_user_key( t selfR R ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt __init__J s c C s- | i | j o h | | i d 6} | Sd S( s
Pre-authenticate using the user Id found in the relevant ``environ``
item, if any.
The user Id. found will be put into ``identity['fake-userid']``, for
:meth:`authenticate`.
s fake-useridN( R ( R t environt identity( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt identifyZ s c C s d S( s
Do nothingN( ( R R R ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt rememberh s c C s d S( s
Do nothingN( ( R R R ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt forgetm s c C s3 d | j o" | i d | | i <| | i Sd S( s
Turn the value in ``identity['fake-userid']`` into the remote user's
name.
Finally, it removes ``identity['fake-userid']`` so that it won't reach
the WSGI application.
s fake-useridN( t popR ( R R R ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt authenticater s
c
C sy | | } t i | } | o( | i d } t | i d } n
d } d } t d | } | | _ | | _ | S( s" Return a 401 page unconditionally.t reasont codes HTTP Unauthorizedi t headers( t _HTTP_STATUS_PATTERNt searcht groupt intR t titleR (
R R t statust app_headerst forget_headersR t status_partsR R t response( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt challenge s
(
t __name__t
__module__t __doc__R R R R
R R R R R R' ( ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyR & s c B s e Z d Z d e d d Z RS( s
:class:`PluggableAuthenticationMiddleware
` proxy
to forge authentication, without bypassing identification.
R c
C s |
| _ t d |
} d | f } | i d | | g } | g } t t | i } | | | | | | | | | | d
d S( s
Setup authentication in an easy to forge way.
All the arguments received will be passed as is to
:class:`repoze.who.middleware.PluggableAuthenticationMiddleware`,
with one instance of :class:`AuthenticationForgerPlugin` in:
* ``identifiers``. This instance will be inserted in the first position
of the list.
* ``authenticators``. Any authenticator passed will be ignored; such
an instance will be the only authenticator defined.
* ``challengers``. Any challenger passed will be ignored; such
an instance will be the only challenger defined.
Internally, it will also set ``remote_user_key`` to
``'repoze.who.testutil.userid'``, so that you can use the standard
``'REMOTE_USER'`` in your tests.
The metadata providers won't be modified.
R t auth_forgeri s repoze.who.testutil.useridN( t actual_remote_user_keyR t insertt superR R (
R t appt identifierst authenticatorst challengerst mdproviderst
classifiert challenge_decidert
log_streamt log_levelR t forgert init( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyR s N( R( R) R* t NoneR R ( ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyR s c O s, t | o t | | St | | Sd S( s
Return the requested authentication middleware.
:param skip_authentication: If ``True``, an instance of
:class:`AuthenticationForgerMiddleware` will be returned instead of
:class:`repoze.who.middleware.PluggableAuthenticationMiddleware`
:type skip_authentication: bool
``args`` and ``kwargs`` are the positional and named arguments,
respectively, to be passed to the relevant authentication middleware.
N( R R R ( t skip_authenticationt argst kwargs( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyR
s
c
C s~ t | p t | | | | | St | d } | i t | t | | i | i | i | i | i
| i d | i S( s
Proxy :func:`repoze.who.config.make_middleware_with_config` to skip
authentication when required.
If ``skip_authentication`` evaluates to ``True``, then the returned
middleware will be an instance of :class:`AuthenticationForgerMiddleware`.
t hereR (
R t mk_mw_cfgR t parset openR R0 R1 R2 R3 t request_classifierR5 R ( R/ t global_conft config_filet log_fileR7 R; t parser( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyR s
( R* t syst loggingR t reR t
compile_regext zope.interfaceR t paste.httpexceptionsR t paste.deploy.convertersR t repoze.who.middlewareR t repoze.who.configR R R? t repoze.who.interfacesR R R
t __all__R t objectR R t FalseR
R: ( ( ( s? /usr/lib/python2.6/site-packages/repoze/who/plugins/testutil.pyt s" l1