Merge lp:~allenap/maas/authenticate-to-api into lp:~maas-committers/maas/trunk

[Gavin Panella]

New authenticate view to allow client libraries to get an API token from a username+password.

[Gavin Panella (allenap)]

I've now also added an `authenticate-api` capability so that python-libmaas (and others) can know cleanly if /accounts/authenticate/ is available, rather than interpreting HTTP status codes. Right now MAAS appears to send a 302 redirect to the login page if /accounts/authenticate/ does not exist, but earlier and later versions may behave differently, sending 401, 403, or 404 for example. It's better to have an unambiguous way to know.

[Mike Pontillo (mpontillo)]

I like it!

I wonder if this could be improved by allowing the user to grab a credential based on the 'comment' field. But that could be done in another branch...

review: Approve

[Gavin Panella (allenap)]

Thanks for the review.

> I wonder if this could be improved by allowing the user to grab a
> credential based on the 'comment' field. But that could be done in
> another branch...

This does it already, but I hadn't documented it. I've added some blurb
to the docstring to explain that. I also fixed a couple of slightly
broken tests; I spotted that one test in particular was not testing
quite what it claimed to test.

[MAAS Lander (maas-lander)]

Attempt to merge into lp:maas failed due to conflicts:

text conflict in src/maasserver/views/account.py

[MAAS Lander (maas-lander)]

The attempt to merge lp:~allenap/maas/authenticate-to-api into lp:maas failed. Below is the output from the failed tests.

Hit:1 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial InRelease
Get:2 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:3 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Get:4 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Fetched 306 kB in 0s (617 kB/s)
Reading package lists...
sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
    --no-install-recommends install apache2 archdetect-deb authbind avahi-utils bash bind9 bind9utils build-essential bzr bzr-builddeb chromium-browser chromium-chromedriver curl daemontools debhelper dh-apport dh-systemd distro-info dnsutils firefox freeipmi-tools git gjs ipython isc-dhcp-common isc-dhcp-server libjs-angularjs libjs-jquery libjs-jquery-hotkeys libjs-yui3-full libjs-yui3-min libnss-wrapper libpq-dev make nodejs-legacy npm postgresql psmisc pxelinux python3-all python3-apt python3-attr python3-bson python3-convoy python3-crochet python3-cssselect python3-curtin python3-dev python3-distro-info python3-django python3-django-nose python3-django-piston3 python3-dnspython python3-docutils python3-formencode python3-hivex python3-httplib2 python3-jinja2 python3-jsonschema python3-lxml python3-netaddr python3-netifaces python3-novaclient python3-oauth python3-oauthlib python3-openssl python3-paramiko python3-petname python3-pexpect python3-psycopg2 python3-pyinotify python3-pyparsing python3-pyvmomi python3-requests python3-seamicroclient python3-setuptools python3-simplestreams python3-sphinx python3-tempita python3-twisted python3-txtftp python3-tz python3-yaml python3-zope.interface python-bson python-crochet python-django python-django-piston python-djorm-ext-pgarray python-formencode python-lxml python-netaddr python-netifaces python-pocket-lint python-psycopg2 python-simplejson python-tempita python-twisted python-yaml socat syslinux-common tgt ubuntu-cloudimage-keyring wget xvfb
Reading package lists...
Building dependency tree...
Reading state information...
authbind is already the newest version (2.1.1+nmu1).
avahi-utils is already the newest version (0.6.32~rc+dfsg-1ubuntu2).
build-essential is already the newest version (12.1ubuntu2).
debhelper is already the newest version (9.20160115ubuntu3).
distro-info is already the newest version (0.14build1).
git is already the newest version (1:2.7.4-0ubuntu1).
libjs-angularjs is already the newest version (1.2.28-1ubuntu2).
libjs-jquery is already the newest version (1.11.3+dfsg-4).
libjs-yui3-full is already the newest version (3.5.1-1ubuntu3).
libjs-yui3-min is already the newest version (3.5.1-1ubuntu3).
make is already the newest version (4.1-6).
postgresql is already the newest version (9.5+173).
psmisc is already the newest version (22.21-2.1build1).
pxelinux is already the newest version (3:6.03+dfsg-11ubuntu1).
python-formencode is already the newest version (1.3.0-0ubuntu5).
python-lxml is already the newest version (3.5.0-1build1).
python-netaddr is already the newest version (0.7.18-1).
python-netifac...

[MAAS Lander (maas-lander)]

The attempt to merge lp:~allenap/maas/authenticate-to-api into lp:maas failed. Below is the output from the failed tests.

Hit:1 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial InRelease
Get:2 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:3 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Get:4 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Fetched 306 kB in 0s (661 kB/s)
Reading package lists...
sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
    --no-install-recommends install apache2 archdetect-deb authbind avahi-utils bash bind9 bind9utils build-essential bzr bzr-builddeb chromium-browser chromium-chromedriver curl daemontools debhelper dh-apport dh-systemd distro-info dnsutils firefox freeipmi-tools git gjs ipython isc-dhcp-common isc-dhcp-server libjs-angularjs libjs-jquery libjs-jquery-hotkeys libjs-yui3-full libjs-yui3-min libnss-wrapper libpq-dev make nodejs-legacy npm postgresql psmisc pxelinux python3-all python3-apt python3-attr python3-bson python3-convoy python3-crochet python3-cssselect python3-curtin python3-dev python3-distro-info python3-django python3-django-nose python3-django-piston3 python3-dnspython python3-docutils python3-formencode python3-hivex python3-httplib2 python3-jinja2 python3-jsonschema python3-lxml python3-netaddr python3-netifaces python3-novaclient python3-oauth python3-oauthlib python3-openssl python3-paramiko python3-petname python3-pexpect python3-psycopg2 python3-pyinotify python3-pyparsing python3-pyvmomi python3-requests python3-seamicroclient python3-setuptools python3-simplestreams python3-sphinx python3-tempita python3-twisted python3-txtftp python3-tz python3-yaml python3-zope.interface python-bson python-crochet python-django python-django-piston python-djorm-ext-pgarray python-formencode python-lxml python-netaddr python-netifaces python-pocket-lint python-psycopg2 python-simplejson python-tempita python-twisted python-yaml socat syslinux-common tgt ubuntu-cloudimage-keyring wget xvfb
Reading package lists...
Building dependency tree...
Reading state information...
authbind is already the newest version (2.1.1+nmu1).
avahi-utils is already the newest version (0.6.32~rc+dfsg-1ubuntu2).
build-essential is already the newest version (12.1ubuntu2).
debhelper is already the newest version (9.20160115ubuntu3).
distro-info is already the newest version (0.14build1).
git is already the newest version (1:2.7.4-0ubuntu1).
libjs-angularjs is already the newest version (1.2.28-1ubuntu2).
libjs-jquery is already the newest version (1.11.3+dfsg-4).
libjs-yui3-full is already the newest version (3.5.1-1ubuntu3).
libjs-yui3-min is already the newest version (3.5.1-1ubuntu3).
make is already the newest version (4.1-6).
postgresql is already the newest version (9.5+173).
psmisc is already the newest version (22.21-2.1build1).
pxelinux is already the newest version (3:6.03+dfsg-11ubuntu1).
python-formencode is already the newest version (1.3.0-0ubuntu5).
python-lxml is already the newest version (3.5.0-1build1).
python-netaddr is already the newest version (0.7.18-1).
python-netifac...

[Gavin Panella (allenap)]

Spurious and unrelated test failure in TestNodePreviousStatus.test_changing_status_updates_previous_status. Fixed it though!

[MAAS Lander (maas-lander)]

The attempt to merge lp:~allenap/maas/authenticate-to-api into lp:maas failed. Below is the output from the failed tests.

Hit:1 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial InRelease
Get:2 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:3 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Get:4 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Fetched 306 kB in 0s (623 kB/s)
Reading package lists...
sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
    --no-install-recommends install apache2 archdetect-deb authbind avahi-utils bash bind9 bind9utils build-essential bzr bzr-builddeb chromium-browser chromium-chromedriver curl daemontools debhelper dh-apport dh-systemd distro-info dnsutils firefox freeipmi-tools git gjs ipython isc-dhcp-common isc-dhcp-server libjs-angularjs libjs-jquery libjs-jquery-hotkeys libjs-yui3-full libjs-yui3-min libnss-wrapper libpq-dev make nodejs-legacy npm postgresql psmisc pxelinux python3-all python3-apt python3-attr python3-bson python3-convoy python3-crochet python3-cssselect python3-curtin python3-dev python3-distro-info python3-django python3-django-nose python3-django-piston3 python3-dnspython python3-docutils python3-formencode python3-hivex python3-httplib2 python3-jinja2 python3-jsonschema python3-lxml python3-netaddr python3-netifaces python3-novaclient python3-oauth python3-oauthlib python3-openssl python3-paramiko python3-petname python3-pexpect python3-psycopg2 python3-pyinotify python3-pyparsing python3-pyvmomi python3-requests python3-seamicroclient python3-setuptools python3-simplestreams python3-sphinx python3-tempita python3-twisted python3-txtftp python3-tz python3-yaml python3-zope.interface python-bson python-crochet python-django python-django-piston python-djorm-ext-pgarray python-formencode python-lxml python-netaddr python-netifaces python-pocket-lint python-psycopg2 python-simplejson python-tempita python-twisted python-yaml socat syslinux-common tgt ubuntu-cloudimage-keyring wget xvfb
Reading package lists...
Building dependency tree...
Reading state information...
authbind is already the newest version (2.1.1+nmu1).
avahi-utils is already the newest version (0.6.32~rc+dfsg-1ubuntu2).
build-essential is already the newest version (12.1ubuntu2).
debhelper is already the newest version (9.20160115ubuntu3).
distro-info is already the newest version (0.14build1).
git is already the newest version (1:2.7.4-0ubuntu1).
libjs-angularjs is already the newest version (1.2.28-1ubuntu2).
libjs-jquery is already the newest version (1.11.3+dfsg-4).
libjs-yui3-full is already the newest version (3.5.1-1ubuntu3).
libjs-yui3-min is already the newest version (3.5.1-1ubuntu3).
make is already the newest version (4.1-6).
postgresql is already the newest version (9.5+173).
psmisc is already the newest version (22.21-2.1build1).
pxelinux is already the newest version (3:6.03+dfsg-11ubuntu1).
python-formencode is already the newest version (1.3.0-0ubuntu5).
python-lxml is already the newest version (3.5.0-1build1).
python-netaddr is already the newest version (0.7.18-1).
python-netifac...

=== modified file 'docs/version.rst'
--- docs/version.rst	2016-11-17 11:46:08 +0000
+++ docs/version.rst	2017-03-20 11:11:54 +0000
@@ -79,3 +79,11 @@
 ``bridging-automatic-ubuntu``
   Deploy nodes, automatically configuring bridges on all interfaces.
   Available since 2.1 on Ubuntu deployments.
+
+.. _cap_authenticate_api:
+
+``authenticate-api``
+  An ``/accounts/authenticate/`` endpoint is available for API clients.
+  Clients can pass a username and password and, assuming they are valid,
+  receive in return an API token. The caller is *not* logged-in to MAAS
+  via a session cookie.

=== modified file 'src/maasserver/api/version.py'
--- src/maasserver/api/version.py	2016-11-17 11:46:08 +0000
+++ src/maasserver/api/version.py	2017-03-20 11:11:54 +0000
@@ -23,6 +23,7 @@
 CAP_NETWORK_DEPLOYMENT_UBUNTU = 'network-deployment-ubuntu'
 CAP_BRIDGING_INTERFACE_UBUNTU = 'bridging-interface-ubuntu'
 CAP_BRIDGING_AUTOMATIC_UBUNTU = 'bridging-automatic-ubuntu'
+CAP_AUTHENTICATE_API = 'authenticate-api'
 
 API_CAPABILITIES_LIST = [
     CAP_NETWORKS_MANAGEMENT,
@@ -33,6 +34,7 @@
     CAP_NETWORK_DEPLOYMENT_UBUNTU,
     CAP_BRIDGING_INTERFACE_UBUNTU,
     CAP_BRIDGING_AUTOMATIC_UBUNTU,
+    CAP_AUTHENTICATE_API,
     ]
 
 

=== modified file 'src/maasserver/middleware.py'
--- src/maasserver/middleware.py	2016-09-22 02:53:33 +0000
+++ src/maasserver/middleware.py	2017-03-20 11:11:54 +0000
@@ -84,6 +84,8 @@
         public_url_roots = [
             # Login page: must be visible to anonymous users.
             reverse('login'),
+            # Authentication: must be visible to anonymous users.
+            reverse('authenticate'),
             # The combo loaders are publicly accessible.
             reverse('combo-yui'),
             # Static resources are publicly visible.

=== modified file 'src/maasserver/models/signals/tests/test_nodes.py'
--- src/maasserver/models/signals/tests/test_nodes.py	2017-03-10 15:41:12 +0000
+++ src/maasserver/models/signals/tests/test_nodes.py	2017-03-20 11:11:54 +0000
@@ -17,6 +17,7 @@
     REGION_SERVICES,
     Service,
 )
+from maasserver.models.signals import power
 from maasserver.node_status import NODE_TRANSITIONS
 from maasserver.testing.factory import factory
 from maasserver.testing.testcase import MAASServerTestCase
@@ -34,6 +35,12 @@
 class TestNodePreviousStatus(MAASServerTestCase):
     """Test that `previous_status` is set when the status is changed."""
 
+    def setUp(self):
+        super(TestNodePreviousStatus, self).setUp()
+        # Disable power signals: some status transitions prompt a power check.
+        self.addCleanup(power.signals.enable)
+        power.signals.disable()
+
     def test_changing_status_updates_previous_status(self):
         node = factory.make_Node()
         old_status = node.status

=== modified file 'src/maasserver/urls.py'
--- src/maasserver/urls.py	2016-09-22 13:16:12 +0000
+++ src/maasserver/urls.py	2017-03-20 11:11:54 +0000
@@ -19,6 +19,7 @@
 )
 from maasserver.views import TextTemplateView
 from maasserver.views.account import (
+    authenticate,
     login,
     logout,
 )
@@ -70,6 +71,7 @@
 urlpatterns += patterns(
     'maasserver.views',
     url(r'^accounts/login/$', login, name='login'),
+    url(r'^accounts/authenticate/$', authenticate, name='authenticate'),
     url(
         r'^images-stream/streams/v1/(?P<filename>.*)$',
         simplestreams_stream_handler, name='simplestreams_stream_handler'),

=== modified file 'src/maasserver/views/account.py'
--- src/maasserver/views/account.py	2017-03-15 13:55:52 +0000
+++ src/maasserver/views/account.py	2017-03-20 11:11:54 +0000
@@ -4,22 +4,35 @@
 """Account views."""
 
 __all__ = [
+    "authenticate",
     "login",
     "logout",
     ]
 
 from django import forms
 from django.conf import settings as django_settings
-from django.contrib.auth import REDIRECT_FIELD_NAME
+from django.contrib.auth import (
+    authenticate as dj_authenticate,
+    REDIRECT_FIELD_NAME,
+)
 from django.contrib.auth.views import (
     login as dj_login,
     logout as dj_logout,
 )
 from django.core.urlresolvers import reverse
-from django.http import HttpResponseRedirect
+from django.http import (
+    HttpResponseForbidden,
+    HttpResponseNotAllowed,
+    HttpResponseRedirect,
+    JsonResponse,
+)
 from django.shortcuts import render_to_response
 from django.template import RequestContext
 from maasserver.models import UserProfile
+from maasserver.models.user import (
+    create_auth_token,
+    get_auth_tokens,
+)
 
 
 def login(request):
@@ -62,3 +75,58 @@
         {'form': form},
         context_instance=RequestContext(request),
     )
+
+
+def authenticate(request):
+    """Authenticate a user, but do *not* log them in.
+
+    If the correct username and password are given, credentials suitable for
+    use with MAAS's Web API are returned. This can be used by client libraries
+    to exchange a username+password for an API token.
+
+    Accepts HTTP POST requests with the following parameters:
+
+      username: The user's username.
+      password: The user's password.
+      consumer: The name to use for the token, which can be used to later
+          understand which consumer requested and is using a token. Optional.
+
+    If `consumer` is provided, existing credentials belonging to the user with
+    a matching consumer will be returned, if any exist, else new credentials
+    will be created and labelled with `consumer` before being returned.
+
+    If `consumer` is not provided, the earliest created credentials belonging
+    to the user will be returned. If no preexisting credentials exist, new
+    credentials will be created and returned.
+    """
+    if request.method != "POST":
+        return HttpResponseNotAllowed(["POST"])
+
+    username = request.POST.get("username")
+    password = request.POST.get("password")
+    consumer = request.POST.get("consumer")
+    user = dj_authenticate(username=username, password=password)
+
+    if user is None or not user.is_active:
+        # This is_active check mimics confirm_login_allowed from Django's
+        # django.contrib.auth.forms.AuthenticationForm.
+        return HttpResponseForbidden()
+
+    # Find an existing token. There might be more than one so take the first.
+    tokens = get_auth_tokens(user)
+    if consumer is not None:
+        tokens = tokens.filter(consumer__name=consumer)
+    token = tokens.first()
+
+    # When no existing token is found, create a new one.
+    if token is None:
+        token = create_auth_token(user, consumer)
+
+    # Return something with the same shape as that rendered by
+    # AccountHandler.create_authorisation_token.
+    return JsonResponse({
+        "consumer_key": token.consumer.key,
+        "name": token.consumer.name,
+        "token_key": token.key,
+        "token_secret": token.secret,
+    })

=== modified file 'src/maasserver/views/tests/test_account.py'
--- src/maasserver/views/tests/test_account.py	2017-03-15 13:55:52 +0000
+++ src/maasserver/views/tests/test_account.py	2017-03-20 11:11:54 +0000
@@ -5,6 +5,7 @@
 
 __all__ = []
 
+from http import HTTPStatus
 import http.client
 
 from django.conf import settings
@@ -17,12 +18,22 @@
     fromstring,
     tostring,
 )
+from maasserver.models.user import (
+    create_auth_token,
+    get_auth_tokens,
+)
 from maasserver.testing import (
     extract_redirect,
     get_content_links,
 )
 from maasserver.testing.factory import factory
+from maasserver.testing.matchers import HasStatusCode
 from maasserver.testing.testcase import MAASServerTestCase
+from maasserver.utils.converters import json_load_bytes
+from testtools.matchers import (
+    ContainsDict,
+    Equals,
+)
 
 
 class TestLoginLegacy(MAASServerTestCase):
@@ -137,3 +148,154 @@
         self.client.login(username=user.username, password=password)
         self.client.post(reverse('logout'))
         self.assertNotIn(SESSION_KEY, self.client.session)
+
+
+def token_to_dict(token):
+    return {
+        "token_key": token.key,
+        "token_secret": token.secret,
+        "consumer_key": token.consumer.key,
+        "name": token.consumer.name,
+    }
+
+
+class TestAuthenticate(MAASServerTestCase):
+    """Tests for the `authenticate` view."""
+
+    def test__returns_existing_credentials(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        user = factory.make_User(username, password)
+        [token] = get_auth_tokens(user)
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            Equals(token_to_dict(token)))
+
+    def test__returns_first_of_existing_credentials(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        user = factory.make_User(username, password)
+        [token] = get_auth_tokens(user)
+        for i in range(1, 6):
+            create_auth_token(user, "Token #%d" % i)
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            Equals(token_to_dict(token)))
+
+    def test__returns_existing_named_credentials(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        consumer = factory.make_name("consumer")
+        user = factory.make_User(username, password)
+        token = create_auth_token(user, consumer)
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+                "consumer": consumer,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            Equals(token_to_dict(token)))
+
+    def test__returns_first_of_existing_named_credentials(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        consumer = factory.make_name("consumer")
+        user = factory.make_User(username, password)
+        tokens = [create_auth_token(user, consumer) for _ in range(1, 6)]
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+                "consumer": consumer,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            Equals(token_to_dict(tokens[0])))
+
+    def test__returns_new_credentials(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        user = factory.make_User(username, password)
+        get_auth_tokens(user).delete()  # Delete all tokens.
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.OK))
+        [token] = get_auth_tokens(user)
+        self.assertThat(
+            json_load_bytes(response.content),
+            Equals(token_to_dict(token)))
+
+    def test__returns_new_named_credentials(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        consumer = factory.make_name("consumer")
+        user = factory.make_User(username, password)
+        get_auth_tokens(user).delete()  # Delete all tokens.
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+                "consumer": consumer,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            ContainsDict({"name": Equals(consumer)}))
+
+    def test__rejects_unknown_username(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.FORBIDDEN))
+
+    def test__rejects_incorrect_password(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        factory.make_User(username, password)
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password + "-garbage",
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.FORBIDDEN))
+
+    def test__rejects_inactive_user(self):
+        username = factory.make_name("username")
+        password = factory.make_name("password")
+        user = factory.make_User(username, password)
+        user.is_active = False
+        user.save()
+        response = self.client.post(
+            reverse("authenticate"), data={
+                "username": username,
+                "password": password,
+            })
+        self.assertThat(response, HasStatusCode(HTTPStatus.FORBIDDEN))
+
+    def test__rejects_GET(self):
+        response = self.client.get(reverse("authenticate"))
+        self.assertThat(response, HasStatusCode(HTTPStatus.METHOD_NOT_ALLOWED))
+        self.assertThat(response["Allow"], Equals("POST"))