Merge lp:~canonical-isd-hackers/canonical-identity-provider/password-reset into lp:canonical-identity-provider/release

[Łukasz Czyżykowski]

Implementation of two method calls enabling doing password change via API.

[Ricardo Kirkner (ricardokirkner)]

In line 158 of the diff, what happens if token.requester is None? You should probably test for that.

review: Needs Fixing

[Ricardo Kirkner (ricardokirkner)]

Nice work. Thanks for the patience.

review: Approve

=== modified file 'doctests/stories/api-workflows.txt'
--- doctests/stories/api-workflows.txt	2010-05-03 21:27:13 +0000
+++ doctests/stories/api-workflows.txt	2010-06-14 12:47:24 +0000
@@ -19,6 +19,7 @@
 
     >>> if real_webservice:
     ...     from identityprovider.models import AuthToken, APIUser
+    ...     from identityprovider.models.const import LoginTokenType
     ...     from identityprovider.utils import encrypt_launchpad_password
     ...     password = encrypt_launchpad_password('password')
     ...     user, created = APIUser.objects.get_or_create(
@@ -57,7 +58,7 @@
 all of that to the API:
 
     >>> api.registrations.register(
-    ...     captcha_solution='bla', password='blogdf3D',
+    ...     captcha_solution='bla', password='blogdf3Daa',
     ...     captcha_id='bli', email='[e-mail]')
     {u'status': u'ok', u'message': u'Email verification required.'}
 
@@ -79,11 +80,35 @@
 indicating that fact:
 
     >>> api.registrations.register(
-    ...     captcha_solution='bla', password='blo',
+    ...     captcha_solution='bla', password='bla',
     ...     captcha_id='bli', email='blu')
     {u'status': u'error', u'errors': {u'password': [u'Password must be at least 8 characters long, and must contain at least one number and an upper case letter.'], u'email': [u'Enter a valid e-mail address.']}}
 
 
+Reset User Password
+-------------------
+
+To be able to set new password for an account you can request sending
+of password reset token to the email address.
+
+    >>> api.registrations.request_password_reset_token(email="[e-mail]")
+    {u'status': u'ok', u'message': u'Password reset token sent.'}
+
+    >>> if real_webservice:
+    ...     token = AuthToken.objects.get(
+    ...         email='[e-mail]',
+    ...         token_type=LoginTokenType.PASSWORDRECOVERY).token
+    ... else:
+    ...     token = "abcd"
+
+Then, when actually changing it you have to pass this token to the
+call:
+
+    >>> api.registrations.set_new_password(
+    ...     email="[e-mail]", token=token, new_password="blogdf3D")
+    {u'status': u'ok', u'message': u'Password changed'}
+
+
 As Authenticated User Using Basic Authentication
 ================================================
 
@@ -166,7 +191,9 @@
 which in turn will call this method.
 
     >>> if real_webservice:
-    ...     email_token = AuthToken.objects.get(email='[e-mail]').token
+    ...     email_token = AuthToken.objects.get(
+    ...         email='[e-mail]',
+    ...         token_type=LoginTokenType.VALIDATEEMAIL).token
     ... else:
     ...     email_token = "jJRkmngbHjmnJDEK"
 

=== added file 'identityprovider/tests/test_webservice.py'
--- identityprovider/tests/test_webservice.py	1970-01-01 00:00:00 +0000
+++ identityprovider/tests/test_webservice.py	2010-06-14 12:47:24 +0000
@@ -0,0 +1,47 @@
+from identityprovider.tests.utils import SQLCachedTestCase
+from identityprovider.models.authtoken import (AuthTokenFactory,
+                                               LoginTokenType,
+                                               AuthToken)
+from identityprovider.models.account import Account
+from identityprovider.models.const import AccountStatus
+from identityprovider.webservice.models import (RegistrationSet,
+                                                CanNotResetPassowrdError)
+
+
+class RegistrationsTestCase(SQLCachedTestCase):
+
+    fixtures = ["test"]
+    pgsql_functions = ["generate_openid_identifier"]
+
+    def setUp(self):
+        self.registration = RegistrationSet()
+
+    def test_authtoken_without_requester_is_handled_properly(self):
+        authtoken = AuthTokenFactory().new(None, None, "[e-mail]",
+                                           LoginTokenType.PASSWORDRECOVERY,
+                                           None)
+
+        response = self.registration.set_new_password("[e-mail]",
+                                                      authtoken.token, "pass")
+
+        self.assertEquals(response['status'], "error")
+
+    def test_reset_token_when_email_is_invalid(self):
+        self.assertRaises(CanNotResetPassowrdError,
+                          self.registration.request_password_reset_token,
+                          "[e-mail]")
+
+    def test_reset_token_when_account_is_disabled(self):
+        account = Account.objects.get_by_email("[e-mail]")
+        account.status = AccountStatus.SUSPENDED
+        account.save()
+
+        self.assertRaises(CanNotResetPassowrdError,
+                          self.registration.request_password_reset_token,
+                          "[e-mail]")
+
+    def test_reset_password_when_not_existing_token_is_passed(self):
+        self.assertRaises(AuthToken.DoesNotExist,
+                          self.registration.set_new_password,
+                          "[e-mail]", "not-existing-token",
+                          "password")

=== modified file 'identityprovider/webservice/interfaces.py'
--- identityprovider/webservice/interfaces.py	2010-04-21 15:29:24 +0000
+++ identityprovider/webservice/interfaces.py	2010-06-14 12:47:24 +0000
@@ -149,6 +149,19 @@
     def register(email, password, captcha_id, captcha_solution):
         """ Generate a new captcha """
 
+    @operation_parameters(email=TextLine(title=u"Email address."))
+    @export_write_operation()
+    def request_password_reset_token(email):
+        """Request password reset code to be sent to the email"""
+
+    @operation_parameters(
+        email=TextLine(title=u"Email address."),
+        token=TextLine(title=u"Password reset token."),
+        new_password=TextLine(title=u"New password"))
+    @export_write_operation()
+    def set_new_password(email, token, new_password):
+        """Set new password for given user"""
+
 
 class ICaptchaSet(IDjangoLocation):
     export_as_webservice_collection(ICaptcha)

=== modified file 'identityprovider/webservice/models.py'
--- identityprovider/webservice/models.py	2010-04-21 15:29:24 +0000
+++ identityprovider/webservice/models.py	2010-06-14 12:47:24 +0000
@@ -10,6 +10,7 @@
 from lazr.restful.frameworks.django import DjangoWebServiceConfiguration
 from lazr.restful.wsgi import BaseWSGIWebServiceConfiguration
 from lazr.restful.utils import get_current_browser_request
+from lazr.restful.declarations import webservice_error
 
 from identityprovider.models import (Account, EmailAddress,
                  AccountPassword, Token, APIUser, Person)
@@ -26,6 +27,10 @@
 from identityprovider.webservice.forms import WebserviceCreateAccountForm
 from identityprovider.models.captcha import Captcha as CaptchaModel
 from identityprovider.views.server import get_team_memberships
+from identityprovider.utils import (CannotResetPasswordException,
+    PersonAndAccountNotFoundException, get_person_and_account_by_email)
+
+
 
 
 class RootAbsoluteURL(RootResourceAbsoluteURL):
@@ -183,6 +188,10 @@
             return []
 
 
+class CanNotResetPassowrdError(Exception):
+    webservice_error(403)
+
+
 class RegistrationSet(make_set('BaseRegistrationSet', 'registration',
                                IRegistrationSet, Account, 'id')):
     def register(self, **kwargs):
@@ -224,6 +233,49 @@
             'message': "Email verification required."
         }
 
+    def request_password_reset_token(self, email):
+        error = False
+        try:
+            person, account = get_person_and_account_by_email(email)
+        except (CannotResetPasswordException,
+                PersonAndAccountNotFoundException):
+            error = True
+
+        if error or (account is not None and not account.can_reset_password):
+            raise CanNotResetPassowrdError(
+                "Can't reset password for this account")
+
+        token = AuthTokenFactory().new(account, email, email,
+                                       LoginTokenType.PASSWORDRECOVERY, None)
+
+        token.sendPasswordResetEmail()
+
+        return {
+            'status': 'ok',
+            'message': "Password reset token sent."
+        }
+
+    def set_new_password(self, email, token, new_password):
+        token = AuthToken.objects.get(
+            email=email, token=token,
+            token_type=LoginTokenType.PASSWORDRECOVERY)
+        if not token.requester:
+            token.delete()
+            return {
+                'status': 'error',
+                'message': "Wrong token, request new one."
+            }
+        password_obj = token.requester.accountpassword
+        password_obj.password = encrypt_launchpad_password(new_password)
+        password_obj.save()
+
+        token.consume()
+
+        return {
+            'status': 'ok',
+            'message': "Password changed"
+        }
+
 
 class Captcha(object):
     implements(ICaptcha)

=== modified file 'mockservice/api-workflows.txt'
--- mockservice/api-workflows.txt	2010-04-21 15:29:24 +0000
+++ mockservice/api-workflows.txt	2010-06-14 12:47:24 +0000
@@ -45,7 +45,7 @@
 all of that to the API:
 
     >>> api.registrations.register(
-    ...     captcha_solution='bla', password='blogdf3D',
+    ...     captcha_solution='bla', password='blogdf3Daa',
     ...     captcha_id='bli', email='[e-mail]')
     {u'status': u'ok', u'message': u'Email verification required.'}
 
@@ -72,6 +72,25 @@
     {u'status': u'error', u'errors': {u'password': [u'Password must be at least 8 characters long, and must contain at least one number and an upper case letter.'], u'email': [u'Enter a valid e-mail address.']}}
 
 
+Reset User Password
+-------------------
+
+To be able to set new password for an account you can request sending
+of password reset token to the email address.
+
+    >>> api.registrations.request_password_reset_token(email="[e-mail]")
+    {u'status': u'ok', u'message': u'Password reset token sent.'}
+
+
+Then, when actually changing it you have to pass this token to the
+call:
+
+    >>> api.registrations.set_new_password(
+    ...     email="[e-mail]", token="abcd", new_password="blogdf3D")
+    {u'status': u'ok', u'message': u'Password changed'}
+
+
+
 As Authenticated User Using Basic Authentication
 ================================================
 

=== modified file 'mockservice/mockserver.py'
--- mockservice/mockserver.py	2010-05-10 15:40:33 +0000
+++ mockservice/mockserver.py	2010-06-14 12:47:24 +0000
@@ -20,6 +20,8 @@
     'validated email': '{"email": "[e-mail]"}',
     'bad email token': '{"errors": {"email_token": ["Bad email token!"]}}',
     'team_memberships': '[]',
+    'password reset token': '{"status": "ok", "message": "Password reset token sent."}',
+    'set new password': '{"status": "ok", "message": "Password changed"}'
 }
 
 email_re = re.compile(
@@ -192,9 +194,16 @@
             clength = int(self.environ['CONTENT_LENGTH'])
             input = self.environ['wsgi.input'].read(clength)
             form = self.decode_form(input)
-            form.pop('ws.op')
-            errors = validate_new_account_form(**form)
-            return self.jsons(json=simplejson.dumps(errors))
+            if 'ws.op' in form:
+                op = form['ws.op']
+                if op == 'register':
+                    form.pop('ws.op')
+                    errors = validate_new_account_form(**form)
+                    return self.jsons(json=simplejson.dumps(errors))
+                elif op == 'request_password_reset_token':
+                    return self.jsons('password reset token')
+                elif op == 'set_new_password':
+                    return self.jsons('set new password')
 
     def handle_authentications(self):
         # 1. Check that we have some auth

=== modified file 'mockservice/wadl.xml'
--- mockservice/wadl.xml	2010-04-21 15:29:24 +0000
+++ mockservice/wadl.xml	2010-06-14 12:47:24 +0000
@@ -488,6 +488,65 @@
         </wadl:request>
 
       </wadl:method>
+      <wadl:method id="registrations-request_password_reset_token" name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Generate a new captcha
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="request_password_reset_token">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email address.
+</wadl:doc>
+
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+
+      </wadl:method>
+      <wadl:method id="registrations-set_new_password" name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Generate a new captcha
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="set_new_password">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email address.
+</wadl:doc>
+
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Password reset token.
+</wadl:doc>
+
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="new_password">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+New password
+</wadl:doc>
+
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+
+      </wadl:method>
+
     </wadl:resource_type>