Merge lp:~jaboing/canonical-identity-provider/debug_paper_codes into lp:canonical-identity-provider/release

[Julien Funk]

Refactored login.py to test_device_login.py now uses the testclass format.

Refactored login.py to test_device_login.py now uses the testclass format.

[Leo Arias (elopio)]

<elopio> jfunk: why did you add
<elopio> 239␉+# -*- coding: utf-8 -*-
<elopio> ?
<jfunk> elopio, I never added that actually, don't know how or why
<jfunk> sometimes my trackpad does interesting things
<jfunk> I can delete that
<elopio> jfunk: did you merge with trunk?
<jfunk> elopio, yes
<elopio> weird then.
<elopio> jfunk: well, the thing with the encoding is that the pep says it should be added just if required.
<elopio> some people prefer to add it always.
<elopio> so we don't have a real preference on that. It just looked weird on your mp.
<jfunk> yeah agree
<elopio> jfunk: I would rename go_to_edit_preferences to go_to_your_account, as it has preferences and other information.
<jfunk> elopio, sure
<jfunk> elopio, the reason why I called it that is because the template is named 'edit.html'
<elopio> jfunk: on TwoFactorVerify, the title is not being used if you define the qa_anchor.
<elopio> jfunk: l. 101 is not aligned. It will fail on the pep8 test.
<jfunk> weird, I checked that out, thanks
<elopio> according to the clean code book, functions that receive booleans are terrible.
<elopio> on python I think they are not so bad, because we have keyword arguments, so I try no to use them a lot but I still find them useful
<elopio> on your branch, a nice example is self._set_twofactor(True)
<elopio> it will be more readable if you do self._set_twofactor(always_required=True)
<elopio> I think attempt_unverified_account_access shouldn't be part of the page.
<elopio> I think it will be only used once, by the test. So I'll move it to the test.
<elopio> and, I would keep the comment about bug #923814
<hal> Bug #923814: "Always require an auth device" doesn't! <http://launchpad.net/bugs/923814>
<elopio> jfunk: those are all my comments. Tests look really nice. Thanks again.
<elopio> and they will look even nicer tomorrow when I land the fixtures.
<jfunk> elopio, cool! I am going to try hard to get the rest of devices done this week

review: Needs Fixing

[lp:~jaboing/canonical-identity-provider/debug_paper_codes]

880. By Julien Funk on 2013-05-30

Merging with trunk.

881. By Julien Funk on 2013-05-30

resolved conflict with merge

[Natalia Bidart (nataliabidart)]

Setting MP as Rejected to reduce numbers of landing candidates in @reviewlist. Change status again if this MP is still current.

Unmerged revisions

881. By Julien Funk on 2013-05-30

resolved conflict with merge

880. By Julien Funk on 2013-05-30

Merging with trunk.

879. By Julien Funk on 2013-05-23

merging with latest

878. By Julien Funk on 2013-05-23

refactored the 2F tests from login.py to use the testcase class format

877. By Julien Funk on 2013-05-22

updating my branch with latest from trunk

876. By Julien Funk on 2013-05-21

merging after new pull

875. By Julien Funk on 2013-05-21

In progress of writing test_device_login with changes to pages.py

=== modified file 'acceptance/pages.py'
--- acceptance/pages.py	2013-05-28 07:18:34 +0000
+++ acceptance/pages.py	2013-05-30 22:51:25 +0000
@@ -33,6 +33,16 @@
         sst.actions.click_link('devices-link')
         return YourAuthenticationDevices()
 
+    @log_action(logging.info)
+    def go_to_your_account(self):
+        sst.actions.click_link('account-link')
+        return YourAccount(self.get_user_name())
+
+    @log_action(logging.info)
+    def log_out(self):
+        sst.actions.click_link('logout-link')
+        return YouHaveBeenLoggedOut()
+
 
 class PageWithUsernameInTitle(PageWithUserSubheader):
 
@@ -50,6 +60,9 @@
 
     """
 
+    url_path = '(/|/\+login)'
+    is_url_path_regex = True
+
     @log_action(logging.info)
     def log_in_to_site_recognized(self, user=None):
         """Fill the log in form and continue to the site that requested it.
@@ -64,6 +77,71 @@
         self._log_in(user)
         return YourAccount()
 
+    @log_action(logging.info)
+    def log_in_with_two_factor(self, user=None):
+        """Fill the log in form and continue to two factor authentication."""
+        self._log_in(user)
+        return TwoFactorVerify()
+
+
+class TwoFactorVerify(PageWithUserSubheader):
+    """The page where customer is prompted for a 2FA key"""
+
+    url_path = '/two_factor_auth.*'
+    is_url_path_regex = True
+    qa_anchor = 'two_factor_verify'
+
+    @log_action(logging.info)
+    def two_factor_authentication(self, one_time_password):
+        self._fill_one_time_password_form(one_time_password)
+        self._click_authenticate()
+        return YourAccount(self.subheader.get_user_name())
+
+    @log_action(logging.info)
+    def authenticate_2F_with_error(self, bad_password):
+        self._fill_one_time_password_form(bad_password)
+        self._click_authenticate()
+        return TwoFactorVerify()
+
+    @log_action(logging.info)
+    def last_2F_attempt_with_error(self, bad_password):
+        self._fill_one_time_password_form(bad_password)
+        self._click_authenticate()
+        return YouAreSuspendedSucka()
+
+    def _fill_one_time_password_form(self, one_time_password):
+        sst.actions.write_textfield('id_oath_token', one_time_password)
+
+    def _click_authenticate(self):
+        auth_button = sst.actions.get_element_by_css(
+            '*[data-qa-id="auth_button"]')
+        sst.actions.click_button(auth_button)
+
+    def get_form_errors(self):
+        try:
+            one_time_password_error = sst.actions.get_element(
+                css_class='error').text
+        except AssertionError:
+            one_time_password_error = None
+        return one_time_password_error
+
+
+class YouHaveBeenLoggedOut(u1testutils.sso.sst.pages.YouHaveBeenLoggedOut):
+    """The logged out landing page of the Ubuntu Single Sign On website."""
+
+    @log_action(logging.info)
+    def click_log_in_or_create_account(self):
+        sst.actions.click_link('login-link')
+        return LogIn()
+
+
+class  YouAreSuspendedSucka(u1testutils.sst.Page):
+    """This is the page you are given if you fail 2 Factor 18 times."""
+
+    title = 'Rate limit exceeded'
+    url_path = '/+suspended'
+    qa_anchor = 'account_suspended'
+
 
 class YourAccount(PageWithUserSubheader):
     """Your account page of the Ubuntu Single Sign On website.
@@ -76,6 +154,24 @@
     url_path = '/'
     qa_anchor = 'edit_account'
 
+    def _set_twofactor(self, required):
+        radio = sst.actions.get_element(tag="input", name="twofactor_required",
+                                        value=required)
+        sst.actions.set_radio_value(radio)
+
+    @log_action(logging.info)
+    def set_twofactor_to_always_required(self):
+        self._set_twofactor(always_required=True)
+
+    @log_action(logging.info)
+    def set_twofactor_to_required_as_needed(self):
+        self._set_twofactor(always_required=False)
+
+    @log_action(logging.info)
+    def click_update_button(self):
+        sst.actions.click_button(sst.actions.get_element_by_css(
+            '*[data-qa-id="update_preferences"]'))
+
 
 class YourEmailAddresses(u1testutils.sso.sst.pages.PageWithUserSubheader):
 

=== renamed file 'acceptance/tests/devices/scripts/login.py' => 'acceptance/tests/devices/scripts/test_device_login.py'
--- acceptance/tests/devices/scripts/login.py	2013-05-27 17:53:40 +0000
+++ acceptance/tests/devices/scripts/test_device_login.py	2013-05-30 22:51:25 +0000
@@ -1,57 +1,90 @@
-# Test logging in with two factor authentication
+# Copyright 2012, 2013 Canonical Ltd.
+# This software is licensed under the GNU Affero General Public License
+# version 3 (see the file LICENSE).
+
 from sst.actions import (
     assert_displayed,
-    assert_text,
-    assert_url,
-    click_link,
-    get_base_url,
-    get_element,
-    go_to,
+    assert_element,
+    wait_for,
 )
 from u1testutils.sst import config
 
+from acceptance import helpers
 from acceptance.devices import (
     add_device,
-    authenticate,
     enter_otp,
 )
-from acceptance import helpers
-
-
-config.set_base_url_from_env()
-base_url = get_base_url()
-
-email = helpers.login_or_register_account(device_cleanup=True)
-
-# Go to the authentication devices page
-click_link('devices-link')
-
-# Add an authentication device
-add_device('login')
-
-# Change the preference to always require 2 factor authentication and save
-helpers.set_twofactor_to_always_required()
-
-# Logout and attempt to log back in
-helpers.logout_and_in()
-
-#   Should insist on 2F and not give access to '/'
-# In response to defect #923814
-go_to(base_url)
-
-# Check we are on the 2-factor login page
-assert_displayed('id_oath_token')
-
-# Enter an invalid password and submit
-enter_otp('foo bar baz')
-
-# Check an error message is shown and we are not logged in
-assert_displayed('id_oath_token')
-assert_text(get_element(css_class='error'),
+
+import pdb
+
+import sst.actions
+
+from oath import hotp
+
+from acceptance import base
+
+
+class TestDeviceLogin(base.SSTTestCaseWithLogIn):
+
+    def navigate_to_page(self):
+        """Go to the AddNewAuthenticationDevice page.
+
+        It will be accessible for the tests from the page attribute.
+
+        """
+        # 'start' is the base YourAccount page object.
+        start = super(TestDeviceLogin, self).navigate_to_page()
+        auth_devices = start.subheader.go_to_authentication_devices()
+        return auth_devices.add_new_authentication_device()
+
+    def test_account_suspension(self):
+        pdb.set_trace()
+        from time import sleep
+        two_f_page = self._set_two_factor_required_then_logout_and_in()
+        for _ in range(17):
+            two_f_page = two_f_page.authenticate_2F_with_error('bad pass')
+        suspended_page = two_f_page.last_2F_attempt_with_error('bad pass')
+        self.assertEqual(suspended_page.qa_anchor, 'account_suspended')
+
+        #for _ in range(18):
+            ## Check we are on the 2-factor login page
+            #wait_for(assert_displayed, 'id_oath_token')
+            ## Enter an incorrect password and submit
+            #enter_otp('12345678')
+        ## The account is now suspended
+        #assert_element(tag='h1', text='Account suspended')
+
+    def _set_two_factor_required_then_logout_and_in(self):
+        add_generic_device_page = self.page.add_generic_device()
+        self.aes_key = add_generic_device_page.get_key()
+        one_time_pass = hotp.hotp(self.aes_key, 0)
+        auth_devices_page = add_generic_device_page.add_device(
+            'Test generic device', one_time_pass)
+        your_account_page = auth_devices_page.subheader.go_to_your_account()
+        your_account_page.set_twofactor_to_always_required()
+        your_account_page.click_update_button()
+        logout_landing_page = your_account_page.subheader.log_out()
+        login_page = logout_landing_page.click_log_in_or_create_account()
+        return login_page.log_in_with_two_factor(self.user)
+"""
+    def test_login_with_generic_device(self):
+        two_factor_page = self._set_two_factor_required_then_logout_and_in()
+        one_time_pass = hotp.hotp(self.aes_key, 1)
+        account_page = two_factor_page.two_factor_authentication(one_time_pass)
+        self.assertEqual(account_page.qa_anchor, 'edit_account')
+
+    def test_invalid_two_factor_password(self):
+        two_factor_page = self._set_two_factor_required_then_logout_and_in()
+        two_factor_page = two_factor_page.authenticate_2F_with_error('bad pass')
+        one_time_password_error = two_factor_page.get_form_errors()
+        self.assertEqual(
+            one_time_password_error,
             'Please enter a 6-digit or 8-digit one-time password.')
 
-# Enter a valid one time password
-authenticate('login')
-
-# Check we are now logged in
-assert_url('/')
+    def test_attempt_skipping_two_factor_prompt(self):
+        two_factor_page = self._set_two_factor_required_then_logout_and_in()
+        # Should insist on 2F and not give access to '/'
+        # In response to defect 923814
+        sst.actions.go_to('/')
+        self.assertEqual(two_factor_page.qa_anchor, 'two_factor_verify')
+"""
\ No newline at end of file

=== modified file 'webui/models.py'
--- webui/models.py	2012-12-03 17:50:53 +0000
+++ webui/models.py	2013-05-30 22:51:25 +0000
@@ -0,0 +1,1 @@
+# -*- coding: utf-8 -*-

=== modified file 'webui/templates/account/edit.html'
--- webui/templates/account/edit.html	2013-05-15 07:47:10 +0000
+++ webui/templates/account/edit.html	2013-05-30 22:51:25 +0000
@@ -145,7 +145,7 @@
 
     <p class="actions">
     {% if not readonly %}
-        <button type="submit" class="btn" name="update"><span><span>{% trans "Update" %}</span></span></button>
+        <button type="submit" class="btn" name="update" data-qa-id="update_preferences"><span><span>{% trans "Update" %}</span></span></button>
     {% endif %}
     {% if token %}
         {% trans "or" %}

=== modified file 'webui/templates/account/suspended.html'
--- webui/templates/account/suspended.html	2010-07-12 19:11:15 +0000
+++ webui/templates/account/suspended.html	2013-05-30 22:51:25 +0000
@@ -6,6 +6,8 @@
 GNU Affero General Public License version 3 (see the file  LICENSE).
 {% endcomment %}
 
+{% block html_extra %}data-qa-id="account_suspended"{% endblock %}
+
 {% block title %}{% trans "Account suspended" %}{% endblock %}
 
 {% block text_title %}

=== modified file 'webui/templates/ubuntu/registration/twofactor.html'
--- webui/templates/ubuntu/registration/twofactor.html	2013-04-17 13:23:35 +0000
+++ webui/templates/ubuntu/registration/twofactor.html	2013-05-30 22:51:25 +0000
@@ -3,6 +3,8 @@
 {% load i18n %}
 {% load static_url %}
 
+{% block html_extra %}data-qa-id="two_factor_verify"{% endblock %}
+
 {% block leftcol %}
 <div id="auth">
     {% if rpconfig %}
@@ -40,7 +42,7 @@
 
         <div class="actions">
             {% if next %}<input type="hidden" name="next" value="{{ next }}" />{% endif %}
-            <button type="submit" class="btn" name="continue"><span><span>{% trans "Authenticate" %}</span></span></button>
+            <button type="submit" class="btn" name="continue" data-qa-id="auth_button"><span><span>{% trans "Authenticate" %}</span></span></button>
             {% if token %}{% trans "or" %}
             {% include "common/cancel_link.html" %}{% endif %}
         </div>