Merge lp:~salgado/launchpad/bug-415977 into lp:launchpad

[Guilherme Salgado]

[Guilherme Salgado (salgado)]

= Summary =

I created this branch to fix bug 415977, but after having a look at
xx-resetpassword.txt I realized a good chunk of it (i.e. the tests of
corner cases) could be turned into view tests, so I did that.

== Proposed fix ==

== Pre-implementation notes ==

== Implementation details ==

== Tests ==

./bin/test -vvt test_password_reset

== Demo and Q/A ==

= Launchpad lint =

Checking for conflicts. and issues in doctests and templates.
Running jslint, xmllint, pyflakes, and pylint.
Using normal rules.

Linting changed files:
  lib/canonical/launchpad/browser/tests/test_password_reset.py
  lib/lp/registry/stories/foaf/xx-resetpassword.txt

[Abel Deuring (adeuring)]

review: Approve (code)

=== modified file 'lib/canonical/launchpad/browser/tests/test_password_reset.py'
--- lib/canonical/launchpad/browser/tests/test_password_reset.py	2009-10-26 15:03:24 +0000
+++ lib/canonical/launchpad/browser/tests/test_password_reset.py	2009-10-29 15:25:21 +0000
@@ -4,6 +4,7 @@
 import unittest
 
 from zope.component import getUtility
+from zope.security.proxy import removeSecurityProxy
 
 import transaction
 from canonical.launchpad.browser.logintoken import ResetPasswordView
@@ -12,43 +13,81 @@
 from canonical.launchpad.interfaces.authtoken import LoginTokenType
 from canonical.launchpad.interfaces.emailaddress import EmailAddressStatus
 from canonical.launchpad.interfaces.logintoken import ILoginTokenSet
+from canonical.launchpad.interfaces.lpstorm import IMasterObject
 from lp.testing import TestCaseWithFactory
 from canonical.testing import DatabaseFunctionalLayer
 
 
 class TestPasswordReset(TestCaseWithFactory):
     layer = DatabaseFunctionalLayer
+    email = '[e-mail]'
 
-    def setUp(self):
-        TestCaseWithFactory.setUp(self)
-        self.email = '[e-mail]'
+    def _create_inactive_person(self):
         self.person = self.factory.makePerson(
             email=self.email, email_address_status=EmailAddressStatus.NEW)
         self.account = self.person.account
+        self.assertEquals(self.account.status, AccountStatus.NOACCOUNT)
 
     def test_inactive_accounts_are_activated(self):
         # Resetting the password of an account in the NOACCOUNT state will
         # activate it.
-        self.assertEquals(self.account.status, AccountStatus.NOACCOUNT)
+        self._create_inactive_person()
+        self._resetPassword(ensure_no_errors=True)
+        self.assertEquals(self.account.status, AccountStatus.ACTIVE)
+        self.assertEquals(
+            self.account.preferredemail.email, '[e-mail]')
+
+    def _create_deactivated_person(self):
+        self.person = self.factory.makePerson(email=self.email)
+        removeSecurityProxy(self.person.deactivateAccount('Testing'))
+        # Get the account from the master DB to make sure it has the changes
+        # we did above.
+        self.account = IMasterObject(self.person.account)
+        self.assertEquals(self.account.status, AccountStatus.DEACTIVATED)
+
+    def test_deactivated_accounts_are_reactivated(self):
+        # Resetting the password of an account in the DEACTIVATED state will
+        # reactivate it.
+        self._create_deactivated_person()
+        self._resetPassword(ensure_no_errors=True)
+        self.assertEquals(self.account.status, AccountStatus.ACTIVE)
+        self.assertEquals(
+            self.account.preferredemail.email, '[e-mail]')
+
+    def _create_suspended_person(self):
+        self.person = self.factory.makePerson(email=self.email)
+        # Get the account from the master DB as we're going to change it.
+        self.account = IMasterObject(self.person.account)
+        removeSecurityProxy(self.account).status = AccountStatus.SUSPENDED
+        self.assertEquals(self.account.status, AccountStatus.SUSPENDED)
+
+    def test_suspended_accounts_cannot_reset_password(self):
+        # It's not possible to reset the password of a SUSPENDED account.
+        self._create_suspended_person()
+        harness = self._resetPassword()
+        notifications = [notification.message
+                         for notification in harness.request.notifications]
+        self.assertIn(
+            'Your password cannot be reset because your account is suspended',
+            '\n'.join(notifications))
+        self.assertEquals(self.account.status, AccountStatus.SUSPENDED)
+
+    def _resetPassword(self, ensure_no_errors=False):
         token = getUtility(ILoginTokenSet).new(
             self.person, self.email, self.email,
             LoginTokenType.PASSWORDRECOVERY)
-        self._completePasswordReset(token)
-        self.assertEquals(self.account.status, AccountStatus.ACTIVE)
-        self.assertEquals(
-            self.account.preferredemail.email, '[e-mail]')
-
-    def _completePasswordReset(self, token):
         harness = LaunchpadFormHarness(token, ResetPasswordView)
         form = {'field.email': self.email,
                 'field.password': 'test',
                 'field.password_dupe': 'test'}
         harness.submit('continue', form)
-        self.assertFalse(harness.hasErrors())
+        if ensure_no_errors:
+            self.assertFalse(harness.hasErrors())
         # Need to manually commit because we're interested in testing the
         # changes done by the view on the token's requester (i.e.
         # self.person).
         transaction.commit()
+        return harness
 
 
 def test_suite():

=== modified file 'lib/lp/registry/stories/foaf/xx-resetpassword.txt'
--- lib/lp/registry/stories/foaf/xx-resetpassword.txt	2009-10-16 16:13:00 +0000
+++ lib/lp/registry/stories/foaf/xx-resetpassword.txt	2009-10-29 15:25:21 +0000
@@ -184,165 +184,3 @@
     >>> print_feedback_messages(browser.contents)
     The email address [e-mail]
     belongs to a team, and teams cannot log in to Launchpad.
-
-
-== Reactivating an account ==
-
-Users can reactivate their account using the reset password feature.
-
-    # Create a new person and deactivate it. This is just so that we can show
-    # that it can be reactivated.
-    >>> login(ANONYMOUS)
-    >>> person = factory.makePerson(name='person', password='foo')
-    >>> email = person.preferredemail.email
-    >>> login_person(person)
-    >>> person.deactivateAccount('Testing')
-    >>> logout()
-    >>> transaction.commit()
-    >>> deactivated_person = person
-    >>> deactivated_person.account.status
-    <DBItem AccountStatus.DEACTIVATED...
-
-Former User realises his life is incomplete without Launchpad. He
-tries to login, but his password does not work anymore.
-
-    >>> browser = setupBrowser()
-    >>> browser.open('http://launchpad.dev/')
-    >>> browser.getLink('Log in / Register').click()
-    >>> browser.getControl('E-mail address:', index=0).value = email
-    >>> browser.getControl('Password').value = 'foo'
-    >>> browser.getControl('Log In').click()
-    >>> browser.title
-    'Log in or register with Launchpad'
-
-    >>> print_feedback_messages(browser.contents)
-    The email address belongs to a deactivated account. Use the
-    "Forgotten your password" link to reactivate it.
-
-He requests a new password.
-
-    >>> browser.getLink('Forgotten your password?').click()
-    >>> browser.title
-    'Need a new Launchpad password?'
-
-    >>> browser.getControl(name='email').value = (
-    ...     '[e-mail]')
-    >>> set_captcha_answer(browser)
-    >>> browser.getControl('Request Reset').click()
-
-    >>> print extract_text(find_main_content(browser.contents).p)
-    We have sent you an email with instructions to reset your password.
-
-He retrieves the URL form the email and opens it in his browser.
-
-    >>> len(stub.test_emails)
-    1
-    >>> from_addr, to_addrs, raw_msg = stub.test_emails.pop()
-    >>> link = get_token_url_from_email(raw_msg)
-    >>> to_addrs
-    ['[e-mail]']
-    >>> link
-    'http://launchpad.dev/token/...'
-
-    >>> browser.open(link)
-    >>> browser.url
-    'http://launchpad.dev/token/.../+resetpassword'
-
-Former User types his password twice to verify it and submits
-it with the Continue button. He is happy to see his name is restored
-in the URL.
-
-    >>> browser.getControl(
-    ...     name='field.email').value = '[e-mail]'
-    >>> browser.getControl(name='field.password').value = 'test'
-    >>> browser.getControl(name='field.password_dupe').value = 'test'
-    >>> browser.getControl('Continue').click()
-
-    >>> browser.url
-    'http://launchpad.dev'
-
-    >>> print_feedback_messages(browser.contents)
-    Welcome back to Launchpad.
-    Your password has been reset successfully.
-
-    >>> print find_tag_by_id(browser.contents, 'not-lp-user-or-team')
-    None
-
-
-== Suspended accounts cannot reset their password ==
-
-Users with suspended accounts cannot use reset password to gain access
-to their accounts.
-
-    # Open up the black box and shine a light on the test's inner workings.
-    # Create a user with a SUSPENDED account.
-    >>> from canonical.launchpad.interfaces.account import AccountStatus
-
-    # Only admins can suspend an account.
-    >>> login('[e-mail]')
-    >>> bad_user = factory.makePerson(
-    ...     email='[e-mail]',
-    ...     name='bad-user',
-    ...     password='invalid')
-    >>> from canonical.launchpad.interfaces import IMasterObject
-    >>> IMasterObject(bad_user.account).status = AccountStatus.SUSPENDED
-    >>> logout()
-
-    >>> import transaction
-    >>> transaction.commit()
-
-Bad User has a suspended account. He discovers that his account is disabled
-when he visits his profile page.
-
-    >>> browser = setupBrowser()
-    >>> browser.open('http://launchpad.dev/~bad-user')
-    >>> browser.title
-    'Bad-user does not use Launchpad'
-
-He believes he can reactivate his account by resetting his password. He
-requests an email that will have the link that will let him provide a
-new password.
-
-    >>> browser.getLink('Log in / Register').click()
-    >>> browser.title
-    'Log in or register with Launchpad'
-
-    >>> browser.getLink('Forgotten your password?').click()
-    >>> browser.title
-    'Need a new Launchpad password?'
-    >>> browser.getControl(name='email').value = (
-    ...     '[e-mail]')
-    >>> set_captcha_answer(browser)
-    >>> browser.getControl('Request Reset').click()
-
-    >>> print extract_text(find_main_content(browser.contents).p)
-    We have sent you an email with instructions to reset your password.
-
-Bad User retrieves the URL from the email and opens it in his browser.
-
-    >>> len(stub.test_emails)
-    1
-    >>> from_addr, to_addrs, raw_msg = stub.test_emails.pop()
-    >>> link = get_token_url_from_email(raw_msg)
-    >>> to_addrs
-    ['[e-mail]']
-    >>> link
-    'http://launchpad.dev/token/...'
-
-    >>> browser.open(link)
-    >>> browser.url
-    'http://launchpad.dev/token/.../+resetpassword'
-
-Bad User types his password twice to verify it and submits it with the
-Continue button. He is disappointed to see that his account is still
-suspended, and that he is instructed to contact admin.
-
-    >>> browser.getControl(
-    ...     name='field.email').value = '[e-mail]'
-    >>> browser.getControl(name='field.password').value = 'test'
-    >>> browser.getControl(name='field.password_dupe').value = 'test'
-    >>> browser.getControl('Continue').click()
-
-    >>> print_feedback_messages(browser.contents)
-    Your password cannot be reset because your account is suspended.
-    Contact a Launchpad admin about this issue.