rhodecode/apps/admin/tests/test_admin_auth_settings.py

# Copyright (C) 2010-2024 RhodeCode GmbH
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License, version 3
# (only), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
# This program is dual-licensed. If you wish to learn more about the
# RhodeCode Enterprise Edition, including its added features, Support services,
# and proprietary license terms, please see https://rhodecode.com/licenses/

import pytest

from rhodecode.tests import assert_session_flash
from rhodecode.tests.utils import AssertResponse
from rhodecode.model.db import Session
from rhodecode.model.settings import SettingsModel


def assert_auth_settings_updated(response):
    assert response.status_int == 302, 'Expected response HTTP Found 302'
    assert_session_flash(response, 'Auth settings updated successfully')


@pytest.mark.usefixtures("autologin_user", "app")
class TestAuthSettingsView(object):

    def _enable_plugins(self, plugins_list, csrf_token, override=None,
                        verify_response=False):
        test_url = '/_admin/auth'
        params = {
            'auth_plugins': plugins_list,
            'csrf_token': csrf_token,
        }
        if override:
            params.update(override)
        _enabled_plugins = []
        for plugin in plugins_list.split(','):
            plugin_name = plugin.partition('#')[-1]
            enabled_plugin = '%s_enabled' % plugin_name
            cache_ttl = '%s_cache_ttl' % plugin_name

            # default params that are needed for each plugin,
            # `enabled` and `cache_ttl`
            params.update({
                enabled_plugin: True,
                cache_ttl: 0
            })
            _enabled_plugins.append(enabled_plugin)

        # we need to clean any enabled plugin before, since they require
        # form params to be present
        db_plugin = SettingsModel().get_setting_by_name('auth_plugins')
        db_plugin.app_settings_value = \
            'egg:rhodecode-enterprise-ce#rhodecode'
        Session().add(db_plugin)
        Session().commit()
        for _plugin in _enabled_plugins:
            db_plugin = SettingsModel().get_setting_by_name(_plugin)
            if db_plugin:
                Session().delete(db_plugin)
        Session().commit()

        response = self.app.post(url=test_url, params=params)

        if verify_response:
            assert_auth_settings_updated(response)
        return params

    def _post_ldap_settings(self, params, override=None, force=False):

        params.update({
            'filter': 'user',
            'user_member_of': '',
            'user_search_base': '',
            'user_search_filter': 'test_filter',

            'host': 'dc.example.com',
            'port': '999',
            'timeout': 3600,
            'tls_kind': 'PLAIN',
            'tls_reqcert': 'NEVER',
            'tls_cert_dir':'/etc/openldap/cacerts',
            'dn_user': 'test_user',
            'dn_pass': 'test_pass',
            'base_dn': 'test_base_dn',
            'search_scope': 'BASE',
            'attr_login': 'test_attr_login',
            'attr_firstname': 'ima',
            'attr_lastname': 'tester',
            'attr_email': '[e-mail]',
            'cache_ttl': '0',
        })
        if force:
            params = {}
        params.update(override or {})

        test_url = '/_admin/auth/ldap/'

        response = self.app.post(url=test_url, params=params)
        return response

    def test_index(self):
        response = self.app.get('/_admin/auth')
        response.mustcontain('Authentication Plugins')

    @pytest.mark.parametrize("disable_plugin, needs_import", [
        ('egg:rhodecode-enterprise-ce#headers', None),
        ('egg:rhodecode-enterprise-ce#crowd', None),
        ('egg:rhodecode-enterprise-ce#jasig_cas', None),
        ('egg:rhodecode-enterprise-ce#ldap', None),
        ('egg:rhodecode-enterprise-ce#pam',  "pam"),
    ])
    def test_disable_plugin(self, csrf_token, disable_plugin, needs_import):
        # TODO: johbo: "pam" is currently not available on darwin,
        # although the docs state that it should work on darwin.
        if needs_import:
            pytest.importorskip(needs_import)

        self._enable_plugins(
            'egg:rhodecode-enterprise-ce#rhodecode,' + disable_plugin,
            csrf_token, verify_response=True)

        self._enable_plugins(
            'egg:rhodecode-enterprise-ce#rhodecode', csrf_token,
            verify_response=True)

    def test_ldap_save_settings(self, csrf_token):
        params = self._enable_plugins(
            'egg:rhodecode-enterprise-ce#rhodecode,'
            'egg:rhodecode-enterprise-ce#ldap',
            csrf_token)
        response = self._post_ldap_settings(params)
        assert_auth_settings_updated(response)

        new_settings = SettingsModel().get_auth_settings()
        assert new_settings['auth_ldap_host'] == u'dc.example.com', \
            'fail db write compare'

    def test_ldap_error_form_wrong_port_number(self, csrf_token):
        params = self._enable_plugins(
            'egg:rhodecode-enterprise-ce#rhodecode,'
            'egg:rhodecode-enterprise-ce#ldap',
            csrf_token)
        invalid_port_value = 'invalid-port-number'
        response = self._post_ldap_settings(params, override={
            'port': invalid_port_value,
        })
        assertr = response.assert_response()
        assertr.element_contains(
            '.form .field #port ~ .error-message',
            invalid_port_value)

    def test_ldap_error_form(self, csrf_token):
        params = self._enable_plugins(
            'egg:rhodecode-enterprise-ce#rhodecode,'
            'egg:rhodecode-enterprise-ce#ldap',
            csrf_token)
        response = self._post_ldap_settings(params, override={
            'attr_login': '',
        })
        response.mustcontain("""<span class="error-message">The LDAP Login"""
                             """ attribute of the CN must be specified""")

    def test_post_ldap_group_settings(self, csrf_token):
        params = self._enable_plugins(
            'egg:rhodecode-enterprise-ce#rhodecode,'
            'egg:rhodecode-enterprise-ce#ldap',
            csrf_token)

        response = self._post_ldap_settings(params, override={
            'host': 'dc-legacy.example.com',
            'port': '999',
            'tls_kind': 'PLAIN',
            'tls_reqcert': 'NEVER',
            'dn_user': 'test_user',
            'dn_pass': 'test_pass',
            'base_dn': 'test_base_dn',
            'filter': 'test_filter',
            'search_scope': 'BASE',
            'attr_login': 'test_attr_login',
            'attr_firstname': 'ima',
            'attr_lastname': 'tester',
            'attr_email': '[e-mail]',
            'cache_ttl': '60',
            'csrf_token': csrf_token,
            }
        )
        assert_auth_settings_updated(response)

        new_settings = SettingsModel().get_auth_settings()
        assert new_settings['auth_ldap_host'] == u'dc-legacy.example.com', \
            'fail db write compare'