auth: UI changes

- make buttons wider to handle longer names for SAML plugins
- make order of plugins sorted again because it tends to jump arround in order
  without that sorting.
- social is now external auth

rhodecode/authentication/routes.py

@@ -1,155 +1,155 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 import collections
 
 from pyramid.exceptions import ConfigurationError
 
 from rhodecode.lib.utils2 import safe_str
 from rhodecode.model.settings import SettingsModel
 from rhodecode.translation import _
 
 
 log = logging.getLogger(__name__)
 
 
 class AuthnResourceBase(object):
     __name__ = None
     __parent__ = None
 
     def get_root(self):
         current = self
         while current.__parent__ is not None:
             current = current.__parent__
         return current
 
 
 class AuthnPluginResourceBase(AuthnResourceBase):
 
     def __init__(self, plugin):
         self.plugin = plugin
         self.__name__ = plugin.get_url_slug()
         self.display_name = plugin.get_display_name()
 
 
 class AuthnRootResource(AuthnResourceBase):
     """
     This is the root traversal resource object for the authentication settings.
     """
 
     def __init__(self):
         self._store = collections.OrderedDict()
         self._resource_name_map = {}
         self.display_name = _('Authentication Plugins')
 
     def __getitem__(self, key):
         """
         Customized get item function to return only items (plugins) that are
         activated.
         """
         if self._is_item_active(key):
             return self._store[key]
         else:
             raise KeyError('Authentication plugin "{}" is not active.'.format(
                 key))
 
     def __iter__(self):
         for key in self._store.keys():
             if self._is_item_active(key):
                 yield self._store[key]
 
     def _is_item_active(self, key):
         activated_plugins = SettingsModel().get_auth_plugins()
         plugin_id = self.get_plugin_id(key)
         return plugin_id in activated_plugins
 
     def get_plugin_id(self, resource_name):
         """
         Return the plugin id for the given traversal resource name.
         """
         # TODO: Store this info in the resource element.
         return self._resource_name_map[resource_name]
 
-    def get_sorted_list(self):
+    def get_sorted_list(self, sort_key=None):
         """
         Returns a sorted list of sub resources for displaying purposes.
         """
-        def sort_key(resource):
+        def default_sort_key(resource):
             return str.lower(safe_str(resource.display_name))
 
         active = [item for item in self]
-        return sorted(active, key=sort_key)
+        return sorted(active, key=sort_key or default_sort_key)
 
     def get_nav_list(self, sort=True):
         """
         Returns a sorted list of resources for displaying the navigation.
         """
         if sort:
             nav_list = self.get_sorted_list()
         else:
             nav_list = [item for item in self]
 
         nav_list.insert(0, self)
         return nav_list
 
     def add_authn_resource(self, config, plugin_id, resource):
         """
         Register a traversal resource as a sub element to the authentication
         settings. This method is registered as a directive on the pyramid
         configurator object and called by plugins.
         """
 
         def _ensure_unique_name(name, limit=100):
             counter = 1
             current = name
             while current in self._store.keys():
                 current = '{}{}'.format(name, counter)
                 counter += 1
                 if counter > limit:
                     raise ConfigurationError(
                         'Cannot build unique name for traversal resource "%s" '
                         'registered by plugin "%s"', name, plugin_id)
             return current
 
         # Allow plugin resources with identical names by rename duplicates.
         unique_name = _ensure_unique_name(resource.__name__)
         if unique_name != resource.__name__:
             log.warn('Name collision for traversal resource "%s" registered '
                      'by authentication plugin "%s"', resource.__name__,
                      plugin_id)
             resource.__name__ = unique_name
 
         log.debug('Register traversal resource "%s" for plugin "%s"',
                   unique_name, plugin_id)
         self._resource_name_map[unique_name] = plugin_id
         resource.__parent__ = self
         self._store[unique_name] = resource
 
 
 root = AuthnRootResource()
 
 
 def root_factory(request=None):
     """
     Returns the root traversal resource instance used for the authentication
     settings route.
     """
     return root

rhodecode/public/css/buttons.less

@@ -1,418 +1,418 b''
 
 
 //BUTTONS
 button,
 .btn,
 input[type="button"] {
     -webkit-appearance: none;
     display: inline-block;
     margin: 0 @padding/3 0 0;
     padding: @button-padding;
     text-align: center;
     font-size: @basefontsize;
     line-height: 1em;
     font-family: @text-light;
     text-decoration: none;
     text-shadow: none;
     color: @grey4;
     background-color: white;
     background-image: none;
     border: none;
     .border ( @border-thickness-buttons, @grey4 );
     .border-radius (@border-radius);
     cursor: pointer;
     white-space: nowrap;
     -webkit-transition: background .3s,color .3s;
        -moz-transition: background .3s,color .3s;
          -o-transition: background .3s,color .3s;
             transition: background .3s,color .3s;
 
     a {
         display: block;
         margin: 0;
         padding: 0;
         color: inherit;
         text-decoration: none;
 
         &:hover {
             text-decoration: none;
         }
     }
 
     &:focus,
     &:active {
         outline:none;
     }
     &:hover {
         color: white;
         background-color: @grey4;
     }
 
     .icon-remove-sign {
         display: none;
     }
 
     //disabled buttons
     //last; overrides any other styles
     &:disabled {
         opacity: .7;
         cursor: auto;
         background-color: white;
         color: @grey4;
         text-shadow: none;
     }
 
     &.no-margin {
         margin: 0 0 0 0;
     }
 
 }
 
 
 .btn-default {
     .border ( @border-thickness-buttons, @rcblue );
     background-image: none;
     color: @rcblue;
 
     a {
         color: @rcblue;
     }
 
     &:hover,
     &.active {
         color: white;
         background-color: @rcdarkblue;
         .border ( @border-thickness, @rcdarkblue );
 
         a {
             color: white;
         }
     }
     &:disabled {
         .border ( @border-thickness-buttons, @grey4 );
         background-color: transparent;
     }
 }
 
 .btn-primary,
 .btn-small, /* TODO: anderson: remove .btn-small to not mix with the new btn-sm */
 .btn-success {
     .border ( @border-thickness, @rcblue );
     background-color: @rcblue;
     color: white;
 
     a {
         color: white;
     }
 
     &:hover,
     &.active {
         .border ( @border-thickness, @rcdarkblue );
         color: white;
         background-color: @rcdarkblue;
 
         a {
             color: white;
         }
     }
     &:disabled {
         background-color: @rcblue;
     }
 }
 
 .btn-secondary {
     &:extend(.btn-default);
 
     background-color: white;
 
     &:focus {
         outline: 0;
     }
 
     &:hover {
         &:extend(.btn-default:hover);
     }
 
     &.btn-link {
         &:extend(.btn-link);
         color: @rcblue;
     }
 
     &:disabled {
         color: @rcblue;
         background-color: white;
     }
 }
 
 .btn-warning,
 .btn-danger,
 .revoke_perm,
 .btn-x,
 .form .action_button.btn-x   {
     .border ( @border-thickness, @alert2 );
     background-color: white;
     color: @alert2;
 
     a {
         color: @alert2;
     }
 
     &:hover,
     &.active {
         .border ( @border-thickness, @alert2 );
         color: white;
         background-color: @alert2;
 
         a {
             color: white;
         }
     }
 
     i {
         display:none;
     }
 
     &:disabled {
         background-color: white;
         color: @alert2;
     }
 }
 
 .btn-approved-status {
     .border ( @border-thickness, @alert1 );
     background-color: white;
     color: @alert1;
 
 }
 
 .btn-rejected-status {
     .border ( @border-thickness, @alert2 );
     background-color: white;
     color: @alert2;
 }
 
 .btn-sm,
 .btn-mini,
 .field-sm .btn {
     padding: @padding/3;
 }
 
 .btn-xs {
     padding: @padding/4;
 }
 
 .btn-lg {
     padding: @padding * 1.2;
 }
 
 .btn-group {
     display: inline-block;
     .btn {
         float: left;
         margin: 0 0 0 -1px;
     }
 }
 
 .btn-link {
     background: transparent;
     border: none;
     padding: 0;
     color: @rcblue;
 
     &:hover {
         background: transparent;
         border: none;
         color: @rcdarkblue;
     }
 
     //disabled buttons
     //last; overrides any other styles
     &:disabled {
         opacity: .7;
         cursor: auto;
         background-color: white;
         color: @grey4;
         text-shadow: none;
     }
 
     // TODO: johbo: Check if we can avoid this, indicates that the structure
     // is not yet good.
     // lisa: The button CSS reflects the button HTML; both need a cleanup.
     &.btn-danger {
         color: @alert2;
 
         &:hover {
             color: darken(@alert2,30%);
         }
 
         &:disabled {
             color: @alert2;
         }
     }
 }
 
 .btn-social {
     &:extend(.btn-default);
     margin: 5px 5px 5px 0px;
-    min-width: 150px;
+    min-width: 160px;
 }
 
 // TODO: johbo: check these exceptions
 
 .links {
 
     .btn + .btn {
         margin-top: @padding;
     }
 }
 
 
 .action_button {
     display:inline;
     margin: 0;
     padding: 0 1em 0 0;
     font-size: inherit;
     color: @rcblue;
     border: none;
     border-radius: 0;
     background-color: transparent;
 
     &.last-item {
         border: none;
         padding: 0 0 0 0;
     }
 
     &:last-child {
         border: none;
         padding: 0 0 0 0;
     }
 
     &:hover {
         color: @rcdarkblue;
         background-color: transparent;
         border: none;
     }
 }
 .grid_delete {
     .action_button {
         border: none;
     }
 }
 
 
 // TODO: johbo: Form button tweaks, check if we can use the classes instead
 input[type="submit"] {
     &:extend(.btn-primary);
 
     &:focus {
         outline: 0;
     }
 
     &:hover {
         &:extend(.btn-primary:hover);
     }
 
     &.btn-link {
         &:extend(.btn-link);
         color: @rcblue;
 
         &:disabled {
             color: @rcblue;
             background-color: transparent;
         }
     }
 
     &:disabled {
         .border ( @border-thickness-buttons, @rcblue );
         background-color: @rcblue;
         color: white;
     }
 }
 
 input[type="reset"] {
     &:extend(.btn-default);
 
     // TODO: johbo: Check if this tweak can be avoided.
     background: transparent;
 
     &:focus {
         outline: 0;
     }
 
     &:hover {
         &:extend(.btn-default:hover);
     }
 
     &.btn-link {
         &:extend(.btn-link);
         color: @rcblue;
 
         &:disabled {
             border: none;
         }
     }
 
     &:disabled {
         .border ( @border-thickness-buttons, @rcblue );
         background-color: white;
         color: @rcblue;
     }
 }
 
 input[type="submit"],
 input[type="reset"] {
     &.btn-danger {
         &:extend(.btn-danger);
 
         &:focus {
             outline: 0;
         }
 
         &:hover {
             &:extend(.btn-danger:hover);
         }
 
         &.btn-link {
             &:extend(.btn-link);
             color: @alert2;
 
             &:hover {
                 color: darken(@alert2,30%);
             }
         }
 
         &:disabled {
             color: @alert2;
             background-color: white;
         }
     }
     &.btn-danger-action {
         .border ( @border-thickness, @alert2 );
         background-color: @alert2;
         color: white;
 
         a {
             color: white;
         }
 
         &:hover {
             background-color: darken(@alert2,20%);
         }
 
         &.active {
             .border ( @border-thickness, @alert2 );
             color: white;
             background-color: @alert2;
 
             a {
                 color: white;
             }
         }
 
         &:disabled {
             background-color: white;
             color: @alert2;
         }
     }
 }
 

rhodecode/templates/admin/auth/auth_settings.mako

@@ -1,124 +1,124 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Authentication Settings')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
     ${_('Authentication Plugins')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 
 <div class="box">
   <div class="title">
     ${self.breadcrumbs()}
   </div>
 
   <div class='sidebar-col-wrapper'>
 
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
-          % for item in resource.get_root().get_nav_list(sort=False):
+          % for item in resource.get_root().get_nav_list():
             <li ${'class=active' if item == resource else ''}>
               <a href="${request.resource_path(item, route_name='auth_home')}">${item.display_name}</a>
             </li>
           % endfor
         </ul>
     </div>
 
     <div class="main-content-full-width">
       ${h.secure_form(request.resource_path(resource, route_name='auth_home'), request=request)}
         <div class="panel panel-default">
 
           <div class="panel-heading">
             <h3 class="panel-title">${_("Enabled and Available Plugins")}</h3>
           </div>
 
           <div class="panel-body">
 
 
               <div class="label">${_("Ordered Enabled Plugins")}</div>
               <div class="textarea text-area editor">
                   ${h.textarea('auth_plugins',cols=120,rows=20,class_="medium")}
               </div>
               <div class="field">
                 <p class="help-block pre-formatting">${_('List of plugins, separated by commas.'
                   '\nThe order of the plugins is also the order in which '
                   'RhodeCode Enterprise will try to authenticate a user.')}
                 </p>
               </div>
 
               <table class="rctable">
                   <th>${_('Activate')}</th>
                   <th>${_('Plugin Name')}</th>
                   <th>${_('Documentation')}</th>
                   <th>${_('Plugin ID')}</th>
                   %for plugin in available_plugins:
                       <tr>
                           <td>
                             <span plugin_id="${plugin.get_id()}" class="toggle-plugin btn ${'btn-success' if plugin.get_id() in enabled_plugins else ''}">
                               ${_('enabled') if plugin.get_id() in enabled_plugins else _('disabled')}
                             </span>
                           </td>
                           <td>${plugin.get_display_name()}</td>
                           <td>
                               % if plugin.docs():
                                 <a href="${plugin.docs()}">docs</a>
                               % endif
                           </td>
                           <td>${plugin.get_id()}</td>
                       </tr>
                   %endfor
               </table>
 
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
             </div>
           </div>
         </div>
       ${h.end_form()}
     </div>
   </div>
 </div>
 
 <script>
   $('.toggle-plugin').click(function(e){
     var auth_plugins_input = $('#auth_plugins');
     var elems = [];
 
     $.each(auth_plugins_input.val().split(',') , function (index, element) {
         if (element !== "") {
             elems.push(element.strip())
         }
     });
 
     var cur_button = e.currentTarget;
     var plugin_id = $(cur_button).attr('plugin_id');
     if($(cur_button).hasClass('btn-success')){
       elems.splice(elems.indexOf(plugin_id), 1);
       auth_plugins_input.val(elems.join(',\n'));
       $(cur_button).removeClass('btn-success');
       cur_button.innerHTML = _gettext('disabled');
     }
     else{
       if(elems.indexOf(plugin_id) == -1){
         elems.push(plugin_id);
       }
       auth_plugins_input.val(elems.join(',\n'));
       $(cur_button).addClass('btn-success');
       cur_button.innerHTML = _gettext('enabled');
     }
   });
 </script>
 </%def>

rhodecode/templates/register.mako

@@ -1,147 +1,149 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="base/root.mako"/>
 
 <%def name="title()">
     ${_('Create an Account')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 <style>body{background-color:#eeeeee;}</style>
 
 <div class="loginbox">
     <div class="header">
         <div id="header-inner" class="title">
             <div id="logo">
                 <div class="logo-wrapper">
                     <a href="${h.route_path('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
                 </div>
                 %if c.rhodecode_name:
                 <div class="branding">- ${h.branding(c.rhodecode_name)}</div>
                 %endif
             </div>
         </div>
     </div>
 
     <div class="loginwrapper">
         <rhodecode-toast id="notifications"></rhodecode-toast>
         <div class="left-column">
             <img class="sign-in-image" src="${h.asset('images/sign-in.png')}" alt="RhodeCode"/>
         </div>
         <%block name="above_register_button" />
         <div id="register" class="right-column">
             <!-- login -->
             <div class="sign-in-title">
-                % if social_auth_provider:
-                    <h1>${_('Create an account linked with {}').format(social_auth_provider)}</h1>
+                % if external_auth_provider:
+                    <h1>${_('Create an account linked with {}').format(external_auth_provider)}</h1>
                 % else:
                     <h1>${_('Create an account')}</h1>
                 % endif
 
                 <h4>${h.link_to(_("Go to the login page to sign in with an existing account."), request.route_path('login'))}</h4>
             </div>
             <div class="inner form">
                 ${h.form(request.route_path('register'), needs_csrf_token=False)}
 
                     <label for="username">${_('Username')}:</label>
                     ${h.text('username', defaults.get('username'))}
                     %if 'username' in errors:
                       <span class="error-message">${errors.get('username')}</span>
                       <br />
                     %endif
 
-                    % if social_auth_provider:
+                    % if external_auth_provider:
+                        ## store internal marker about external identity
+                        ${h.hidden('external_identity', external_auth_provider)}
                         ## hide password prompts for social auth
                         <div style="display: none">
                     % endif
 
                     <label for="password">${_('Password')}:</label>
                     ${h.password('password', defaults.get('password'))}
                     %if 'password' in errors:
                       <span class="error-message">${errors.get('password')}</span>
                       <br />
                     %endif
 
                     <label for="password_confirmation">${_('Re-enter password')}:</label>
                     ${h.password('password_confirmation', defaults.get('password_confirmation'))}
                     %if 'password_confirmation' in errors:
                       <span class="error-message">${errors.get('password_confirmation')}</span>
                       <br />
                     %endif
 
-                    % if social_auth_provider:
+                    % if external_auth_provider:
                         ## hide password prompts for social auth
                         </div>
                     % endif
 
                     <label for="firstname">${_('First Name')}:</label>
                     ${h.text('firstname', defaults.get('firstname'))}
                     %if 'firstname' in errors:
                       <span class="error-message">${errors.get('firstname')}</span>
                       <br />
                     %endif
 
                     <label for="lastname">${_('Last Name')}:</label>
                     ${h.text('lastname', defaults.get('lastname'))}
                     %if 'lastname' in errors:
                       <span class="error-message">${errors.get('lastname')}</span>
                       <br />
                     %endif
 
                     <label for="email">${_('Email')}:</label>
                     ${h.text('email', defaults.get('email'))}
                     %if 'email' in errors:
                       <span class="error-message">${errors.get('email')}</span>
                       <br />
                     %endif
 
                     %if captcha_active:
                     <div>
                         <label for="recaptcha">${_('Captcha')}:</label>
                         ${h.hidden('recaptcha_field')}
                         <div id="recaptcha"></div>
                         %if 'recaptcha_field' in errors:
                           <span class="error-message">${errors.get('recaptcha_field')}</span>
                           <br />
                         %endif
                     </div>
                     %endif
 
                     %if not auto_active:
                         <p class="activation_msg">
                             ${_('Account activation requires admin approval.')}
                         </p>
                     %endif
                     <p class="register_message">
                         ${register_message|n}
                     </p>
 
                     ${h.submit('sign_up',_('Create Account'),class_="btn sign-in")}
                     <p class="help-block pull-right">
                         RhodeCode ${c.rhodecode_edition}
                     </p>
                 ${h.end_form()}
             </div>
             <%block name="below_register_button" />
         </div>
     </div>
 </div>
 
 
 <script type="text/javascript">
  $(document).ready(function(){
     $('#username').focus();
  });
 </script>
 
 % if captcha_active:
 <script type="text/javascript">
 var onloadCallback = function() {
     grecaptcha.render('recaptcha', {
       'sitekey' : "${captcha_public_key}"
     });
 };
 </script>
 <script src="https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=explicit" async defer></script>
 % endif
 

rhodecode/tests/auth_external_test.py

@@ -1,109 +1,109 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 External module for testing plugins
 
 rhodecode.tests.auth_external_test
 
 """
 import logging
 import traceback
 
 from rhodecode.authentication.base import (
     RhodeCodeExternalAuthPlugin, hybrid_property)
 from rhodecode.model.db import User
 from rhodecode.lib.ext_json import formatted_json
 
 log = logging.getLogger(__name__)
 
 
 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
     def __init__(self):
         self._logger = logging.getLogger(__name__)
 
     @hybrid_property
     def allows_creating_users(self):
         return True
 
     @hybrid_property
     def name(self):
-        return "external_test"
+        return u"external_test"
 
     def settings(self):
         settings = [
         ]
         return settings
 
     def use_fake_password(self):
         return True
 
     def user_activation_state(self):
         def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.extern_activate.auto' in def_user_perms
 
     def auth(self, userobj, username, password, settings, **kwargs):
         """
         Given a user object (which may be null), username, a plaintext password,
         and a settings object (containing all the keys needed as listed in settings()),
         authenticate this user's login attempt.
 
         Return None on failure. On success, return a dictionary of the form:
 
             see: RhodeCodeAuthPluginBase.auth_func_attrs
         This is later validated for correctness
         """
 
         if not username or not password:
             log.debug('Empty username or password skipping...')
             return None
 
         try:
             user_dn = username
 
             # # old attrs fetched from RhodeCode database
             admin = getattr(userobj, 'admin', False)
             active = getattr(userobj, 'active', True)
             email = getattr(userobj, 'email', '')
             firstname = getattr(userobj, 'firstname', '')
             lastname = getattr(userobj, 'lastname', '')
             extern_type = getattr(userobj, 'extern_type', '')
             #
             user_attrs = {
                 'username': username,
                 'firstname': firstname,
                 'lastname': lastname,
                 'groups': [],
                 'email': '[e-mail]' % username,
                 'admin': admin,
                 'active': active,
                 "active_from_extern": None,
                 'extern_name': user_dn,
                 'extern_type': extern_type,
             }
 
             log.debug('EXTERNAL user: \n%s', formatted_json(user_attrs))
             log.info('user `%s` authenticated correctly', user_attrs['username'])
 
             return user_attrs
 
         except (Exception,):
             log.error(traceback.format_exc())
             return None

rhodecode/tests/lib/auth_modules/test_auth_modules.py

@@ -1,189 +1,189 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 from rhodecode.lib.auth import _RhodeCodeCryptoBCrypt
 from rhodecode.authentication.base import RhodeCodeAuthPluginBase
 from rhodecode.authentication.plugins.auth_ldap import RhodeCodeAuthPlugin
 from rhodecode.model import db
 
 
 class RcTestAuthPlugin(RhodeCodeAuthPluginBase):
 
     def name(self):
-        return 'stub_auth'
+        return u'stub_auth'
 
 
 def test_authenticate_returns_from_auth(stub_auth_data):
     plugin = RcTestAuthPlugin('stub_id')
     with mock.patch.object(plugin, 'auth') as auth_mock:
         auth_mock.return_value = stub_auth_data
         result = plugin._authenticate(mock.Mock(), 'test', 'password', {})
     assert stub_auth_data == result
 
 
 def test_authenticate_returns_empty_auth_data():
     auth_data = {}
     plugin = RcTestAuthPlugin('stub_id')
     with mock.patch.object(plugin, 'auth') as auth_mock:
         auth_mock.return_value = auth_data
         result = plugin._authenticate(mock.Mock(), 'test', 'password', {})
     assert auth_data == result
 
 
 def test_authenticate_skips_hash_migration_if_mismatch(stub_auth_data):
     stub_auth_data['_hash_migrate'] = 'new-hash'
     plugin = RcTestAuthPlugin('stub_id')
     with mock.patch.object(plugin, 'auth') as auth_mock:
         auth_mock.return_value = stub_auth_data
         result = plugin._authenticate(mock.Mock(), 'test', 'password', {})
 
     user = db.User.get_by_username(stub_auth_data['username'])
     assert user.password != 'new-hash'
     assert result == stub_auth_data
 
 
 def test_authenticate_migrates_to_new_hash(stub_auth_data):
     new_password = b'new-password'
     new_hash = _RhodeCodeCryptoBCrypt().hash_create(new_password)
     stub_auth_data['_hash_migrate'] = new_hash
     plugin = RcTestAuthPlugin('stub_id')
     with mock.patch.object(plugin, 'auth') as auth_mock:
         auth_mock.return_value = stub_auth_data
         result = plugin._authenticate(
             mock.Mock(), stub_auth_data['username'], new_password, {})
 
     user = db.User.get_by_username(stub_auth_data['username'])
     assert user.password == new_hash
     assert result == stub_auth_data
 
 
 @pytest.fixture
 def stub_auth_data(user_util):
     user = user_util.create_user()
     data = {
         'username': user.username,
         'password': 'password',
         'email': '[e-mail]',
         'firstname': 'John',
         'lastname': 'Smith',
         'groups': [],
         'active': True,
         'admin': False,
         'extern_name': 'test',
         'extern_type': 'ldap',
         'active_from_extern': True
     }
     return data
 
 
 class TestRhodeCodeAuthPlugin(object):
     def setup_method(self, method):
         self.finalizers = []
         self.user = mock.Mock()
         self.user.username = 'test'
         self.user.password = 'old-password'
         self.fake_auth = {
             'username': 'test',
             'password': 'test',
             'email': '[e-mail]',
             'firstname': 'John',
             'lastname': 'Smith',
             'groups': [],
             'active': True,
             'admin': False,
             'extern_name': 'test',
             'extern_type': 'ldap',
             'active_from_extern': True
         }
 
     def teardown_method(self, method):
         if self.finalizers:
             for finalizer in self.finalizers:
                 finalizer()
             self.finalizers = []
 
     def test_fake_password_is_created_for_the_new_user(self):
         self._patch()
         auth_plugin = RhodeCodeAuthPlugin('stub_id')
         auth_plugin._authenticate(self.user, 'test', 'test', [])
         self.password_generator_mock.assert_called_once_with(length=16)
         create_user_kwargs = self.create_user_mock.call_args[1]
         assert create_user_kwargs['password'] == 'new-password'
 
     def test_fake_password_is_not_created_for_the_existing_user(self):
         self._patch()
         self.get_user_mock.return_value = self.user
         auth_plugin = RhodeCodeAuthPlugin('stub_id')
         auth_plugin._authenticate(self.user, 'test', 'test', [])
         assert self.password_generator_mock.called is False
         create_user_kwargs = self.create_user_mock.call_args[1]
         assert create_user_kwargs['password'] == self.user.password
 
     def _patch(self):
         get_user_patch = mock.patch('rhodecode.model.db.User.get_by_username')
         self.get_user_mock = get_user_patch.start()
         self.get_user_mock.return_value = None
         self.finalizers.append(get_user_patch.stop)
 
         create_user_patch = mock.patch(
             'rhodecode.model.user.UserModel.create_or_update')
         self.create_user_mock = create_user_patch.start()
         self.create_user_mock.return_value = None
         self.finalizers.append(create_user_patch.stop)
 
         auth_patch = mock.patch.object(RhodeCodeAuthPlugin, 'auth')
         self.auth_mock = auth_patch.start()
         self.auth_mock.return_value = self.fake_auth
         self.finalizers.append(auth_patch.stop)
 
         password_generator_patch = mock.patch(
             'rhodecode.lib.auth.PasswordGenerator.gen_password')
         self.password_generator_mock = password_generator_patch.start()
         self.password_generator_mock.return_value = 'new-password'
         self.finalizers.append(password_generator_patch.stop)
 
 
 def test_missing_ldap():
     from rhodecode.model.validators import Missing
 
     try:
         import ldap_not_existing
     except ImportError:
         # means that python-ldap is not installed
         ldap_not_existing = Missing
 
     # missing is singleton
     assert ldap_not_existing == Missing
 
 
 def test_import_ldap():
     from rhodecode.model.validators import Missing
 
     try:
         import ldap
     except ImportError:
         # means that python-ldap is not installed
         ldap = Missing
 
     # missing is singleton
     assert False is (ldap == Missing)