fix(tests): fixed 2fa tests and password reset broken by accident

rhodecode/apps/login/tests/test_login.py

@@ -1,593 +1,593 b''
 # Copyright (C) 2010-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import urllib.parse
 
 import mock
 import pytest
 
 
 from rhodecode.lib.auth import check_password
 from rhodecode.lib import helpers as h
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.model.db import User, Notification, UserApiKeys
 from rhodecode.model.meta import Session
 
 from rhodecode.tests import (
     assert_session_flash, HG_REPO, TEST_USER_ADMIN_LOGIN,
     no_newline_id_generator)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.routes import route_path
 
 fixture = Fixture()
 
 whitelist_view = ['RepoCommitsView:repo_commit_raw']
 
 
 @pytest.mark.usefixtures('app')
 class TestLoginController(object):
     destroy_users = set()
 
     @classmethod
     def teardown_class(cls):
         fixture.destroy_users(cls.destroy_users)
 
     def teardown_method(self, method):
         for n in Notification.query().all():
             Session().delete(n)
 
         Session().commit()
         assert Notification.query().all() == []
 
     def test_index(self):
         response = self.app.get(route_path('login'))
         assert response.status == '200 OK'
         # Test response...
 
     def test_login_admin_ok(self):
         response = self.app.post(route_path('login'),
                                  {'username': 'test_admin',
                                   'password': 'test12'}, status=302)
         response = response.follow()
         session = response.get_session_from_response()
         username = session['rhodecode_user'].get('username')
         assert username == 'test_admin'
         response.mustcontain('logout')
 
     def test_login_regular_ok(self):
         response = self.app.post(route_path('login'),
                                  {'username': 'test_regular',
                                   'password': 'test12'}, status=302)
 
         response = response.follow()
         session = response.get_session_from_response()
         username = session['rhodecode_user'].get('username')
         assert username == 'test_regular'
         response.mustcontain('logout')
 
     def test_login_with_primary_email(self):
         user_email = '[e-mail]'
         response = self.app.post(route_path('login'),
                                  {'username': user_email,
                                   'password': 'test12'}, status=302)
         response = response.follow()
         session = response.get_session_from_response()
         user = session['rhodecode_user']
         assert user['username'] == user_email.split('@')[0]
         assert user['is_authenticated']
         response.mustcontain('logout')
 
     def test_login_regular_forbidden_when_super_admin_restriction(self):
         from rhodecode.authentication.plugins.auth_rhodecode import RhodeCodeAuthPlugin
         with fixture.auth_restriction(self.app._pyramid_registry,
                                       RhodeCodeAuthPlugin.AUTH_RESTRICTION_SUPER_ADMIN):
             response = self.app.post(route_path('login'),
                                      {'username': 'test_regular',
                                       'password': 'test12'})
 
             response.mustcontain('invalid user name')
             response.mustcontain('invalid password')
 
     def test_login_regular_forbidden_when_scope_restriction(self):
         from rhodecode.authentication.plugins.auth_rhodecode import RhodeCodeAuthPlugin
         with fixture.scope_restriction(self.app._pyramid_registry,
                                        RhodeCodeAuthPlugin.AUTH_RESTRICTION_SCOPE_VCS):
             response = self.app.post(route_path('login'),
                                      {'username': 'test_regular',
                                       'password': 'test12'})
 
             response.mustcontain('invalid user name')
             response.mustcontain('invalid password')
 
     def test_login_ok_came_from(self):
         test_came_from = '/_admin/users?branch=stable'
         _url = '{}?came_from={}'.format(route_path('login'), test_came_from)
         response = self.app.post(
             _url, {'username': 'test_admin', 'password': 'test12'}, status=302)
 
         assert 'branch=stable' in response.location
         response = response.follow()
 
         assert response.status == '200 OK'
         response.mustcontain('Users administration')
 
     def test_redirect_to_login_with_get_args(self):
         with fixture.anon_access(False):
             kwargs = {'branch': 'stable'}
             response = self.app.get(
                 h.route_path('repo_summary', repo_name=HG_REPO, _query=kwargs),
                 status=302)
 
             response_query = urllib.parse.parse_qsl(response.location)
             assert 'branch=stable' in response_query[0][1]
 
     def test_login_form_with_get_args(self):
         _url = '{}?came_from=/_admin/users,branch=stable'.format(route_path('login'))
         response = self.app.get(_url)
         assert 'branch%3Dstable' in response.form.action
 
     @pytest.mark.parametrize("url_came_from", [
         'data:text/html,<script>window.alert("xss")</script>',
         'mailto:[e-mail]',
         'file:///etc/passwd',
         'ftp://some.ftp.server',
         'http://other.domain',
     ], ids=no_newline_id_generator)
     def test_login_bad_came_froms(self, url_came_from):
         _url = '{}?came_from={}'.format(route_path('login'), url_came_from)
         response = self.app.post(
             _url, {'username': 'test_admin', 'password': 'test12'}, status=302)
         assert response.status == '302 Found'
         response = response.follow()
         assert response.status == '200 OK'
         assert response.request.path == '/'
 
     @pytest.mark.xfail(reason="newline params changed behaviour in python3")
     @pytest.mark.parametrize("url_came_from", [
         '/\r\nX-Forwarded-Host: \rhttp://example.org',
     ], ids=no_newline_id_generator)
     def test_login_bad_came_froms_404(self, url_came_from):
         _url = '{}?came_from={}'.format(route_path('login'), url_came_from)
         response = self.app.post(
             _url, {'username': 'test_admin', 'password': 'test12'}, status=302)
 
         response = response.follow()
         assert response.status == '404 Not Found'
 
     def test_login_short_password(self):
         response = self.app.post(route_path('login'),
                                  {'username': 'test_admin',
                                   'password': 'as'})
         assert response.status == '200 OK'
 
         response.mustcontain('Enter 3 characters or more')
 
     def test_login_wrong_non_ascii_password(self, user_regular):
         response = self.app.post(
             route_path('login'),
             {'username': user_regular.username,
              'password': 'invalid-non-asci\xe4'.encode('utf8')})
 
         response.mustcontain('invalid user name')
         response.mustcontain('invalid password')
 
     def test_login_with_non_ascii_password(self, user_util):
         password = u'valid-non-ascii\xe4'
         user = user_util.create_user(password=password)
         response = self.app.post(
             route_path('login'),
             {'username': user.username,
              'password': password})
         assert response.status_code == 302
 
     def test_login_wrong_username_password(self):
         response = self.app.post(route_path('login'),
                                  {'username': 'error',
                                   'password': 'test12'})
 
         response.mustcontain('invalid user name')
         response.mustcontain('invalid password')
 
     def test_login_admin_ok_password_migration(self, real_crypto_backend):
         from rhodecode.lib import auth
 
         # create new user, with sha256 password
         temp_user = 'test_admin_sha256'
         user = fixture.create_user(temp_user)
         user.password = auth._RhodeCodeCryptoSha256().hash_create(
             b'test123')
         Session().add(user)
         Session().commit()
         self.destroy_users.add(temp_user)
         response = self.app.post(route_path('login'),
                                  {'username': temp_user,
                                   'password': 'test123'}, status=302)
 
         response = response.follow()
         session = response.get_session_from_response()
         username = session['rhodecode_user'].get('username')
         assert username == temp_user
         response.mustcontain('logout')
 
         # new password should be bcrypted, after log-in and transfer
         user = User.get_by_username(temp_user)
         assert user.password.startswith('$')
 
     # REGISTRATIONS
     def test_register(self):
         response = self.app.get(route_path('register'))
         response.mustcontain('Create an Account')
 
     def test_register_err_same_username(self):
         uname = 'test_admin'
         response = self.app.post(
             route_path('register'),
             {
                 'username': uname,
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         assertr = response.assert_response()
         msg = 'Username "%(username)s" already exists'
         msg = msg % {'username': uname}
         assertr.element_contains('#username+.error-message', msg)
 
     def test_register_err_same_email(self):
         response = self.app.post(
             route_path('register'),
             {
                 'username': 'test_admin_0',
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         assertr = response.assert_response()
         msg = u'This e-mail address is already taken'
         assertr.element_contains('#email+.error-message', msg)
 
     def test_register_err_same_email_case_sensitive(self):
         response = self.app.post(
             route_path('register'),
             {
                 'username': 'test_admin_1',
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
         assertr = response.assert_response()
         msg = u'This e-mail address is already taken'
         assertr.element_contains('#email+.error-message', msg)
 
     def test_register_err_wrong_data(self):
         response = self.app.post(
             route_path('register'),
             {
                 'username': 'xs',
                 'password': 'test',
                 'password_confirmation': 'test',
                 'email': 'goodmailm',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
         assert response.status == '200 OK'
         response.mustcontain('An email address must contain a single @')
         response.mustcontain('Enter a value 6 characters long or more')
 
     def test_register_err_username(self):
         response = self.app.post(
             route_path('register'),
             {
                 'username': 'error user',
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': 'goodmailm',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         response.mustcontain('An email address must contain a single @')
         response.mustcontain(
             'Username may only contain '
             'alphanumeric characters underscores, '
             'periods or dashes and must begin with '
             'alphanumeric character')
 
     def test_register_err_case_sensitive(self):
         usr = 'Test_Admin'
         response = self.app.post(
             route_path('register'),
             {
                 'username': usr,
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': 'goodmailm',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         assertr = response.assert_response()
         msg = u'Username "%(username)s" already exists'
         msg = msg % {'username': usr}
         assertr.element_contains('#username+.error-message', msg)
 
     def test_register_special_chars(self):
         response = self.app.post(
             route_path('register'),
             {
                 'username': 'xxxaxn',
                 'password': 'ąćźżąśśśś',
                 'password_confirmation': 'ąćźżąśśśś',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         msg = u'Invalid characters (non-ascii) in password'
         response.mustcontain(msg)
 
     def test_register_password_mismatch(self):
         response = self.app.post(
             route_path('register'),
             {
                 'username': 'xs',
                 'password': '123qwe',
                 'password_confirmation': 'qwe123',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
         msg = u'Passwords do not match'
         response.mustcontain(msg)
 
     def test_register_ok(self):
         username = 'test_regular4'
         password = 'qweqwe'
         email = '[e-mail]'
         name = 'testname'
         lastname = 'testlastname'
 
         # this initializes a session
         response = self.app.get(route_path('register'))
         response.mustcontain('Create an Account')
 
 
         response = self.app.post(
             route_path('register'),
             {
                 'username': username,
                 'password': password,
                 'password_confirmation': password,
                 'email': email,
                 'firstname': name,
                 'lastname': lastname,
                 'admin': True
             },
             status=302
         )  # This should be overridden
 
         assert_session_flash(
             response, 'You have successfully registered with RhodeCode. You can log-in now.')
 
         ret = Session().query(User).filter(
             User.username == 'test_regular4').one()
         assert ret.username == username
         assert check_password(password, ret.password)
         assert ret.email == email
         assert ret.name == name
         assert ret.lastname == lastname
         assert ret.auth_tokens is not None
         assert not ret.admin
 
     def test_forgot_password_wrong_mail(self):
         bad_email = '[e-mail]'
         # this initializes a session
         self.app.get(route_path('reset_password'))
 
         response = self.app.post(
             route_path('reset_password'), {'email': bad_email, }
         )
         assert_session_flash(response,
             'If such email exists, a password reset link was sent to it.')
 
     def test_forgot_password(self, user_util):
         # this initializes a session
         self.app.get(route_path('reset_password'))
 
         user = user_util.create_user()
         user_id = user.user_id
         email = user.email
 
         response = self.app.post(route_path('reset_password'), {'email': email, })
 
         assert_session_flash(response,
             'If such email exists, a password reset link was sent to it.')
 
         # BAD KEY
-        confirm_url = '{}?key={}'.format(route_path('reset_password_confirmation'), 'badkey')
+        confirm_url = route_path('reset_password_confirmation', params={'key': 'badkey'})
         response = self.app.get(confirm_url, status=302)
         assert response.location.endswith(route_path('reset_password'))
         assert_session_flash(response, 'Given reset token is invalid')
 
         response.follow()  # cleanup flash
 
         # GOOD KEY
         key = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == user_id)\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_PASSWORD_RESET)\
             .first()
 
         assert key
 
         confirm_url = '{}?key={}'.format(route_path('reset_password_confirmation'), key.api_key)
         response = self.app.get(confirm_url)
         assert response.status == '302 Found'
         assert response.location.endswith(route_path('login'))
 
         assert_session_flash(
             response,
             'Your password reset was successful, '
             'a new password has been sent to your email')
 
         response.follow()
 
     def _get_api_whitelist(self, values=None):
         config = {'api_access_controllers_whitelist': values or []}
         return config
 
     @pytest.mark.parametrize("test_name, auth_token", [
         ('none', None),
         ('empty_string', ''),
         ('fake_number', '123456'),
         ('proper_auth_token', None)
     ])
     def test_access_not_whitelisted_page_via_auth_token(
             self, test_name, auth_token, user_admin):
 
         whitelist = self._get_api_whitelist([])
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert [] == whitelist['api_access_controllers_whitelist']
             if test_name == 'proper_auth_token':
                 # use builtin if api_key is None
                 auth_token = user_admin.api_key
 
             with fixture.anon_access(False):
                 # webtest uses linter to check if response is bytes,
                 # and we use memoryview here as a wrapper, quick turn-off
                 self.app.lint = False
 
                 self.app.get(
                     route_path('repo_commit_raw',
                                repo_name=HG_REPO, commit_id='tip',
                                params=dict(api_key=auth_token)),
                     status=302)
 
     @pytest.mark.parametrize("test_name, auth_token, code", [
         ('none', None, 302),
         ('empty_string', '', 302),
         ('fake_number', '123456', 302),
         ('proper_auth_token', None, 200)
     ])
     def test_access_whitelisted_page_via_auth_token(
             self, test_name, auth_token, code, user_admin):
 
         whitelist = self._get_api_whitelist(whitelist_view)
 
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert whitelist_view == whitelist['api_access_controllers_whitelist']
 
             if test_name == 'proper_auth_token':
                 auth_token = user_admin.api_key
                 assert auth_token
 
             with fixture.anon_access(False):
                 # webtest uses linter to check if response is bytes,
                 # and we use memoryview here as a wrapper, quick turn-off
                 self.app.lint = False
                 self.app.get(
                     route_path('repo_commit_raw',
                                repo_name=HG_REPO, commit_id='tip',
                                params=dict(api_key=auth_token)),
                     status=code)
 
     @pytest.mark.parametrize("test_name, auth_token, code", [
         ('proper_auth_token', None, 200),
         ('wrong_auth_token', '123456', 302),
     ])
     def test_access_whitelisted_page_via_auth_token_bound_to_token(
             self, test_name, auth_token, code, user_admin):
 
         expected_token = auth_token
         if test_name == 'proper_auth_token':
             auth_token = user_admin.api_key
             expected_token = auth_token
             assert auth_token
 
         whitelist = self._get_api_whitelist([
             'RepoCommitsView:repo_commit_raw@{}'.format(expected_token)])
 
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
 
             with fixture.anon_access(False):
                 # webtest uses linter to check if response is bytes,
                 # and we use memoryview here as a wrapper, quick turn-off
                 self.app.lint = False
 
                 self.app.get(
                     route_path('repo_commit_raw',
                                repo_name=HG_REPO, commit_id='tip',
                                params=dict(api_key=auth_token)),
                     status=code)
 
     def test_access_page_via_extra_auth_token(self):
         whitelist = self._get_api_whitelist(whitelist_view)
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert whitelist_view == \
                 whitelist['api_access_controllers_whitelist']
 
             new_auth_token = AuthTokenModel().create(
                 TEST_USER_ADMIN_LOGIN, 'test')
             Session().commit()
             with fixture.anon_access(False):
                 # webtest uses linter to check if response is bytes,
                 # and we use memoryview here as a wrapper, quick turn-off
                 self.app.lint = False
                 self.app.get(
                     route_path('repo_commit_raw',
                                repo_name=HG_REPO, commit_id='tip',
                                params=dict(api_key=new_auth_token.api_key)),
                     status=200)
 
     def test_access_page_via_expired_auth_token(self):
         whitelist = self._get_api_whitelist(whitelist_view)
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert whitelist_view == \
                 whitelist['api_access_controllers_whitelist']
 
             new_auth_token = AuthTokenModel().create(
                 TEST_USER_ADMIN_LOGIN, 'test')
             Session().commit()
             # patch the api key and make it expired
             new_auth_token.expires = 0
             Session().add(new_auth_token)
             Session().commit()
             with fixture.anon_access(False):
                 # webtest uses linter to check if response is bytes,
                 # and we use memoryview here as a wrapper, quick turn-off
                 self.app.lint = False
                 self.app.get(
                     route_path('repo_commit_raw',
                                repo_name=HG_REPO, commit_id='tip',
                                params=dict(api_key=new_auth_token.api_key)),
                     status=302)

rhodecode/apps/login/views.py

@@ -1,554 +1,552 b''
 # Copyright (C) 2016-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import time
 import json
 import pyotp
 import qrcode
 import collections
 import datetime
 import formencode
 import formencode.htmlfill
 import logging
 import urllib.parse
 import requests
 from io import BytesIO
 from base64 import b64encode
 
 from pyramid.renderers import render
 from pyramid.response import Response
 from pyramid.httpexceptions import HTTPFound
 
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.authentication.base import authenticate, HTTP_TYPE
 from rhodecode.authentication.plugins import auth_rhodecode
 from rhodecode.events import UserRegistered, trigger
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     AuthUser, HasPermissionAnyDecorator, CSRFRequired, LoginRequired, NotAnonymous)
 from rhodecode.lib.base import get_ip_addr
 from rhodecode.lib.exceptions import UserCreationError
 from rhodecode.lib.utils2 import safe_str
 from rhodecode.model.db import User, UserApiKeys
 from rhodecode.model.forms import LoginForm, RegisterForm, PasswordResetForm, TOTPForm
 from rhodecode.model.meta import Session
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.model.settings import SettingsModel
 from rhodecode.model.user import UserModel
 from rhodecode.translation import _
 
 
 log = logging.getLogger(__name__)
 
 CaptchaData = collections.namedtuple(
     'CaptchaData', 'active, private_key, public_key')
 
 
 def store_user_in_session(session, user_identifier, remember=False):
     user = User.get_by_username_or_primary_email(user_identifier)
     auth_user = AuthUser(user.user_id)
     auth_user.set_authenticated()
     cs = auth_user.get_cookie_store()
     session['rhodecode_user'] = cs
     user.update_lastlogin()
     Session().commit()
 
     # If they want to be remembered, update the cookie
     if remember:
         _year = (datetime.datetime.now() +
                  datetime.timedelta(seconds=60 * 60 * 24 * 365))
         session._set_cookie_expires(_year)
 
     session.save()
 
     safe_cs = cs.copy()
     safe_cs['password'] = '****'
     log.info('user %s is now authenticated and stored in '
              'session, session attrs %s', user_identifier, safe_cs)
 
     # dumps session attrs back to cookie
     session._update_cookie_out()
     # we set new cookie
     headers = None
     if session.request['set_cookie']:
         # send set-cookie headers back to response to update cookie
         headers = [('Set-Cookie', session.request['cookie_out'])]
     return headers
 
 
 def get_came_from(request):
     came_from = safe_str(request.GET.get('came_from', ''))
     parsed = urllib.parse.urlparse(came_from)
 
     allowed_schemes = ['http', 'https']
     default_came_from = h.route_path('home')
     if parsed.scheme and parsed.scheme not in allowed_schemes:
         log.error('Suspicious URL scheme detected %s for url %s',
                   parsed.scheme, parsed)
         came_from = default_came_from
     elif parsed.netloc and request.host != parsed.netloc:
         log.error('Suspicious NETLOC detected %s for url %s server url '
                   'is: %s', parsed.netloc, parsed, request.host)
         came_from = default_came_from
     elif any(bad_char in came_from for bad_char in ('\r', '\n')):
         log.error('Header injection detected `%s` for url %s server url ',
                   parsed.path, parsed)
         came_from = default_came_from
 
     return came_from or default_came_from
 
 
 class LoginView(BaseAppView):
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         c.came_from = get_came_from(self.request)
         return c
 
     def _get_captcha_data(self):
         settings = SettingsModel().get_all_settings()
         private_key = settings.get('rhodecode_captcha_private_key')
         public_key = settings.get('rhodecode_captcha_public_key')
         active = bool(private_key)
         return CaptchaData(
             active=active, private_key=private_key, public_key=public_key)
 
     def validate_captcha(self, private_key):
 
         captcha_rs = self.request.POST.get('g-recaptcha-response')
         url = "https://www.google.com/recaptcha/api/siteverify"
         params = {
             'secret': private_key,
             'response': captcha_rs,
             'remoteip': get_ip_addr(self.request.environ)
         }
         verify_rs = requests.get(url, params=params, verify=True, timeout=60)
         verify_rs = verify_rs.json()
         captcha_status = verify_rs.get('success', False)
         captcha_errors = verify_rs.get('error-codes', [])
         if not isinstance(captcha_errors, list):
             captcha_errors = [captcha_errors]
         captcha_errors = ', '.join(captcha_errors)
         captcha_message = ''
         if captcha_status is False:
             captcha_message = "Bad captcha. Errors: {}".format(
                 captcha_errors)
 
         return captcha_status, captcha_message
 
     def login(self):
         c = self.load_default_context()
         auth_user = self._rhodecode_user
 
         # redirect if already logged in
         if (auth_user.is_authenticated and
                 not auth_user.is_default and auth_user.ip_allowed):
             raise HTTPFound(c.came_from)
 
         # check if we use headers plugin, and try to login using it.
         try:
             log.debug('Running PRE-AUTH for headers based authentication')
             auth_info = authenticate(
                 '', '', self.request.environ, HTTP_TYPE, skip_missing=True)
             if auth_info:
                 headers = store_user_in_session(
                     self.session, auth_info.get('username'))
                 raise HTTPFound(c.came_from, headers=headers)
         except UserCreationError as e:
             log.error(e)
             h.flash(e, category='error')
 
         return self._get_template_context(c)
 
     def login_post(self):
         c = self.load_default_context()
 
         login_form = LoginForm(self.request.translate)()
 
         try:
             self.session.invalidate()
             form_result = login_form.to_python(self.request.POST)
             # form checks for username/password, now we're authenticated
             username = form_result['username']
             if (user := User.get_by_username_or_primary_email(username)).has_enabled_2fa:
                 user.has_check_2fa_flag = True
 
             headers = store_user_in_session(
                 self.session,
                 user_identifier=username,
                 remember=form_result['remember'])
             log.debug('Redirecting to "%s" after login.', c.came_from)
 
             audit_user = audit_logger.UserWrap(
                 username=self.request.POST.get('username'),
                 ip_addr=self.request.remote_addr)
             action_data = {'user_agent': self.request.user_agent}
             audit_logger.store_web(
                 'user.login.success', action_data=action_data,
                 user=audit_user, commit=True)
 
             raise HTTPFound(c.came_from, headers=headers)
         except formencode.Invalid as errors:
             defaults = errors.value
             # remove password from filling in form again
             defaults.pop('password', None)
             render_ctx = {
                 'errors': errors.error_dict,
                 'defaults': defaults,
             }
 
             audit_user = audit_logger.UserWrap(
                 username=self.request.POST.get('username'),
                 ip_addr=self.request.remote_addr)
             action_data = {'user_agent': self.request.user_agent}
             audit_logger.store_web(
                 'user.login.failure', action_data=action_data,
                 user=audit_user, commit=True)
             return self._get_template_context(c, **render_ctx)
 
         except UserCreationError as e:
             # headers auth or other auth functions that create users on
             # the fly can throw this exception signaling that there's issue
             # with user creation, explanation should be provided in
             # Exception itself
             h.flash(e, category='error')
             return self._get_template_context(c)
 
     @CSRFRequired()
     def logout(self):
         auth_user = self._rhodecode_user
         log.info('Deleting session for user: `%s`', auth_user)
 
         action_data = {'user_agent': self.request.user_agent}
         audit_logger.store_web(
             'user.logout', action_data=action_data,
             user=auth_user, commit=True)
         self.session.delete()
         return HTTPFound(h.route_path('home'))
 
     @HasPermissionAnyDecorator(
         'hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')
     def register(self, defaults=None, errors=None):
         c = self.load_default_context()
         defaults = defaults or {}
         errors = errors or {}
 
         settings = SettingsModel().get_all_settings()
         register_message = settings.get('rhodecode_register_message') or ''
         captcha = self._get_captcha_data()
         auto_active = 'hg.register.auto_activate' in User.get_default_user()\
             .AuthUser().permissions['global']
 
         render_ctx = self._get_template_context(c)
         render_ctx.update({
             'defaults': defaults,
             'errors': errors,
             'auto_active': auto_active,
             'captcha_active': captcha.active,
             'captcha_public_key': captcha.public_key,
             'register_message': register_message,
         })
         return render_ctx
 
     @HasPermissionAnyDecorator(
         'hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')
     def register_post(self):
         from rhodecode.authentication.plugins import auth_rhodecode
 
         self.load_default_context()
         captcha = self._get_captcha_data()
         auto_active = 'hg.register.auto_activate' in User.get_default_user()\
             .AuthUser().permissions['global']
 
         extern_name = auth_rhodecode.RhodeCodeAuthPlugin.uid
         extern_type = auth_rhodecode.RhodeCodeAuthPlugin.uid
 
         register_form = RegisterForm(self.request.translate)()
         try:
 
             form_result = register_form.to_python(self.request.POST)
             form_result['active'] = auto_active
             external_identity = self.request.POST.get('external_identity')
 
             if external_identity:
                 extern_name = external_identity
                 extern_type = external_identity
 
             if captcha.active:
                 captcha_status, captcha_message = self.validate_captcha(
                     captcha.private_key)
 
                 if not captcha_status:
                     _value = form_result
                     _msg = _('Bad captcha')
                     error_dict = {'recaptcha_field': captcha_message}
                     raise formencode.Invalid(
                         _msg, _value, None, error_dict=error_dict)
 
             new_user = UserModel().create_registration(
                 form_result, extern_name=extern_name, extern_type=extern_type)
 
             action_data = {'data': new_user.get_api_data(),
                            'user_agent': self.request.user_agent}
 
             if external_identity:
                 action_data['external_identity'] = external_identity
 
             audit_user = audit_logger.UserWrap(
                 username=new_user.username,
                 user_id=new_user.user_id,
                 ip_addr=self.request.remote_addr)
 
             audit_logger.store_web(
                 'user.register', action_data=action_data,
                 user=audit_user)
 
             event = UserRegistered(user=new_user, session=self.session)
             trigger(event)
             h.flash(
                 _('You have successfully registered with RhodeCode. You can log-in now.'),
                 category='success')
             if external_identity:
                 h.flash(
                     _('Please use the {identity} button to log-in').format(
                         identity=external_identity),
                     category='success')
             Session().commit()
 
             redirect_ro = self.request.route_path('login')
             raise HTTPFound(redirect_ro)
 
         except formencode.Invalid as errors:
             errors.value.pop('password', None)
             errors.value.pop('password_confirmation', None)
             return self.register(
                 defaults=errors.value, errors=errors.error_dict)
 
         except UserCreationError as e:
             # container auth or other auth functions that create users on
             # the fly can throw this exception signaling that there's issue
             # with user creation, explanation should be provided in
             # Exception itself
             h.flash(e, category='error')
             return self.register()
 
     def password_reset(self):
         c = self.load_default_context()
         captcha = self._get_captcha_data()
 
         template_context = {
             'captcha_active': captcha.active,
             'captcha_public_key': captcha.public_key,
             'defaults': {},
             'errors': {},
         }
 
         # always send implicit message to prevent from discovery of
         # matching emails
         msg = _('If such email exists, a password reset link was sent to it.')
 
         def default_response():
             log.debug('faking response on invalid password reset')
             # make this take 2s, to prevent brute forcing.
             time.sleep(2)
             h.flash(msg, category='success')
             return HTTPFound(self.request.route_path('reset_password'))
 
         if self.request.POST:
             if h.HasPermissionAny('hg.password_reset.disabled')():
                 _email = self.request.POST.get('email', '')
                 log.error('Failed attempt to reset password for `%s`.', _email)
                 h.flash(_('Password reset has been disabled.'), category='error')
                 return HTTPFound(self.request.route_path('reset_password'))
 
             password_reset_form = PasswordResetForm(self.request.translate)()
             description = 'Generated token for password reset from {}'.format(
                 datetime.datetime.now().isoformat())
 
             try:
                 form_result = password_reset_form.to_python(
                     self.request.POST)
                 user_email = form_result['email']
 
                 if captcha.active:
                     captcha_status, captcha_message = self.validate_captcha(
                         captcha.private_key)
 
                     if not captcha_status:
                         _value = form_result
                         _msg = _('Bad captcha')
                         error_dict = {'recaptcha_field': captcha_message}
                         raise formencode.Invalid(
                             _msg, _value, None, error_dict=error_dict)
 
                 # Generate reset URL and send mail.
                 user = User.get_by_email(user_email)
 
                 # only allow rhodecode based users to reset their password
                 # external auth shouldn't allow password reset
                 if user and user.extern_type != auth_rhodecode.RhodeCodeAuthPlugin.uid:
                     log.warning('User %s with external type `%s` tried a password reset. '
                                 'This try was rejected', user, user.extern_type)
                     return default_response()
 
                 # generate password reset token that expires in 10 minutes
                 reset_token = UserModel().add_auth_token(
                     user=user, lifetime_minutes=10,
                     role=UserModel.auth_token_role.ROLE_PASSWORD_RESET,
                     description=description)
                 Session().commit()
 
                 log.debug('Successfully created password recovery token')
                 password_reset_url = self.request.route_url(
                     'reset_password_confirmation',
                     _query={'key': reset_token.api_key})
                 UserModel().reset_password_link(
                     form_result, password_reset_url)
 
                 action_data = {'email': user_email,
                                'user_agent': self.request.user_agent}
                 audit_logger.store_web(
                     'user.password.reset_request', action_data=action_data,
                     user=self._rhodecode_user, commit=True)
 
                 return default_response()
 
             except formencode.Invalid as errors:
                 template_context.update({
                     'defaults': errors.value,
                     'errors': errors.error_dict,
                 })
                 if not self.request.POST.get('email'):
                     # case of empty email, we want to report that
                     return self._get_template_context(c, **template_context)
 
                 if 'recaptcha_field' in errors.error_dict:
                     # case of failed captcha
                     return self._get_template_context(c, **template_context)
 
             return default_response()
 
         return self._get_template_context(c, **template_context)
 
-    @LoginRequired()
-    @NotAnonymous()
     def password_reset_confirmation(self):
         self.load_default_context()
-        if self.request.GET and self.request.GET.get('key'):
+
+        if key := self.request.GET.get('key'):
             # make this take 2s, to prevent brute forcing.
             time.sleep(2)
 
-            token = AuthTokenModel().get_auth_token(
-                self.request.GET.get('key'))
+            token = AuthTokenModel().get_auth_token(key)
 
             # verify token is the correct role
             if token is None or token.role != UserApiKeys.ROLE_PASSWORD_RESET:
                 log.debug('Got token with role:%s expected is %s',
                           getattr(token, 'role', 'EMPTY_TOKEN'),
                           UserApiKeys.ROLE_PASSWORD_RESET)
                 h.flash(
                     _('Given reset token is invalid'), category='error')
                 return HTTPFound(self.request.route_path('reset_password'))
 
             try:
                 owner = token.user
                 data = {'email': owner.email, 'token': token.api_key}
                 UserModel().reset_password(data)
                 h.flash(
                     _('Your password reset was successful, '
                       'a new password has been sent to your email'),
                     category='success')
             except Exception as e:
                 log.error(e)
                 return HTTPFound(self.request.route_path('reset_password'))
 
         return HTTPFound(self.request.route_path('login'))
 
     @LoginRequired()
     @NotAnonymous()
     def setup_2fa(self):
         _ = self.request.translate
         c = self.load_default_context()
         user_instance = self._rhodecode_db_user
         form = TOTPForm(_, user_instance)()
         render_ctx = {}
         if self.request.method == 'POST':
             post_items = dict(self.request.POST)
 
             try:
                 form_details = form.to_python(post_items)
                 secret = form_details['secret_totp']
 
                 user_instance.init_2fa_recovery_codes(persist=True, force=True)
                 user_instance.set_2fa_secret(secret)
 
                 Session().commit()
                 raise HTTPFound(self.request.route_path('my_account_configure_2fa', _query={'show-recovery-codes': 1}))
             except formencode.Invalid as errors:
                 defaults = errors.value
                 render_ctx = {
                     'errors': errors.error_dict,
                     'defaults': defaults,
                 }
 
         # NOTE: here we DO NOT persist the secret 2FA, since this is only for setup, once a setup is completed
         # only then we should persist it
         secret = user_instance.init_secret_2fa(persist=False)
 
         totp_name = f'RhodeCode token ({self.request.user.username})'
 
         qr = qrcode.QRCode(version=1, box_size=10, border=5)
         qr.add_data(pyotp.totp.TOTP(secret).provisioning_uri(name=totp_name))
         qr.make(fit=True)
         img = qr.make_image(fill_color='black', back_color='white')
         buffered = BytesIO()
         img.save(buffered)
         return self._get_template_context(
             c,
             qr=b64encode(buffered.getvalue()).decode("utf-8"),
             key=secret,
             totp_name=totp_name,
             ** render_ctx
         )
 
     @LoginRequired()
     @NotAnonymous()
     def verify_2fa(self):
         _ = self.request.translate
         c = self.load_default_context()
         render_ctx = {}
         user_instance = self._rhodecode_db_user
         totp_form = TOTPForm(_, user_instance, allow_recovery_code_use=True)()
         if self.request.method == 'POST':
             post_items = dict(self.request.POST)
             # NOTE: inject secret, as it's a post configured saved item.
             post_items['secret_totp'] = user_instance.get_secret_2fa()
             try:
                 totp_form.to_python(post_items)
                 user_instance.has_check_2fa_flag = False
                 Session().commit()
                 raise HTTPFound(c.came_from)
             except formencode.Invalid as errors:
                 defaults = errors.value
                 render_ctx = {
                     'errors': errors.error_dict,
                     'defaults': defaults,
                 }
         return self._get_template_context(c, **render_ctx)

rhodecode/tests/routes.py

@@ -1,321 +1,322 b''
 # Copyright (C) 2010-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 def get_url_defs():
     from rhodecode.apps._base import ADMIN_PREFIX
 
     return {
         "home": "/",
         "main_page_repos_data": "/_home_repos",
         "main_page_repo_groups_data": "/_home_repo_groups",
         "repo_group_home": "/{repo_group_name}",
         "user_autocomplete_data": "/_users",
         "user_group_autocomplete_data": "/_user_groups",
         "repo_list_data": "/_repos",
         "goto_switcher_data": "/_goto_data",
         "admin_home": ADMIN_PREFIX + "",
         "admin_audit_logs": ADMIN_PREFIX + "/audit_logs",
         "admin_defaults_repositories": ADMIN_PREFIX + "/defaults/repositories",
         "admin_defaults_repositories_update": ADMIN_PREFIX
         + "/defaults/repositories/update",
         "search": ADMIN_PREFIX + "/search",
         "search_repo": "/{repo_name}/search",
         "my_account_auth_tokens": ADMIN_PREFIX + "/my_account/auth_tokens",
         "my_account_auth_tokens_add": ADMIN_PREFIX + "/my_account/auth_tokens/new",
         "my_account_auth_tokens_delete": ADMIN_PREFIX
         + "/my_account/auth_tokens/delete",
         "repos": ADMIN_PREFIX + "/repos",
         "repos_data": ADMIN_PREFIX + "/repos_data",
         "repo_groups": ADMIN_PREFIX + "/repo_groups",
         "repo_groups_data": ADMIN_PREFIX + "/repo_groups_data",
         "user_groups": ADMIN_PREFIX + "/user_groups",
         "user_groups_data": ADMIN_PREFIX + "/user_groups_data",
         "user_profile": "/_profiles/{username}",
         "profile_user_group": "/_profile_user_group/{user_group_name}",
         "repo_summary": "/{repo_name}",
         "repo_creating_check": "/{repo_name}/repo_creating_check",
         "edit_repo": "/{repo_name}/settings",
         "edit_repo_vcs": "/{repo_name}/settings/vcs",
         "edit_repo_vcs_update": "/{repo_name}/settings/vcs/update",
         "edit_repo_vcs_svn_pattern_delete": "/{repo_name}/settings/vcs/svn_pattern/delete",
         "repo_archivefile": "/{repo_name}/archive/{fname}",
         "repo_files_diff": "/{repo_name}/diff/{f_path}",
         "repo_files_diff_2way_redirect": "/{repo_name}/diff-2way/{f_path}",
         "repo_files": "/{repo_name}/files/{commit_id}/{f_path}",
         "repo_files:default_path": "/{repo_name}/files/{commit_id}/",
         "repo_files:default_commit": "/{repo_name}/files",
         "repo_files:rendered": "/{repo_name}/render/{commit_id}/{f_path}",
         "repo_files:annotated": "/{repo_name}/annotate/{commit_id}/{f_path}",
         "repo_files:annotated_previous": "/{repo_name}/annotate-previous/{commit_id}/{f_path}",
         "repo_files_nodelist": "/{repo_name}/nodelist/{commit_id}/{f_path}",
         "repo_file_raw": "/{repo_name}/raw/{commit_id}/{f_path}",
         "repo_file_download": "/{repo_name}/download/{commit_id}/{f_path}",
         "repo_file_history": "/{repo_name}/history/{commit_id}/{f_path}",
         "repo_file_authors": "/{repo_name}/authors/{commit_id}/{f_path}",
         "repo_files_remove_file": "/{repo_name}/remove_file/{commit_id}/{f_path}",
         "repo_files_delete_file": "/{repo_name}/delete_file/{commit_id}/{f_path}",
         "repo_files_edit_file": "/{repo_name}/edit_file/{commit_id}/{f_path}",
         "repo_files_update_file": "/{repo_name}/update_file/{commit_id}/{f_path}",
         "repo_files_add_file": "/{repo_name}/add_file/{commit_id}/{f_path}",
         "repo_files_upload_file": "/{repo_name}/upload_file/{commit_id}/{f_path}",
         "repo_files_create_file": "/{repo_name}/create_file/{commit_id}/{f_path}",
         "repo_files_replace_binary": "/{repo_name}/replace_binary/{commit_id}/{f_path}",
         "repo_nodetree_full": "/{repo_name}/nodetree_full/{commit_id}/{f_path}",
         "repo_nodetree_full:default_path": "/{repo_name}/nodetree_full/{commit_id}/",
         "journal": ADMIN_PREFIX + "/journal",
         "journal_rss": ADMIN_PREFIX + "/journal/rss",
         "journal_atom": ADMIN_PREFIX + "/journal/atom",
         "journal_public": ADMIN_PREFIX + "/public_journal",
         "journal_public_atom": ADMIN_PREFIX + "/public_journal/atom",
         "journal_public_atom_old": ADMIN_PREFIX + "/public_journal_atom",
         "journal_public_rss": ADMIN_PREFIX + "/public_journal/rss",
         "journal_public_rss_old": ADMIN_PREFIX + "/public_journal_rss",
         "toggle_following": ADMIN_PREFIX + "/toggle_following",
         "upload_file": "/_file_store/upload",
         "download_file": "/_file_store/download/{fid}",
         "download_file_by_token": "/_file_store/token-download/{_auth_token}/{fid}",
         "gists_show": ADMIN_PREFIX + "/gists",
         "gists_new": ADMIN_PREFIX + "/gists/new",
         "gists_create": ADMIN_PREFIX + "/gists/create",
         "gist_show": ADMIN_PREFIX + "/gists/{gist_id}",
         "gist_delete": ADMIN_PREFIX + "/gists/{gist_id}/delete",
         "gist_edit": ADMIN_PREFIX + "/gists/{gist_id}/edit",
         "gist_edit_check_revision": ADMIN_PREFIX
         + "/gists/{gist_id}/edit/check_revision",
         "gist_update": ADMIN_PREFIX + "/gists/{gist_id}/update",
         "gist_show_rev": ADMIN_PREFIX + "/gists/{gist_id}/rev/{revision}",
         "gist_show_formatted": ADMIN_PREFIX
         + "/gists/{gist_id}/rev/{revision}/{format}",
         "gist_show_formatted_path": ADMIN_PREFIX
         + "/gists/{gist_id}/rev/{revision}/{format}/{f_path}",
         "login": ADMIN_PREFIX + "/login",
         "logout": ADMIN_PREFIX + "/logout",
+        "setup_2fa": ADMIN_PREFIX + "/setup_2fa",
         "check_2fa": ADMIN_PREFIX + "/check_2fa",
         "register": ADMIN_PREFIX + "/register",
         "reset_password": ADMIN_PREFIX + "/password_reset",
         "reset_password_confirmation": ADMIN_PREFIX + "/password_reset_confirmation",
         "admin_permissions_application": ADMIN_PREFIX + "/permissions/application",
         "admin_permissions_application_update": ADMIN_PREFIX
         + "/permissions/application/update",
         "repo_commit_raw": "/{repo_name}/changeset-diff/{commit_id}",
         "user_group_members_data": ADMIN_PREFIX
         + "/user_groups/{user_group_id}/members",
         "user_groups_new": ADMIN_PREFIX + "/user_groups/new",
         "user_groups_create": ADMIN_PREFIX + "/user_groups/create",
         "edit_user_group": ADMIN_PREFIX + "/user_groups/{user_group_id}/edit",
         "edit_user_group_advanced_sync": ADMIN_PREFIX
         + "/user_groups/{user_group_id}/edit/advanced/sync",
         "edit_user_group_global_perms_update": ADMIN_PREFIX
         + "/user_groups/{user_group_id}/edit/global_permissions/update",
         "user_groups_update": ADMIN_PREFIX + "/user_groups/{user_group_id}/update",
         "user_groups_delete": ADMIN_PREFIX + "/user_groups/{user_group_id}/delete",
         "edit_user_group_perms": ADMIN_PREFIX
         + "/user_groups/{user_group_id}/edit/permissions",
         "edit_user_group_perms_update": ADMIN_PREFIX
         + "/user_groups/{user_group_id}/edit/permissions/update",
         "edit_repo_group": "/{repo_group_name}/_edit",
         "edit_repo_group_perms": "/{repo_group_name:}/_settings/permissions",
         "edit_repo_group_perms_update": "/{repo_group_name}/_settings/permissions/update",
         "edit_repo_group_advanced": "/{repo_group_name}/_settings/advanced",
         "edit_repo_group_advanced_delete": "/{repo_group_name}/_settings/advanced/delete",
         "edit_user_ssh_keys": ADMIN_PREFIX + "/users/{user_id}/edit/ssh_keys",
         "edit_user_ssh_keys_generate_keypair": ADMIN_PREFIX
         + "/users/{user_id}/edit/ssh_keys/generate",
         "edit_user_ssh_keys_add": ADMIN_PREFIX + "/users/{user_id}/edit/ssh_keys/new",
         "edit_user_ssh_keys_delete": ADMIN_PREFIX
         + "/users/{user_id}/edit/ssh_keys/delete",
         "users": ADMIN_PREFIX + "/users",
         "users_data": ADMIN_PREFIX + "/users_data",
         "users_create": ADMIN_PREFIX + "/users/create",
         "users_new": ADMIN_PREFIX + "/users/new",
         "user_edit": ADMIN_PREFIX + "/users/{user_id}/edit",
         "user_edit_advanced": ADMIN_PREFIX + "/users/{user_id}/edit/advanced",
         "user_edit_global_perms": ADMIN_PREFIX
         + "/users/{user_id}/edit/global_permissions",
         "user_edit_global_perms_update": ADMIN_PREFIX
         + "/users/{user_id}/edit/global_permissions/update",
         "user_update": ADMIN_PREFIX + "/users/{user_id}/update",
         "user_delete": ADMIN_PREFIX + "/users/{user_id}/delete",
         "user_create_personal_repo_group": ADMIN_PREFIX
         + "/users/{user_id}/create_repo_group",
         "edit_user_auth_tokens": ADMIN_PREFIX + "/users/{user_id}/edit/auth_tokens",
         "edit_user_auth_tokens_add": ADMIN_PREFIX
         + "/users/{user_id}/edit/auth_tokens/new",
         "edit_user_auth_tokens_delete": ADMIN_PREFIX
         + "/users/{user_id}/edit/auth_tokens/delete",
         "edit_user_emails": ADMIN_PREFIX + "/users/{user_id}/edit/emails",
         "edit_user_emails_add": ADMIN_PREFIX + "/users/{user_id}/edit/emails/new",
         "edit_user_emails_delete": ADMIN_PREFIX + "/users/{user_id}/edit/emails/delete",
         "edit_user_ips": ADMIN_PREFIX + "/users/{user_id}/edit/ips",
         "edit_user_ips_add": ADMIN_PREFIX + "/users/{user_id}/edit/ips/new",
         "edit_user_ips_delete": ADMIN_PREFIX + "/users/{user_id}/edit/ips/delete",
         "edit_user_perms_summary": ADMIN_PREFIX
         + "/users/{user_id}/edit/permissions_summary",
         "edit_user_perms_summary_json": ADMIN_PREFIX
         + "/users/{user_id}/edit/permissions_summary/json",
         "edit_user_audit_logs": ADMIN_PREFIX + "/users/{user_id}/edit/audit",
         "edit_user_audit_logs_download": ADMIN_PREFIX
         + "/users/{user_id}/edit/audit/download",
         "admin_settings": ADMIN_PREFIX + "/settings",
         "admin_settings_update": ADMIN_PREFIX + "/settings/update",
         "admin_settings_global": ADMIN_PREFIX + "/settings/global",
         "admin_settings_global_update": ADMIN_PREFIX + "/settings/global/update",
         "admin_settings_vcs": ADMIN_PREFIX + "/settings/vcs",
         "admin_settings_vcs_update": ADMIN_PREFIX + "/settings/vcs/update",
         "admin_settings_vcs_svn_pattern_delete": ADMIN_PREFIX
         + "/settings/vcs/svn_pattern_delete",
         "admin_settings_mapping": ADMIN_PREFIX + "/settings/mapping",
         "admin_settings_mapping_update": ADMIN_PREFIX + "/settings/mapping/update",
         "admin_settings_visual": ADMIN_PREFIX + "/settings/visual",
         "admin_settings_visual_update": ADMIN_PREFIX + "/settings/visual/update",
         "admin_settings_issuetracker": ADMIN_PREFIX + "/settings/issue-tracker",
         "admin_settings_issuetracker_update": ADMIN_PREFIX
         + "/settings/issue-tracker/update",
         "admin_settings_issuetracker_test": ADMIN_PREFIX
         + "/settings/issue-tracker/test",
         "admin_settings_issuetracker_delete": ADMIN_PREFIX
         + "/settings/issue-tracker/delete",
         "admin_settings_email": ADMIN_PREFIX + "/settings/email",
         "admin_settings_email_update": ADMIN_PREFIX + "/settings/email/update",
         "admin_settings_hooks": ADMIN_PREFIX + "/settings/hooks",
         "admin_settings_hooks_update": ADMIN_PREFIX + "/settings/hooks/update",
         "admin_settings_hooks_delete": ADMIN_PREFIX + "/settings/hooks/delete",
         "admin_settings_search": ADMIN_PREFIX + "/settings/search",
         "admin_settings_labs": ADMIN_PREFIX + "/settings/labs",
         "admin_settings_labs_update": ADMIN_PREFIX + "/settings/labs/update",
         "admin_settings_sessions": ADMIN_PREFIX + "/settings/sessions",
         "admin_settings_sessions_cleanup": ADMIN_PREFIX + "/settings/sessions/cleanup",
         "admin_settings_system": ADMIN_PREFIX + "/settings/system",
         "admin_settings_system_update": ADMIN_PREFIX + "/settings/system/updates",
         "admin_settings_open_source": ADMIN_PREFIX + "/settings/open_source",
         "repo_group_new": ADMIN_PREFIX + "/repo_group/new",
         "repo_group_create": ADMIN_PREFIX + "/repo_group/create",
         "repo_new": ADMIN_PREFIX + "/repos/new",
         "repo_create": ADMIN_PREFIX + "/repos/create",
         "admin_permissions_global": ADMIN_PREFIX + "/permissions/global",
         "admin_permissions_global_update": ADMIN_PREFIX + "/permissions/global/update",
         "admin_permissions_object": ADMIN_PREFIX + "/permissions/object",
         "admin_permissions_object_update": ADMIN_PREFIX + "/permissions/object/update",
         "admin_permissions_ips": ADMIN_PREFIX + "/permissions/ips",
         "admin_permissions_overview": ADMIN_PREFIX + "/permissions/overview",
         "admin_permissions_ssh_keys": ADMIN_PREFIX + "/permissions/ssh_keys",
         "admin_permissions_ssh_keys_data": ADMIN_PREFIX + "/permissions/ssh_keys/data",
         "admin_permissions_ssh_keys_update": ADMIN_PREFIX
         + "/permissions/ssh_keys/update",
         "pullrequest_show": "/{repo_name}/pull-request/{pull_request_id}",
         "pull_requests_global": ADMIN_PREFIX + "/pull-request/{pull_request_id}",
         "pull_requests_global_0": ADMIN_PREFIX + "/pull_requests/{pull_request_id}",
         "pull_requests_global_1": ADMIN_PREFIX + "/pull-requests/{pull_request_id}",
         "notifications_show_all": ADMIN_PREFIX + "/notifications",
         "notifications_mark_all_read": ADMIN_PREFIX + "/notifications_mark_all_read",
         "notifications_show": ADMIN_PREFIX + "/notifications/{notification_id}",
         "notifications_update": ADMIN_PREFIX
         + "/notifications/{notification_id}/update",
         "notifications_delete": ADMIN_PREFIX
         + "/notifications/{notification_id}/delete",
         "my_account": ADMIN_PREFIX + "/my_account/profile",
         "my_account_edit": ADMIN_PREFIX + "/my_account/edit",
         "my_account_update": ADMIN_PREFIX + "/my_account/update",
         "my_account_pullrequests": ADMIN_PREFIX + "/my_account/pull_requests",
         "my_account_pullrequests_data": ADMIN_PREFIX + "/my_account/pull_requests/data",
         "my_account_emails": ADMIN_PREFIX + "/my_account/emails",
         "my_account_emails_add": ADMIN_PREFIX + "/my_account/emails/new",
         "my_account_emails_delete": ADMIN_PREFIX + "/my_account/emails/delete",
         "my_account_password": ADMIN_PREFIX + "/my_account/password",
         "my_account_password_update": ADMIN_PREFIX + "/my_account/password/update",
         "my_account_repos": ADMIN_PREFIX + "/my_account/repos",
         "my_account_watched": ADMIN_PREFIX + "/my_account/watched",
         "my_account_perms": ADMIN_PREFIX + "/my_account/perms",
         "my_account_notifications": ADMIN_PREFIX + "/my_account/notifications",
         "my_account_ssh_keys": ADMIN_PREFIX + "/my_account/ssh_keys",
         "my_account_ssh_keys_generate": ADMIN_PREFIX + "/my_account/ssh_keys/generate",
         "my_account_ssh_keys_add": ADMIN_PREFIX + "/my_account/ssh_keys/new",
         "my_account_ssh_keys_delete": ADMIN_PREFIX + "/my_account/ssh_keys/delete",
         "pullrequest_show_all": "/{repo_name}/pull-request",
         "pullrequest_show_all_data": "/{repo_name}/pull-request-data",
         "bookmarks_home": "/{repo_name}/bookmarks",
         "branches_home": "/{repo_name}/branches",
         "tags_home": "/{repo_name}/tags",
         "repo_changelog": "/{repo_name}/changelog",
         "repo_commits": "/{repo_name}/commits",
         "repo_commits_file": "/{repo_name}/commits/{commit_id}/{f_path}",
         "repo_commits_elements": "/{repo_name}/commits_elements",
         "repo_commit": "/{repo_name}/changeset/{commit_id}",
         "repo_commit_comment_create": "/{repo_name}/changeset/{commit_id}/comment/create",
         "repo_commit_comment_preview": "/{repo_name}/changeset/{commit_id}/comment/preview",
         "repo_commit_comment_delete": "/{repo_name}/changeset/{commit_id}/comment/{comment_id}/delete",
         "repo_commit_comment_edit": "/{repo_name}/changeset/{commit_id}/comment/{comment_id}/edit",
         "repo_commit_children": "/{repo_name}/changeset_children/{commit_id}",
         "repo_commit_parents": "/{repo_name}/changeset_parents/{commit_id}",
         "repo_commit_patch": "/{repo_name}/changeset-patch/{commit_id}",
         "repo_commit_download": "/{repo_name}/changeset-download/{commit_id}",
         "repo_commit_data": "/{repo_name}/changeset-data/{commit_id}",
         "repo_compare": "/{repo_name}/compare/{source_ref_type}@{source_ref}...{target_ref_type}@{target_ref}",
         "repo_compare_select": "/{repo_name}/compare",
         "rss_feed_home": "/{repo_name}/feed-rss",
         "atom_feed_home": "/{repo_name}/feed-atom",
         "rss_feed_home_old": "/{repo_name}/feed/rss",
         "atom_feed_home_old": "/{repo_name}/feed/atom",
         "repo_fork_new": "/{repo_name}/fork",
         "repo_fork_create": "/{repo_name}/fork/create",
         "repo_forks_show_all": "/{repo_name}/forks",
         "repo_forks_data": "/{repo_name}/forks/data",
         "edit_repo_issuetracker": "/{repo_name}/settings/issue_trackers",
         "edit_repo_issuetracker_test": "/{repo_name}/settings/issue_trackers/test",
         "edit_repo_issuetracker_delete": "/{repo_name}/settings/issue_trackers/delete",
         "edit_repo_issuetracker_update": "/{repo_name}/settings/issue_trackers/update",
         "edit_repo_maintenance": "/{repo_name}/settings/maintenance",
         "edit_repo_maintenance_execute": "/{repo_name}/settings/maintenance/execute",
         "repo_changelog_file": "/{repo_name}/changelog/{commit_id}/{f_path}",
         "pullrequest_repo_refs": "/{repo_name}/pull-request/refs/{target_repo_name:.*?[^/]}",
         "pullrequest_repo_targets": "/{repo_name}/pull-request/repo-destinations",
         "pullrequest_new": "/{repo_name}/pull-request/new",
         "pullrequest_create": "/{repo_name}/pull-request/create",
         "pullrequest_update": "/{repo_name}/pull-request/{pull_request_id}/update",
         "pullrequest_merge": "/{repo_name}/pull-request/{pull_request_id}/merge",
         "pullrequest_delete": "/{repo_name}/pull-request/{pull_request_id}/delete",
         "pullrequest_comment_create": "/{repo_name}/pull-request/{pull_request_id}/comment",
         "pullrequest_comment_delete": "/{repo_name}/pull-request/{pull_request_id}/comment/{comment_id}/delete",
         "pullrequest_comment_edit": "/{repo_name}/pull-request/{pull_request_id}/comment/{comment_id}/edit",
         "edit_repo_caches": "/{repo_name}/settings/caches",
         "edit_repo_perms": "/{repo_name}/settings/permissions",
         "edit_repo_fields": "/{repo_name}/settings/fields",
         "edit_repo_remote": "/{repo_name}/settings/remote",
         "edit_repo_statistics": "/{repo_name}/settings/statistics",
         "edit_repo_advanced": "/{repo_name}/settings/advanced",
         "edit_repo_advanced_delete": "/{repo_name}/settings/advanced/delete",
         "edit_repo_advanced_archive": "/{repo_name}/settings/advanced/archive",
         "edit_repo_advanced_fork": "/{repo_name}/settings/advanced/fork",
         "edit_repo_advanced_locking": "/{repo_name}/settings/advanced/locking",
         "edit_repo_advanced_journal": "/{repo_name}/settings/advanced/journal",
         "repo_stats": "/{repo_name}/repo_stats/{commit_id}",
         "repo_refs_data": "/{repo_name}/refs-data",
         "repo_refs_changelog_data": "/{repo_name}/refs-data-changelog",
         "repo_artifacts_stream_store": "/_file_store/stream-upload",
     }
 
 
 def route_path(name, params=None, **kwargs):
     import urllib.parse
 
     base_url = get_url_defs()[name].format(**kwargs)
 
     if params:
         base_url = f"{base_url}?{urllib.parse.urlencode(params)}"
     return base_url