|
| 1 | +import datetime |
| 2 | +import logging |
| 3 | + |
| 4 | +from . import client_credentials |
| 5 | + |
| 6 | + |
| 7 | +def test_expired_secret_cannot_authenticate(testclient, client, backend, caplog): |
| 8 | + """Clients cannot use an expired secret at the token endpoint.""" |
| 9 | + client.client_secret_expires_at = datetime.datetime.now( |
| 10 | + datetime.timezone.utc |
| 11 | + ) - datetime.timedelta(days=1) |
| 12 | + backend.save(client) |
| 13 | + assert client.secret_expired |
| 14 | + |
| 15 | + res = testclient.post( |
| 16 | + "/oauth/token", |
| 17 | + params=dict(grant_type="client_credentials"), |
| 18 | + headers={"Authorization": f"Basic {client_credentials(client)}"}, |
| 19 | + status=401, |
| 20 | + ) |
| 21 | + |
| 22 | + assert res.json["error"] == "invalid_client" |
| 23 | + assert ( |
| 24 | + "canaille", |
| 25 | + logging.SECURITY, |
| 26 | + f"Client {client.client_id} authentication attempt with a secret " |
| 27 | + f"expired since {client.client_secret_expires_at}", |
| 28 | + ) in caplog.record_tuples |
| 29 | + |
| 30 | + |
| 31 | +def test_expired_secret_cannot_authenticate_with_client_secret_post( |
| 32 | + testclient, client, backend |
| 33 | +): |
| 34 | + """The client_secret_post method is guarded the same way as client_secret_basic.""" |
| 35 | + client.token_endpoint_auth_method = "client_secret_post" |
| 36 | + client.client_secret_expires_at = datetime.datetime.now( |
| 37 | + datetime.timezone.utc |
| 38 | + ) - datetime.timedelta(days=1) |
| 39 | + backend.save(client) |
| 40 | + |
| 41 | + res = testclient.post( |
| 42 | + "/oauth/token", |
| 43 | + params=dict( |
| 44 | + grant_type="client_credentials", |
| 45 | + client_id=client.client_id, |
| 46 | + client_secret=client.client_secret, |
| 47 | + ), |
| 48 | + status=401, |
| 49 | + ) |
| 50 | + |
| 51 | + assert res.json["error"] == "invalid_client" |
| 52 | + |
| 53 | + |
| 54 | +def test_future_expiration_can_authenticate(testclient, client, backend): |
| 55 | + """A secret expiring in the future is still valid.""" |
| 56 | + client.client_secret_expires_at = datetime.datetime.now( |
| 57 | + datetime.timezone.utc |
| 58 | + ) + datetime.timedelta(days=1) |
| 59 | + backend.save(client) |
| 60 | + assert not client.secret_expired |
| 61 | + |
| 62 | + testclient.post( |
| 63 | + "/oauth/token", |
| 64 | + params=dict(grant_type="client_credentials"), |
| 65 | + headers={"Authorization": f"Basic {client_credentials(client)}"}, |
| 66 | + status=200, |
| 67 | + ) |
| 68 | + |
| 69 | + |
| 70 | +def test_edit_secret_expiration(testclient, client, logged_admin, backend): |
| 71 | + """Administrators can set and unset the secret expiration date.""" |
| 72 | + assert not client.client_secret_expires_at |
| 73 | + |
| 74 | + expiration = datetime.datetime.now(datetime.timezone.utc).replace( |
| 75 | + second=0, microsecond=0 |
| 76 | + ) + datetime.timedelta(days=30) |
| 77 | + |
| 78 | + res = testclient.get("/admin/client/edit/" + client.client_id) |
| 79 | + res.forms["clienteditform"]["client_secret_expires_at"] = expiration.strftime( |
| 80 | + "%Y-%m-%d %H:%M" |
| 81 | + ) |
| 82 | + res = res.forms["clienteditform"].submit(status=302, name="action", value="edit") |
| 83 | + assert ("success", "The client has been edited.") in res.flashes |
| 84 | + |
| 85 | + backend.reload(client) |
| 86 | + assert client.client_secret_expires_at == expiration |
| 87 | + assert not client.secret_expired |
| 88 | + |
| 89 | + res = res.follow() |
| 90 | + res.forms["clienteditform"]["client_secret_expires_at"] = "" |
| 91 | + res = res.forms["clienteditform"].submit(status=302, name="action", value="edit") |
| 92 | + |
| 93 | + backend.reload(client) |
| 94 | + assert client.client_secret_expires_at is None |
| 95 | + |
| 96 | + |
| 97 | +def test_new_client_secret(testclient, client, logged_admin, backend, caplog): |
| 98 | + """Renewing the secret of a client clears its expiration date.""" |
| 99 | + old_secret = client.client_secret |
| 100 | + client.client_secret_expires_at = datetime.datetime.now( |
| 101 | + datetime.timezone.utc |
| 102 | + ) - datetime.timedelta(days=1) |
| 103 | + backend.save(client) |
| 104 | + |
| 105 | + res = testclient.get("/admin/client/edit/" + client.client_id) |
| 106 | + res = res.forms["clienteditform"].submit( |
| 107 | + status=302, name="action", value="new-client-secret" |
| 108 | + ) |
| 109 | + assert ( |
| 110 | + "success", |
| 111 | + "The client secret has been renewed. The new secret does not expire.", |
| 112 | + ) in res.flashes |
| 113 | + assert ( |
| 114 | + "canaille", |
| 115 | + logging.SECURITY, |
| 116 | + f"Renewed the secret of client {client.client_id} by {logged_admin.id}", |
| 117 | + ) in caplog.record_tuples |
| 118 | + |
| 119 | + backend.reload(client) |
| 120 | + assert client.client_secret != old_secret |
| 121 | + assert client.client_secret_expires_at is None |
| 122 | + assert not client.secret_expired |
| 123 | + |
| 124 | + testclient.post( |
| 125 | + "/oauth/token", |
| 126 | + params=dict(grant_type="client_credentials"), |
| 127 | + headers={"Authorization": f"Basic {client_credentials(client)}"}, |
| 128 | + status=200, |
| 129 | + ) |
| 130 | + |
| 131 | + |
| 132 | +def test_expired_secret_is_displayed(testclient, client, logged_admin, backend): |
| 133 | + """Expired secrets are reported on the client page and in the client list.""" |
| 134 | + res = testclient.get("/admin/client/edit/" + client.client_id) |
| 135 | + res.mustcontain(no="Expired secret") |
| 136 | + res = testclient.get("/admin/client") |
| 137 | + res.mustcontain(no="The secret of this application has expired") |
| 138 | + |
| 139 | + client.client_secret_expires_at = datetime.datetime.now( |
| 140 | + datetime.timezone.utc |
| 141 | + ) - datetime.timedelta(days=1) |
| 142 | + backend.save(client) |
| 143 | + |
| 144 | + res = testclient.get("/admin/client/edit/" + client.client_id) |
| 145 | + res.mustcontain("Expired secret") |
| 146 | + res = testclient.get("/admin/client") |
| 147 | + res.mustcontain("The secret of this application has expired") |
| 148 | + |
| 149 | + |
| 150 | +def test_secret_expiration_is_serialized_as_a_timestamp(testclient, client, backend): |
| 151 | + """The RFC7591 client information uses timestamps, and 0 when there is no expiration.""" |
| 152 | + assert client.client_info["client_secret_expires_at"] == 0 |
| 153 | + |
| 154 | + expiration = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta( |
| 155 | + days=1 |
| 156 | + ) |
| 157 | + client.client_secret_expires_at = expiration |
| 158 | + backend.save(client) |
| 159 | + assert client.client_info["client_secret_expires_at"] == int(expiration.timestamp()) |
0 commit comments