Changeset - cd697cb12765
Parent rev.
Child rev.
[Not reviewed]
default
0 3 0
Mads Kiilerich - 9 years ago 2016-08-04 14:23:36
madski@unity3d.com
routing: introduce 'edit_user_api_keys_delete' url and use POST instead of DELETE
3 files changed with 10 insertions and 10 deletions:
kallithea/config/routing.py
2
2
kallithea/templates/admin/users/user_edit_api_keys.html
2
2
kallithea/tests/functional/test_admin_users.py
6
6
0 comments (0 inline, 0 general)
kallithea/config/routing.py
➞
Show inline comments
 
@@ -172,50 +172,50 @@ def make_map(config):
 
                        controller='admin/users') as m:
 
        m.connect("users", "/users",
 
                  action="create", conditions=dict(method=["POST"]))
 
        m.connect("users", "/users",
 
                  action="index", conditions=dict(method=["GET"]))
 
        m.connect("formatted_users", "/users.{format}",
 
                  action="index", conditions=dict(method=["GET"]))
 
        m.connect("new_user", "/users/new",
 
                  action="new", conditions=dict(method=["GET"]))
 
        m.connect("update_user", "/users/{id}",
 
                  action="update", conditions=dict(method=["PUT"]))
 
        m.connect("delete_user", "/users/{id}",
 
                  action="delete", conditions=dict(method=["DELETE"]))
 
        m.connect("edit_user", "/users/{id}/edit",
 
                  action="edit", conditions=dict(method=["GET"]))
 

			




	
	
	
		
 
        #EXTRAS USER ROUTES

			




	
	
	
		
 
        m.connect("edit_user_advanced", "/users/{id}/edit/advanced",

			




	
	
	
		
 
                  action="edit_advanced", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

			




	
	
	
		
 
                  action="edit_api_keys", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

			




	
	
	
		
 
                  action="add_api_key", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

			




	
	
	
		
 
                  action="delete_api_key", conditions=dict(method=["DELETE"]))

			




	
	
	
		
 
        m.connect("edit_user_api_keys_delete", "/users/{id}/edit/api_keys/delete",

			




	
	
	
		
 
                  action="delete_api_key", conditions=dict(method=["POST"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_perms", "/users/{id}/edit/permissions",

			




	
	
	
		
 
                  action="edit_perms", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_perms", "/users/{id}/edit/permissions",

			




	
	
	
		
 
                  action="update_perms", conditions=dict(method=["PUT"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_emails", "/users/{id}/edit/emails",

			




	
	
	
		
 
                  action="edit_emails", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_emails", "/users/{id}/edit/emails",

			




	
	
	
		
 
                  action="add_email", conditions=dict(method=["PUT"]))

			




	
	
	
		
 
        m.connect("edit_user_emails", "/users/{id}/edit/emails",

			




	
	
	
		
 
                  action="delete_email", conditions=dict(method=["DELETE"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_ips", "/users/{id}/edit/ips",

			




	
	
	
		
 
                  action="edit_ips", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_ips", "/users/{id}/edit/ips",

			




	
	
	
		
 
                  action="add_ip", conditions=dict(method=["PUT"]))

			




	
	
	
		
 
        m.connect("edit_user_ips_delete", "/users/{id}/edit/ips/delete",

			




	
	
	
		
 
                  action="delete_ip", conditions=dict(method=["POST"]))

			




	
	
	
		
 

			




	
	
	
		
 
    #ADMIN USER GROUPS REST ROUTES

			




	
	
	
		
 
    with rmap.submapper(path_prefix=ADMIN_PREFIX,

			




	
	
	
		
 
                        controller='admin/user_groups') as m:

			




	
	
	
		
 
        m.connect("users_groups", "/user_groups",

			




        

    


    
    

    

        

                

                    kallithea/templates/admin/users/user_edit_api_keys.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
<div class="apikeys_wrap">

			




	
	
	
		
 
  <table class="noborder">

			




	
	
	
		
 
    <tr>

			




	
	
	
		
 
        <td style="width: 450px"><div class="truncate autoexpand" style="width:120px;font-size:16px;font-family: monospace">${c.user.api_key}</div></td>

			




	
	
	
		
 
        <td>

			




	
	
	
		
 
            <span class="btn btn-mini btn-success disabled">${_('Built-in')}</span>

			




	
	
	
		
 
        </td>

			




	
	
	
		
 
        <td>${_('Expires')}: ${_('Never')}</td>

			




	
	
	
		
 
        <td>

			




	
	
	
		
 
            ${h.form(url('edit_user_api_keys', id=c.user.user_id),method='delete')}

			




	
	
	
		
 
            ${h.form(url('edit_user_api_keys_delete', id=c.user.user_id))}

			




	
	
	
		
 
                ${h.hidden('del_api_key',c.user.api_key)}

			




	
	
	
		
 
                ${h.hidden('del_api_key_builtin',1)}

			




	
	
	
		
 
                <button class="btn btn-mini btn-danger" type="submit"

			




	
	
	
		
 
                        onclick="return confirm('${_('Confirm to reset this API key: %s') % c.user.api_key}');">

			




	
	
	
		
 
                    ${_('Reset')}

			




	
	
	
		
 
                </button>

			




	
	
	
		
 
            ${h.end_form()}

			




	
	
	
		
 
        </td>

			




	
	
	
		
 
    </tr>

			




	
	
	
		
 
    %if c.user_api_keys:

			




	
	
	
		
 
        %for api_key in c.user_api_keys:

			




	
	
	
		
 
          <tr class="${'expired' if api_key.expired else ''}">

			




	
	
	
		
 
            <td style="width: 450px"><div class="truncate autoexpand" style="width:120px;font-size:16px;font-family: monospace">${api_key.api_key}</div></td>

			




	
	
	
		
 
            <td>${api_key.description}</td>

			




	
	
	
		
 
            <td style="min-width: 80px">

			




	
	
	
		
 
                 %if api_key.expires == -1:

			




	
	
	
		
 
                  ${_('Expires')}: ${_('Never')}

			




	
	
	
		
 
                 %else:

			




	
	
	
		
 
                    %if api_key.expired:

			




	
	
	
		
 
                        ${_('Expired')}: ${h.age(h.time_to_datetime(api_key.expires))}

			




	
	
	
		
 
                    %else:

			




	
	
	
		
 
                        ${_('Expires')}: ${h.age(h.time_to_datetime(api_key.expires))}

			




	
	
	
		
 
                    %endif

			




	
	
	
		
 
                 %endif

			




	
	
	
		
 
            </td>

			




	
	
	
		
 
            <td>

			




	
	
	
		
 
                ${h.form(url('edit_user_api_keys', id=c.user.user_id),method='delete')}

			




	
	
	
		
 
                ${h.form(url('edit_user_api_keys_delete', id=c.user.user_id))}

			




	
	
	
		
 
                    ${h.hidden('del_api_key',api_key.api_key)}

			




	
	
	
		
 
                    <button class="btn btn-mini btn-danger" type="submit"

			




	
	
	
		
 
                            onclick="return confirm('${_('Confirm to remove this API key: %s') % api_key.api_key}');">

			




	
	
	
		
 
                        <i class="icon-minus-circled"></i>

			




	
	
	
		
 
                        ${_('Remove')}

			




	
	
	
		
 
                    </button>

			




	
	
	
		
 
                ${h.end_form()}

			




	
	
	
		
 
            </td>

			




	
	
	
		
 
          </tr>

			




	
	
	
		
 
        %endfor

			




	
	
	
		
 
    %else:

			




	
	
	
		
 
    <tr><td><div class="ip">${_('No additional API keys specified')}</div></td></tr>

			




	
	
	
		
 
    %endif

			




	
	
	
		
 
  </table>

			




	
	
	
		
 
</div>

			




	
	
	
		
 

			




	
	
	
		
 
<div>

			




	
	
	
		
 
    ${h.form(url('edit_user_api_keys', id=c.user.user_id), method='post')}

			




	
	
	
		
 
    <div class="form">

			




	
	
	
		
 
        <!-- fields -->

			




	
	
	
		
 
        <div class="fields">

			




	
	
	
		
 
             <div class="field">

			




	
	
	
		
 
                <div class="label">

			




	
	
	
		
 
                    <label for="description">${_('New API key')}:</label>

			




        

    


    
    

    

        

                

                    kallithea/tests/functional/test_admin_users.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -466,65 +466,65 @@ class TestAdminUsersController(TestContr

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            response = response.follow()

			




	
	
	
		
 
            user = User.get(user_id)

			




	
	
	
		
 
            for api_key in user.api_keys:

			




	
	
	
		
 
                response.mustcontain(api_key)

			




	
	
	
		
 
        finally:

			




	
	
	
		
 
            for api_key in UserApiKeys.query().filter(UserApiKeys.user_id == user_id).all():

			




	
	
	
		
 
                Session().delete(api_key)

			




	
	
	
		
 
                Session().commit()

			




	
	
	
		
 

			




	
	
	
		
 
    def test_remove_api_key(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_by_username(TEST_USER_REGULAR_LOGIN)

			




	
	
	
		
 
        user_id = user.user_id

			




	
	
	
		
 

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys', id=user_id),

			




	
	
	
		
 
                {'description': 'desc', 'lifetime': -1, '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        self.checkSessionFlash(response, 'API key successfully created')

			




	
	
	
		
 
        response = response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
        #now delete our key

			




	
	
	
		
 
        keys = UserApiKeys.query().filter(UserApiKeys.user_id == user_id).all()

			




	
	
	
		
 
        assert 1 == len(keys)

			




	
	
	
		
 

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys', id=user_id),

			




	
	
	
		
 
                 {'_method': 'delete', 'del_api_key': keys[0].api_key, '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys_delete', id=user_id),

			




	
	
	
		
 
                 {'del_api_key': keys[0].api_key, '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        self.checkSessionFlash(response, 'API key successfully deleted')

			




	
	
	
		
 
        keys = UserApiKeys.query().filter(UserApiKeys.user_id == user_id).all()

			




	
	
	
		
 
        assert 0 == len(keys)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_reset_main_api_key(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_by_username(TEST_USER_REGULAR_LOGIN)

			




	
	
	
		
 
        user_id = user.user_id

			




	
	
	
		
 
        api_key = user.api_key

			




	
	
	
		
 
        response = self.app.get(url('edit_user_api_keys', id=user_id))

			




	
	
	
		
 
        response.mustcontain(api_key)

			




	
	
	
		
 
        response.mustcontain('Expires: Never')

			




	
	
	
		
 

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys', id=user_id),

			




	
	
	
		
 
                 {'_method': 'delete', 'del_api_key_builtin': api_key, '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys_delete', id=user_id),

			




	
	
	
		
 
                 {'del_api_key_builtin': api_key, '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        self.checkSessionFlash(response, 'API key successfully reset')

			




	
	
	
		
 
        response = response.follow()

			




	
	
	
		
 
        response.mustcontain(no=[api_key])

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class TestAdminUsersController_unittest(object):

			




	
	
	
		
 
    """ Unit tests for the users controller """

			




	
	
	
		
 

			




	
	
	
		
 
    def test_get_user_or_raise_if_default(self, monkeypatch):

			




	
	
	
		
 
        # flash complains about an non-existing session

			




	
	
	
		
 
        def flash_mock(*args, **kwargs):

			




	
	
	
		
 
            pass

			




	
	
	
		
 
        monkeypatch.setattr(h, 'flash', flash_mock)

			




	
	
	
		
 

			




	
	
	
		
 
        u = UsersController()

			




	
	
	
		
 
        # a regular user should work correctly

			




	
	
	
		
 
        user = User.get_by_username(TEST_USER_REGULAR_LOGIN)

			




	
	
	
		
 
        assert u._get_user_or_raise_if_default(user.user_id) == user

			




	
	
	
		
 
        # the default user should raise

			




	
	
	
		
 
        with pytest.raises(HTTPNotFound):

			




	
	
	
		
 
            u._get_user_or_raise_if_default(User.get_default_user().user_id)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class TestAdminUsersControllerForDefaultUser(TestController):

			




	
	
		
 
@@ -536,50 +536,50 @@ class TestAdminUsersControllerForDefault

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.get(url('edit_user', id=user.user_id), status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_edit_advanced_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.get(url('edit_user_advanced', id=user.user_id), status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    # API keys

			




	
	
	
		
 
    def test_edit_api_keys_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.get(url('edit_user_api_keys', id=user.user_id), status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_add_api_keys_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys', id=user.user_id),

			




	
	
	
		
 
                 {'_method': 'put', '_authentication_token': self.authentication_token()}, status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_delete_api_keys_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys', id=user.user_id),

			




	
	
	
		
 
                 {'_method': 'delete', '_authentication_token': self.authentication_token()}, status=404)

			




	
	
	
		
 
        response = self.app.post(url('edit_user_api_keys_delete', id=user.user_id),

			




	
	
	
		
 
                 {'_authentication_token': self.authentication_token()}, status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    # Permissions

			




	
	
	
		
 
    def test_edit_perms_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.get(url('edit_user_perms', id=user.user_id), status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_update_perms_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.post(url('edit_user_perms', id=user.user_id),

			




	
	
	
		
 
                 {'_method': 'put', '_authentication_token': self.authentication_token()}, status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    # Emails

			




	
	
	
		
 
    def test_edit_emails_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.get(url('edit_user_emails', id=user.user_id), status=404)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_add_emails_default_user(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        user = User.get_default_user()

			




	
	
	
		
 
        response = self.app.post(url('edit_user_emails', id=user.user_id),

			




	
	
	
		
 
                 {'_method': 'put', '_authentication_token': self.authentication_token()}, status=404)

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.