eb1f2b82eb
First step of the self-service password-change feature: a timestamp that backs the per-session freshness check used to invalidate other sessions on password change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.3 KiB
Python
40 lines
1.3 KiB
Python
from l4d2web.db import init_db, session_scope
|
|
from l4d2web.models import Blueprint, User
|
|
|
|
|
|
def test_create_user_and_blueprint(tmp_path, monkeypatch) -> None:
|
|
monkeypatch.setenv("DATABASE_URL", f"sqlite:///{tmp_path/'app.db'}")
|
|
|
|
init_db()
|
|
|
|
with session_scope() as session:
|
|
user = User(username="alice", password_digest="digest", admin=False)
|
|
session.add(user)
|
|
session.flush()
|
|
|
|
blueprint = Blueprint(user_id=user.id, name="default", arguments="[]", config="[]")
|
|
session.add(blueprint)
|
|
session.flush()
|
|
|
|
assert user.id is not None
|
|
assert blueprint.id is not None
|
|
|
|
|
|
def test_user_has_password_changed_at_default(tmp_path, monkeypatch):
|
|
from datetime import UTC, datetime
|
|
from l4d2web.app import create_app
|
|
from l4d2web.auth import hash_password
|
|
|
|
db_url = f"sqlite:///{tmp_path/'pw.db'}"
|
|
monkeypatch.setenv("DATABASE_URL", db_url)
|
|
create_app({"TESTING": True, "DATABASE_URL": db_url, "SECRET_KEY": "test"})
|
|
init_db()
|
|
|
|
before = datetime.now(UTC).replace(tzinfo=None)
|
|
with session_scope() as db:
|
|
db.add(User(username="alice", password_digest=hash_password("secret")))
|
|
with session_scope() as db:
|
|
user = db.query(User).filter_by(username="alice").one()
|
|
|
|
assert user.password_changed_at is not None
|
|
assert user.password_changed_at >= before
|