
    hLI                        d Z ddlZddlmc mZ ddlZddlZddl	m
Z
 ej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d	        Zej                  j                  d
        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zej                  j                  d        Zy)a  
test_auth.py

Purpose:
  Comprehensive test suite for authentication functionality including login,
  logout, rate limiting, session management, and CSRF protection.

Test Categories:
  - Successful login with valid credentials
  - Failed login with invalid credentials  
  - Logout functionality and session clearing
  - Rate limiting enforcement per user and IP
  - Session management and security
    Nget_dbc                 j   | j                         }|d   }|j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                  }|j                  }d} ||      }|sdd
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      t        j                  |      t        j                  |      dz  }t        t        j                  |            dx}x}x}}|j                  d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}y)z=Test successful login with valid credentials via POST /login.regular/loginusernamepasswordr   r	   data.  ==z3%(py2)s
{%(py2)s = %(py0)s.status_code
} == %(py5)sresponsepy0py2py5assert %(py7)spy7N/selecthassert %(py8)s
{%(py8)s = %(py4)s
{%(py4)s = %(py2)s
{%(py2)s = %(py0)s.location
}.endswith
}(%(py6)s)
}r   r   py4py6py8   )test_clientpoststatus_code
@pytest_ar_call_reprcompare@py_builtinslocals_should_repr_global_name	_safereprAssertionError_format_explanationlocationendswithget)app
test_usersclear_rate_limitsclientuserr   @py_assert1@py_assert4@py_assert3@py_format6@py_format8@py_assert5@py_assert7@py_format9s                 MC:\Users\algun\Documents\ceba web\Ceba - Github\tests\functional\test_auth.py'test_successful_login_valid_credentialsr;      s    __Fi D{{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 0%%0i0%i0000000080008000000%000i0000000000 zz)$H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&    c                    | j                         }|j                  dddd      }|j                  }d}||k(  }|st        j                  d|fd||f      d	t        j                         v st        j                  |      rt        j                  |      nd	t        j                  |      t        j                  |      d
z  }dd|iz  }	t        t        j                  |	            dx}x}}|j                  }|j                  }d}
 ||
      }|sdd	t        j                         v st        j                  |      rt        j                  |      nd	t        j                  |      t        j                  |      t        j                  |
      t        j                  |      dz  }t        t        j                  |            dx}x}x}
}|j                  d      }|j                  }d}||k(  }|st        j                  d|fd||f      d	t        j                         v st        j                  |      rt        j                  |      nd	t        j                  |      t        j                  |      d
z  }dd|iz  }	t        t        j                  |	            dx}x}}g }d}|j                  }||v }|}|sd}|j                  }||v }|}|st        j                  d|fd||f      t        j                  |      d	t        j                         v st        j                  |      rt        j                  |      nd	t        j                  |      dz  }	dd|	iz  }|j                  |       |st        j                  dfdf      t        j                  |      d	t        j                         v st        j                  |      rt        j                  |      nd	t        j                  |      dz  }dd|iz  }|j                  |       t        j                   |d      i z  }dd|iz  }t        t        j                  |            dx}x}x}x}x}x}x}}y) z(Test failed login with invalid username.r   nonexistentuseranypasswordr
   r   r   r   r   r   r   r   r   N/r   r   r      Pogre   korisniinz,%(py3)s in %(py7)s
{%(py7)s = %(py5)s.data
}py3r   r   %(py9)spy9z0%(py12)s in %(py16)s
{%(py16)s = %(py14)s.data
}py12py14py16%(py18)spy18   assert %(py21)spy21r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r   append_format_boolop)r-   r.   r/   r0   r   r2   r3   r4   r5   r6   r7   r8   r9   @py_assert2@py_assert6@py_assert0@py_assert11@py_assert15@py_assert13@py_format10@py_format17@py_format19@py_format20@py_format22s                           r:   "test_failed_login_invalid_usernamerb   ,   s    __F{{8%!+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&*%%*c*%c********8***8******%***c********** zz#H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&C8Cx}}C8}$C
ChmmC
m(CCCCC8}CCC8CCCCCCxCCCxCCC}CCCCCCC
mCCC
CCCCCChCCChCCCmCCCCCCCCCCCCCCr<   c                    | j                         }|d   }|j                  d|d   dd      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                  }|j                  }d} ||      }|sdd
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      t        j                  |      t        j                  |      dz  }t        t        j                  |            dx}x}x}}|j                  d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}g }d}|j                  }||v }|}|sd}|j                  }||v }|}|st        j                  d|fd||f      t        j                  |      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      dz  }
dd|
iz  }|j                  |       |st        j                  dfdf      t        j                  |      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      dz  }dd|iz  }|j                  |       t        j                   |d      i z  }dd |iz  }t        t        j                  |            dx}x}x}x}x}x}x}}y)!z(Test failed login with invalid password.limitedr   r   wrongpasswordr
   r   r   r   r   r   r   r   r   Nr@   r   r   r   rA   rB   rC   rE   rF   rH   rI   rJ   rK   rO   rP   rQ   rR   rS   rT   )r-   r.   r/   r0   r1   r   r2   r3   r4   r5   r6   r7   r8   r9   rW   rX   rY   rZ   r[   r\   r]   r^   r_   r`   ra   s                            r:   "test_failed_login_invalid_passwordrf   A   s    __Fi D{{8$#+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&*%%*c*%c********8***8******%***c********** zz#H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&C8Cx}}C8}$C
ChmmC
m(CCCCC8}CCC8CCCCCCxCCCxCCC}CCCCCCC
mCCC
CCCCCChCCChCCCmCCCCCCCCCCCCCCr<   c                    | j                         }|j                  dddd      }|j                  }d}||k(  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      d	z  }d
d|iz  }t        t        j                  |            dx}x}}|j                  }|j                  }d}	 ||	      }
|
sddt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      t        j                  |	      t        j                  |
      dz  }t        t        j                  |            dx}x}x}	}
y)z)Test failed login with empty credentials.r    r
   r   r   r   r   r   r   r   r   Nr@   r   r   )r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   )r-   r/   r0   r   r2   r3   r4   r5   r6   r7   r8   r9   s               r:   #test_failed_login_empty_credentialsri   W   s)    __F{{8+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&*%%*c*%c********8***8******%***c**********r<   c                 T	    |        | j                         }|d   }|j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                  d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                         5 }|j                  dd      }ddd       |j                  ddi      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                  }|j                  }d} ||      }|sdd
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      t        j                  |      t        j                  |      dz  }t        t        j                  |            dx}x}x}}|j                  d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}y# 1 sw Y   xY w)z@Test logout functionality via POST /logout and session clearing.adminr   r   r	   r
   r   r   r   r   r   r   r   r   Nr   r   
csrf_tokenrh   /logoutr@   r   r   )r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r,   session_transactionr*   r+   )r-   r.   r/   r0   r1   r   r2   r3   r4   r5   r6   sessrl   r7   r8   r9   s                   r:   test_logout_functionalityrp   g   s     __F gD{{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& zz)$H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	%XXlB/
 
& {{9L*+E{FH &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&*%%*c*%c********8***8******%***c********** zz)$H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
&	%s   *RR'c                    | j                         }|d   }|j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                  d      }|j                  }ddg}||v }|st        j                  d|fd||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}y)z3Test that GET /logout is not supported (only POST).r   r   r   r	   r
   r   r   r   r   r   r   r   r   Nrm   i  i  rC   )z3%(py2)s
{%(py2)s = %(py0)s.status_code
} in %(py5)s)r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r,   )r-   r.   r/   r0   r1   r   r2   r3   r4   r5   r6   s              r:   %test_logout_get_request_not_supportedrr      s=    __F i D{{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& zz)$H-C:-:----:------8---8------:-------r<   c                 6    |        | j                         }ddl}ddlm} | j	                         5   |       }|j                  dj                  d      |j                               j                  d      }ddl	}dt         |j                                }|j                  d||df      }	|j                          ddd       |j                  d	dd
      }
|
j                  }d}||k(  }|st        j                   d|fd||f      dt#        j$                         v st        j&                  |
      rt        j(                  |
      ndt        j(                  |      t        j(                  |      dz  }dd|iz  }t+        t        j,                  |            dx}x}}t/        d      D ]  }|j1                  d      }
|
j                  }d}||k(  }|st        j                   d|fd||f      dt#        j$                         v st        j&                  |
      rt        j(                  |
      ndt        j(                  |      t        j(                  |      dz  }dd|iz  }t+        t        j,                  |            dx}x}} y# 1 sw Y   xY w)z7Test that session persists across requests after login.r   Nr   testpassutf-8sessionuser_FINSERT INTO users (username, password_hash, is_admin) VALUES (?, ?, ?)Fr   r
   r   r   r   r   r   r   r   r      r   r   )r   bcryptapp_modules.dbr   app_contexthashpwencodegensaltdecodetimeintexecutecommitr    r!   r"   r#   r$   r%   r&   r'   r(   r)   ranger,   )r-   r/   r0   ry   r   dbtest_password_hashr   unique_usernamecursorr   r2   r3   r4   r5   r6   is                    r:   test_session_managementr      s     __F %		X#]]:+<+<W+Ev~~GWX__`gh(YTYY[)9(:;T0%8
 			 
 {{8#+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 1X::i(##*s*#s****#s******x***x***#***s******* ) 
	s   BJJc                    | j                         }ddg}|D ]  }|j                  |      }|j                  }d}||k(  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }	dd	|	iz  }
t        t        j                  |
            d
x}x}} y
)z5Test that protected endpoints require authentication.r   /dodaj-kamerur   r   r   r   r   r   r   N)r   r,   r!   r"   r#   r$   r%   r&   r'   r(   r)   )r-   r/   r0   protected_endpointsendpointr   r2   r3   r4   r5   r6   s              r:   /test_protected_endpoints_require_authenticationr      s     __F 	
 (::h'##*s*#s****#s******x***x***#***s******* (r<   c                    | j                         }|d   }|j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                  di       }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                         5 }|j                  dd      }ddd       |j                  ddi      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}y# 1 sw Y   xY w)z(Test CSRF protection on logout endpoint.r   r   r   r	   r
   r   r   r   r   r   r   r   r   Nrm     rl   rh   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   rn   r,   r-   r.   r/   r0   r1   r   r2   r3   r4   r5   r6   ro   rl   s                r:   test_csrf_protection_on_logoutr      s    __Fi D {{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& {{92{.H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	%XXlB/
 
& {{9L*+E{FH&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&	 
&	%s   %KK'c                    | j                         }|j                  d      }|j                  }d}||k(  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}|j                         5 }	|	j                  d
      }
d	}|
|u}|st        j                  d|fd|
|f      d
t        j                         v st        j                  |
      rt        j                  |
      nd
t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}}t        |
      }d}||kD  }|st        j                  d|fd||f      dt        j                         v st        j                  t              rt        j                  t              ndd
t        j                         v st        j                  |
      rt        j                  |
      nd
t        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}d	d	d	       y	# 1 sw Y   y	xY w)z:Test that CSRF tokens are properly generated and injected.r@   r   r   r   r   r   r   r   Nrl   is notz%(py0)s is not %(py3)sr   rG   assert %(py5)sr      )>)z/%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} > %(py6)slenr   py1rG   r   assert %(py8)sr   )r   r,   r!   r"   r#   r$   r%   r&   r'   r(   r)   rn   r   )r-   r/   r0   r   r2   r3   r4   r5   r6   ro   rl   rW   @py_format4r7   @py_format7r9   s                   r:   test_csrf_token_generationr      s    __F zz#H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	%XXl+
!%%z%%%%z%%%%%%z%%%z%%%%%%%%%%:############s###s######:###:############# 
&	%	%s   :GK

Kc                     | j                         }|d   }|j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}|j                         5 }|j                  dd      }ddd       |j                  dddd      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}y# 1 sw Y   xY w)z9Test CSRF protection on various state-changing endpoints.rk   r   r   r	   r
   r   r   r   r   r   r   r   r   Nrl   rh   z/admin/add_usertestuser123testpass123r   r   r   s                r:   /test_csrf_protection_on_state_changing_requestsr     sy    __FgD {{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	%XXlB/
 
& {{,!!4{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
&	%s   
HHc                 *   | j                         }|d   }| j                         5  t               }|j                  d       |j	                          ddd       |j                  d|d   |d   d      }|j                  }d	}||k(  }	|	st        j                  d
|	fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}| j                         5  t               }|j                  dd|d   f      j                         }t!        |      }d}||k(  }|st        j                  d
|fd||f      dt        j                         v st        j                  t               rt        j                  t               nddt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            dx}x}}|d   }|d   }|d   }	||	k(  }|slt        j                  d
|fd||	f      t        j                  |      t        j                  |	      dz  }dd|iz  }t        t        j                  |            dx}x}}	|d   }d}	||	u}|slt        j                  d|fd ||	f      t        j                  |      t        j                  |	      dz  }dd|iz  }t        t        j                  |            dx}x}}	|d!   }d}	||	k(  }|slt        j                  d
|fd||	f      t        j                  |      t        j                  |	      dz  }dd|iz  }t        t        j                  |            dx}x}}	ddd       | j                         }|j                  d|d   d"d      }|j                  }d	}||k(  }	|	st        j                  d
|	fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}| j                         5  t               }|j                  dd#|d   f      j                         }t!        |      }d}||k(  }|st        j                  d
|fd||f      dt        j                         v st        j                  t               rt        j                  t               nddt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            dx}x}}|d   }|d   }|d   }	||	k(  }|slt        j                  d
|fd||	f      t        j                  |      t        j                  |	      dz  }dd|iz  }t        t        j                  |            dx}x}}	|d!   }d#}	||	k(  }|slt        j                  d
|fd||	f      t        j                  |      t        j                  |	      dz  }dd|iz  }t        t        j                  |            dx}x}}	ddd       y# 1 sw Y   xY w# 1 sw Y   ixY w# 1 sw Y   yxY w)$z4Test that authentication events are properly logged.rd   zDELETE FROM auth_logNr   r   r	   r
   r   r   r   r   r   r   r   r   z7SELECT * FROM auth_log WHERE event = ? AND username = ?login_successrQ   )z0%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} == %(py6)sr   logsr   r   r   r   )z%(py1)s == %(py4)sr   r   assert %(py6)sr   user_idr   )z%(py1)s is not %(py4)seventre   login_failure)r   r{   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   fetchallr   )r-   r.   r/   r0   r1   r   r   r2   r3   r4   r5   r6   r   rW   r7   r   r9   logrY   @py_format5client_2s                        r:   !test_authentication_event_loggingr   #  s    __Fi D 
	X


)*
		 
 {{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	XzzS)4
+;<>>Fhj 	4yAyA~yAss44yA1g:2$z"22"22222"2222222"222222229~)T)~T))))~T)))~)))T)))))))7|..|....|...|.......... 
  H}}X$#-} H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	XzzS)4
+;<>>Fhj 	4yAyA~yAss44yA1g:2$z"22"22222"2222222"222222227|..|....|...|.......... 
	A 
	 
	& 
	s%   ,]/K]<I^	/]9<^	^c                 <	   | j                         }|d   }|j                  d      }|j                  }d}||k(  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }	dd	|	iz  }
t        t        j                  |
            d
x}x}}|j                         5 }|j                  dd      }d
d
d
       |j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }	dd	|	iz  }
t        t        j                  |
            d
x}x}}|j                         5 }|j                  d      }d
}||u}|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      dz  }dd|iz  }	t        t        j                  |	            d
x}}d
d
d
       |j                  d      }|j                  }d}||k(  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }	dd	|	iz  }
t        t        j                  |
            d
x}x}}|j                         5 }|j                  dd      }d}||k7  }|st        j                  d|fd||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      dz  }dd|iz  }	t        t        j                  |	            d
x}}d
d
d
       y
# 1 sw Y   hxY w# 1 sw Y   xY w# 1 sw Y   y
xY w)zFTest that session is regenerated on login to prevent session fixation.r   r@   r   r   r   r   r   r   r   Nrl   rh   r   r   r	   r
   r   r   r   r   r   logged_in_user_idr   r   r   r   !=)z%(py0)s != %(py3)scsrf_token_after_login)r   r,   r!   r"   r#   r$   r%   r&   r'   r(   r)   rn   r    )r-   r.   r/   r0   r1   r   r2   r3   r4   r5   r6   ro   initial_csrf_tokenr   rW   r   r   s                    r:   "test_session_regeneration_on_loginr   U  s    __Fi D zz#H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	%!XXlB7 
& {{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	% HHY/(,, ,,,, ,,,,,, ,,, ,,,,,,,,,, 
&
 zz)$H&3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&& 
	#	#	%!%,!;)++%++++%++++++%+++%++++++++++ 
&	%) 
&	% 
&	% 
&	%s&   ?Q8B7R6B9R8RRRc                 	   |d   }| j                         }| j                         }|j                  d|d   |d   d      }|j                  }d}||k(  }	|	st        j                  d|	fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}|j                  d|d   |d   d      }|j                  }d}||k(  }	|	st        j                  d|	fd	||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}|j                  d      }|j                  }d}||k(  }	|	st        j                  d|	fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}|j                  d      }|j                  }d}||k(  }	|	st        j                  d|	fd	||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}|j                         5 }|j                  dd      }ddd       |j                  ddi       |j                  d      }|j                  }d}||k(  }	|	st        j                  d|	fd	||f      dt        j                         v st        j                  |      rt        j                  |      ndt        j                  |      t        j                  |      dz  }
dd|
iz  }t        t        j                  |            dx}x}	}y# 1 sw Y   xY w)z@Test handling of multiple concurrent sessions for the same user.rk   r   r   r	   r
   r   r   r   r   	response1r   r   r   N	response2r   r   rl   rh   rm   )r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r,   rn   )r-   r.   r/   r1   client1client2r   r2   r3   r4   r5   r6   r   ro   csrf_token1s                  r:   !test_multiple_concurrent_sessionsr   z  s+    gD ooGooG X$$- I   'C' C'''' C''''''9'''9''' '''C''''''' X$$- I   'C' C'''' C''''''9'''9''' '''C''''''' I&I  'C' C'''' C''''''9'''9''' '''C'''''''I&I  'C' C'''' C''''''9'''9''' '''C''''''' 
	$	$	&$hh|R0 
' LL,!<L= I&I  'C' C'''' C''''''9'''9''' '''C''''''' 
'	&s   0R::Sc           	         | j                         }|d   }|j                  d|d   |d   d      }|j                  }d}||k(  }|st        j                  d|fd	||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }	dd|	iz  }
t        t        j                  |
            dx}x}}ddg}|D ]  }|j                  |      }g }|j                  }d}||k7  }|}|s'|j                  }|j                  }d} ||      }| }|}|st        j                  d|fd||f      d
t        j                         v st        j                  |      rt        j                  |      nd
t        j                  |      t        j                  |      dz  }
dd|
iz  }|j                  |       |sdd
t        j                         v st        j                  |      rt        j                  |      nd
t        j                        t        j                        t        j                        t        j                        dz  }|j                  |       t        j                  |d      i z  }dd|iz  }t        t        j                  |            dx}x}x}x}x}x}x}x}x}} y)zBTest that authenticated session persists across multiple requests.rd   r   r   r	   r
   r   r   r   r   r   r   r   r   Nr   r   r@   r   )z3%(py4)s
{%(py4)s = %(py2)s.status_code
} != %(py7)s)r   r   r   rH   rI   zmnot %(py19)s
{%(py19)s = %(py15)s
{%(py15)s = %(py13)s
{%(py13)s = %(py11)s.location
}.endswith
}(%(py17)s)
})py11py13py15py17py19rQ   zassert %(py23)spy23)r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r,   r*   r+   rU   rV   )r-   r.   r/   r0   r1   r   r2   r3   r4   r5   r6   protected_urlsurlrX   r7   rY   @py_assert12@py_assert14@py_assert16@py_assert18@py_assert20r]   @py_format21ra   @py_format24s                            r:   (test_session_persistence_across_requestsr     s    __Fi D {{8$$+{ H &3&3&&&&3&&&&&&8&&&8&&&&&&3&&&&&&&  1N::c?Qx##QsQ#s*Q(2C2CQ2C2L2LQSQ2LS2QQ2Q.QQ.QQQQ#sQQQQQQxQQQxQQQ#QQQsQQQQQQQQQQ(QQQ(QQQ2CQQQ2LQQQSQQQ2QQQQQQQQQQQQQQQ r<   c                    | j                         }ddl}ddlm} | j	                         5   |       }|j                  dj                  d      |j                               j                  d      }ddl	}dt         |j                                }|j                  d||df      }	|j                          ddd       t        d	      D ]  }
|j                  d
dd      }|j                  }d}||k(  }|st!        j"                  d|fd||f      dt%        j&                         v st!        j(                  |      rt!        j*                  |      ndt!        j*                  |      t!        j*                  |      dz  }dd|iz  }t-        t!        j.                  |            dx}x}} | j	                         5   |       }|j                  df      j1                         }|r|d   }d	}||k\  }|slt!        j"                  d|fd||f      t!        j*                  |      t!        j*                  |      dz  }dd|iz  }t-        t!        j.                  |            dx}x}}ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)z6Test comprehensive rate limiting enforcement per user.r   Nr   rt   ru   ratelimituser_rw   F   r   re   r
   r   r   r   r   r   r   r   r   z8SELECT fail_count FROM login_attempts WHERE username = ?
fail_count>=)z%(py1)s >= %(py4)sr   r   r   )r   ry   rz   r   r{   r|   r}   r~   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   fetchone)r-   r/   r0   ry   r   r   r   r   r   r   r   r   r2   r3   r4   r5   r6   attemptsrY   rW   r   r   s                         r:   )test_rate_limiting_per_user_comprehensiver     s    __F %		X#]]:+<+<W+Ev~~GWX__`gh*3ytyy{+;*<=T0%8
 			 
  1X;;x''/
;  ##*s*#s****#s******x***x***#***s*******  
	X::F
 (* 	
 L).Q.)Q....)Q...)...Q....... 
	1 
	0 
	s   BI1=B+I>1I;>Jc                 \   | j                         }ddl}ddlm} ddl}| j                         5   |       }|j                  dj                  d      |j                               j                  d      }g }t        d      D ]H  }	dt         |j                                d|	 }
|j                  d	|
|d
f      }|j                  |
       J |j                          ddd       g }D ]^  }t        d      D ]D  }|j                  d|dd      }|j                  |j                          |j                   dk(  sD n |d   dk(  s^ n g }d}||v }|}|sd}||v }|}|sXt#        j$                  d|fd||f      t#        j&                  |      dt)        j*                         v st#        j,                  |      rt#        j&                  |      nddz  }dd|iz  }|j                  |       |st#        j$                  dfd|f      t#        j&                  |      dt)        j*                         v st#        j,                  |      rt#        j&                  |      nddz  }dd|iz  }|j                  |       t#        j.                  |d      i z  }dd|iz  }t1        t#        j2                  |            dx}x}x}x}x}}| j                         5   |       }|j                  d      j5                         }t7        |      }d}||k\  }|st#        j$                  d |fd!||f      d"t)        j*                         v st#        j,                  t6              rt#        j&                  t6              nd"d#t)        j*                         v st#        j,                  |      rt#        j&                  |      nd#t#        j&                  |      t#        j&                  |      d$z  }d%d&|iz  }t1        t#        j2                  |            dx}x}}ddd       y# 1 sw Y   :xY w# 1 sw Y   yxY w)'z.Test rate limiting enforcement per IP address.r   Nr   rt   ru   rx   ipuser__rw   Fr   re   r
   r   i  r   rC   )z%(py3)s in %(py5)s	responses)rG   r   z%(py7)sr   )z%(py10)s in %(py12)s)py10rL   z%(py14)srM   rQ   zassert %(py17)sr   zSELECT * FROM login_ip_attemptsr   )z0%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} >= %(py6)sr   ip_attemptsr   r   r   )r   ry   rz   r   r   r{   r|   r}   r~   r   r   r   r   rU   r   r    r!   r"   r#   r'   r$   r%   r&   rV   r(   r)   r   r   ) r-   r/   r0   ry   r   r   r   r   usersr   r   r   r   r   jr   r2   rW   r3   rY   @py_assert9rZ   r5   r6   @py_format13@py_format15@py_format16@py_format18r   r7   r   r9   s                                    r:   test_rate_limiting_per_ipr     s    __F %		X#]]:+<+<W+Ev~~GWX__`ghqA 'IDIIK(8'91#>OZZX "4e<F LL)  			 
  IqA{{8$+3{ H X112##s*  R=C  03/3)/s/si/////3)///3//////)///)///////si///s//////i///i////////////// 
	Xjj!BCLLN;$1$1$$$$1$$$$$$s$$$s$$$$$$;$$$;$$$$$$1$$$$$$$	 
	G 
	F 
	s   B.PD7P"P"P+)__doc__builtinsr$   _pytest.assertion.rewrite	assertionrewriter"   pytestr   rz   r   markauthr;   rb   rf   ri   rp   rr   r   r   r   r   r   r   r   r   r   r   r    r<   r:   <module>r      s#      ! ' ', D D( D D* + + "' "'J . ., "+ "+J + +  ' '2 $ $  ' '8 ./ ./b !, !,H %( %(P R R, )/ )/X 1% 1%r<   