netbox/netbox/users/tests/test_models.py

import secrets
from datetime import timedelta
from unittest.mock import patch

from django.core.exceptions import ValidationError
from django.test import TestCase, override_settings
from django.utils import timezone

from users.choices import TokenVersionChoices
from users.constants import TOKEN_CHARSET, TOKEN_DEFAULT_LENGTH
from users.models import Token, User
from utilities.testing import create_test_user


class TokenTestCase(TestCase):
    """
    Test class for testing the functionality of the Token model.
    """

    @classmethod
    def setUpTestData(cls):
        """
        Set up test data for the Token model.
        """
        cls.user = create_test_user('User 1')

    def test_is_active(self):
        """
        Test the is_active property.
        """
        # Token with enabled status and no expiration date
        token = Token(user=self.user, enabled=True, expires=None)
        self.assertTrue(token.is_active)

        # Token with disabled status
        token.enabled = False
        self.assertFalse(token.is_active)

        # Token with enabled status and future expiration
        future_date = timezone.now() + timedelta(days=1)
        token = Token(user=self.user, enabled=True, expires=future_date)
        self.assertTrue(token.is_active)

        # Token with past expiration
        token.expires = timezone.now() - timedelta(days=1)
        self.assertFalse(token.is_active)

        # Token with disabled status and past expiration
        past_date = timezone.now() - timedelta(days=1)
        token = Token(user=self.user, enabled=False, expires=past_date)
        self.assertFalse(token.is_active)

    def test_is_expired(self):
        """
        Test the is_expired property.
        """
        # Token with no expiration
        token = Token(user=self.user, expires=None)
        self.assertFalse(token.is_expired)

        # Token with future expiration
        token.expires = timezone.now() + timedelta(days=1)
        self.assertFalse(token.is_expired)

        # Token with past expiration
        token.expires = timezone.now() - timedelta(days=1)
        self.assertTrue(token.is_expired)

    def test_cannot_create_token_with_past_expiration(self):
        """
        Test that creating a token with an expiration date in the past raises a ValidationError.
        """
        past_date = timezone.now() - timedelta(days=1)
        token = Token(user=self.user, expires=past_date)

        with self.assertRaises(ValidationError) as cm:
            token.clean()
        self.assertIn('expires', cm.exception.error_dict)

    def test_can_update_existing_expired_token(self):
        """
        Test that updating an already expired token does NOT raise a ValidationError.
        """
        # Create a valid token first with an expiration date in the past
        # bypasses the clean() method
        token = Token.objects.create(user=self.user)
        token.expires = timezone.now() - timedelta(days=1)
        token.save()

        # Try to update the description
        token.description = 'New Description'
        try:
            token.clean()
            token.save()
        except ValidationError:
            self.fail('Updating an expired token should not raise ValidationError')

        token.refresh_from_db()
        self.assertEqual(token.description, 'New Description')

    @override_settings(API_TOKEN_PEPPERS={})
    def test_v2_without_peppers_configured(self):
        """
        Attempting to save a v2 token without API_TOKEN_PEPPERS defined should raise a ValidationError.
        """
        token = Token(version=TokenVersionChoices.V2)
        with self.assertRaises(ValidationError):
            token.clean()

    def test_generate_uses_csprng(self):
        """
        Regression: Token.generate() must use secrets.choice (CSPRNG), not random.choice
        (Mersenne Twister). Verify that the call is routed through the secrets module.
        """
        with patch('users.models.tokens.secrets.choice', wraps=secrets.choice) as mock_choice:
            value = Token.generate()

        self.assertEqual(mock_choice.call_count, TOKEN_DEFAULT_LENGTH,
                         "secrets.choice must be called once per token character")
        self.assertEqual(len(value), TOKEN_DEFAULT_LENGTH)
        self.assertTrue(all(c in TOKEN_CHARSET for c in value),
                        "Generated token must only contain characters from TOKEN_CHARSET")

    def test_generate_length_parameter(self):
        """
        Token.generate(length=N) returns a string of exactly N characters from TOKEN_CHARSET.
        """
        for length in (8, 20, TOKEN_DEFAULT_LENGTH, 64):
            value = Token.generate(length=length)
            self.assertEqual(len(value), length, f"Expected length {length}, got {len(value)}")
            self.assertTrue(all(c in TOKEN_CHARSET for c in value))


class UserConfigTestCase(TestCase):

    @classmethod
    def setUpTestData(cls):

        user = User.objects.create_user(username='testuser')
        user.config.data = {
            'a': True,
            'b': {
                'foo': 101,
                'bar': 102,
            },
            'c': {
                'foo': {
                    'x': 201,
                },
                'bar': {
                    'y': 202,
                },
                'baz': {
                    'z': 203,
                }
            }
        }
        user.config.save()

    def test_get(self):
        userconfig = User.objects.get(username='testuser').config

        # Retrieve root and nested values
        self.assertEqual(userconfig.get('a'), True)
        self.assertEqual(userconfig.get('b.foo'), 101)
        self.assertEqual(userconfig.get('c.baz.z'), 203)

        # Invalid values should return None
        self.assertIsNone(userconfig.get('invalid'))
        self.assertIsNone(userconfig.get('a.invalid'))
        self.assertIsNone(userconfig.get('b.foo.invalid'))
        self.assertIsNone(userconfig.get('b.foo.x.invalid'))

        # Invalid values with a provided default should return the default
        self.assertEqual(userconfig.get('invalid', 'DEFAULT'), 'DEFAULT')
        self.assertEqual(userconfig.get('a.invalid', 'DEFAULT'), 'DEFAULT')
        self.assertEqual(userconfig.get('b.foo.invalid', 'DEFAULT'), 'DEFAULT')
        self.assertEqual(userconfig.get('b.foo.x.invalid', 'DEFAULT'), 'DEFAULT')

    def test_all(self):
        userconfig = User.objects.get(username='testuser').config
        flattened_data = {
            'a': True,
            'b.foo': 101,
            'b.bar': 102,
            'c.foo.x': 201,
            'c.bar.y': 202,
            'c.baz.z': 203,
        }

        # Retrieve a flattened dictionary containing all config data
        self.assertEqual(userconfig.all(), flattened_data)

    def test_set(self):
        userconfig = User.objects.get(username='testuser').config

        # Overwrite existing values
        userconfig.set('a', 'abc')
        userconfig.set('c.foo.x', 'abc')
        self.assertEqual(userconfig.data['a'], 'abc')
        self.assertEqual(userconfig.data['c']['foo']['x'], 'abc')

        # Create new values
        userconfig.set('d', 'abc')
        userconfig.set('b.baz', 'abc')
        self.assertEqual(userconfig.data['d'], 'abc')
        self.assertEqual(userconfig.data['b']['baz'], 'abc')

        # Set a value and commit to the database
        userconfig.set('a', 'def', commit=True)

        userconfig.refresh_from_db()
        self.assertEqual(userconfig.data['a'], 'def')

        # Attempt to change a branch node to a leaf node
        with self.assertRaises(TypeError):
            userconfig.set('b', 1)

        # Attempt to change a leaf node to a branch node
        with self.assertRaises(TypeError):
            userconfig.set('a.x', 1)

    def test_clear(self):
        userconfig = User.objects.get(username='testuser').config

        # Clear existing values
        userconfig.clear('a')
        userconfig.clear('b.foo')
        self.assertTrue('a' not in userconfig.data)
        self.assertTrue('foo' not in userconfig.data['b'])
        self.assertEqual(userconfig.data['b']['bar'], 102)

        # Clear a non-existing value; should fail silently
        userconfig.clear('invalid')

    @override_settings(MAINTENANCE_MODE=True)
    def test_commit_skipped_in_maintenance_mode(self):
        userconfig = User.objects.get(username='testuser').config

        # The change is applied, but not saved
        userconfig.set('a', 'def', commit=True)
        userconfig.clear('b.foo', commit=True)
        self.assertEqual(userconfig.data['a'], 'def')
        self.assertNotIn('foo', userconfig.data['b'])

        userconfig.refresh_from_db()
        self.assertEqual(userconfig.data['a'], True)
        self.assertEqual(userconfig.data['b']['foo'], 101)


class RestrictedQuerySetTestCase(TestCase):
    """
    Test the is_active handling of RestrictedQuerySet.restrict()'s superuser bypass.
    """

    @classmethod
    def setUpTestData(cls):
        # Token uses a plain RestrictedQuerySet manager, so its objects() exercises restrict()
        # directly without requiring any object permissions to be configured.
        cls.token = Token.objects.create(user=create_test_user('Token Owner'))

    def test_active_superuser_bypasses_restriction(self):
        user = User.objects.create(username='active_su', is_superuser=True, is_active=True)
        self.assertIn(self.token, Token.objects.restrict(user, 'view'))

    def test_inactive_superuser_does_not_bypass_restriction(self):
        """
        A deactivated superuser must not bypass restrict(). Without an explicit
        view permission they receive an empty queryset, mirroring the is_active
        guard in ObjectPermissionMixin.has_perm.
        """
        user = User.objects.create(username='inactive_su', is_superuser=True, is_active=False)
        self.assertNotIn(self.token, Token.objects.restrict(user, 'view'))
        self.assertEqual(Token.objects.restrict(user, 'view').count(), 0)