0513e67838
Adds Microsoft 365 + Google OAuth providers (separate from the existing generic OIDC SSO at src/auth/sso.py) and a passwordless magic-link login flow. New OAuth signups capture Loi 25 art. 14 consents (4 granular checkboxes) BEFORE creating the User row via /auth/oauth/finish-signup. Per compatibility-audit.md C2: - No src/auth_extended/ directory — extends src/auth/ in place - No new User columns — reuses sso_provider/sso_subject + email_verified - Magic-link tokens via itsdangerous URLSafeTimedSerializer (15-min, no DB) - All routes added to existing auth_bp; templates extend marketing/base.html - Anti-enumeration on /auth/magic-link (generic flash for unknown OR unverified emails) and /auth/magic-link/<token> (same flash for invalid/expired/unverified-user) Files added: - src/auth/oauth_providers.py — Microsoft + Google OAuth registration, is_oauth_provider_enabled(), find_user_by_oauth(), create_oauth_user_with_consent() - src/auth/magic_link.py — generate/consume magic-link tokens - templates/auth/magic_link_request.html, templates/auth/oauth_finish_signup.html - tests/test_oauth_magic_link.py + tests/_run_oauth_magic_link_windows.py (16 tests) - config/env.oauth.example Files modified: - src/api/auth.py — 5 new routes (oauth_provider_login/callback, oauth_finish_signup, magic_link_request/consume); login flashes translated FR; oauth_*_enabled flags passed to login template - src/app.py — wires init_oauth_providers(app) after blueprint registration - src/services/email.py — adds send_magic_link_email() (FR + DictIA brand) - templates/login.html — refondu IN PLACE (was 178 lines legacy Vue/TW3) to extend marketing/base.html with OAuth buttons, password form, magic-link CTA, signup link - templates/auth/check_email.html — adds action='magic_link' branch - static/css/tailwind.config.js — adds templates/login.html to content - static/css/marketing.css — rebuilt Tests: 16/16 PASS via Windows manual driver. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
2.8 KiB
Python
82 lines
2.8 KiB
Python
"""Windows manual driver for tests/test_oauth_magic_link.py.
|
|
|
|
src/init_db.py imports `fcntl`, which is POSIX-only. On Windows we stub it
|
|
before src.app gets imported, then run each test_* function and report.
|
|
|
|
Run from the repo root:
|
|
py -3 tests/_run_oauth_magic_link_windows.py
|
|
|
|
This script is local-dev only (not picked up by pytest collection).
|
|
"""
|
|
import os
|
|
import sys
|
|
import types
|
|
import traceback
|
|
|
|
# 1) Stub fcntl BEFORE any import of src.* happens.
|
|
if 'fcntl' not in sys.modules:
|
|
fcntl_stub = types.ModuleType('fcntl')
|
|
fcntl_stub.LOCK_EX = 2
|
|
fcntl_stub.LOCK_NB = 4
|
|
fcntl_stub.LOCK_UN = 8
|
|
fcntl_stub.LOCK_SH = 1
|
|
fcntl_stub.flock = lambda *_args, **_kw: None
|
|
fcntl_stub.fcntl = lambda *_args, **_kw: 0
|
|
sys.modules['fcntl'] = fcntl_stub
|
|
|
|
# 2) Make repo root importable
|
|
HERE = os.path.dirname(os.path.abspath(__file__))
|
|
REPO = os.path.dirname(HERE)
|
|
sys.path.insert(0, REPO)
|
|
|
|
# 3) Set test config
|
|
os.environ.setdefault('SQLALCHEMY_DATABASE_URI', 'sqlite:///:memory:')
|
|
os.environ.setdefault('SECRET_KEY', 'test-secret-key-oauth')
|
|
os.environ.setdefault('ENABLE_EMAIL_VERIFICATION', 'false')
|
|
os.environ.setdefault('TRANSCRIPTION_BASE_URL', 'http://test-stub')
|
|
os.environ.setdefault('TRANSCRIPTION_API_KEY', 'test-stub')
|
|
os.environ.setdefault('RATELIMIT_ENABLED', 'false')
|
|
# Pre-set OAuth env vars so init_oauth_providers registers clients at app boot.
|
|
os.environ.setdefault('MS_CLIENT_ID', 'test-ms-client-id')
|
|
os.environ.setdefault('MS_CLIENT_SECRET', 'test-ms-client-secret')
|
|
os.environ.setdefault('GOOGLE_CLIENT_ID', 'test-google-client-id')
|
|
os.environ.setdefault('GOOGLE_CLIENT_SECRET', 'test-google-client-secret')
|
|
# Force UTF-8 stdout so src.app's emoji prints don't crash on cp1252 Windows.
|
|
try:
|
|
sys.stdout.reconfigure(encoding='utf-8', errors='replace')
|
|
sys.stderr.reconfigure(encoding='utf-8', errors='replace')
|
|
except Exception:
|
|
pass
|
|
|
|
# 4) Import the test module and run every test_* function it defines
|
|
import importlib.util # noqa: E402
|
|
spec = importlib.util.spec_from_file_location(
|
|
'test_oauth_magic_link',
|
|
os.path.join(HERE, 'test_oauth_magic_link.py'),
|
|
)
|
|
mod = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(mod)
|
|
|
|
tests = [(name, fn) for name, fn in vars(mod).items()
|
|
if name.startswith('test_') and callable(fn)]
|
|
|
|
passed = 0
|
|
failed = []
|
|
for name, fn in tests:
|
|
try:
|
|
fn()
|
|
print(f' PASS {name}')
|
|
passed += 1
|
|
except Exception as e: # noqa: BLE001
|
|
print(f' FAIL {name}: {type(e).__name__}: {e}')
|
|
failed.append((name, traceback.format_exc()))
|
|
|
|
total = len(tests)
|
|
print()
|
|
print(f'Result: {passed}/{total} passed, {len(failed)} failed')
|
|
if failed:
|
|
print('\n--- Failures ---\n')
|
|
for name, tb in failed:
|
|
print(f'### {name}\n{tb}\n')
|
|
sys.exit(0 if not failed else 1)
|