diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..ad9ce05
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,97 @@
+import os
+import sys
+from pathlib import Path
+
+import mongomock
+import pymongo
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+os.environ.update({
+ "FLASK_ENV": "development",
+ "SECRET_KEY": "finally-adding-tests-omg-now-32-bytes-plus",
+ "SENDGRID_API_KEY": "test",
+ "MONGO_URI": "mongodb://localhost:27017/",
+ "DISCORD_CLIENT_ID": "123",
+ "DISCORD_CLIENT_SECRET": "test",
+ "DISCORD_REDIRECT_URI": "http://localhost/api/v2/auth/discord/redirect",
+ "DISCORD_BOT_TOKEN": "test",
+ "DISCORD_GUILD_ID": "1",
+})
+
+
+pymongo.MongoClient = mongomock.MongoClient
+
+import config # noqa: E402
+import send_grid_email # noqa: E402
+import taskapp # noqa: E402 (registers every route)
+import task_login # noqa: E402
+
+USERNAME = "Gerni Test"
+EMAIL = "GerniTest@example.com"
+PASSWORD = "Str0ng!PassF0rT3st1ng"
+
+
+@pytest.fixture
+def app():
+ taskapp.app.config.update(TESTING=True, SERVER_NAME="localhost")
+ return taskapp.app
+
+
+@pytest.fixture
+def client(app):
+ return app.test_client()
+
+
+@pytest.fixture(autouse=True)
+def clean_db():
+ yield
+ for name in config.MONGO_CLIENT.list_database_names():
+ config.MONGO_CLIENT.drop_database(name)
+
+
+@pytest.fixture(autouse=True)
+def sent_emails(monkeypatch):
+ sent = []
+ def fake_send(to, subject, body):
+ sent.append({"to": to, "subject": subject, "body": body})
+ return True
+ monkeypatch.setattr(send_grid_email, "send_message", fake_send)
+ return sent
+
+
+@pytest.fixture(autouse=True)
+def no_network(monkeypatch):
+ import requests
+ def blocked(self, method, url, *args, **kwargs):
+ # ConnectionError is a RequestException, so the app's own
+ # "Discord/Google is down" handling gets exercised too.
+ raise requests.ConnectionError(f"Network blocked in tests: {method} {url}")
+ monkeypatch.setattr(requests.sessions.Session, "request", blocked)
+
+
+@pytest.fixture
+def make_user():
+ def _make(username=USERNAME, password=PASSWORD, email=EMAIL,
+ official=False, lms=False):
+ ok, err = task_login.add_user(username, password, email, official, lms)
+ assert ok, err
+ return username
+ return _make
+
+
+@pytest.fixture
+def login(client):
+ def _login(username=USERNAME, password=PASSWORD):
+ return client.post("/login/", data={"username": username, "password": password})
+ return _login
+
+
+@pytest.fixture
+def logged_in(client, make_user, login):
+ make_user()
+ resp = login()
+ assert resp.status_code == 302 and "/dashboard/" in resp.headers["Location"]
+ return client
diff --git a/tests/test_api.py b/tests/test_api.py
new file mode 100644
index 0000000..49c8376
--- /dev/null
+++ b/tests/test_api.py
@@ -0,0 +1,26 @@
+from conftest import USERNAME, PASSWORD
+
+
+def _token(client):
+ resp = client.post("/api/v2/login", json={"username": USERNAME, "password": PASSWORD})
+ assert resp.status_code == 200
+ return resp.get_json()["token"]
+
+
+def test_api_login_and_profile(client, make_user):
+ make_user()
+ token = _token(client)
+ resp = client.get("/api/v2/user/profile", headers={"Authorization": f"Bearer {token}"})
+ assert resp.status_code == 200
+
+
+def test_api_login_bad_password(client, make_user):
+ make_user()
+ resp = client.post("/api/v2/login", json={"username": USERNAME, "password": "x"})
+ assert resp.status_code == 401
+
+
+def test_api_rejects_missing_and_bad_token(client):
+ assert client.get("/api/v2/user/profile").status_code == 401
+ assert client.get("/api/v2/user/profile",
+ headers={"Authorization": "Bearer garbage"}).status_code == 401
diff --git a/tests/test_auth.py b/tests/test_auth.py
new file mode 100644
index 0000000..0102851
--- /dev/null
+++ b/tests/test_auth.py
@@ -0,0 +1,70 @@
+import task_login
+from conftest import USERNAME, EMAIL, PASSWORD
+
+
+def test_register_creates_user_and_sends_verification(client, sent_emails):
+ resp = client.post("/register/", data={
+ "username": USERNAME, "password": PASSWORD, "confirmPassword": PASSWORD,
+ "email": EMAIL,
+ })
+ assert resp.status_code == 302 and resp.headers["Location"].endswith("/login/")
+ assert task_login.coll.find_one({"username": USERNAME}) is not None
+ assert sent_emails and sent_emails[0]["to"] == EMAIL
+ assert "/email_verify_inital/" in sent_emails[0]["body"]
+
+
+def test_register_rejects_mismatched_passwords(client):
+ resp = client.post("/register/", data={
+ "username": USERNAME, "password": PASSWORD, "confirmPassword": "nope",
+ "email": EMAIL,
+ })
+ assert b"did not match" in resp.data
+ assert task_login.coll.find_one({"username": USERNAME}) is None
+
+
+def test_register_rejects_weak_password(client):
+ resp = client.post("/register/", data={
+ "username": USERNAME, "password": "weak", "confirmPassword": "weak",
+ "email": EMAIL,
+ })
+ assert b"does not meet requirements" in resp.data
+ assert task_login.coll.find_one({"username": USERNAME}) is None
+
+
+def test_login_success_sets_session(client, make_user, login):
+ make_user()
+ resp = login()
+ assert resp.status_code == 302 and "/dashboard/" in resp.headers["Location"]
+ with client.session_transaction() as s:
+ assert s["logged_in"] and s["username"] == USERNAME
+
+
+def test_login_wrong_password(client, make_user, login):
+ make_user()
+ resp = login(password="Wr0ng!Pass")
+ assert resp.status_code == 200 and b"Invalid Username or Password" in resp.data
+ with client.session_transaction() as s:
+ assert "logged_in" not in s
+
+
+def test_login_unknown_user(login):
+ resp = login(username="unknown user")
+ assert b"Invalid Username or Password" in resp.data
+
+
+def test_long_password_over_72_bytes(make_user, login):
+ long_pw = "TooL0ng!" + "g" * 100 # meets policy, 108 bytes
+ make_user(password=long_pw)
+ assert login(password=long_pw).status_code == 302
+
+
+def test_logout_clears_session(logged_in):
+ resp = logged_in.get("/logout/")
+ assert resp.status_code == 302
+ with logged_in.session_transaction() as s:
+ assert "logged_in" not in s
+
+
+def test_protected_page_redirects_when_logged_out(client):
+ resp = client.get("/dashboard/")
+ assert resp.status_code == 302 and "/login/" in resp.headers["Location"]
diff --git a/tests/test_discord.py b/tests/test_discord.py
new file mode 100644
index 0000000..6e13dce
--- /dev/null
+++ b/tests/test_discord.py
@@ -0,0 +1,24 @@
+import discord_api
+import discord_service
+from conftest import USERNAME
+
+
+def test_connect_redirects_to_discord(logged_in):
+ resp = logged_in.get("/api/v2/auth/discord/connect")
+ assert resp.status_code == 302
+ assert resp.headers["Location"].startswith("https://discord.com/oauth2/authorize")
+
+
+def test_redirect_links_account(logged_in, monkeypatch):
+ monkeypatch.setattr(discord_api, "exchange_code", lambda code: {"access_token": "tok"})
+ monkeypatch.setattr(discord_api, "retrieve_discord_id", lambda token: {"id": 4242})
+ resp = logged_in.get("/api/v2/auth/discord/redirect?code=abc")
+ assert resp.status_code == 302
+ assert discord_service.get_discord_auth_info(USERNAME).discord_user_id == 4242
+
+
+def test_disconnect(logged_in):
+ discord_service.link_discord_id(USERNAME, 4242)
+ resp = logged_in.get("/api/v2/auth/discord/disconnect")
+ assert resp.status_code == 302
+ assert discord_service.get_discord_auth_info(USERNAME).discord_user_id is None
diff --git a/tests/test_pages.py b/tests/test_pages.py
new file mode 100644
index 0000000..978c0bd
--- /dev/null
+++ b/tests/test_pages.py
@@ -0,0 +1,25 @@
+import pytest
+
+PUBLIC = ["/", "/login/", "/register/", "/reset-password/"]
+AUTHED = ["/dashboard/", "/profile/", "/faq/", "/wall-of-pain/", "/hiscores/",
+ "/rank-check/", "/sync-collection-logs/",
+ "/task-list-easy/", "/task-list-medium/", "/task-list-hard/",
+ "/task-list-elite/", "/task-list-master/", "/task-list-pets/",
+ "/task-list-extra/", "/task-list-passive/"]
+
+
+@pytest.mark.parametrize("path", PUBLIC)
+def test_public_pages_render(client, path):
+ assert client.get(path).status_code == 200
+
+
+@pytest.mark.parametrize("path", AUTHED)
+def test_authenticated_pages_render(logged_in, path):
+ resp = logged_in.get(path)
+ assert resp.status_code == 200, resp.data[:300]
+
+
+@pytest.mark.parametrize("path", AUTHED)
+def test_pages_never_contain_secret_key(logged_in, app, path):
+ body = logged_in.get(path).data.decode("utf-8", "replace")
+ assert app.config["SECRET_KEY"] not in body
diff --git a/tests/test_profile.py b/tests/test_profile.py
new file mode 100644
index 0000000..10eba31
--- /dev/null
+++ b/tests/test_profile.py
@@ -0,0 +1,35 @@
+import task_login
+from conftest import USERNAME
+
+
+NEW_PW = "N3w!Password"
+
+
+def test_change_password(logged_in, login):
+ resp = logged_in.post("/profile/change-password/", data={"new_password": NEW_PW})
+ assert resp.get_json()["success"] is True
+ logged_in.get("/logout/")
+ assert login(password=NEW_PW).status_code == 302
+
+
+def test_change_password_rejects_weak(logged_in):
+ resp = logged_in.post("/profile/change-password/", data={"new_password": "weak"})
+ assert resp.get_json()["success"] is False
+
+
+def test_change_username(logged_in):
+ resp = logged_in.post("/profile/change-username/", data={"username": "Gerni Changed"})
+ assert resp.get_json()["success"] is True
+ with logged_in.session_transaction() as s:
+ assert s["username"] == "Gerni Changed"
+ assert task_login.coll.find_one({"username": "Gerni Changed"}) is not None
+
+
+def test_change_username_to_same_name(logged_in):
+ resp = logged_in.post("/profile/change-username/", data={"username": USERNAME})
+ assert resp.get_json()["success"] is False
+
+
+def test_change_lms_status(logged_in):
+ resp = logged_in.post("/profile/change-lms-status/", data={"lms_status": "true"})
+ assert resp.get_json()["success"] is True
diff --git a/tests/test_reset.py b/tests/test_reset.py
new file mode 100644
index 0000000..cd8c55f
--- /dev/null
+++ b/tests/test_reset.py
@@ -0,0 +1,38 @@
+import re
+from conftest import EMAIL, PASSWORD
+
+NEW_PW = "N3w!Password"
+
+
+def _token_from(email_body):
+ return re.search(r"/reset_password/([^\s]+)", email_body).group(1)
+
+
+def test_reset_request_sends_email(client, make_user, sent_emails):
+ make_user()
+ resp = client.post("/reset-password/request/", data={"email": EMAIL})
+ assert resp.status_code == 200
+ assert sent_emails and "/reset_password/" in sent_emails[0]["body"]
+
+
+def test_full_reset_flow(client, make_user, login, sent_emails):
+ make_user()
+ client.post("/reset-password/request/", data={"email": EMAIL})
+ token = _token_from(sent_emails[0]["body"])
+ assert client.get(f"/reset_password/{token}").status_code == 200
+ resp = client.post(f"/reset_password/{token}",
+ data={"password": NEW_PW, "confirmPassword": NEW_PW})
+ assert resp.status_code == 302 and "/login/" in resp.headers["Location"]
+ assert login(password=NEW_PW).status_code == 302
+
+
+def test_reset_get_with_bad_token_redirects(client):
+ resp = client.get("/reset_password/not-a-token")
+ assert resp.status_code == 302
+
+
+def test_reset_post_with_bad_token_changes_nothing(client, make_user, login):
+ make_user()
+ client.post("/reset_password/not-a-token",
+ data={"password": NEW_PW, "confirmPassword": NEW_PW})
+ assert login(password=PASSWORD).status_code == 302
diff --git a/tests/test_tasks.py b/tests/test_tasks.py
new file mode 100644
index 0000000..dd7dae2
--- /dev/null
+++ b/tests/test_tasks.py
@@ -0,0 +1,11 @@
+def test_generate_unofficial_task(logged_in):
+ resp = logged_in.post("/generate_unofficial/", data={"tier": "easy"})
+ assert resp.status_code == 200, resp.data[:300]
+
+
+def test_official_user_can_generate_task(client, make_user, login):
+ make_user(username="off", official=True)
+ login(username="off")
+ resp = client.post("/generate/")
+ assert resp.status_code == 200, resp.data[:300]
+ assert resp.get_json()["name"]
diff --git a/tests/test_tokens.py b/tests/test_tokens.py
new file mode 100644
index 0000000..0bd4555
--- /dev/null
+++ b/tests/test_tokens.py
@@ -0,0 +1,28 @@
+import task_login
+from conftest import USERNAME, EMAIL
+
+
+def test_reset_token_roundtrip():
+ tok = task_login.get_reset_token(USERNAME)
+ assert task_login.verify_reset_token(tok) == USERNAME
+
+
+def test_reset_token_tampered():
+ tok = task_login.get_reset_token(USERNAME)
+ assert task_login.verify_reset_token(tok + "x") is None
+
+
+def test_reset_token_not_valid_for_email_verify():
+ tok = task_login.get_reset_token(USERNAME)
+ assert task_login.verify_email_verify_token(tok) is None
+
+
+def test_email_token_roundtrip():
+ tok = task_login.get_email_verify_token(USERNAME, EMAIL)
+ assert task_login.verify_email_verify_token(tok) == (USERNAME, EMAIL)
+
+
+def test_reset_token_expires(monkeypatch):
+ tok = task_login.get_reset_token(USERNAME)
+ monkeypatch.setattr(task_login, "TOKEN_MAX_AGE", -1)
+ assert task_login.verify_reset_token(tok) is None
diff --git a/user_migrate.py b/user_migrate.py
deleted file mode 100644
index cd62719..0000000
--- a/user_migrate.py
+++ /dev/null
@@ -1,61 +0,0 @@
-import config
-
-'''
-The methods in this file are for migrating users data from the old format to the new format
-They are to be removed
-'''
-
-mydb = config.MONGO_CLIENT["TaskApp"]
-
-def migrate_task_list(tier_list: dict):
- if ('currentTask' in tier_list):
- tier_list['currentTask'] = { 'id': tier_list['currentTask']['uuid'] }
-
- tier_list['completedTasks'] = [{ 'id': task['uuid'] } for task in tier_list['completedTasks']]
- return tier_list
-
-def merge_task_lists(tier_lists: list[dict]):
- new_tier_list_object = {}
- # this dark magic somehow flattens a list
- new_tier_list_object['completedTasks'] = [task for tier_list in tier_lists for task in tier_list['completedTasks']]
- return new_tier_list_object
-
-def migrate_database_task_list_to_new_format(user: dict) -> dict:
- return {
- '_id': user['_id'],
- 'username': user['username'],
- 'isOfficial': user['isOfficial'],
- 'lmsEnabled': user['lmsEnabled'],
- 'tiers': {
- 'easy': migrate_task_list(user['tiers']['easy']),
- 'medium': migrate_task_list(user['tiers']['medium']),
- 'hard': migrate_task_list(user['tiers']['hard']),
- 'elite': migrate_task_list(user['tiers']['elite']),
- 'master' : migrate_task_list(user['tiers']['master']),
- 'passive': migrate_task_list(user['tiers']['passive']),
- 'extra': migrate_task_list(user['tiers']['extra']),
- 'pets': merge_task_lists([
- migrate_task_list(user['tiers']['bossPets']),
- migrate_task_list(user['tiers']['skillPets']),
- migrate_task_list(user['tiers']['otherPets']),
- ]),
- }
- }
-
-'''
-migrate_db:
-
-Migrates all users to new format
-'''
-def migrate_db():
- coll = mydb['taskLists']
- task_lists = coll.find({}, {})
-
- for task_list in task_lists:
- coll.replace_one(
- { 'username': task_list['username'] },
- migrate_database_task_list_to_new_format(task_list),
- )
-
-if __name__ == "__main__":
- migrate_db()
\ No newline at end of file