From b65ee59b1bf03a972079439e8f838e4040dfa874 Mon Sep 17 00:00:00 2001 From: JocelynDelalande Date: Fri, 22 Dec 2017 17:39:48 +0100 Subject: Remove API password (#290) * Remove the password from API GET responses While keeping it for POST/PUT. fix #289 * Add a test to check password change via API --- ihatemoney/tests/tests.py | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) (limited to 'ihatemoney/tests') diff --git a/ihatemoney/tests/tests.py b/ihatemoney/tests/tests.py index dc46580..6708ca8 100644 --- a/ihatemoney/tests/tests.py +++ b/ihatemoney/tests/tests.py @@ -1076,7 +1076,6 @@ class APITestCase(IhatemoneyTestCase): "balance": {}, } decoded_resp = json.loads(resp.data.decode('utf-8')) - self.assertTrue(check_password_hash(decoded_resp.pop('password'), 'raclette')) self.assertDictEqual(decoded_resp, expected) # edit should work @@ -1101,15 +1100,27 @@ class APITestCase(IhatemoneyTestCase): "balance": {}, } decoded_resp = json.loads(resp.data.decode('utf-8')) - self.assertTrue(check_password_hash(decoded_resp.pop('password'), 'raclette')) self.assertDictEqual(decoded_resp, expected) - # delete should work - resp = self.client.delete("/api/projects/raclette", - headers=self.get_auth("raclette")) + # password change is possible via API + resp = self.client.put("/api/projects/raclette", data={ + "contact_email": "yeah@notmyidea.org", + "password": "tartiflette", + "name": "The raclette party", + }, headers=self.get_auth("raclette")) self.assertEqual(200, resp.status_code) + resp = self.client.get("/api/projects/raclette", + headers=self.get_auth( + "raclette", "tartiflette")) + self.assertEqual(200, resp.status_code) + + # delete should work + resp = self.client.delete("/api/projects/raclette", + headers=self.get_auth( + "raclette", "tartiflette")) + # get should return a 401 on an unknown resource resp = self.client.get("/api/projects/raclette", headers=self.get_auth("raclette")) @@ -1341,7 +1352,6 @@ class APITestCase(IhatemoneyTestCase): self.assertStatus(200, req) decoded_req = json.loads(req.data.decode('utf-8')) - self.assertTrue(check_password_hash(decoded_req.pop('password'), 'raclette')) self.assertDictEqual(decoded_req, expected) -- cgit v1.1