Do not lowercase User.names, keep the capital letters, but login by name is case-insensitive.

Author: Kulv3r

genesis_core/tests/functional/restapi/iam/test_users.py

@@ -30,13 +30,14 @@ class TestUsers(base.BaseIamResourceTest):
 
     USERS_ENDPOINT = "iam/users"
 
-    def test_create_user_success(self, user_api_noauth_client):
+    @pytest.mark.parametrize("name", ["test", "Spider-Man"])
+    def test_create_user_success(self, name, user_api_noauth_client):
         client = user_api_noauth_client()
 
-        user = client.create_user(username="test", password="test")
+        user = client.create_user(username=name, password="test")
 
         assert user["password"] == "*******"
-        assert user["username"] == "test"
+        assert user["username"] == name
 
     def test_create_user_400_error(self, user_api_noauth_client):
         client = user_api_noauth_client()
@@ -182,24 +183,16 @@ def test_update_my_user_test1_auth_success(
         self, user_api_client, auth_test1_user
     ):
         client = user_api_client(auth_test1_user)
-
-        result = client.update_user(
-            auth_test1_user.uuid,
-            username="testXXX",
-        )
-
-        assert result["username"] == "testxxx"
+        name = "testXXX"
+        result = client.update_user(auth_test1_user.uuid, username=name)
+        assert result["username"] == name
 
     def test_update_other_user_test1_auth_forbidden(
         self, user_api_client, auth_test1_user, auth_test2_user
     ):
         client = user_api_client(auth_test1_user)
-
         with pytest.raises(bazooka_exc.ForbiddenError):
-            client.update_user(
-                auth_test2_user.uuid,
-                username="testXXX",
-            )
+            client.update_user(auth_test2_user.uuid, username="testXXX")
 
     def test_update_other_user_test1_auth_access(
         self, user_api_client, auth_test1_user, auth_test2_user
@@ -210,13 +203,9 @@ def test_update_other_user_test1_auth_access(
                 c.PERMISSION_USER_WRITE_ALL,
             ],
         )
-
-        result = client.update_user(
-            auth_test2_user.uuid,
-            username="testXXX",
-        )
-
-        assert result["username"] == "testxxx"
+        name = "testXXX"
+        result = client.update_user(auth_test2_user.uuid, username=name)
+        assert result["username"] == name
 
     def test_update_my_user_update_password_test1_auth_bad_request(
         self, user_api_client, auth_test1_user
@@ -428,6 +417,26 @@ def test_fields_in_me_info_success(
                 # auth by phone is not implemented yet
             ),
             ("invalid_grant_type", "username", pytest.raises(ValueError)),
+            (
+                c.GRANT_TYPE_PASSWORD,
+                "login",
+                pytest.raises(bazooka_exc.BadRequestError),
+            ),
+            (
+                c.GRANT_TYPE_PASSWORD,
+                "email",
+                pytest.raises(bazooka_exc.BadRequestError),
+            ),
+            (
+                c.GRANT_TYPE_PASSWORD_EMAIL,
+                "username",
+                pytest.raises(bazooka_exc.BadRequestError),
+            ),
+            (
+                c.GRANT_TYPE_PASSWORD_LOGIN,
+                "username",
+                pytest.raises(bazooka_exc.BadRequestError),
+            ),
         ],
     )
     def test_auth_with_param(
@@ -439,7 +448,7 @@ def test_auth_with_param(
         auth_test1_user,
     ):
         params = {
-            "username": "dummy_username",
+            "username": None,
             "password": auth_test1_user.password,
             "grant_type": grant_type,
         }
@@ -500,28 +509,24 @@ def test_auth_with_login(
     def test_auth_case_insensitivity(
         self, user_api, auth_test1_user, grant_type, use_email, field_name
     ):
-        # Set up email if needed
+        user = iam_models.User.objects.get_one(
+            filters={"uuid": auth_test1_user.uuid}
+        )
+        user.name = user.name.title()
+        user.email = "Test1@mail.com"
+        user.save()
+
         if use_email:
-            user = iam_models.User.objects.get_one(
-                filters={"uuid": auth_test1_user.uuid}
-            )
-            user.email = "test1@mail.com"
-            user.save()
-            email_value = user.email.upper()
+            login = user.email.upper()
+        else:
+            login = auth_test1_user.username.upper()
 
         params = {
-            "username": "dummy_username",
+            "username": None,
             "password": auth_test1_user.password,
             "grant_type": grant_type,
         }
-        if grant_type == c.GRANT_TYPE_PASSWORD_USERNAME:
-            params[field_name] = auth_test1_user.username.upper()
-        elif grant_type == c.GRANT_TYPE_PASSWORD_EMAIL:
-            params[field_name] = email_value
-        elif grant_type == c.GRANT_TYPE_PASSWORD_LOGIN:
-            params[field_name] = (
-                email_value if use_email else auth_test1_user.username.upper()
-            )
+        params[field_name] = login
 
         # Test authentication
         auth = iam_clients.GenesisCoreAuth(**params)

genesis_core/user_api/iam/api/controllers.py

@@ -26,6 +26,7 @@
 from restalchemy.api import controllers
 from restalchemy.api import resources
 from restalchemy.common import contexts
+from restalchemy.common import exceptions as ra_e
 from restalchemy.dm import filters as ra_filters
 from restalchemy.openapi import utils as oa_utils
 import pyotp
@@ -537,13 +538,29 @@ def login(self, resource, user, password, **kwargs):
     @oa_utils.extend_schema(**oa_specs.OA_SPEC_GET_TOKEN_KWARGS)
     @actions.post
     def get_token(self, resource, grant_type, **kwargs):
-        if grant_type in (
-            c.GRANT_TYPE_PASSWORD,
-            c.GRANT_TYPE_PASSWORD_USERNAME,
-            c.GRANT_TYPE_PASSWORD_EMAIL,
-            c.GRANT_TYPE_PASSWORD_PHONE,
-            c.GRANT_TYPE_PASSWORD_LOGIN,
-        ):
+        grant_type_map = {
+            c.GRANT_TYPE_PASSWORD: (
+                c.PARAM_USERNAME,
+                resource.get_token_by_password,
+            ),
+            c.GRANT_TYPE_PASSWORD_USERNAME: (
+                c.PARAM_USERNAME,
+                resource.get_token_by_password_username,
+            ),
+            c.GRANT_TYPE_PASSWORD_EMAIL: (
+                c.PARAM_EMAIL,
+                resource.get_token_by_password_email,
+            ),
+            c.GRANT_TYPE_PASSWORD_PHONE: (
+                c.PARAM_PHONE,
+                resource.get_token_by_password_phone,
+            ),
+            c.GRANT_TYPE_PASSWORD_LOGIN: (
+                c.PARAM_LOGIN,
+                resource.get_token_by_password_login,
+            ),
+        }
+        if grant_type in grant_type_map:
             client_id = kwargs.get(
                 c.PARAM_CLIENT_ID,
                 self._req.headers.get(c.HEADER_CLIENT_ID, ""),
@@ -564,33 +581,12 @@ def get_token(self, resource, grant_type, **kwargs):
                 otp_code=self._req.headers.get(c.HEADER_OTP_CODE, None),
                 root_endpoint=resource.redirect_url,
             )
-            if grant_type == c.GRANT_TYPE_PASSWORD:
-                token = resource.get_token_by_password(
-                    username=kwargs.get(c.PARAM_USERNAME),
-                    **payload,
-                )
-            elif grant_type == c.GRANT_TYPE_PASSWORD_USERNAME:
-                token = resource.get_token_by_password(
-                    username=kwargs.get(c.PARAM_USERNAME),
-                    **payload,
-                )
-            elif grant_type == c.GRANT_TYPE_PASSWORD_EMAIL:
-                token = resource.get_token_by_password_email(
-                    email=kwargs.get(c.PARAM_EMAIL),
-                    **payload,
-                )
-            elif grant_type == c.GRANT_TYPE_PASSWORD_PHONE:
-                token = resource.get_token_by_password_phone(
-                    phone=kwargs.get(c.PARAM_PHONE),
-                    **payload,
-                )
-            elif grant_type == c.GRANT_TYPE_PASSWORD_LOGIN:
-                token = resource.get_token_by_password_login(
-                    login=kwargs.get(c.PARAM_LOGIN),
-                    **payload,
-                )
-            else:
-                raise ValueError(f"Unexpected {grant_type=}")
+            login_attr, token_getter = grant_type_map[grant_type]
+            payload[login_attr] = kwargs.get(login_attr)
+            if not payload[login_attr]:
+                raise ra_e.ValidationErrorException()
+
+            token = token_getter(**payload)
             return token.get_response_body()
 
         elif grant_type == c.GRANT_TYPE_REFRESH_TOKEN:

genesis_core/user_api/iam/dm/models.py

@@ -1066,20 +1066,22 @@ def get_token_by_password(self, username, **kwargs):
         """
         Get auth token by username + password (default approach).
         """
-        users_query = User.objects.get_all(
-            filters={"name": ra_filters.EQ(username)}
+        users_query = User.objects.query(
+            where_conditions="LOWER(name) = %s",
+            where_values=[username.lower()],
+            limit=1,
         )
         return self._get_token_by_password_and_smth(
             users_query=users_query, **kwargs
         )
 
-    def get_token_by_password_username(self, **kwargs):
+    def get_token_by_password_username(self, username, **kwargs):
         """
         Get auth token by username + password.
         This is just an alias for get_token_by_password_username,
         to ensure consistency.
         """
-        return self.get_token_by_password(**kwargs)
+        return self.get_token_by_password(username, **kwargs)
 
     def get_token_by_password_email(self, email, **kwargs):
         """
@@ -1092,7 +1094,7 @@ def get_token_by_password_email(self, email, **kwargs):
             users_query=users_query, **kwargs
         )
 
-    def get_token_by_password_phone(self, **kwargs):
+    def get_token_by_password_phone(self, phone, **kwargs):
         """
         Get auth token by phone + password.
         Will be added later.
@@ -1107,12 +1109,10 @@ def get_token_by_password_login(self, login, **kwargs):
          - by username (if no "@")
          - by phone [to be done later]
         """
-        lookup_field = "email" if "@" in login else "name"
-        filters = {lookup_field: ra_filters.EQ(login)}
-        users_query = User.objects.get_all(filters=filters)
-        return self._get_token_by_password_and_smth(
-            users_query=users_query, **kwargs
-        )
+        if "@" in login:
+            return self.get_token_by_password_email(login, **kwargs)
+        else:
+            return self.get_token_by_password_username(login, **kwargs)
 
     def get_token_by_refresh_token(self, refresh_token, scope=None):
         context = contexts.get_context()

genesis_core/user_api/iam/dm/types.py

@@ -38,12 +38,6 @@ def min_length(self):
     def max_length(self):
         return self._max_length
 
-    def to_simple_type(self, value):
-        return value.lower()
-
-    def from_simple_type(self, value):
-        return value.lower()
-
     def from_unicode(self, value):
         return self.from_simple_type(value)
 

migrations/0025-case-insensitive-users-name-index-41f4b9.py

@@ -0,0 +1,50 @@
+# Copyright 2016 Eugene Frolov <eugene@frolov.net.ru>
+#
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from restalchemy.storage.sql import migrations
+
+
+class MigrationStep(migrations.AbstarctMigrationStep):
+
+    def __init__(self):
+        self._depends = ["0024-user_confirmation_code_made_at-added-435e66.py"]
+
+    @property
+    def migration_id(self):
+        return "41f4b995-d237-4b89-bec9-046a50de8d27"
+
+    @property
+    def is_manual(self):
+        return False
+
+    def upgrade(self, session):
+        expression = """
+            DROP INDEX IF EXISTS iam_users_name_idx;
+            CREATE UNIQUE INDEX iam_users_name_lower_idx ON iam_users (
+                LOWER(name)
+            );
+        """
+        session.execute(expression)
+
+    def downgrade(self, session):
+        expression = """
+            DROP INDEX IF EXISTS iam_users_name_lower_idx;
+            CREATE UNIQUE INDEX iam_users_name_idx ON iam_users (name);
+        """
+        session.execute(expression)
+
+
+migration_step = MigrationStep()