ValidateMixin, validate password

Author: electis

genesis_core/tests/functional/conftest.py

@@ -134,7 +134,7 @@ def auth_test1_user(
     default_client_id: str,
     default_client_secret: str,
 ):
-    password = "test1"
+    password = "test1test"
     client = user_api_client(auth_user_admin)
     user = client.create_user(username="test1", password=password)
     user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
@@ -162,7 +162,7 @@ def auth_test2_user(
     default_client_id: str,
     default_client_secret: str,
 ):
-    password = "test2"
+    password = "test2test"
     client = user_api_client(auth_user_admin)
     user = client.create_user(username="test2", password=password)
     user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
@@ -190,7 +190,7 @@ def auth_test1_p1_user(
     default_client_id: str,
     default_client_secret: str,
 ):
-    password = "test1p1"
+    password = "testtest1p1"
     client = user_api_client(auth_user_admin)
     user = client.create_user(username="test1p1", password=password)
     user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
@@ -239,7 +239,7 @@ def auth_test2_p1_user(
     default_client_id: str,
     default_client_secret: str,
 ):
-    password = "test2p1"
+    password = "testtest2p1"
     client = user_api_client(auth_user_admin)
     user = client.create_user(username="test2p1", password=password)
     user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})

genesis_core/tests/functional/restapi/iam/test_users.py

@@ -33,7 +33,7 @@ class TestUsers(base.BaseIamResourceTest):
     def test_create_user_success(self, user_api_noauth_client):
         client = user_api_noauth_client()
 
-        user = client.create_user(username="test", password="test")
+        user = client.create_user(username="test", password="testtest")
 
         assert user["password"] == "*******"
         assert user["username"] == "test"
@@ -43,6 +43,10 @@ def test_create_user_400_error(self, user_api_noauth_client):
 
         with pytest.raises(bazooka_exc.BadRequestError):
             client.create_user(username="", password="test")
+        with pytest.raises(bazooka_exc.BadRequestError):
+            client.create_user(username="test400", password="test")
+        with pytest.raises(bazooka_exc.BadRequestError):
+            client.create_user(username="test400", password="test test")
 
     def test_create_user_space_login_400_error(self, user_api_noauth_client):
         client = user_api_noauth_client()

genesis_core/user_api/iam/api/controllers.py

@@ -17,6 +17,8 @@
 import errno
 from os import path as os_path
 import mimetypes
+import re
+import string
 from urllib import parse as urllib_parse
 
 from authlib.integrations import requests_client
@@ -45,6 +47,37 @@ def enforce(self, rule, do_raise=False, exc=None):
         return iam.enforcer.enforce(rule, do_raise, exc)
 
 
+class ValidateMixin:
+    min_length = 8
+    not_contain: str = string.whitespace
+    must_contain: list[str] = None  # [digits, ascii_uppercase, punctuation]
+    regex: str = None
+
+    def validate(self, value):
+        error = None
+        if value is None:
+            error = "Value is required"
+        elif self.min_length and len(value) < self.min_length:
+            error = f"Value must be at least {self.min_length} characters long"
+        elif self.not_contain and set(self.not_contain) & set(value):
+            error = f"Value must not contain {self.not_contain}"
+        elif self.must_contain:
+            for required in self.must_contain:
+                if not set(required) & set(value):
+                    error = f"Value must contain one of {required}"
+                    break
+        elif self.regex and not re.match(self.regex, value):
+            error = f"Value must match regex {self.regex}"
+        if error:
+            exc = ValidationErrorException()
+            exc.message = error
+            raise exc
+
+    def validate_secret(self, kwargs: dict):
+        if "secret" in kwargs:
+            self.validate(kwargs["secret"])
+
+
 class IamController(controllers.RoutesListController):
 
     __TARGET_PATH__ = "/v1/iam/"
@@ -69,7 +102,7 @@ def _get_app_endpoint(req):
 
 
 class UserController(
-    controllers.BaseResourceControllerPaginated, EnforceMixin
+    controllers.BaseResourceControllerPaginated, EnforceMixin, ValidateMixin
 ):
     __resource__ = resources.ResourceByModelWithCustomProps(
         models.User,
@@ -119,6 +152,7 @@ class UserController(
     )
 
     def create(self, **kwargs):
+        self.validate_secret(kwargs)
         kwargs.pop("email_verified", None)
         user = super().create(**kwargs)
         app_endpoint = _get_app_endpoint(req=self._req)
@@ -132,6 +166,7 @@ def filter(self, filters, **kwargs):
         return super().filter(filters, **kwargs)
 
     def update(self, uuid, **kwargs):
+        self.validate_secret(kwargs)
         kwargs.pop("email_verified", None)
         is_me = models.User.me().uuid == uuid
         if self.enforce(c.PERMISSION_USER_WRITE_ALL) or is_me:
@@ -154,6 +189,7 @@ def delete(self, uuid):
 
     @actions.post
     def change_password(self, resource, old_password, new_password):
+        self.validate(new_password)
         is_me = models.User.me() == resource
         if self.enforce(c.PERMISSION_USER_WRITE_ALL) or is_me:
             resource.change_secret_safe(
@@ -237,6 +273,7 @@ def confirm_email(self, resource, code=None):
     def reset_password(self, resource, new_password=None, code=None):
         code = code or self._req.params.get("code")
         new_secret = new_password or self._req.params.get("new_password")
+        self.validate(new_secret)
         resource.reset_secret_by_code(
             new_secret=new_secret,
             code=code,