Merge commit 'e277edf6e7' into feature/store-i18n

tests/unit/python/roles/web-app-keycloak/files/test_email_verified.py

@@ -1,5 +1,6 @@
 import contextlib
 import io
+import json
 import os
 import sys
 import unittest
@@ -49,41 +50,60 @@ class FakeKeycloak:
 
 
 class TestVerify(unittest.TestCase):
-    def test_an_unverified_user_is_updated_and_keeps_its_other_fields(self):
+    def test_an_unverified_user_holding_its_inventory_address_is_updated(self):
         kc = FakeKeycloak()
-        user_id = kc.add_user("biber", False, email="biber@example.org")
-        self.assertEqual(m.verify(kc, "biber"), "updated")
+        user_id = kc.add_user("biber", False, email="biber@example.org", firstName="B")
+        self.assertEqual(m.verify(kc, "biber", "biber@example.org"), "updated")
         self.assertIs(kc.users[user_id]["emailVerified"], True)
         self.assertEqual(kc.users[user_id]["email"], "biber@example.org")
+        self.assertEqual(kc.users[user_id]["firstName"], "B")
 
-    def test_a_verified_user_is_left_alone(self):
+    def test_a_user_holding_another_address_is_never_marked_verified(self):
         kc = FakeKeycloak()
-        kc.add_user("biber", True)
-        self.assertEqual(m.verify(kc, "biber"), "unchanged")
+        user_id = kc.add_user("biber", False, email="erpnext-api-bot@example.org")
+        self.assertEqual(m.verify(kc, "biber", "biber@example.org"), "mismatch")
+        self.assertIs(kc.users[user_id]["emailVerified"], False)
+        self.assertEqual(kc.puts, [])
+
+    def test_a_user_without_an_address_is_never_marked_verified(self):
+        kc = FakeKeycloak()
+        kc.add_user("biber", False)
+        self.assertEqual(m.verify(kc, "biber", "biber@example.org"), "mismatch")
+        self.assertEqual(kc.puts, [])
+
+    def test_the_addresses_compare_case_insensitively(self):
+        kc = FakeKeycloak()
+        kc.add_user("biber", False, email="biber@example.org")
+        self.assertEqual(m.verify(kc, "biber", "Biber@Example.org"), "updated")
+
+    def test_a_verified_user_holding_its_inventory_address_is_left_alone(self):
+        kc = FakeKeycloak()
+        kc.add_user("biber", True, email="biber@example.org")
+        self.assertEqual(m.verify(kc, "biber", "biber@example.org"), "unchanged")
         self.assertEqual(kc.puts, [])
 
     def test_an_absent_user_is_reported_missing(self):
         kc = FakeKeycloak()
-        self.assertEqual(m.verify(kc, "biber"), "missing")
+        self.assertEqual(m.verify(kc, "biber", "biber@example.org"), "missing")
         self.assertEqual(kc.puts, [])
 
     def test_only_the_exact_username_is_touched(self):
         kc = FakeKeycloak()
-        other = kc.add_user("contact2", False)
-        target = kc.add_user("contact", False)
-        self.assertEqual(m.verify(kc, "Contact"), "updated")
+        other = kc.add_user("contact2", False, email="contact@example.org")
+        target = kc.add_user("contact", False, email="contact@example.org")
+        self.assertEqual(m.verify(kc, "Contact", "contact@example.org"), "updated")
         self.assertEqual(kc.puts, [target])
         self.assertIs(kc.users[other]["emailVerified"], False)
 
 
 class TestMain(unittest.TestCase):
-    def _run(self, kc, usernames):
+    def _run(self, kc, emails):
         out = io.StringIO()
         env = {
             "KC_URL": "http://kc",
             "KC_PID": "1",
             "KC_REALM": "r",
-            "USERNAMES": usernames,
+            "EMAILS_JSON": json.dumps(emails),
         }
         with (
             mock.patch.dict(os.environ, env),
@@ -97,18 +117,37 @@ class TestMain(unittest.TestCase):
 
     def test_the_summary_counts_every_outcome(self):
         kc = FakeKeycloak()
-        kc.add_user("administrator", True)
-        kc.add_user("biber", False)
-        code, lines = self._run(kc, "administrator biber ghost")
+        kc.add_user("administrator", True, email="administrator@example.org")
+        kc.add_user("biber", False, email="biber@example.org")
+        kc.add_user("mallory", False, email="erpnext-api-bot@example.org")
+        code, lines = self._run(
+            kc,
+            {
+                "administrator": "administrator@example.org",
+                "biber": "biber@example.org",
+                "mallory": "mallory@example.org",
+                "ghost": "ghost@example.org",
+            },
+        )
         self.assertEqual(code, 0)
-        self.assertEqual(lines[-1], "summary updated=1 unchanged=1 missing=1 failed=0")
+        self.assertIn("mismatch mallory", lines)
+        self.assertEqual(
+            lines[-1],
+            "summary updated=1 unchanged=1 mismatch=1 missing=1 failed=0",
+        )
 
     def test_one_failed_user_fails_the_run_but_not_the_others(self):
         kc = FakeKeycloak()
-        kc.add_user("administrator", False)
-        kc.add_user("biber", False)
+        kc.add_user("administrator", False, email="administrator@example.org")
+        kc.add_user("biber", False, email="biber@example.org")
         kc.failing.add("administrator")
-        code, lines = self._run(kc, "administrator biber")
+        code, lines = self._run(
+            kc,
+            {
+                "administrator": "administrator@example.org",
+                "biber": "biber@example.org",
+            },
+        )
         self.assertEqual(code, 1)
         self.assertIn("failed administrator", lines)
         self.assertIn("updated biber", lines)
@@ -124,6 +163,29 @@ class TestMain(unittest.TestCase):
         self.assertEqual(code, 1)
         self.assertTrue(out.getvalue().startswith("setup-failed"))
 
+    def test_emails_that_are_no_username_to_address_object_fail_before_any_call(
+        self,
+    ):
+        kc = FakeKeycloak()
+        kc.add_user("biber", False, email="biber@example.org")
+        out = io.StringIO()
+        env = {
+            "KC_URL": "http://kc",
+            "KC_PID": "1",
+            "KC_REALM": "r",
+            "EMAILS_JSON": json.dumps(["biber"]),
+        }
+        with (
+            mock.patch.dict(os.environ, env),
+            mock.patch.object(m, "Keycloak", lambda *args: kc),
+            mock.patch.object(m, "container_credentials", lambda path: ("a", "p")),
+            contextlib.redirect_stdout(out),
+        ):
+            code = m.main()
+        self.assertEqual(code, 1)
+        self.assertTrue(out.getvalue().startswith("setup-failed"))
+        self.assertEqual(kc.puts, [])
+
 
 if __name__ == "__main__":
     unittest.main()

tests/unit/python/roles/web-app-keycloak/templates/test_realm_import_json.py

@@ -199,6 +199,24 @@ class TestRealmImportJson(unittest.TestCase):
             CONTEXT["IAM_USERNAME_MAX_LENGTH"],
         )
 
+    def test_only_an_admin_may_change_an_email_address(self) -> None:
+        realm = json.loads(render([]))
+        provider = realm["components"]["org.keycloak.userprofile.UserProfileProvider"]
+        profile = json.loads(provider[0]["config"]["kc.user.profile.config"][0])
+        email = next(
+            attribute
+            for attribute in profile["attributes"]
+            if attribute["name"] == "email"
+        )
+        self.assertEqual(
+            email["permissions"]["edit"],
+            ["admin"],
+            "applications resolve their account by this address and the realm does "
+            "not verify a change, so a self-service edit takes over whichever account "
+            "the typed address names",
+        )
+        self.assertEqual(email["permissions"]["view"], ["admin", "user"])
+
     def test_realm_is_valid_json_with_one_saml_app(self) -> None:
         realm = json.loads(render(["web-app-suitecrm"]))
         clients = {c["clientId"]: c for c in realm["clients"]}