API - add scope on endpoints

fittrackee/tests/oauth2/test_oauth2_client.py

@@ -1,10 +1,11 @@
 from time import time
-from typing import Dict
+from typing import Any, Dict
 from unittest.mock import patch
 
+import pytest
 from flask import Flask
 
-from fittrackee.oauth2.client import create_oauth_client
+from fittrackee.oauth2.client import check_scope, create_oauth_client
 from fittrackee.oauth2.models import OAuth2Client
 from fittrackee.users.models import User
 
@@ -106,7 +107,7 @@ class TestCreateOAuth2Client:
     def test_oauth_client_has_expected_scope(
         self, app: Flask, user_1: User
     ) -> None:
-        scope = 'profile'
+        scope = 'write'
         client_metadata: Dict = {**TEST_METADATA, 'scope': scope}
 
         oauth_client = create_oauth_client(client_metadata, user_1)
@@ -138,3 +139,28 @@ class TestCreateOAuth2Client:
         oauth_client = create_oauth_client(TEST_METADATA, user_1)
 
         assert oauth_client.user_id == user_1.id
+
+
+class TestOAuthCheckScopes:
+    @pytest.mark.parametrize(
+        'input_scope', ['', 1, random_string(), [random_string(), 'readwrite']]
+    )
+    def test_it_returns_read_if_scope_is_invalid(
+        self, input_scope: Any
+    ) -> None:
+        assert check_scope(input_scope) == 'read'
+
+    @pytest.mark.parametrize(
+        'input_scope,expected_scope',
+        [
+            ('read', 'read'),
+            ('read ' + random_string(), 'read'),
+            ('write', 'write'),
+            ('write read', 'write read'),
+            ('write read ' + random_string(), 'write read'),
+        ],
+    )
+    def test_it_return_only_valid_scopes(
+        self, input_scope: str, expected_scope: str
+    ) -> None:
+        assert check_scope(input_scope) == expected_scope

fittrackee/tests/oauth2/test_oauth2_scopes.py

@@ -0,0 +1,259 @@
+from json import dumps
+
+import pytest
+from flask import Flask
+from werkzeug.test import TestResponse
+
+from fittrackee.users.models import User
+
+from ..mixins import ApiTestCaseMixin
+from ..utils import random_short_id, random_string
+
+
+class OAuth2ScopesTestCase(ApiTestCaseMixin):
+    def assert_expected_response(
+        self, response: TestResponse, client_scope: str, endpoint_scope: str
+    ) -> None:
+        if client_scope == endpoint_scope:
+            self.assert_not_insufficient_scope_error(response)
+        else:
+            self.assert_insufficient_scope(response)
+
+
+class TestOAuth2ScopesWithReadAccess(OAuth2ScopesTestCase):
+    scope = 'read'
+
+    @pytest.mark.parametrize(
+        'endpoint_url',
+        [
+            '/api/auth/profile',
+            '/api/records',
+            '/api/sports',
+            '/api/sports/1',
+            f'/api/stats/{random_string()}/by_sport',
+            f'/api/stats/{random_string()}/by_time',
+            '/api/users/test',
+            '/api/workouts',
+            f'/api/workouts/{random_short_id()}',
+            f'/api/workouts/{random_short_id()}/chart_data',
+            f'/api/workouts/{random_short_id()}/chart_data/segment/1',
+            f'/api/workouts/{random_short_id()}/gpx',
+            f'/api/workouts/{random_short_id()}/gpx/download',
+            f'/api/workouts/{random_short_id()}/gpx/segment/1',
+        ],
+    )
+    def test_access_to_get_endpoints(
+        self, app: Flask, user_1: User, endpoint_url: str
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1, scope=self.scope
+        )
+
+        response = client.get(
+            endpoint_url,
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_expected_response(
+            response, client_scope=self.scope, endpoint_scope='read'
+        )
+
+    @pytest.mark.parametrize(
+        'endpoint_url',
+        ['/api/users'],
+    )
+    def test_access_to_endpoints_as_admin(
+        self, app: Flask, user_1_admin: User, endpoint_url: str
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1_admin, scope=self.scope
+        )
+
+        response = client.get(
+            endpoint_url,
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_expected_response(
+            response, client_scope=self.scope, endpoint_scope='read'
+        )
+
+    @pytest.mark.parametrize(
+        'endpoint_url',
+        [
+            '/api/auth/picture',
+            '/api/auth/profile/edit',
+            '/api/auth/profile/edit/preferences',
+            '/api/auth/profile/edit/sports',
+            '/api/workouts',
+            '/api/workouts/no_gpx',
+        ],
+    )
+    def test_access_post_endpoints(
+        self, app: Flask, user_1: User, endpoint_url: str
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1, scope=self.scope
+        )
+
+        response = client.post(
+            endpoint_url,
+            data=dumps(dict()),
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_expected_response(
+            response, client_scope=self.scope, endpoint_scope='write'
+        )
+
+    @pytest.mark.parametrize(
+        'endpoint_url',
+        [
+            '/api/auth/profile/edit/account',
+            '/api/workouts/0',
+        ],
+    )
+    def test_access_to_patch_endpoints(
+        self, app: Flask, user_1: User, endpoint_url: str
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1, scope=self.scope
+        )
+
+        response = client.patch(
+            endpoint_url,
+            data=dumps(dict()),
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_expected_response(
+            response, client_scope=self.scope, endpoint_scope='write'
+        )
+
+    @pytest.mark.parametrize(
+        'endpoint_url',
+        [
+            '/api/config',
+            '/api/sports/1',
+            f'/api/users/{random_string()}',
+        ],
+    )
+    def test_access_to_patch_endpoints_as_admin(
+        self, app: Flask, user_1_admin: User, endpoint_url: str
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1_admin, scope=self.scope
+        )
+
+        response = client.patch(
+            endpoint_url,
+            data=dumps(dict()),
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_expected_response(
+            response, client_scope=self.scope, endpoint_scope='write'
+        )
+
+    @pytest.mark.parametrize(
+        'endpoint_url',
+        [
+            '/api/auth/picture',
+            '/api/auth/profile/reset/sports/1',
+            f'/api/users/{random_string()}',
+            '/api/workouts/0',
+        ],
+    )
+    def test_access_to_delete_endpoints(
+        self, app: Flask, user_1: User, endpoint_url: str
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1, scope=self.scope
+        )
+        user_1.picture = random_string()
+
+        response = client.delete(
+            endpoint_url,
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_expected_response(
+            response, client_scope=self.scope, endpoint_scope='write'
+        )
+
+
+class TestOAuth2ScopesWithWriteAccess(TestOAuth2ScopesWithReadAccess):
+    scope = 'write'
+
+
+class TestOAuth2ScopesWithReadAndWriteAccess(ApiTestCaseMixin):
+    scope = 'read write'
+
+    def test_client_can_access_endpoint_with_read_scope(
+        self, app: Flask, user_1: User
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1, scope=self.scope
+        )
+
+        response = client.get(
+            '/api/auth/profile',
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_not_insufficient_scope_error(response)
+
+    def test_client_with_read_can_access_endpoints_with_write_scope(
+        self, app: Flask, user_1: User
+    ) -> None:
+        (
+            client,
+            oauth_client,
+            access_token,
+        ) = self.create_oauth_client_and_issue_token(
+            app, user_1, scope=self.scope
+        )
+
+        response = client.post(
+            '/api/auth/picture',
+            data=dumps(dict()),
+            content_type='application/json',
+            headers=dict(Authorization=f'Bearer {access_token}'),
+        )
+
+        self.assert_not_insufficient_scope_error(response)