<reponame>n0emis/pretix
#
# This file is part of pretix (Community Edition).
#
# Copyright (C) 2014-2020 <NAME> and contributors
# Copyright (C) 2020-2021 rami.io GmbH and contributors
#
# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
# Public License as published by the Free Software Foundation in version 3 of the License.
#
# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
# this file, see <https://pretix.eu/about/en/license>.
#
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
# <https://www.gnu.org/licenses/>.
#
import datetime
from datetime import timedelta
from decimal import Decimal
from urllib.parse import parse_qs, urlparse

import pytest
from django.core import mail as djmail, signing
from django.core.signing import dumps
from django.test import Client
from django.utils.timezone import now
from django_scopes import scopes_disabled

from pretix.base.models import Event, Item, Order, OrderPosition, Organizer
from pretix.multidomain.models import KnownDomain
from pretix.presale.forms.customer import TokenGenerator


@pytest.fixture
def env():
    o = Organizer.objects.create(name='Big Events LLC', slug='bigevents')
    o.settings.customer_accounts = True
    event = Event.objects.create(
        organizer=o, name='Conference', slug='conf',
        date_from=now() + timedelta(days=10),
        live=True, is_public=False
    )
    return o, event


@pytest.mark.django_db
def test_disabled(env, client):
    env[0].settings.customer_accounts = False
    r = client.get('/bigevents/account/register')
    assert r.status_code == 404
    r = client.get('/bigevents/account/login')
    assert r.status_code == 404
    r = client.get('/bigevents/account/pwreset')
    assert r.status_code == 404
    r = client.get('/bigevents/account/pwrecover')
    assert r.status_code == 404
    r = client.get('/bigevents/account/activate')
    assert r.status_code == 404
    r = client.get('/bigevents/account/change')
    assert r.status_code == 404
    r = client.get('/bigevents/account/confirmchange')
    assert r.status_code == 404
    r = client.get('/bigevents/account/')
    assert r.status_code == 404


@pytest.mark.django_db
def test_org_register(env, client):
    signer = signing.TimestampSigner(salt='customer-registration-captcha-127.0.0.1')
    r = client.post('/bigevents/account/register', {
        'email': '<EMAIL>',
        'name_parts_0': '<NAME>',
        'challenge': signer.sign('1+2'),
        'response': '3',
    }, REMOTE_ADDR='127.0.0.1')
    assert r.status_code == 302
    assert len(djmail.outbox) == 1
    with scopes_disabled():
        customer = env[0].customers.get(email='<EMAIL>')
        assert not customer.is_verified
        assert customer.is_active

    r = client.post(
        f'/bigevents/account/activate?id={customer.identifier}&token={TokenGenerator().make_token(customer)}', {
            'password': '<PASSWORD>',
            'password_repeat': '<PASSWORD>',
        })
    assert r.status_code == 302

    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')
    assert customer.is_verified


@pytest.mark.django_db
def test_org_register_duplicate_email(env, client):
    with scopes_disabled():
        env[0].customers.create(email='<EMAIL>')
    r = client.post('/bigevents/account/register', {
        'email': '<EMAIL>',
        'name_parts_0': '<NAME>',
    })
    assert b'already registered' in r.content
    assert r.status_code == 200


@pytest.mark.django_db
def test_org_resetpw(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=False)

    r = client.post('/bigevents/account/pwreset', {
        'email': '<EMAIL>',
    })
    assert r.status_code == 302
    assert len(djmail.outbox) == 1

    r = client.post(
        f'/bigevents/account/pwrecover?id={customer.identifier}&token={TokenGenerator().make_token(customer)}', {
            'password': '<PASSWORD>',
            'password_repeat': '<PASSWORD>',
        })
    assert r.status_code == 302

    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')
    assert customer.is_verified


@pytest.mark.django_db
def test_org_activate_invalid_token(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=False)
    r = client.get(
        f'/bigevents/account/activate?id={customer.identifier}&token=.invalid.{TokenGenerator().make_token(customer)}')
    assert r.status_code == 302


@pytest.mark.django_db
def test_org_login_logout(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.get('/bigevents/account/')
    assert r.status_code == 200

    r = client.get('/bigevents/account/logout')
    assert r.status_code == 302

    r = client.get('/bigevents/account/')
    assert r.status_code == 302


@pytest.mark.django_db
def test_org_login_invalid_password(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 200
    assert b'alert-danger' in r.content


@pytest.mark.django_db
def test_org_login_not_verified(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=False)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 200
    assert b'alert-danger' in r.content


@pytest.mark.django_db
def test_org_login_not_active(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True, is_active=False)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 200
    assert b'alert-danger' in r.content


@pytest.mark.django_db
@pytest.mark.parametrize("url", [
    "account/change",
    "account/membership/1/",
    "account/",
])
def test_login_required(client, env, url):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    assert client.get('/bigevents/' + url).status_code == 302

    client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert client.get('/bigevents/' + url).status_code in (200, 404)


@pytest.mark.django_db
def test_org_order_list(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        event = env[1]
        ticket = Item.objects.create(event=event, name='Early-bird ticket', default_price=23, admission=True)
        o1 = Order.objects.create(
            status=Order.STATUS_PENDING,
            event=event,
            email='admin@localhost',
            datetime=now() - datetime.timedelta(days=3),
            expires=now() + datetime.timedelta(days=11),
            total=Decimal("23"),
        )
        OrderPosition.objects.create(
            order=o1,
            item=ticket,
            variation=None,
            price=Decimal("23"),
            attendee_name_parts={'full_name': "Peter"}
        )
        o2 = Order.objects.create(
            status=Order.STATUS_PENDING,
            event=event,
            email='<EMAIL>',
            datetime=now() - datetime.timedelta(days=3),
            expires=now() + datetime.timedelta(days=11),
            total=Decimal("23"),
        )
        OrderPosition.objects.create(
            order=o2,
            item=ticket,
            variation=None,
            price=Decimal("23"),
            attendee_name_parts={'full_name': "Peter"}
        )
        o3 = Order.objects.create(
            status=Order.STATUS_PENDING,
            event=event,
            email='admin@localhost',
            customer=customer,
            datetime=now() - datetime.timedelta(days=3),
            expires=now() + datetime.timedelta(days=11),
            total=Decimal("23"),
        )
        OrderPosition.objects.create(
            order=o3,
            item=ticket,
            variation=None,
            price=Decimal("23"),
            attendee_name_parts={'full_name': "Peter"}
        )

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.get('/bigevents/account/')
    assert r.status_code == 200
    content = r.content.decode()
    assert o1.code not in content
    assert o2.code not in content
    assert o3.code in content

    env[0].settings.customer_accounts_link_by_email = True

    r = client.get('/bigevents/account/')
    assert r.status_code == 200
    content = r.content.decode()
    assert o1.code not in content
    assert o2.code in content
    assert o3.code in content


@pytest.mark.django_db
def test_change_name(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.post('/bigevents/account/change', {
        'name_parts_0': '<NAME>',
        'email': '<EMAIL>',
    })
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.name == '<NAME>'


@pytest.mark.django_db
def test_change_email(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.post('/bigevents/account/change', {
        'name_parts_0': '<NAME>',
        'email': '<EMAIL>'
    })
    assert r.status_code == 200
    customer.refresh_from_db()
    assert customer.email == '<EMAIL>'

    r = client.post('/bigevents/account/change', {
        'name_parts_0': '<NAME>',
        'email': '<EMAIL>',
        'password_current': '<PASSWORD>',
    })
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.email == '<EMAIL>'
    assert len(djmail.outbox) == 1

    token = dumps({
        'customer': customer.pk,
        'email': '<EMAIL>'
    }, salt='pretix.presale.views.customer.ChangeInformationView')
    r = client.get(f'/bigevents/account/confirmchange?token={token}')
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.email == '<EMAIL>'


@pytest.mark.django_db
def test_change_pw(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.post('/bigevents/account/password', {
        'password_current': 'invalid',
        'password': '<PASSWORD>',
        'password_repeat': '<PASSWORD>',
    })
    assert r.status_code == 200
    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')

    r = client.post('/bigevents/account/password', {
        'password_current': 'foo',
        'password': '<PASSWORD>',
        'password_repeat': '<PASSWORD>',
    })
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')


@pytest.mark.django_db
def test_login_per_org(env, client):
    with scopes_disabled():
        o2 = Organizer.objects.create(name='Demo', slug='demo')
        o2.settings.customer_accounts = True
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert client.get('/bigevents/account/').status_code == 200
    assert client.get('/demo/account/').status_code == 302


@pytest.fixture
def client2():
    # We need a second test client instance for cross domain stuff since the test client
    # does not isolate sessions per-domain like browsers do
    return Client()


def _cross_domain_login(env, client, client2):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        KnownDomain.objects.create(domainname='org.test', organizer=env[0])
        KnownDomain.objects.create(domainname='event.test', organizer=env[0], event=env[1])

    # Log in on org domain
    r = client.post('/account/login?next=https://event.test/redeem&request_cross_domain_customer_auth=true', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    }, HTTP_HOST='org.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'event.test'
    assert u.path == '/redeem'
    q = parse_qs(u.query)
    assert 'cross_domain_customer_auth' in q

    # Take session over to event domain
    r = client2.get(f'/?{u.query}', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content


@pytest.mark.django_db
def test_cross_domain_login(env, client, client2):
    _cross_domain_login(env, client, client2)

    # Logged in on org domain
    r = client.get('/', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content

    # Logged in on event domain
    r = client2.get('/', HTTP_HOST='org.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content


@pytest.mark.django_db
def test_cross_domain_logout_on_org_domain(env, client, client2):
    _cross_domain_login(env, client, client2)

    r = client.get('/account/logout', HTTP_HOST='org.test')
    assert r.status_code == 302

    # Logged out on org domain
    r = client.get('/', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content

    # Logged out on event domain
    r = client2.get('/', HTTP_HOST='org.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content


@pytest.mark.django_db
def test_cross_domain_logout_on_event_domain(env, client, client2):
    _cross_domain_login(env, client, client2)

    r = client2.get('/account/logout?next=/redeem', HTTP_HOST='event.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'org.test'
    assert u.path == '/account/logout'

    r = client.get(f'{u.path}?{u.query}', HTTP_HOST='org.test')
    assert r.status_code == 302
    assert r.headers['Location'] == 'http://event.test/redeem'

    # Logged out on org domain
    r = client.get('/', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content

    # Logged out on event domain
    r = client2.get('/', HTTP_HOST='org.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content


@pytest.mark.django_db
def test_cross_domain_login_otp_only_valid_once(env, client, client2):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        KnownDomain.objects.create(domainname='org.test', organizer=env[0])
        KnownDomain.objects.create(domainname='event.test', organizer=env[0], event=env[1])

    # Log in on org domain
    r = client.post('/account/login?next=https://event.test/redeem&request_cross_domain_customer_auth=true', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    }, HTTP_HOST='org.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'event.test'
    assert u.path == '/redeem'
    q = parse_qs(u.query)
    assert 'cross_domain_customer_auth' in q

    # Take session over to event domain
    r = client.get(f'/?{u.query}', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content

    # Try to use again
    r = client2.get(f'/?{u.query}', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content


@pytest.mark.django_db
def test_cross_domain_login_validate_redirect_url(env, client, client2):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        KnownDomain.objects.create(domainname='org.test', organizer=env[0])
        KnownDomain.objects.create(domainname='event.test', organizer=env[0], event=env[1])

    # Log in on org domain
    r = client.post('/account/login?next=https://evilcorp.test/redeem&request_cross_domain_customer_auth=true', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    }, HTTP_HOST='org.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'org.test'
    assert u.path == '/account/'
    q = parse_qs(u.query)
    assert 'cross_domain_customer_auth' not in q

#
# This file is part of pretix (Community Edition).
#
# Copyright (C) 2014-2020 <NAME> and contributors
# Copyright (C) 2020-2021 rami.io GmbH and contributors
#
# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
# Public License as published by the Free Software Foundation in version 3 of the License.
#
# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
# this file, see <https://pretix.eu/about/en/license>.
#
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
# <https://www.gnu.org/licenses/>.
#
import datetime
from datetime import timedelta
from decimal import Decimal
from urllib.parse import parse_qs, urlparse

import pytest
from django.core import mail as djmail, signing
from django.core.signing import dumps
from django.test import Client
from django.utils.timezone import now
from django_scopes import scopes_disabled

from pretix.base.models import Event, Item, Order, OrderPosition, Organizer
from pretix.multidomain.models import KnownDomain
from pretix.presale.forms.customer import TokenGenerator


@pytest.fixture
def env():
    o = Organizer.objects.create(name='Big Events LLC', slug='bigevents')
    o.settings.customer_accounts = True
    event = Event.objects.create(
        organizer=o, name='Conference', slug='conf',
        date_from=now() + timedelta(days=10),
        live=True, is_public=False
    )
    return o, event


@pytest.mark.django_db
def test_disabled(env, client):
    env[0].settings.customer_accounts = False
    r = client.get('/bigevents/account/register')
    assert r.status_code == 404
    r = client.get('/bigevents/account/login')
    assert r.status_code == 404
    r = client.get('/bigevents/account/pwreset')
    assert r.status_code == 404
    r = client.get('/bigevents/account/pwrecover')
    assert r.status_code == 404
    r = client.get('/bigevents/account/activate')
    assert r.status_code == 404
    r = client.get('/bigevents/account/change')
    assert r.status_code == 404
    r = client.get('/bigevents/account/confirmchange')
    assert r.status_code == 404
    r = client.get('/bigevents/account/')
    assert r.status_code == 404


@pytest.mark.django_db
def test_org_register(env, client):
    signer = signing.TimestampSigner(salt='customer-registration-captcha-127.0.0.1')
    r = client.post('/bigevents/account/register', {
        'email': '<EMAIL>',
        'name_parts_0': '<NAME>',
        'challenge': signer.sign('1+2'),
        'response': '3',
    }, REMOTE_ADDR='127.0.0.1')
    assert r.status_code == 302
    assert len(djmail.outbox) == 1
    with scopes_disabled():
        customer = env[0].customers.get(email='<EMAIL>')
        assert not customer.is_verified
        assert customer.is_active

    r = client.post(
        f'/bigevents/account/activate?id={customer.identifier}&token={TokenGenerator().make_token(customer)}', {
            'password': '<PASSWORD>',
            'password_repeat': '<PASSWORD>',
        })
    assert r.status_code == 302

    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')
    assert customer.is_verified


@pytest.mark.django_db
def test_org_register_duplicate_email(env, client):
    with scopes_disabled():
        env[0].customers.create(email='<EMAIL>')
    r = client.post('/bigevents/account/register', {
        'email': '<EMAIL>',
        'name_parts_0': '<NAME>',
    })
    assert b'already registered' in r.content
    assert r.status_code == 200


@pytest.mark.django_db
def test_org_resetpw(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=False)

    r = client.post('/bigevents/account/pwreset', {
        'email': '<EMAIL>',
    })
    assert r.status_code == 302
    assert len(djmail.outbox) == 1

    r = client.post(
        f'/bigevents/account/pwrecover?id={customer.identifier}&token={TokenGenerator().make_token(customer)}', {
            'password': '<PASSWORD>',
            'password_repeat': '<PASSWORD>',
        })
    assert r.status_code == 302

    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')
    assert customer.is_verified


@pytest.mark.django_db
def test_org_activate_invalid_token(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=False)
    r = client.get(
        f'/bigevents/account/activate?id={customer.identifier}&token=.invalid.{TokenGenerator().make_token(customer)}')
    assert r.status_code == 302


@pytest.mark.django_db
def test_org_login_logout(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.get('/bigevents/account/')
    assert r.status_code == 200

    r = client.get('/bigevents/account/logout')
    assert r.status_code == 302

    r = client.get('/bigevents/account/')
    assert r.status_code == 302


@pytest.mark.django_db
def test_org_login_invalid_password(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 200
    assert b'alert-danger' in r.content


@pytest.mark.django_db
def test_org_login_not_verified(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=False)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 200
    assert b'alert-danger' in r.content


@pytest.mark.django_db
def test_org_login_not_active(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True, is_active=False)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 200
    assert b'alert-danger' in r.content


@pytest.mark.django_db
@pytest.mark.parametrize("url", [
    "account/change",
    "account/membership/1/",
    "account/",
])
def test_login_required(client, env, url):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    assert client.get('/bigevents/' + url).status_code == 302

    client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert client.get('/bigevents/' + url).status_code in (200, 404)


@pytest.mark.django_db
def test_org_order_list(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        event = env[1]
        ticket = Item.objects.create(event=event, name='Early-bird ticket', default_price=23, admission=True)
        o1 = Order.objects.create(
            status=Order.STATUS_PENDING,
            event=event,
            email='admin@localhost',
            datetime=now() - datetime.timedelta(days=3),
            expires=now() + datetime.timedelta(days=11),
            total=Decimal("23"),
        )
        OrderPosition.objects.create(
            order=o1,
            item=ticket,
            variation=None,
            price=Decimal("23"),
            attendee_name_parts={'full_name': "Peter"}
        )
        o2 = Order.objects.create(
            status=Order.STATUS_PENDING,
            event=event,
            email='<EMAIL>',
            datetime=now() - datetime.timedelta(days=3),
            expires=now() + datetime.timedelta(days=11),
            total=Decimal("23"),
        )
        OrderPosition.objects.create(
            order=o2,
            item=ticket,
            variation=None,
            price=Decimal("23"),
            attendee_name_parts={'full_name': "Peter"}
        )
        o3 = Order.objects.create(
            status=Order.STATUS_PENDING,
            event=event,
            email='admin@localhost',
            customer=customer,
            datetime=now() - datetime.timedelta(days=3),
            expires=now() + datetime.timedelta(days=11),
            total=Decimal("23"),
        )
        OrderPosition.objects.create(
            order=o3,
            item=ticket,
            variation=None,
            price=Decimal("23"),
            attendee_name_parts={'full_name': "Peter"}
        )

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.get('/bigevents/account/')
    assert r.status_code == 200
    content = r.content.decode()
    assert o1.code not in content
    assert o2.code not in content
    assert o3.code in content

    env[0].settings.customer_accounts_link_by_email = True

    r = client.get('/bigevents/account/')
    assert r.status_code == 200
    content = r.content.decode()
    assert o1.code not in content
    assert o2.code in content
    assert o3.code in content


@pytest.mark.django_db
def test_change_name(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.post('/bigevents/account/change', {
        'name_parts_0': '<NAME>',
        'email': '<EMAIL>',
    })
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.name == '<NAME>'


@pytest.mark.django_db
def test_change_email(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.post('/bigevents/account/change', {
        'name_parts_0': '<NAME>',
        'email': '<EMAIL>'
    })
    assert r.status_code == 200
    customer.refresh_from_db()
    assert customer.email == '<EMAIL>'

    r = client.post('/bigevents/account/change', {
        'name_parts_0': '<NAME>',
        'email': '<EMAIL>',
        'password_current': '<PASSWORD>',
    })
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.email == '<EMAIL>'
    assert len(djmail.outbox) == 1

    token = dumps({
        'customer': customer.pk,
        'email': '<EMAIL>'
    }, salt='pretix.presale.views.customer.ChangeInformationView')
    r = client.get(f'/bigevents/account/confirmchange?token={token}')
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.email == '<EMAIL>'


@pytest.mark.django_db
def test_change_pw(env, client):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    r = client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert r.status_code == 302

    r = client.post('/bigevents/account/password', {
        'password_current': 'invalid',
        'password': '<PASSWORD>',
        'password_repeat': '<PASSWORD>',
    })
    assert r.status_code == 200
    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')

    r = client.post('/bigevents/account/password', {
        'password_current': 'foo',
        'password': '<PASSWORD>',
        'password_repeat': '<PASSWORD>',
    })
    assert r.status_code == 302
    customer.refresh_from_db()
    assert customer.check_password('<PASSWORD>')


@pytest.mark.django_db
def test_login_per_org(env, client):
    with scopes_disabled():
        o2 = Organizer.objects.create(name='Demo', slug='demo')
        o2.settings.customer_accounts = True
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()

    client.post('/bigevents/account/login', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    })
    assert client.get('/bigevents/account/').status_code == 200
    assert client.get('/demo/account/').status_code == 302


@pytest.fixture
def client2():
    # We need a second test client instance for cross domain stuff since the test client
    # does not isolate sessions per-domain like browsers do
    return Client()


def _cross_domain_login(env, client, client2):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        KnownDomain.objects.create(domainname='org.test', organizer=env[0])
        KnownDomain.objects.create(domainname='event.test', organizer=env[0], event=env[1])

    # Log in on org domain
    r = client.post('/account/login?next=https://event.test/redeem&request_cross_domain_customer_auth=true', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    }, HTTP_HOST='org.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'event.test'
    assert u.path == '/redeem'
    q = parse_qs(u.query)
    assert 'cross_domain_customer_auth' in q

    # Take session over to event domain
    r = client2.get(f'/?{u.query}', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content


@pytest.mark.django_db
def test_cross_domain_login(env, client, client2):
    _cross_domain_login(env, client, client2)

    # Logged in on org domain
    r = client.get('/', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content

    # Logged in on event domain
    r = client2.get('/', HTTP_HOST='org.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content


@pytest.mark.django_db
def test_cross_domain_logout_on_org_domain(env, client, client2):
    _cross_domain_login(env, client, client2)

    r = client.get('/account/logout', HTTP_HOST='org.test')
    assert r.status_code == 302

    # Logged out on org domain
    r = client.get('/', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content

    # Logged out on event domain
    r = client2.get('/', HTTP_HOST='org.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content


@pytest.mark.django_db
def test_cross_domain_logout_on_event_domain(env, client, client2):
    _cross_domain_login(env, client, client2)

    r = client2.get('/account/logout?next=/redeem', HTTP_HOST='event.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'org.test'
    assert u.path == '/account/logout'

    r = client.get(f'{u.path}?{u.query}', HTTP_HOST='org.test')
    assert r.status_code == 302
    assert r.headers['Location'] == 'http://event.test/redeem'

    # Logged out on org domain
    r = client.get('/', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content

    # Logged out on event domain
    r = client2.get('/', HTTP_HOST='org.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content


@pytest.mark.django_db
def test_cross_domain_login_otp_only_valid_once(env, client, client2):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        KnownDomain.objects.create(domainname='org.test', organizer=env[0])
        KnownDomain.objects.create(domainname='event.test', organizer=env[0], event=env[1])

    # Log in on org domain
    r = client.post('/account/login?next=https://event.test/redeem&request_cross_domain_customer_auth=true', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    }, HTTP_HOST='org.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'event.test'
    assert u.path == '/redeem'
    q = parse_qs(u.query)
    assert 'cross_domain_customer_auth' in q

    # Take session over to event domain
    r = client.get(f'/?{u.query}', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' in r.content

    # Try to use again
    r = client2.get(f'/?{u.query}', HTTP_HOST='event.test')
    assert r.status_code == 200
    assert b'<EMAIL>' not in r.content


@pytest.mark.django_db
def test_cross_domain_login_validate_redirect_url(env, client, client2):
    with scopes_disabled():
        customer = env[0].customers.create(email='<EMAIL>', is_verified=True)
        customer.set_password('<PASSWORD>')
        customer.save()
        KnownDomain.objects.create(domainname='org.test', organizer=env[0])
        KnownDomain.objects.create(domainname='event.test', organizer=env[0], event=env[1])

    # Log in on org domain
    r = client.post('/account/login?next=https://evilcorp.test/redeem&request_cross_domain_customer_auth=true', {
        'email': '<EMAIL>',
        'password': '<PASSWORD>',
    }, HTTP_HOST='org.test')
    assert r.status_code == 302

    u = urlparse(r.headers['Location'])
    assert u.netloc == 'org.test'
    assert u.path == '/account/'
    q = parse_qs(u.query)
    assert 'cross_domain_customer_auth' not in q
# # This file is part of pretix (Community Edition). # # Copyright (C) 2014-2020 <NAME> and contributors # Copyright (C) 2020-2021 rami.io GmbH and contributors # # This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General # Public License as published by the Free Software Foundation in version 3 of the License. # # ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are # applicable granting you additional permissions and placing additional restrictions on your usage of this software. # Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive # this file, see <https://pretix.eu/about/en/license>. # # This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more # details. # # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see # <https://www.gnu.org/licenses/>. # # We need a second test client instance for cross domain stuff since the test client # does not isolate sessions per-domain like browsers do # Log in on org domain # Take session over to event domain # Logged in on org domain # Logged in on event domain # Logged out on org domain # Logged out on event domain # Logged out on org domain # Logged out on event domain # Log in on org domain # Take session over to event domain # Try to use again # Log in on org domain