paperless-ngx/src/paperless/tests/settings/test_remote_user.py

import os
from unittest import mock

from django.conf import settings
from django.test import override_settings
from rest_framework import status
from rest_framework.test import APITestCase

from paperless.settings import _parse_remote_user_settings
from paperless_testing.dirs import DirectoriesMixin
from paperless_testing.factories import UserFactory


class TestRemoteUser(DirectoriesMixin, APITestCase):
    def setUp(self) -> None:
        super().setUp()

        self.user = UserFactory(username="temp_admin", superuser=True)

        # _parse_remote_user_settings() mutates these shared lists in place,
        # so undo that after the test instead of leaking remote-user auth
        # into every test that runs afterward.
        original_middleware = list(settings.MIDDLEWARE)
        original_auth_backends = list(settings.AUTHENTICATION_BACKENDS)
        original_auth_classes = list(
            settings.REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"],
        )

        def _restore_remote_user_settings() -> None:
            settings.MIDDLEWARE[:] = original_middleware
            settings.AUTHENTICATION_BACKENDS[:] = original_auth_backends
            settings.REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"][:] = (
                original_auth_classes
            )

        self.addCleanup(_restore_remote_user_settings)

    def test_remote_user(self) -> None:
        """
        GIVEN:
            - Configured user
            - Remote user auth is enabled
        WHEN:
            - Call is made to root
        THEN:
            - Call succeeds
        """

        with mock.patch.dict(
            os.environ,
            {
                "PAPERLESS_ENABLE_HTTP_REMOTE_USER": "True",
            },
        ):
            _parse_remote_user_settings()

            response = self.client.get("/documents/")

            self.assertEqual(
                response.status_code,
                status.HTTP_302_FOUND,
            )

            response = self.client.get(
                "/documents/",
                headers={
                    "Remote-User": self.user.username,
                },
            )

            self.assertEqual(response.status_code, status.HTTP_200_OK)

    def test_remote_user_api(self) -> None:
        """
        GIVEN:
            - Configured user
            - Remote user auth is enabled for the API
        WHEN:
            - API call is made to get documents
        THEN:
            - Call succeeds
        """

        with mock.patch.dict(
            os.environ,
            {
                "PAPERLESS_ENABLE_HTTP_REMOTE_USER_API": "True",
            },
        ):
            _parse_remote_user_settings()

            response = self.client.get("/api/documents/")

            # 403 testing locally, 401 on ci...
            self.assertIn(
                response.status_code,
                [status.HTTP_401_UNAUTHORIZED, status.HTTP_403_FORBIDDEN],
            )

            response = self.client.get(
                "/api/documents/",
                headers={
                    "Remote-User": self.user.username,
                },
            )

            self.assertEqual(response.status_code, status.HTTP_200_OK)

    @override_settings(
        REST_FRAMEWORK={
            **settings.REST_FRAMEWORK,
            "DEFAULT_AUTHENTICATION_CLASSES": [
                "rest_framework.authentication.BasicAuthentication",
                "rest_framework.authentication.TokenAuthentication",
                "rest_framework.authentication.SessionAuthentication",
            ],
        },
    )
    def test_remote_user_api_disabled(self) -> None:
        """
        GIVEN:
            - Configured user
            - Remote user auth enabled for frontend but disabled for the API
            - Note that REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] is set in settings.py in production
        WHEN:
            - API call is made to get documents
        THEN:
            - Call fails
        """
        response = self.client.get(
            "/api/documents/",
            headers={
                "Remote-User": self.user.username,
            },
        )

        self.assertIn(
            response.status_code,
            [status.HTTP_401_UNAUTHORIZED, status.HTTP_403_FORBIDDEN],
        )

    def test_remote_user_header_setting(self) -> None:
        """
        GIVEN:
            - Remote user header name is set
        WHEN:
            - Settings are parsed
        THEN:
            - Correct header name is returned
        """

        with mock.patch.dict(
            os.environ,
            {
                "PAPERLESS_ENABLE_HTTP_REMOTE_USER": "True",
                "PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME": "HTTP_FOO",
            },
        ):
            header_name = _parse_remote_user_settings()

            self.assertEqual(header_name, "HTTP_FOO")