I71954

.github/workflows/main.yml

@@ -49,18 +49,17 @@ jobs:
         pytest --cov=. --cov-report=html
 
   docs:
-    needs: test
     runs-on: ubuntu-latest
     steps:
+    - uses: actions/checkout@v3
+    - uses: actions/setup-python@v3
     - name: Install dependencies
       run: |
         pip install sphinx sphinx_rtd_theme sphinx-tabs sphinx-copybutton
         pip install .
     - name: Sphinx build
       run: |
         sphinx-build docs _build
-        cp -a htmlcov/ _build/htmlcov
-        ls -la _build/htmlcov/
 
     - name: Deploy to GitHub Pages
       uses: peaceiris/actions-gh-pages@v3

changes/71954.chore

@@ -0,0 +1 @@
+add test to ensure service accounts can't be manually changed

package.json

@@ -29,4 +29,4 @@
     "main": "webpack.config.js",
     "keywords": [],
     "author": ""
-}
+}

resources/personal.js

@@ -11,18 +11,18 @@ $(document).ready(function () {
                 function (field_index, field_value) {
                     let el = $(
                         "body.template-" +
-                        template_value +
-                        " #form-widgets-" +
-                        field_value,
+                            template_value +
+                            " #form-widgets-" +
+                            field_value,
                     );
                     if (el.length) {
                         el.addClass("d-none");
                         el.after(
                             '<input type="text" name="fake_' +
-                            field_value +
-                            '" class="form-control" id="fake_' +
-                            field_value +
-                            '" />',
+                                field_value +
+                                '" class="form-control" id="fake_' +
+                                field_value +
+                                '" />',
                         );
                         let fake_el = $("#fake_" + field_value);
                         fake_el.val(el.val());

src/ims/sso/browser/login.py

@@ -144,7 +144,6 @@ def __call__(self):
 
 class RequireLoginView(BrowserView):
     def __call__(self, *args, **kw):
-
         utility = getUtility(ISingleSignonUtility)
 
         if utility.is_plone_authenticated():

src/ims/sso/browser/templates/usergroups_usersoverview.pt

@@ -230,7 +230,10 @@
                 </div>
               </div>
 
-              <input type="hidden" name="submitted" value=1"/>
+              <input name="submitted"
+                     type="hidden"
+                     value='1"/'
+              />
             </form>
             <form class="enableAutoFocus pat-formunloadalert"
                   id="users_manage"
@@ -499,21 +502,21 @@
                   <div class="form-check pt-1"
                        id="manage-status"
                   >
-                              <input class="form-check-input"
-                                     id="manage-users-${opt/value}"
-                                     checked
-                                     name="active_status:list"
-                                     type="checkbox"
-                                     value="${opt/value}"
-                                     tal:condition="opt/selected"
-                              />
-                              <input class="form-check-input"
-                                     id="manage-users-${opt/value}"
-                                     name="active_status:list"
-                                     type="checkbox"
-                                     value="${opt/value}"
-                                     tal:condition="not:opt/selected"
-                              />
+                    <input class="form-check-input"
+                           id="manage-users-${opt/value}"
+                           checked
+                           name="active_status:list"
+                           type="checkbox"
+                           value="${opt/value}"
+                           tal:condition="opt/selected"
+                    />
+                    <input class="form-check-input"
+                           id="manage-users-${opt/value}"
+                           name="active_status:list"
+                           type="checkbox"
+                           value="${opt/value}"
+                           tal:condition="not:opt/selected"
+                    />
                     <label class="form-check-label"
                            for="manage-users-${opt/value}"
                     >${opt/title}</label>
@@ -554,7 +557,10 @@
               </div>
 
               <input tal:replace="structure context/@@authenticator/authenticator" />
-              <input type="hidden" name="submitted" value=1"/>
+              <input name="submitted"
+                     type="hidden"
+                     value='1"/'
+              />
 
             </form>
           </div>

src/ims/sso/profiles/default/registry/settings.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <registry>
-  <records interface="ims.sso.interfaces.ISSOSettings"/>
+  <records interface="ims.sso.interfaces.ISSOSettings" />
 </registry>

tests/test_active_status.py

@@ -38,15 +38,6 @@ def test_deactivate(self, portal):
         view.manageUser(users=(rec,))
         assert api.user.get("siteadmin").getProperty("active") == "inactive"
 
-    def test_cant_deactivate_manager(self, portal):
-        """User cannot deactivate someone with the Manager role"""
-        view = api.content.get_view("usergroup-userprefs", context=portal)
-        view.request.environ["HTTP_X_CSRF_TOKEN"] = createToken()
-        view.request.method = "POST"
-        rec = RequestRecord(id="manager", reset_email="noreply@nohost.com", active="active")
-        view.manageUser(users=(rec,))
-        assert api.user.get("manager").getProperty("active") == "active"
-
     def test_cant_deactivate_without_permission(self, portal):
         """User must have permission to deactivate/reactivate"""
         with api.env.adopt_user("siteadmin"):

tests/test_cron.py

@@ -26,6 +26,18 @@ def setup_users(self, portal, sso):
             email="noreply@imsweb.com",
             properties={"active": "active", "created_date": datetime.date.today()},
         )
+        self.manager = api.user.create(
+            username="manager",
+            email="noreply@imsweb.com",
+            roles=["Member", "Manager"],
+            properties={"active": "active", "created_date": datetime.date(2000, 1, 1)},
+        )
+        self.service = api.user.create(
+            username="service",
+            email="noreply@imsweb.com",
+            roles=["Member", "Manager"],
+            properties={"active": "active", "created_date": datetime.date(2000, 1, 1), "service": True},
+        )
         sso.set_login_name(user_id=self.user1.getId(), login_name=f"x@{NOT_LINKED}")
         sso.set_login_name(user_id=self.user2.getId(), login_name=f"y@{NOT_LINKED}")
 
@@ -38,6 +50,8 @@ def test_purge_unlinked(self, view):
 
         assert api.user.get("user1") is None
         assert api.user.get("user2") is not None
+        assert api.user.get("manager") is not None
+        assert api.user.get("service") is not None
 
     def test_disable_user_accounts(self, sso, view):
         self.user1.setMemberProperties({"activation_date": datetime.date.today()})
@@ -55,9 +69,27 @@ def test_disable_user_accounts(self, sso, view):
         self.user2.setMemberProperties({
             "activation_date": datetime.date.today() - datetime.timedelta(self.disabled_days + 1)
         })
+        self.manager.setMemberProperties({
+            "activation_date": datetime.date.today() - datetime.timedelta(self.inactive_days + 1)
+        })
+        self.service.setMemberProperties({
+            "activation_date": datetime.date.today() - datetime.timedelta(self.inactive_days + 1)
+        })
         view()
         assert api.user.get("user1").getProperty("active") == "inactive"
         assert api.user.get("user2").getProperty("active") == "disabled"
+        assert api.user.get("manager").getProperty("active") == "active"
+        assert api.user.get("service").getProperty("active") == "active"
+
+        self.manager.setMemberProperties({
+            "activation_date": datetime.date.today() - datetime.timedelta(self.disabled_days + 1)
+        })
+        self.service.setMemberProperties({
+            "activation_date": datetime.date.today() - datetime.timedelta(self.disabled_days + 1)
+        })
+        view()
+        assert api.user.get("manager").getProperty("active") == "active"
+        assert api.user.get("service").getProperty("active") == "active"
 
     def test_purge_activation_keys(self, portal, view):
         annotations = IAnnotations(portal)

tests/test_login.py

@@ -14,12 +14,16 @@ def test_change_password(self, portal):
 
     def test_login_url(self, portal):
         view = api.content.get_view(context=portal, name="get_login_url")
-        assert view() == "http://nohost/plone/@@login?came_from=http://nohost"
+        base_url = portal.absolute_url()
+        actual_url = view.request.ACTUAL_URL
+
+        assert view() == f"{base_url}/@@login?came_from={actual_url}"
 
     def test_missing_plugin(self, portal):
         portal.acl_users.manage_delObjects(["ims_sso_plugin"])
         view = api.content.get_view(context=portal, name="get_login_url")
-        assert view() == "http://nohost/plone"
+
+        assert view() == portal.absolute_url()
 
     def test_login_condition_yes_plone(self, portal):
         """Plone authenticated"""

tests/test_views.py

@@ -37,7 +37,10 @@ def setup_users(self, http_request, sso):
 
     def test_login_url(self, portal):
         view = api.content.get_view("get_login_url", context=portal)
-        assert view() == "http://nohost/plone/@@login?came_from=http://nohost"
+        base_url = portal.absolute_url()
+        actual_url = view.request.ACTUAL_URL
+
+        assert view() == f"{base_url}/@@login?came_from={actual_url}"
 
     def test_viewlet_auth_unauth(self, portal):
         zope.logout()