def test_make_response_from_ticket_invalidates_verification_key(self, mock_service_validate):
     self.user.verification_key = fake.md5()
     self.user.save()
     mock_response = make_successful_response(self.user)
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = 'http://accounts.osf.io/?ticket=' + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)

 def test_make_response_from_ticket_invalidates_verification_key(self, mock_service_validate):
     self.user.verification_key = fake.md5()
     self.user.save()
     mock_service_validate.return_value = make_successful_response(self.user)
     ticket = fake.md5()
     service_url = 'http://localhost:5000/'
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_true(self.user.verification_key is None)

 def test_make_response_from_ticket_invalidates_verification_key(self, mock_service_validate):
     self.user.verification_key = fake.md5()
     self.user.save()
     mock_response = make_external_response()
     validated_creds = cas.validate_external_credential(mock_response.user)
     self.user.external_identity = {validated_creds["provider"]: {validated_creds["id"]: "VERIFIED"}}
     self.user.save()
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = "http://accounts.osf.io/?ticket=" + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)

def make_successful_response(user):
    return cas.CasResponse(
        authenticated=True, user=user._primary_key,
        attributes={
            'accessToken': fake.md5()
        }
    )

 def test_make_response_from_ticket_failure(self, mock_service_validate):
     mock_response = make_failure_response()
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = 'http://accounts.osf.io/?ticket=' + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     assert_equal(resp.location, 'http://accounts.osf.io/')

 def test_make_response_from_ticket_generates_new_verification_key(self, mock_service_validate):
     self.user.verification_key = fake.md5()
     self.user.save()
     mock_response = make_external_response()
     validated_creds = cas.validate_external_credential(mock_response.user)
     self.user.external_identity = {
         validated_creds['provider']: {
             validated_creds['id']: 'VERIFIED'
         }
     }
     self.user.save()
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = 'http://localhost:5000/'
     verification_key = self.user.verification_key
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_not_equal(self.user.verification_key, verification_key)

 def test_make_response_from_ticket_no_user(self, mock_service_validate):
     mock_response = make_external_response()
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = "http://accounts.osf.io/?ticket=" + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     assert_equal(resp.location, "/external-login/email")

 def test_successful_external_first_login_without_attributes(self, mock_service_validate, mock_get_user_from_cas_resp, mock_external_first_login_authenticate):
     service_url = 'http://localhost:5000/dashboard/'
     user, validated_credentials, cas_resp = generate_external_user_with_resp(service_url, user=False, release=False)
     mock_service_validate.return_value = cas_resp
     mock_get_user_from_cas_resp.return_value = (None, validated_credentials, 'external_first_login')
     ticket = fake.md5()
     cas.make_response_from_ticket(ticket, service_url)
     assert_equal(user, mock_external_first_login_authenticate.call_args[0][0])

def test_parse_authorization_header():
    token = fake.md5()
    valid = 'Bearer {}'.format(token)
    assert_equal(cas.parse_auth_header(valid), token)

    missing_token = 'Bearer '
    with assert_raises(cas.CasTokenError):
        cas.parse_auth_header(missing_token)

 def test_make_response_from_ticket_success(self, mock_service_validate, mock_get_user_from_cas_resp):
     mock_service_validate.return_value = make_successful_response(self.user)
     mock_get_user_from_cas_resp.return_value = (self.user, None, 'authenticate')
     ticket = fake.md5()
     service_url = 'http://localhost:5000/'
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     assert_equal(mock_service_validate.call_count, 1)
     assert_equal(mock_get_user_from_cas_resp.call_count, 1)

def make_service_validation_response_body(user, access_token=None):
    token = access_token or fake.md5()
    return RESPONSE_TEMPLATE.format(
        user_id=user._primary_key,
        given_name=user.given_name,
        family_name=user.family_name,
        username=user.username,
        access_token=token
    )

 def test_make_response_from_ticket_failure(self, mock_service_validate, mock_get_user_from_cas_resp):
     mock_service_validate.return_value = make_failure_response()
     mock_get_user_from_cas_resp.return_value = (None, None, None)
     ticket = fake.md5()
     service_url = 'http://localhost:5000/'
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     assert_equal(mock_service_validate.call_count, 1)
     assert_equal(mock_get_user_from_cas_resp.call_count, 0)

 def test_successful_external_first_login(self, mock_service_validate, mock_get_user_from_cas_resp):
     service_url = 'http://localhost:5000/dashboard/'
     _, validated_credentials, cas_resp = generate_external_user_with_resp(service_url, user=False)
     mock_service_validate.return_value = cas_resp
     mock_get_user_from_cas_resp.return_value = (None, validated_credentials, 'external_first_login')
     ticket = fake.md5()
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302, 'redirect to external login email get')
     assert_in('/external-login/email', resp.location)

def make_external_response():
    return cas.CasResponse(
        authenticated=True,
        user='OrcidProfile#{}'.format(fake.numerify('####-####-####-####')),
        attributes={
            'given-names': fake.first_name(),
            'family-name': fake.last_name(),
            'accessToken': fake.md5(),
        }
    )

 def test_service_validate(self):
     user = UserFactory()
     url = furl.furl(self.base_url)
     url.path.segments.extend(("p3", "serviceValidate"))
     service_url = "http://test.osf.io"
     ticket = fake.md5()
     body = make_service_validation_response_body(user, ticket)
     httpretty.register_uri(httpretty.GET, url.url, body=body, status=200)
     resp = self.client.service_validate(ticket, service_url)
     assert_true(resp.authenticated)

 def test_make_response_from_ticket_handles_non_unicode(self, mock_service_validate):
     mock_response = make_external_response()
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = "http://accounts.osf.io/?ticket=" + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     assert_equal(mock_service_validate.call_count, 1)
     first_call_args = mock_service_validate.call_args[0]
     assert_equal(first_call_args[0], ticket)
     assert_equal(first_call_args[1], "http://accounts.osf.io/")

 def test_make_response_from_ticket_success(self, mock_service_validate):
     mock_response = make_successful_response(self.user)
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = 'http://accounts.osf.io/?ticket=' + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     mock_service_validate.assert_called_once()
     first_call_args = mock_service_validate.call_args[0]
     assert_equal(first_call_args[0], ticket)
     assert_equal(first_call_args[1], 'http://accounts.osf.io/')

 def test_successful_external_login_cas_redirect(self, mock_service_validate, mock_get_user_from_cas_resp):
     user, validated_credentials, cas_resp = generate_external_user_with_resp()
     mock_service_validate.return_value = cas_resp
     mock_get_user_from_cas_resp.return_value = (user, validated_credentials, 'authenticate')
     ticket = fake.md5()
     service_url = 'http://accounts.osf.io/?ticket=' + ticket
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302, 'redirect to CAS login')
     assert_in('/login?service=', resp.location)
     assert_in('username={}'.format(user.username), resp.location)
     assert_in('verification_key={}'.format(user.verification_key), resp.location)

 def test_make_response_from_ticket_handles_unicode(self, mock_service_validate):
     mock_response = make_external_response(unicode=True)
     mock_service_validate.return_value = mock_response
     ticket = fake.md5()
     service_url = 'http://localhost:5000/'
     resp = cas.make_response_from_ticket(ticket, service_url)
     assert_equal(resp.status_code, 302)
     assert_equal(mock_service_validate.call_count, 1)
     first_call_args = mock_service_validate.call_args[0]
     assert_equal(first_call_args[0], ticket)
     assert_equal(first_call_args[1], 'http://localhost:5000/')

def make_external_response(release=True, unicode=False):
    attributes = {"accessToken": fake.md5()}
    if release:
        attributes.update(
            {
                "given-names": fake.first_name() if not unicode else u"нет",
                "family-name": fake.last_name() if not unicode else u"Да",
            }
        )
    return cas.CasResponse(
        authenticated=True, user="OrcidProfile#{}".format(fake.numerify("####-####-####-####")), attributes=attributes
    )