From ca5fc3e43184b8c3e3a1c4957fa611617255c2ca Mon Sep 17 00:00:00 2001
From: Soline <soline_blanc@outlook.fr>
Date: Thu, 19 Oct 2023 17:00:49 -0400
Subject: [PATCH 1/3] Rely on is_authenticated attribute of UserMixin and
 AnonymousUserMixin to handle the login information

---
 clockwork_web/browser_routes/settings.py    | 108 +++--------
 clockwork_web/login_routes.py               |   4 +-
 clockwork_web/server_app.py                 |   4 +-
 clockwork_web/templates/base.html           |   4 +-
 clockwork_web/user.py                       |  12 --
 clockwork_web_test/test_browser_settings.py | 190 ++++++++++----------
 6 files changed, 129 insertions(+), 193 deletions(-)

diff --git a/clockwork_web/browser_routes/settings.py b/clockwork_web/browser_routes/settings.py
index 7b07883e..c47dede3 100644
--- a/clockwork_web/browser_routes/settings.py
+++ b/clockwork_web/browser_routes/settings.py
@@ -120,24 +120,13 @@ def route_set_nbr_items_per_page():
         # Check if nbr_items_per_page is a positive integer
         if type(nbr_items_per_page) == int and nbr_items_per_page > 0:
 
-            if current_user.is_authenticated():
-                # If it is, update this number in the current user's settings and
-                # retrieve the status code and status message associated to this
-                # operation
-                (
-                    status_code,
-                    status_message,
-                ) = current_user.settings_nbr_items_per_page_set(nbr_items_per_page)
-            else:
-                # Otherwise, return an error
-                return (
-                    render_template_with_user_settings(
-                        "error.html",
-                        error_msg=gettext("The user is not authenticated."),
-                        previous_request_args=previous_request_args,
-                    ),
-                    403,  # Forbidden
-                )
+            # If it is, update this number in the current user's settings and
+            # retrieve the status code and status message associated to this
+            # operation
+            (
+                status_code,
+                status_message,
+            ) = current_user.settings_nbr_items_per_page_set(nbr_items_per_page)
 
             if status_code == 200:
                 # If a success has been return, redirect to the settings page
@@ -195,18 +184,7 @@ def route_set_dark_mode():
 
     # Set the dark mode value to True in the current user's web settings and
     # retrieve the status code and status message associated to the operation
-    if current_user.is_authenticated():
-        (status_code, status_message) = current_user.settings_dark_mode_enable()
-    else:
-        # Otherwise, return an error
-        return (
-            render_template_with_user_settings(
-                "error.html",
-                error_msg=gettext("The user is not authenticated."),
-                previous_request_args=previous_request_args,
-            ),
-            403,  # Forbidden
-        )
+    (status_code, status_message) = current_user.settings_dark_mode_enable()
 
     if status_code == 200:
         # If a success has been returned
@@ -237,20 +215,10 @@ def route_unset_dark_mode():
 
     # Initialize the request arguments (it is further transferred to the HTML)
     previous_request_args = {}
-    if current_user.is_authenticated():
-        # Set the dark mode value to False in the current user's web settings and
-        # retrieve the status code and status message associated to the operation
-        (status_code, status_message) = current_user.settings_dark_mode_disable()
-    else:
-        # Otherwise, return an error
-        return (
-            render_template_with_user_settings(
-                "error.html",
-                error_msg=gettext("The user is not authenticated."),
-                previous_request_args=previous_request_args,
-            ),
-            403,  # Forbidden
-        )
+
+    # Set the dark mode value to False in the current user's web settings and
+    # retrieve the status code and status message associated to the operation
+    (status_code, status_message) = current_user.settings_dark_mode_disable()
 
     if status_code == 200:
         # If a success has been returned
@@ -496,25 +464,13 @@ def route_set_date_format():
     if date_format:
         # Check if the date format is supported
         if date_format in get_available_date_formats():
-            if current_user.is_authenticated():
-                # If the requested date format is expected, update the preferred
-                # date format of the current user and retrieve the status code
-                # and status message associated to this operation
-                (
-                    status_code,
-                    status_message,
-                ) = current_user.settings_date_format_set(date_format)
-
-            else:
-                # Otherwise, return an error
-                return (
-                    render_template_with_user_settings(
-                        "error.html",
-                        error_msg=gettext("The user is not authenticated."),
-                        previous_request_args=previous_request_args,
-                    ),
-                    403,  # Forbidden
-                )
+            # If the requested date format is expected, update the preferred
+            # date format of the current user and retrieve the status code
+            # and status message associated to this operation
+            (
+                status_code,
+                status_message,
+            ) = current_user.settings_date_format_set(date_format)
 
             if status_code == 200:
                 # If a success has been return, redirect to the home page
@@ -578,24 +534,14 @@ def route_set_time_format():
     if time_format:
         # Check if the date format is supported
         if time_format in get_available_time_formats():
-            if current_user.is_authenticated():
-                # If the requested time format is expected, update the preferred
-                # time format of the current user and retrieve the status code
-                # and status message associated to this operation
-                (
-                    status_code,
-                    status_message,
-                ) = current_user.settings_time_format_set(time_format)
-            else:
-                # Otherwise, return an error
-                return (
-                    render_template_with_user_settings(
-                        "error.html",
-                        error_msg=gettext("The user is not authenticated."),
-                        previous_request_args=previous_request_args,
-                    ),
-                    403,  # Forbidden
-                )
+
+            # If the requested time format is expected, update the preferred
+            # time format of the current user and retrieve the status code
+            # and status message associated to this operation
+            (
+                status_code,
+                status_message,
+            ) = current_user.settings_time_format_set(time_format)
 
             if status_code == 200:
                 # If a success has been return, redirect to the home page
diff --git a/clockwork_web/login_routes.py b/clockwork_web/login_routes.py
index 2244d4c7..6772e7b6 100644
--- a/clockwork_web/login_routes.py
+++ b/clockwork_web/login_routes.py
@@ -206,9 +206,9 @@ def route_callback():
     from flask import current_app
 
     current_app.logger.debug(
-        "called login_user(user) for user with email %s, user.is_authenticated() is %s",
+        "called login_user(user) for user with email %s, user.is_authenticated is %s",
         user.mila_email_username,
-        user.is_authenticated(),
+        user.is_authenticated,
     )
     # Send user back to homepage
     return redirect(url_for("index"))
diff --git a/clockwork_web/server_app.py b/clockwork_web/server_app.py
index eb997bd3..d8375f6d 100644
--- a/clockwork_web/server_app.py
+++ b/clockwork_web/server_app.py
@@ -151,7 +151,7 @@ def have_same_users(user1: str, user2: str):
     @babel.localeselector
     def get_locale():
         # If the user is authenticated
-        if current_user and current_user.is_authenticated():
+        if current_user and current_user.is_authenticated:
 
             return current_user.get_language()
 
@@ -251,7 +251,7 @@ def index():
         where people can click on the "login" button on the web interface.
         """
 
-        if current_user.is_authenticated():
+        if current_user.is_authenticated:
             app.logger.debug("in route for '/'; redirecting to jobs/")
             return redirect("jobs/")
         else:
diff --git a/clockwork_web/templates/base.html b/clockwork_web/templates/base.html
index 84ce5261..5a3917bd 100644
--- a/clockwork_web/templates/base.html
+++ b/clockwork_web/templates/base.html
@@ -70,7 +70,7 @@ <h4><span>{{ gettext("Alpha version!") }}</span></h4>
 						{% endif %}
 					</a>
 				</div>
-				{% if current_user.is_authenticated() %}
+				{% if current_user.is_authenticated %}
 				<div class="col">
 					<nav class="navbar-expand-lg">
 						<div class="container-fluid">
@@ -126,7 +126,7 @@ <h4><span>{{ gettext("Alpha version!") }}</span></h4>
 		</div>
 
 		{% block form %}
-		{% if request.path != '/jobs/dashboard' and current_user.is_authenticated() %}
+		{% if request.path != '/jobs/dashboard' and current_user.is_authenticated %}
 			<!-- Search jobs form -->
 			<div id="formBlock">
 				<div class="search_button formCollapse {{ 'collapse' if request.path != '/jobs/search' }} {{ 'show' if request.path == '/jobs/search' }}" id="mainCollapse">
diff --git a/clockwork_web/user.py b/clockwork_web/user.py
index 8261a0ab..27b3eff4 100644
--- a/clockwork_web/user.py
+++ b/clockwork_web/user.py
@@ -94,15 +94,6 @@ def boolean(value):
             "actions"
         ] = False
 
-    # If we don't set those two values ourselves, we are going
-    # to have users being asked to login every time they click
-    # on a link or refresh the pages.
-    def is_authenticated(self):
-        return True
-
-    def is_active(self):
-        return self.status == "enabled"
-
     def get_id(self):
         return self.mila_email_username
 
@@ -350,6 +341,3 @@ def get_web_settings(self):
             A dictionary presenting the default web settings.
         """
         return self.web_settings
-
-    def is_authenticated(self):
-        return False
diff --git a/clockwork_web_test/test_browser_settings.py b/clockwork_web_test/test_browser_settings.py
index a9bf3c08..8239289f 100644
--- a/clockwork_web_test/test_browser_settings.py
+++ b/clockwork_web_test/test_browser_settings.py
@@ -1,6 +1,5 @@
 from flask import session
-from flask_login import current_user
-from flask_login import FlaskLoginClient
+from flask_login import current_user, FlaskLoginClient
 import pytest
 
 from clockwork_web.db import get_db
@@ -99,42 +98,21 @@ def test_settings_set_nbr_items_per_page_zero_or_negative_value(
     assert response.status_code == 400  # Bad Request
 
 
-@pytest.mark.parametrize(
-    "nbr_items_per_page",
-    [13, 2],
-)
-def test_settings_set_nbr_items_per_page_unknown_user(client, nbr_items_per_page):
-    """
-    Test the function route_set_nbr_items_per_page when sending a zero or
-    negative integer as nbr_items_per_page.
 
-    Parameters:
-    - client                The web client used to send the request
-    - nbr_items_per_page    The value to try to set as the preferred number of
-                            items to display per page for the current user
-    """
-    # Define the request to test
-    test_request = (
-        f"/settings/web/nbr_items_per_page/set?nbr_items_per_page={nbr_items_per_page}"
-    )
-
-    # Retrieve the response to the call we are testing
-    response = client.get(test_request)
-
-    # Check if the response is the expected one
-    assert response.status_code == 403  # Forbidden
-
-
-def test_settings_set_date_format_missing_argument(client):
+def test_settings_set_date_format_missing_argument(client, fake_data):
     """
     Test the function route_set_date_format without sending a
     date_format as argument.
 
     Parameters:
-    - client    The web client used to send the request
+    - client        The web client used to send the request
+    - fake_data     The data our tests are based on
     """
-    # This is to establish a 'current_user'
-    client.get("/settings/")
+    user_id = fake_data["users"][0]["mila_email_username"]
+
+    # Log in to Clockwork
+    login_response = client.get(f"/login/testing?user_id={user_id}")
+    assert login_response.status_code == 302  # Redirect
 
     # Retrieve the response to the call we are testing
     response = client.get("/settings/web/date_format/set")
@@ -142,6 +120,10 @@ def test_settings_set_date_format_missing_argument(client):
     # Check if the response is the expected one
     assert response.status_code == 400  # Bad Request
 
+    # Log out from Clockwork
+    response_logout = client.get("/login/logout")
+    assert response_logout.status_code == 302  # Redirect
+
 
 @pytest.mark.parametrize("date_format", ["test", 1.3, True])
 def test_settings_set_date_format_wrong_type(client, date_format):
@@ -169,20 +151,21 @@ def test_settings_set_date_format_wrong_type(client, date_format):
 
 
 @pytest.mark.parametrize("date_format", ["words", "unix_timestamp", "MM/DD/YYYY"])
-def test_settings_set_date_format_success(client, known_user, date_format):
+def test_settings_set_date_format_success(client, fake_data, date_format):
     """
     Test the function route_set_date_format when the operation is
     done successfully.
 
     Parameters:
     - client        The web client used to send the request
-    - known_user    A known user we will check or edit
+    - fake_data     The data our tests are based on
     - date_format   The format to display the dates to store in the user's settings
     """
-    user_id = known_user["mila_email_username"]
+    # Define the current user
+    user = fake_data["users"][0]
 
     # Log in to Clockwork in order to have an active current user
-    login_response = client.get(f"/login/testing?user_id={user_id}")
+    login_response = client.get(f"/login/testing?user_id={user['mila_email_username']}")
     assert login_response.status_code == 302  # Redirect
 
     # Define the request to test
@@ -193,7 +176,7 @@ def test_settings_set_date_format_success(client, known_user, date_format):
     assert response.status_code == 302  # Redirect
 
     # Retrieve the user data
-    D_user = get_db()["users"].find_one({"mila_email_username": user_id})
+    D_user = get_db()["users"].find_one({"mila_email_username": user['mila_email_username']})
     # Assert the date format setting has been modified
     assert D_user["web_settings"]["date_format"] == date_format
 
@@ -380,7 +363,7 @@ def test_settings_unset_column_display_bad_request(client, page_name, column_nam
     [("jobs_list", "job_id")],
 )
 def test_settings_set_and_unset_column_display_good_request(
-    client, known_user, page_name, column_name
+    client, fake_data, page_name, column_name
 ):
     """
     Test the functions route_set_column_display and route_unset_column_display when the
@@ -388,20 +371,21 @@ def test_settings_set_and_unset_column_display_good_request(
 
     Parameters:
     - client        The web client used to send the requests
-    - known_user    A known user we will check or edit
+    - fake_data     The data our tests are based on
     - page_name     The page name on which the provided job property should appear or not regarding the web setting value
     - column_name   The job property we try to change whether or not it is displayed
     """
-    user_id = known_user["mila_email_username"]
+    # Define the current user
+    user = fake_data["users"][0]
 
     # Log in to Clockwork in order to have an active current user
-    login_response = client.get(f"/login/testing?user_id={user_id}")
+    login_response = client.get(f"/login/testing?user_id={user['mila_email_username']}")
     assert login_response.status_code == 302  # Redirect
 
     # Check the current value of the web setting we want to update through
     # our requests
     try:
-        previous_value = known_user["web_settings"][page_name][column_name]
+        previous_value = user["web_settings"][page_name][column_name]
     except Exception:
         previous_value = True  # Default value if the setting has not been defined. Anyway, set and unset are tested below
 
@@ -423,7 +407,7 @@ def test_settings_set_and_unset_column_display_good_request(
         assert response.status_code == 200  # Success
 
         # Retrieve the user data
-        D_user = get_db()["users"].find_one({"mila_email_username": user_id})
+        D_user = get_db()["users"].find_one({"mila_email_username": user["mila_email_username"]})
         # Assert the column display value has been modified
         assert D_user["web_settings"]["column_display"][page_name][column_name] == (
             not previous_value
@@ -436,83 +420,101 @@ def test_settings_set_and_unset_column_display_good_request(
     assert response_logout.status_code == 302  # Redirect
 
 
-def test_settings_enable_dark_mode_with_no_user(app, client):
+@pytest.mark.parametrize(
+    "nbr_items_per_page",
+    [13, 2],
+)
+def test_settings_set_nbr_items_per_page_unknown_user(client_with_login, nbr_items_per_page):
+    """
+    Test the function route_set_nbr_items_per_page when sending a zero or
+    negative integer as nbr_items_per_page.
+
+    Parameters:
+    - client                The web client used to send the request. It takes login status into account
+    - nbr_items_per_page    The value to try to set as the preferred number of
+                            items to display per page for the current user
+    """
+    # Define the request to test
+    test_request = (
+        f"/settings/web/nbr_items_per_page/set?nbr_items_per_page={nbr_items_per_page}"
+    )
+
+    # Retrieve the response to the call we are testing
+    response = client_with_login.get(test_request)
+
+    # Check if the response is the expected one
+    assert response.status_code == 302  # Redirect
+
+
+def test_settings_enable_dark_mode_with_no_user(client_with_login):
     """
     Test enabling the dark mode with an unknown user.
 
     Parameters:
-    - app           The scope of our tests, used to set the context (to access MongoDB)
-    - client        The web client to request. Note that this fixture depends on other
-                    fixtures that are going to put the fake data in the database for us
+    - client_with_login     The web client to request. It takes login status into account. Note that
+                            this fixture depends on other fixtures that are going to put the fake
+                            data in the database for us
     """
-    # Use the app context
-    with app.app_context():
-        # Set the dark mode for a user who does not exist to True and get the status code
-        # of the operation (in this case, we have valid setting_key and setting_value)
-        response = client.get(f"/settings/web/dark_mode/set")
+    # Set the dark mode for a user who does not exist to True and get the status code
+    # of the operation (in this case, we have valid setting_key and setting_value)
+    response = client_with_login.get(f"/settings/web/dark_mode/set")
 
-        # Check the status code
-        assert response.status_code == 403
+    # Check the status code
+    assert response.status_code == 302 # Redirect
 
 
-def test_settings_disable_dark_mode_with_no_user(app, client):
+def test_settings_disable_dark_mode_with_no_user(client_with_login):
     """
     Test disabling the dark mode with an unknown user.
 
     Parameters:
-    - app           The scope of our tests, used to set the context (to access MongoDB)
-    - client        The web client to request. Note that this fixture depends on other
-                    fixtures that are going to put the fake data in the database for us
+    - client_with_login     The web client to request. It takes login status into account. Note that
+                            this fixture depends on other fixtures that are going to put the fake
+                            data in the database for us
     """
-    # Use the app context
-    with app.app_context():
-        # Set the dark mode for a user who does not exist to False and get the status code
-        # of the operation (in this case, we have valid setting_key and setting_value)
-        response = client.get(f"/settings/web/dark_mode/unset")
+    # Set the dark mode for a user who does not exist to False and get the status code
+    # of the operation (in this case, we have valid setting_key and setting_value)
+    response = client_with_login.get(f"/settings/web/dark_mode/unset")
 
-        # Check the status code
-        assert response.status_code == 403
+    # Check the status code
+    assert response.status_code == 302 # Redirect
 
 
-def test_settings_set_date_format_with_no_user(app, client):
+def test_settings_set_date_format_with_no_user(client_with_login):
     """
     Test updating the date format with an unknown user.
 
     Parameters:
-    - app           The scope of our tests, used to set the context (to access MongoDB)
-    - client        The web client to request. Note that this fixture depends on other
-                    fixtures that are going to put the fake data in the database for us
-    """
-    # Use the app context
-    with app.app_context():
-        # Set the dark mode for a user who does not exist to True and get the status code
-        # of the operation (in this case, we have valid setting_key and setting_value)
-        date_format = "unix_timestamp"  # Valid date format
-        response = client.get(
-            f"/settings/web/date_format/set?date_format={date_format}"
-        )
+    - client_with_login     The web client to request. It takes login status into account. Note that
+                            this fixture depends on other fixtures that are going to put the fake
+                            data in the database for us
+    """
+    # Set the dark mode for a user who does not exist to True and get the status code
+    # of the operation (in this case, we have valid setting_key and setting_value)
+    date_format = "unix_timestamp"  # Valid date format
+    response = client_with_login.get(
+        f"/settings/web/date_format/set?date_format={date_format}"
+    )
 
-        # Check the status code
-        assert response.status_code == 403
+    # Check the status code
+    assert response.status_code == 302 # Redirect
 
 
-def test_settings_set_time_format_with_no_user(app, client):
+def test_settings_set_time_format_with_no_user(client_with_login):
     """
     Test updating the time format with an unknown user.
 
     Parameters:
-    - app           The scope of our tests, used to set the context (to access MongoDB)
-    - client        The web client to request. Note that this fixture depends on other
-                    fixtures that are going to put the fake data in the database for us
-    """
-    # Use the app context
-    with app.app_context():
-        # Set the dark mode for a user who does not exist to True and get the status code
-        # of the operation (in this case, we have valid setting_key and setting_value)
-        time_format = "24h"  # Valid time format
-        response = client.get(
-            f"/settings/web/time_format/set?time_format={time_format}"
-        )
+    - client_with_login     The web client to request. It takes login status into account. Note that
+                            this fixture depends on other fixtures that are going to put the fake
+                            data in the database for us
+    """
+    # Set the dark mode for a user who does not exist to True and get the status code
+    # of the operation (in this case, we have valid setting_key and setting_value)
+    time_format = "24h"  # Valid time format
+    response = client_with_login.get(
+        f"/settings/web/time_format/set?time_format={time_format}"
+    )
 
-        # Check the status code
-        assert response.status_code == 403  # Forbidden
+    # Check the status code
+    assert response.status_code == 302  # Redirect

From debccb4e153aecfc49c51492449a448bef43f2a5 Mon Sep 17 00:00:00 2001
From: Soline <soline_blanc@outlook.fr>
Date: Thu, 19 Oct 2023 17:01:16 -0400
Subject: [PATCH 2/3] Black reformatting

---
 clockwork_web_test/test_browser_settings.py | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/clockwork_web_test/test_browser_settings.py b/clockwork_web_test/test_browser_settings.py
index 8239289f..2ca7d145 100644
--- a/clockwork_web_test/test_browser_settings.py
+++ b/clockwork_web_test/test_browser_settings.py
@@ -98,7 +98,6 @@ def test_settings_set_nbr_items_per_page_zero_or_negative_value(
     assert response.status_code == 400  # Bad Request
 
 
-
 def test_settings_set_date_format_missing_argument(client, fake_data):
     """
     Test the function route_set_date_format without sending a
@@ -176,7 +175,9 @@ def test_settings_set_date_format_success(client, fake_data, date_format):
     assert response.status_code == 302  # Redirect
 
     # Retrieve the user data
-    D_user = get_db()["users"].find_one({"mila_email_username": user['mila_email_username']})
+    D_user = get_db()["users"].find_one(
+        {"mila_email_username": user["mila_email_username"]}
+    )
     # Assert the date format setting has been modified
     assert D_user["web_settings"]["date_format"] == date_format
 
@@ -407,7 +408,9 @@ def test_settings_set_and_unset_column_display_good_request(
         assert response.status_code == 200  # Success
 
         # Retrieve the user data
-        D_user = get_db()["users"].find_one({"mila_email_username": user["mila_email_username"]})
+        D_user = get_db()["users"].find_one(
+            {"mila_email_username": user["mila_email_username"]}
+        )
         # Assert the column display value has been modified
         assert D_user["web_settings"]["column_display"][page_name][column_name] == (
             not previous_value
@@ -424,7 +427,9 @@ def test_settings_set_and_unset_column_display_good_request(
     "nbr_items_per_page",
     [13, 2],
 )
-def test_settings_set_nbr_items_per_page_unknown_user(client_with_login, nbr_items_per_page):
+def test_settings_set_nbr_items_per_page_unknown_user(
+    client_with_login, nbr_items_per_page
+):
     """
     Test the function route_set_nbr_items_per_page when sending a zero or
     negative integer as nbr_items_per_page.
@@ -460,7 +465,7 @@ def test_settings_enable_dark_mode_with_no_user(client_with_login):
     response = client_with_login.get(f"/settings/web/dark_mode/set")
 
     # Check the status code
-    assert response.status_code == 302 # Redirect
+    assert response.status_code == 302  # Redirect
 
 
 def test_settings_disable_dark_mode_with_no_user(client_with_login):
@@ -477,7 +482,7 @@ def test_settings_disable_dark_mode_with_no_user(client_with_login):
     response = client_with_login.get(f"/settings/web/dark_mode/unset")
 
     # Check the status code
-    assert response.status_code == 302 # Redirect
+    assert response.status_code == 302  # Redirect
 
 
 def test_settings_set_date_format_with_no_user(client_with_login):
@@ -497,7 +502,7 @@ def test_settings_set_date_format_with_no_user(client_with_login):
     )
 
     # Check the status code
-    assert response.status_code == 302 # Redirect
+    assert response.status_code == 302  # Redirect
 
 
 def test_settings_set_time_format_with_no_user(client_with_login):

From 46f4b9bed1a99ac6bd1387ca80453997066f11ba Mon Sep 17 00:00:00 2001
From: Soline <soline_blanc@outlook.fr>
Date: Thu, 19 Oct 2023 17:54:35 -0400
Subject: [PATCH 3/3] Set login_disabled to false in the configuration file

---
 test_config.toml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test_config.toml b/test_config.toml
index dd7d239f..551ddd70 100644
--- a/test_config.toml
+++ b/test_config.toml
@@ -1,6 +1,8 @@
 [flask]
 testing=true
-login_disabled=true
+# login_disabled is set to false in order to test the "true" handling of the anonymous user
+# but it could be changed for testing purposes
+login_disabled=false
 secret_key="testing_secret_key"
 
 [sentry]