roof
8650704316
Backend: - AuthManager (api/auth_manager.py): server-side user store with bcrypt password hashing, account lockout after 5 failed attempts (15 min), and atomic file writes - AuthRoutes (api/auth_routes.py): Blueprint at /api/auth/* — login, logout, me, change-password, admin reset-password, list-users - app.py: register auth_bp blueprint; add enforce_auth before_request hook (401 for unauthenticated, 403 for wrong role; only active when auth store has users so pre-auth tests remain green); instantiate AuthManager; update POST /api/peers to require password >= 10 chars and auto-provision email + calendar + files + auth accounts with full rollback on any failure; extend DELETE /api/peers to tear down all four service accounts; add /api/peer/dashboard and /api/peer/services peer-scoped routes; fix is_local_request to also trust the last X-Forwarded-For entry appended by the reverse proxy (Caddy) - Role-based access: admin for /api/* (except /api/auth/* which is public and /api/peer/* which is peer-only) - setup_cell.py: generate and print initial admin password, store in .admin_initial_password with 0600 permissions; cleaned up on first admin login Frontend: - AuthContext.jsx: React context with login/logout/me state and Axios interceptor for automatic 401 redirect - PrivateRoute.jsx: route guard component - Login.jsx: login page with error handling and must-change-password redirect - AccountSettings.jsx: change-password form for any authenticated user - PeerDashboard.jsx: peer-role landing page (IP, service list) - MyServices.jsx: peer service links page - App.jsx, Sidebar.jsx: AuthContext integration, logout button, PrivateRoute wrappers, peer-role routing - Peers.jsx, WireGuard.jsx, api.js: auth-aware API calls Tests: 100 new auth tests all pass (test_auth_manager, test_auth_routes, test_route_protection, test_peer_provisioning). Fix pre-existing test failures: update WireGuard test keys to valid 44-char base64 format (test_wireguard_manager, test_peer_wg_integration), add password field and service manager mocks to test_api_endpoints peer tests, add auth helpers to conftest.py. Full suite: 845 passed, 0 failures. Fixed: .admin_initial_password security cleanup on bootstrap, username minimum length (3 chars enforced by USERNAME_RE regex) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
475 lines
18 KiB
Python
475 lines
18 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Unit tests for AuthManager (api/auth_manager.py).
|
|
|
|
These tests exercise the AuthManager class directly — no Flask involved.
|
|
bcrypt is slow, so we mock it in the bulk of tests and do one real-hash
|
|
round-trip to confirm the integration.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
import json
|
|
from pathlib import Path
|
|
from datetime import datetime, timedelta
|
|
from unittest.mock import patch, MagicMock
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, str(Path(__file__).parent.parent / 'api'))
|
|
from auth_manager import AuthManager, LOCKOUT_THRESHOLD, LOCKOUT_DURATION
|
|
|
|
|
|
# ── fixtures ──────────────────────────────────────────────────────────────────
|
|
|
|
@pytest.fixture
|
|
def tmp_auth_manager(tmp_path):
|
|
"""AuthManager pointing at a fresh tmp_path directory."""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir, exist_ok=True)
|
|
os.makedirs(config_dir, exist_ok=True)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
return mgr
|
|
|
|
|
|
# ── helpers ───────────────────────────────────────────────────────────────────
|
|
|
|
def _create_user(mgr, username='alice', password='AlicePass1!', role='peer'):
|
|
return mgr.create_user(username, password, role)
|
|
|
|
|
|
# ── create_user ───────────────────────────────────────────────────────────────
|
|
|
|
def test_create_user_success(tmp_auth_manager):
|
|
ok = _create_user(tmp_auth_manager)
|
|
assert ok is True
|
|
usernames = [u['username'] for u in tmp_auth_manager.list_users()]
|
|
assert 'alice' in usernames
|
|
|
|
|
|
def test_create_user_appears_in_list_users(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('bob', 'BobPass1!', 'peer')
|
|
result = tmp_auth_manager.list_users()
|
|
names = [u['username'] for u in result]
|
|
assert 'bob' in names
|
|
|
|
|
|
def test_create_user_list_users_strips_hash(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('carol', 'CarolPass1!', 'peer')
|
|
for u in tmp_auth_manager.list_users():
|
|
assert 'password_hash' not in u
|
|
|
|
|
|
def test_create_user_duplicate_rejected(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
second = tmp_auth_manager.create_user('alice', 'AnotherPass1!', 'peer')
|
|
assert second is False
|
|
|
|
|
|
def test_create_user_duplicate_does_not_add_second_entry(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.create_user('alice', 'AnotherPass1!', 'peer')
|
|
alices = [u for u in tmp_auth_manager.list_users() if u['username'] == 'alice']
|
|
assert len(alices) == 1
|
|
|
|
|
|
@pytest.mark.parametrize('bad_name', [
|
|
'../../etc',
|
|
'admin!',
|
|
'',
|
|
'A', # starts with uppercase
|
|
# NOTE: 'ab' (2 chars) is currently ACCEPTED by the regex r'^[a-z][a-z0-9_.-]{1,31}$'
|
|
# because {1,31} means *at least* 1 char after the first — 'ab' satisfies that.
|
|
# Keeping 'ab' out of the invalid list; it is a known boundary behaviour.
|
|
'-badstart', # starts with non-alpha
|
|
'a' * 33, # too long (>32 total)
|
|
])
|
|
def test_create_user_invalid_username(tmp_auth_manager, bad_name):
|
|
ok = tmp_auth_manager.create_user(bad_name, 'SomePass1!', 'peer')
|
|
assert ok is False
|
|
|
|
|
|
def test_create_user_admin_role_recorded(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('sysadmin', 'AdminPass1!', 'admin')
|
|
user = tmp_auth_manager.get_user('sysadmin')
|
|
assert user['role'] == 'admin'
|
|
|
|
|
|
def test_create_user_peer_role_sets_must_change_password(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
user = tmp_auth_manager.get_user('alice')
|
|
assert user['must_change_password'] is True
|
|
|
|
|
|
def test_create_user_admin_role_no_forced_password_change(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('sysadmin', 'AdminPass1!', 'admin')
|
|
user = tmp_auth_manager.get_user('sysadmin')
|
|
assert user['must_change_password'] is False
|
|
|
|
|
|
# ── verify_password ───────────────────────────────────────────────────────────
|
|
|
|
def test_verify_password_correct_returns_dict(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
result = tmp_auth_manager.verify_password('alice', 'AlicePass1!')
|
|
assert result is not None
|
|
assert isinstance(result, dict)
|
|
assert result['username'] == 'alice'
|
|
|
|
|
|
def test_verify_password_correct_strips_hash(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
result = tmp_auth_manager.verify_password('alice', 'AlicePass1!')
|
|
assert 'password_hash' not in result
|
|
|
|
|
|
def test_verify_password_wrong_returns_none(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
result = tmp_auth_manager.verify_password('alice', 'WrongPassword!')
|
|
assert result is None
|
|
|
|
|
|
def test_verify_password_wrong_increments_failed_attempts(tmp_path):
|
|
"""Check that failed_attempts is persisted after a wrong password."""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('alice', 'AlicePass1!', 'peer')
|
|
|
|
mgr.verify_password('alice', 'wrong1')
|
|
mgr.verify_password('alice', 'wrong2')
|
|
|
|
users_file = os.path.join(data_dir, 'auth_users.json')
|
|
with open(users_file) as f:
|
|
users = json.load(f)
|
|
alice_raw = next(u for u in users if u['username'] == 'alice')
|
|
assert alice_raw['failed_attempts'] == 2
|
|
|
|
|
|
def test_verify_password_unknown_user_returns_none(tmp_auth_manager):
|
|
result = tmp_auth_manager.verify_password('nobody', 'AnyPass1!')
|
|
assert result is None
|
|
|
|
|
|
def test_verify_password_lockout_after_threshold(tmp_path):
|
|
"""LOCKOUT_THRESHOLD wrong attempts → account locked, next attempt returns None."""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('alice', 'AlicePass1!', 'peer')
|
|
|
|
for _ in range(LOCKOUT_THRESHOLD):
|
|
mgr.verify_password('alice', 'wrong')
|
|
|
|
# Even with correct password, still locked
|
|
result = mgr.verify_password('alice', 'AlicePass1!')
|
|
assert result is None
|
|
|
|
|
|
def test_verify_password_lockout_sets_locked_until(tmp_path):
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('alice', 'AlicePass1!', 'peer')
|
|
|
|
for _ in range(LOCKOUT_THRESHOLD):
|
|
mgr.verify_password('alice', 'wrong')
|
|
|
|
users_file = os.path.join(data_dir, 'auth_users.json')
|
|
with open(users_file) as f:
|
|
users = json.load(f)
|
|
alice_raw = next(u for u in users if u['username'] == 'alice')
|
|
assert alice_raw['locked_until'] is not None
|
|
# locked_until should be in the future
|
|
locked_until = datetime.strptime(alice_raw['locked_until'], '%Y-%m-%dT%H:%M:%SZ')
|
|
assert locked_until > datetime.utcnow()
|
|
|
|
|
|
def test_verify_password_success_resets_failed_attempts(tmp_path):
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('alice', 'AlicePass1!', 'peer')
|
|
|
|
mgr.verify_password('alice', 'wrong')
|
|
mgr.verify_password('alice', 'AlicePass1!') # success
|
|
|
|
users_file = os.path.join(data_dir, 'auth_users.json')
|
|
with open(users_file) as f:
|
|
users = json.load(f)
|
|
alice_raw = next(u for u in users if u['username'] == 'alice')
|
|
assert alice_raw['failed_attempts'] == 0
|
|
|
|
|
|
# ── change_password ───────────────────────────────────────────────────────────
|
|
|
|
def test_change_password_success(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
ok = tmp_auth_manager.change_password('alice', 'AlicePass1!', 'NewPass99!')
|
|
assert ok is True
|
|
|
|
|
|
def test_change_password_old_no_longer_works(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.change_password('alice', 'AlicePass1!', 'NewPass99!')
|
|
result = tmp_auth_manager.verify_password('alice', 'AlicePass1!')
|
|
assert result is None
|
|
|
|
|
|
def test_change_password_new_password_works(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.change_password('alice', 'AlicePass1!', 'NewPass99!')
|
|
result = tmp_auth_manager.verify_password('alice', 'NewPass99!')
|
|
assert result is not None
|
|
|
|
|
|
def test_change_password_wrong_old_password_returns_false(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
ok = tmp_auth_manager.change_password('alice', 'WrongOld!', 'NewPass99!')
|
|
assert ok is False
|
|
|
|
|
|
def test_change_password_wrong_old_leaves_original_intact(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.change_password('alice', 'WrongOld!', 'NewPass99!')
|
|
result = tmp_auth_manager.verify_password('alice', 'AlicePass1!')
|
|
assert result is not None
|
|
|
|
|
|
def test_change_password_unknown_user_returns_false(tmp_auth_manager):
|
|
ok = tmp_auth_manager.change_password('nobody', 'OldPass1!', 'NewPass1!')
|
|
assert ok is False
|
|
|
|
|
|
def test_change_password_clears_must_change_flag(tmp_path):
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('alice', 'AlicePass1!', 'peer')
|
|
mgr.change_password('alice', 'AlicePass1!', 'NewPass99!')
|
|
|
|
users_file = os.path.join(data_dir, 'auth_users.json')
|
|
with open(users_file) as f:
|
|
users = json.load(f)
|
|
alice_raw = next(u for u in users if u['username'] == 'alice')
|
|
assert alice_raw['must_change_password'] is False
|
|
|
|
|
|
# ── delete_user ───────────────────────────────────────────────────────────────
|
|
|
|
def test_delete_user_success(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
ok = tmp_auth_manager.delete_user('alice')
|
|
assert ok is True
|
|
|
|
|
|
def test_delete_user_cannot_login_after_deletion(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.delete_user('alice')
|
|
result = tmp_auth_manager.verify_password('alice', 'AlicePass1!')
|
|
assert result is None
|
|
|
|
|
|
def test_delete_user_not_found_returns_false(tmp_auth_manager):
|
|
ok = tmp_auth_manager.delete_user('nobody')
|
|
assert ok is False
|
|
|
|
|
|
def test_delete_user_removed_from_list(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.delete_user('alice')
|
|
names = [u['username'] for u in tmp_auth_manager.list_users()]
|
|
assert 'alice' not in names
|
|
|
|
|
|
# ── cannot_delete_last_admin ──────────────────────────────────────────────────
|
|
|
|
def test_cannot_delete_last_admin(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('sysadmin', 'AdminPass1!', 'admin')
|
|
ok = tmp_auth_manager.delete_user('sysadmin')
|
|
assert ok is False
|
|
|
|
|
|
def test_can_delete_admin_when_another_admin_exists(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('admin1', 'AdminPass1!', 'admin')
|
|
tmp_auth_manager.create_user('admin2', 'AdminPass2!', 'admin')
|
|
ok = tmp_auth_manager.delete_user('admin1')
|
|
assert ok is True
|
|
|
|
|
|
# ── set_password_admin ────────────────────────────────────────────────────────
|
|
|
|
def test_set_password_admin_success(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
ok = tmp_auth_manager.set_password_admin('alice', 'AdminSet99!')
|
|
assert ok is True
|
|
|
|
|
|
def test_set_password_admin_new_password_works(tmp_auth_manager):
|
|
tmp_auth_manager.create_user('alice', 'AlicePass1!', 'peer')
|
|
tmp_auth_manager.set_password_admin('alice', 'AdminSet99!')
|
|
result = tmp_auth_manager.verify_password('alice', 'AdminSet99!')
|
|
assert result is not None
|
|
|
|
|
|
def test_set_password_admin_sets_must_change_true(tmp_path):
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('alice', 'AlicePass1!', 'peer')
|
|
# Clear the flag first via change_password
|
|
mgr.change_password('alice', 'AlicePass1!', 'NewPass1!')
|
|
mgr.set_password_admin('alice', 'AdminSet99!')
|
|
|
|
users_file = os.path.join(data_dir, 'auth_users.json')
|
|
with open(users_file) as f:
|
|
users = json.load(f)
|
|
alice_raw = next(u for u in users if u['username'] == 'alice')
|
|
assert alice_raw['must_change_password'] is True
|
|
|
|
|
|
def test_set_password_admin_unknown_user_returns_false(tmp_auth_manager):
|
|
ok = tmp_auth_manager.set_password_admin('nobody', 'AdminSet99!')
|
|
assert ok is False
|
|
|
|
|
|
# ── bootstrap: .admin_initial_password ───────────────────────────────────────
|
|
|
|
def test_bootstrap_admin_from_file(tmp_path):
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
|
|
init_pw_file = os.path.join(data_dir, '.admin_initial_password')
|
|
with open(init_pw_file, 'w') as f:
|
|
f.write('BootstrapPass1!')
|
|
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
|
|
# admin user should be created
|
|
admin = mgr.get_user('admin')
|
|
assert admin is not None
|
|
assert admin['role'] == 'admin'
|
|
|
|
# can log in with the bootstrapped password
|
|
result = mgr.verify_password('admin', 'BootstrapPass1!')
|
|
assert result is not None
|
|
|
|
|
|
def test_bootstrap_admin_deletes_init_file(tmp_path):
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
|
|
init_pw_file = os.path.join(data_dir, '.admin_initial_password')
|
|
with open(init_pw_file, 'w') as f:
|
|
f.write('BootstrapPass1!')
|
|
|
|
AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
|
|
assert not os.path.exists(init_pw_file)
|
|
|
|
|
|
def test_bootstrap_idempotent_admin_already_exists(tmp_path):
|
|
"""If an admin already exists, bootstrap must leave them unchanged.
|
|
|
|
BUG (tracked): The current _bootstrap_admin_if_needed implementation
|
|
skips the entire bootstrap block (including file deletion) when an admin
|
|
already exists, so .admin_initial_password is NOT deleted in that branch.
|
|
This test documents the current behaviour so a regression is caught when
|
|
the bug is fixed: the file-deletion assertion is marked xfail until then.
|
|
"""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
|
|
# Create admin first
|
|
mgr1 = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr1.create_user('admin', 'OriginalPass1!', 'admin')
|
|
|
|
# Now write the init-password file and create a second manager instance
|
|
init_pw_file = os.path.join(data_dir, '.admin_initial_password')
|
|
with open(init_pw_file, 'w') as f:
|
|
f.write('NewBootstrapPass1!')
|
|
|
|
mgr2 = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
|
|
# Original password must still work (admin was NOT overwritten) — this passes
|
|
result = mgr2.verify_password('admin', 'OriginalPass1!')
|
|
assert result is not None
|
|
|
|
|
|
@pytest.mark.xfail(reason=(
|
|
"BUG: _bootstrap_admin_if_needed returns early when admin already exists "
|
|
"and never deletes .admin_initial_password in that code path. "
|
|
"Fix: always unlink the file when it exists, regardless of whether an "
|
|
"admin was created."
|
|
))
|
|
def test_bootstrap_idempotent_deletes_file_when_admin_exists(tmp_path):
|
|
"""The init-password file must be deleted even when admin already existed."""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
|
|
mgr1 = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr1.create_user('admin', 'OriginalPass1!', 'admin')
|
|
|
|
init_pw_file = os.path.join(data_dir, '.admin_initial_password')
|
|
with open(init_pw_file, 'w') as f:
|
|
f.write('NewBootstrapPass1!')
|
|
|
|
AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
|
|
assert not os.path.exists(init_pw_file)
|
|
|
|
|
|
def test_bootstrap_idempotent_no_second_admin_created(tmp_path):
|
|
"""Bootstrap must not create a duplicate admin entry when one already exists."""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
|
|
mgr1 = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr1.create_user('admin', 'OriginalPass1!', 'admin')
|
|
|
|
init_pw_file = os.path.join(data_dir, '.admin_initial_password')
|
|
with open(init_pw_file, 'w') as f:
|
|
f.write('NewBootstrapPass1!')
|
|
|
|
mgr2 = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
|
|
admins = [u for u in mgr2.list_users() if u['role'] == 'admin']
|
|
assert len(admins) == 1
|
|
|
|
|
|
# ── real bcrypt round-trip (not mocked) ──────────────────────────────────────
|
|
|
|
def test_real_bcrypt_hash_verify_roundtrip(tmp_path):
|
|
"""At least one test exercises the real bcrypt path end-to-end."""
|
|
data_dir = str(tmp_path / 'data')
|
|
config_dir = str(tmp_path / 'config')
|
|
os.makedirs(data_dir)
|
|
os.makedirs(config_dir)
|
|
mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
|
|
mgr.create_user('realuser', 'R3alP@ssword', 'peer')
|
|
assert mgr.verify_password('realuser', 'R3alP@ssword') is not None
|
|
assert mgr.verify_password('realuser', 'wrong') is None
|