santeh-ray/users/tests.py

from django.contrib.auth import get_user_model
from django.contrib.auth.tokens import default_token_generator
from django.core import mail
from django.test import TestCase, override_settings
from django.urls import reverse
from django.utils.encoding import force_bytes
from django.utils.http import urlsafe_base64_encode

User = get_user_model()


@override_settings(EMAIL_BACKEND="django.core.mail.backends.locmem.EmailBackend")
class UserAuthFlowTests(TestCase):
    def test_login_page_renders_without_active_context(self):
        response = self.client.get(reverse("users:login"))

        self.assertEqual(response.status_code, 200)
        self.assertTemplateUsed(response, "users/login.html")
        self.assertNotContains(response, 'name="guest_cart_payload"', html=False)

    def test_registration_creates_inactive_user_and_sends_activation_email(self):
        response = self.client.post(
            reverse("users:register"),
            data={
                "full_name": "Иван Петров",
                "email": "ivan@example.com",
                "password1": "StrongPassword123",
                "password2": "StrongPassword123",
            },
        )

        self.assertEqual(response.status_code, 200)
        user = User.objects.get(email="ivan@example.com")
        self.assertFalse(user.is_active)
        self.assertEqual(user.username, "ivan@example.com")
        self.assertEqual(len(mail.outbox), 1)
        self.assertIn("/users/activate/", mail.outbox[0].body)

    def test_activation_link_activates_user(self):
        user = User.objects.create_user(
            username="anna@example.com",
            email="anna@example.com",
            password="StrongPassword123",
            is_active=False,
        )
        uid = urlsafe_base64_encode(force_bytes(user.pk))
        token = default_token_generator.make_token(user)

        response = self.client.get(reverse("users:activate", kwargs={"uidb64": uid, "token": token}))

        self.assertEqual(response.status_code, 200)
        user.refresh_from_db()
        self.assertTrue(user.is_active)
        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)

    def test_login_with_email_works_for_active_user(self):
        user = User.objects.create_user(
            username="oleg",
            email="oleg@example.com",
            password="StrongPassword123",
            is_active=True,
        )

        response = self.client.post(
            reverse("users:login"),
            data={"email": "oleg@example.com", "password": "StrongPassword123"},
        )

        self.assertRedirects(response, reverse("users:profile"))
        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)

    def test_login_redirects_to_safe_next_url(self):
        user = User.objects.create_user(
            username="cart-user",
            email="cart-user@example.com",
            password="StrongPassword123",
            is_active=True,
        )
        next_url = reverse("orders:cart")

        response = self.client.post(
            f"{reverse('users:login')}?next={next_url}",
            data={"email": "cart-user@example.com", "password": "StrongPassword123", "next": next_url},
        )

        self.assertRedirects(response, next_url)
        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)

    def test_login_ignores_unsafe_next_url(self):
        user = User.objects.create_user(
            username="safe-user",
            email="safe-user@example.com",
            password="StrongPassword123",
            is_active=True,
        )

        response = self.client.post(
            f"{reverse('users:login')}?next=https://example.com/phishing",
            data={
                "email": "safe-user@example.com",
                "password": "StrongPassword123",
                "next": "https://example.com/phishing",
            },
        )

        self.assertRedirects(response, reverse("users:profile"))
        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)

    def test_login_with_email_works_when_username_differs(self):
        user = User.objects.create_user(
            username="oleg-old",
            email="oleg2@example.com",
            password="StrongPassword123",
            is_active=True,
        )

        response = self.client.post(
            reverse("users:login"),
            data={"email": "oleg2@example.com", "password": "StrongPassword123"},
        )

        self.assertRedirects(response, reverse("users:profile"))
        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)

    def test_password_reset_sends_email_for_existing_user(self):
        User.objects.create_user(
            username="maria@example.com",
            email="maria@example.com",
            password="StrongPassword123",
            is_active=True,
        )

        response = self.client.post(
            reverse("users:password_reset"),
            data={"email": "maria@example.com"},
        )

        self.assertRedirects(response, reverse("users:password_reset_done"))
        self.assertEqual(len(mail.outbox), 1)
        self.assertIn("/users/reset/", mail.outbox[0].body)

    def test_registration_page_does_not_render_guest_cart_payload_field(self):
        response = self.client.get(reverse("users:register"))

        self.assertEqual(response.status_code, 200)
        self.assertNotContains(response, 'name="guest_cart_payload"', html=False)