+
Codes de récupération 2FA
+
Régénérer tes codes remplace immédiatement les 10 précédents par 10 nouveaux — les anciens ne fonctionneront plus. Les nouveaux codes ne sont affichés qu'une seule fois, juste après.
+
+
Supprimer mon compte
diff --git a/tests/test_profile.py b/tests/test_profile.py
index 85cb3b16..3f6699a5 100644
--- a/tests/test_profile.py
+++ b/tests/test_profile.py
@@ -141,3 +141,123 @@ def test_the_only_admin_account_cannot_be_deleted(client):
assert "administrateur" in resp.get_data(as_text=True)
import tests.conftest as conftest_module
assert auth.get_user_by_id(conftest_module._TEST_ADMIN_ID) is not None
+
+
+def test_regenerate_recovery_codes_requires_correct_password(anon_client):
+ _register(anon_client, "regencodeswrong@example.com")
+ _confirm_2fa(anon_client)
+ try:
+ resp = anon_client.post("/profile/regenerate-recovery-codes", data={"current_password": "wrong"})
+ assert "incorrect" in resp.get_data(as_text=True)
+ finally:
+ _cleanup_project("regencodeswrong@example.com")
+
+
+def test_regenerate_recovery_codes_replaces_the_old_ones_and_shows_them_once(anon_client):
+ _register(anon_client, "regencodesok@example.com")
+ _confirm_2fa(anon_client)
+ user = auth.get_user_by_email("regencodesok@example.com")
+ try:
+ old_codes = auth.generate_recovery_codes(user["id"])
+
+ resp = anon_client.post("/profile/regenerate-recovery-codes", data={"current_password": "Sup3r$ecret!"})
+ html = resp.get_data(as_text=True)
+ assert "recoveryCodesModal" in html
+
+ # Jamais réaffichés sur un chargement suivant.
+ html_again = anon_client.get("/profile").get_data(as_text=True)
+ assert "recoveryCodesModal" not in html_again
+
+ # Les anciens codes ne fonctionnent plus, mais le nouveau lot,
+ # visible dans le modal ci-dessus, doit être réellement stocké en
+ # base — vérifié indirectement via verify_recovery_code : aucun des
+ # anciens codes ne doit plus matcher.
+ for old_code in old_codes:
+ assert not auth.verify_recovery_code(user["id"], old_code)
+ finally:
+ _cleanup_project("regencodesok@example.com")
+
+
+def test_update_email_requires_correct_password(anon_client):
+ _register(anon_client, "emailwrongpw@example.com")
+ _confirm_2fa(anon_client)
+ try:
+ resp = anon_client.post("/profile/update-email", data={"email": "new@example.com", "current_password": "wrong"})
+ assert "incorrect" in resp.get_data(as_text=True)
+ assert auth.get_user_by_email("emailwrongpw@example.com") is not None
+ finally:
+ _cleanup_project("emailwrongpw@example.com")
+
+
+def test_update_email_rejects_invalid_format(anon_client):
+ _register(anon_client, "emailinvalid@example.com")
+ _confirm_2fa(anon_client)
+ try:
+ resp = anon_client.post("/profile/update-email", data={"email": "not-an-email", "current_password": "Sup3r$ecret!"})
+ assert "invalide" in resp.get_data(as_text=True)
+ finally:
+ _cleanup_project("emailinvalid@example.com")
+
+
+def test_update_email_rejects_an_email_already_used(anon_client):
+ _register(anon_client, "emailtaken1@example.com")
+ _confirm_2fa(anon_client)
+ anon_client.post("/logout")
+ _register(anon_client, "emailtaken2@example.com")
+ _confirm_2fa(anon_client)
+ try:
+ resp = anon_client.post("/profile/update-email", data={"email": "emailtaken1@example.com", "current_password": "Sup3r$ecret!"})
+ assert "existe déjà" in resp.get_data(as_text=True)
+ finally:
+ _cleanup_project("emailtaken1@example.com")
+ _cleanup_project("emailtaken2@example.com")
+
+
+def test_update_email_renames_the_user_project_folder(anon_client):
+ import os
+
+ _register(anon_client, "oldmail@example.com")
+ _confirm_2fa(anon_client)
+ old_user = auth.get_user_by_email("oldmail@example.com")
+ old_slug = old_user["project_slug"]
+ assert os.path.isdir(db.game_dir(old_slug))
+ try:
+ resp = anon_client.post("/profile/update-email", data={"email": "newmail@example.com", "current_password": "Sup3r$ecret!"})
+ assert "mise à jour" in resp.get_data(as_text=True)
+
+ assert auth.get_user_by_email("oldmail@example.com") is None
+ new_user = auth.get_user_by_email("newmail@example.com")
+ assert new_user is not None
+ new_slug = new_user["project_slug"]
+ assert new_slug == db.slugify("newmail@example.com")
+ assert not os.path.isdir(db.game_dir(old_slug))
+ assert os.path.isdir(db.game_dir(new_slug))
+
+ # La connexion se fait désormais avec la nouvelle adresse.
+ anon_client.post("/logout")
+ resp = anon_client.post("/login", data={"email": "newmail@example.com", "password": "Sup3r$ecret!"}, follow_redirects=False)
+ assert resp.status_code == 302
+ assert resp.headers["Location"] == "/login/2fa"
+ finally:
+ _cleanup_project("oldmail@example.com")
+ _cleanup_project("newmail@example.com")
+
+
+def test_update_email_for_an_admin_does_not_touch_any_project_folder(client, game):
+ """`client`/`game` (conftest.py) : compte admin, pas de project_slug
+ dédié — changer son adresse ne doit renommer aucun dossier. L'admin de
+ test est PARTAGÉ par toute la session de tests (voir conftest.py) :
+ son adresse est restaurée après coup pour ne pas perturber les autres
+ tests qui s'appuient dessus."""
+ import tests.conftest as conftest_module
+
+ try:
+ resp = client.post("/profile/update-email", data={"email": "newadminmail@example.com", "current_password": "Test1234!"})
+ assert "mise à jour" in resp.get_data(as_text=True)
+
+ user = auth.get_user_by_id(conftest_module._TEST_ADMIN_ID)
+ assert user["email"] == "newadminmail@example.com"
+ assert user["project_slug"] is None
+ assert db.game_meta(game) is not None
+ finally:
+ auth.update_email(conftest_module._TEST_ADMIN_ID, "admin@pytest.local")