Bump version number to 1.6.3

Make flask-login respect SECURITY_FLASH_MESSAGES

.travis.yml

@@ -3,10 +3,11 @@ language: python
 python:
   - "2.6"
   - "2.7"
+  - "pypy"
 
 install:
   - pip install . --quiet --use-mirrors
-  - "if [[ $TRAVIS_PYTHON_VERSION != '2.7' ]]; then pip install importlib --quiet --use-mirrors; fi"
+  - "if [[ $TRAVIS_PYTHON_VERSION == '2.6' ]]; then pip install importlib --quiet --use-mirrors; fi"
   - pip install nose simplejson Flask-SQLAlchemy Flask-MongoEngine Flask-Peewee Flask-Mail py-bcrypt MySQL-python --quiet --use-mirrors
 
 before_script:

CHANGES

@@ -4,6 +4,30 @@ Flask-Security Changelog
 Here you can see the full list of changes between each Flask-Security release.
 
 
+Version 1.6.3
+-------------
+
+Released May 8th 2013
+
+- Fixed bug in regards to imports with latest version of MongoEngine
+
+
+Version 1.6.2
+-------------
+
+Released April 4th 2013
+
+- Fixed bug with http basic auth
+
+
+Version 1.6.1
+-------------
+
+Released April 3rd 2013
+
+- Fixed bug with signals
+
+
 Version 1.6.0
 -------------
 

docs/conf.py

@@ -49,7 +49,7 @@ copyright = u'2012, Matt Wright'
 # built documents.
 #
 # The short X.Y version.
-version = '1.6.0'
+version = '1.6.3'
 # The full version, including alpha/beta/rc tags.
 release = version
 

docs/index.rst

@@ -21,7 +21,7 @@ and libraries. They include:
 2. `Flask-Mail <http://packages.python.org/Flask-Mail/>`_
 3. `Flask-Principal <http://packages.python.org/Flask-Principal/>`_
 4. `Flask-Script <http://packages.python.org/Flask-Script/>`_
-5. `Flask-WTF <http://packages.python.org/Flask-Mail/>`_
+5. `Flask-WTF <http://packages.python.org/Flask-WTF/>`_
 6. `itsdangerous <http://packages.python.org/itsdangerous/>`_
 7. `passlib <http://packages.python.org/passlib/>`_
 

flask_security/__init__.py

@@ -10,12 +10,12 @@
     :license: MIT, see LICENSE for more details.
 """
 
-__version__ = '1.6.0'
+__version__ = '1.6.3'
 
 from .core import Security, RoleMixin, UserMixin, AnonymousUser, current_user
 from .datastore import SQLAlchemyUserDatastore, MongoEngineUserDatastore, PeeweeUserDatastore
 from .decorators import auth_token_required, http_auth_required, \
-     login_required, roles_accepted, roles_required
+     login_required, roles_accepted, roles_required, auth_required
 from .forms import ForgotPasswordForm, LoginForm, RegisterForm, \
      ResetPasswordForm, PasswordlessLoginForm, ConfirmRegisterForm
 from .signals import confirm_instructions_sent, password_reset, \

flask_security/confirmable.py

@@ -44,7 +44,7 @@ def send_confirmation_instructions(user):
               'confirmation_instructions', user=user,
               confirmation_link=confirmation_link)
 
-    confirm_instructions_sent.send(user, app=app._get_current_object())
+    confirm_instructions_sent.send(app._get_current_object(), user=user)
     return token
 
 
@@ -80,4 +80,4 @@ def confirm_user(user):
     """
     user.confirmed_at = datetime.utcnow()
     _datastore.put(user)
-    user_confirmed.send(user, app=app._get_current_object())
+    user_confirmed.send(app._get_current_object(), user=user)

flask_security/core.py

@@ -179,8 +179,14 @@ def _get_login_manager(app):
     lm.login_view = '%s.login' % cv('BLUEPRINT_NAME', app=app)
     lm.user_loader(_user_loader)
     lm.token_loader(_token_loader)
-    lm.login_message, lm.login_message_category = cv('MSG_LOGIN', app=app)
+
-    lm.needs_refresh_message, lm.needs_refresh_message_category = cv('MSG_REFRESH', app=app)
+    if cv('FLASH_MESSAGES', app=app):
+        lm.login_message, lm.login_message_category = cv('MSG_LOGIN', app=app)
+        lm.needs_refresh_message, lm.needs_refresh_message_category = cv('MSG_REFRESH', app=app)
+    else:
+        lm.login_message = None
+        lm.needs_refresh_message = None
+
     lm.init_app(app)
     return lm
 
@@ -241,8 +247,7 @@ class RoleMixin(object):
                 self.name == getattr(other, 'name', None))
 
     def __ne__(self, other):
-        return (self.name != other and
+        return not self.__eq__(other)
-                self.name != getattr(other, 'name', None))
 
 
 class UserMixin(BaseUserMixin):
@@ -261,7 +266,10 @@ class UserMixin(BaseUserMixin):
         """Returns `True` if the user identifies with the specified role.
 
         :param role: A role name or `Role` instance"""
-        return role in self.roles
+        if isinstance(role, basestring):
+            return role in (role.name for role in self.roles)
+        else:
+            return role in self.roles
 
 
 class AnonymousUser(AnonymousUserBase):

flask_security/datastore.py

@@ -95,12 +95,11 @@ class UserDatastore(object):
         :param user: The user to manipulate
         :param role: The role to add to the user
         """
-        rv = False
         user, role = self._prepare_role_modify_args(user, role)
         if role not in user.roles:
-            rv = True
             user.roles.append(role)
-        return rv
+            return True
+        return False
 
     def remove_role_from_user(self, user, role):
         """Removes a role from a user
@@ -191,7 +190,14 @@ class MongoEngineUserDatastore(MongoEngineDatastore, UserDatastore):
         UserDatastore.__init__(self, user_model, role_model)
 
     def find_user(self, **kwargs):
-        return self.user_model.objects(**kwargs).first()
+        try:
+            from mongoengine.queryset import Q, QCombination
+        except ImportError:
+            from mongoengine.queryset.visitor import Q, QCombination
+
+        queries = map(lambda i: Q(**{i[0]: i[1]}), kwargs.items())
+        query = QCombination(QCombination.AND, queries)
+        return self.user_model.objects(query).first()
 
     def find_role(self, role):
         return self.role_model.objects(name=role).first()
@@ -217,10 +223,7 @@ class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
             return None
 
     def find_role(self, role):
-        try:
+        return self.role_model.filter(name=role).get()
-            return self.role_model.filter(name=role).get()
-        except self.role_model.DoesNotExist:
-            return None
 
     def create_user(self, **kwargs):
         """Creates and returns a new user from the given parameters."""
@@ -231,7 +234,6 @@ class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
             self.add_role_to_user(user, role)
         return user
 
-
     def add_role_to_user(self, user, role):
         """Adds a role tp a user
 
@@ -239,10 +241,12 @@ class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
         :param role: The role to add to the user
         """
         user, role = self._prepare_role_modify_args(user, role)
-        if self.UserRole.select().where(self.UserRole.user==user, self.UserRole.role==role).count():
+        result = self.UserRole.select() \
+            .where(self.UserRole.user == user.id, self.UserRole.role == role.id)
+        if result.count():
             return False
         else:
-            self.UserRole.create(user=user, role=role)
+            self.UserRole.create(user=user.id, role=role.id)
             return True
 
     def remove_role_from_user(self, user, role):
@@ -252,9 +256,11 @@ class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
         :param role: The role to remove from the user
         """
         user, role = self._prepare_role_modify_args(user, role)
-        if self.UserRole.select().where(self.UserRole.user==user, self.UserRole.role==role).count():
+        result = self.UserRole.select() \
-            self.UserRole.delete().where(self.UserRole.user==user, self.UserRole.role==role)
+            .where(self.UserRole.user == user, self.UserRole.role == role)
+        if result.count():
+            self.UserRole.delete().where(
+                self.UserRole.user == user, self.UserRole.role == role)
             return True
         else:
             return False
-

flask_security/decorators.py

@@ -9,6 +9,7 @@
     :license: MIT, see LICENSE for more details.
 """
 
+from collections import namedtuple
 from functools import wraps
 
 from flask import current_app, Response, request, redirect, _request_ctx_stack
@@ -30,6 +31,8 @@ _default_unauthorized_html = """
     or your browser doesn't understand how to supply the credentials required.</p>
     """
 
+BasicAuth = namedtuple('BasicAuth', 'username, password')
+
 
 def _get_unauthorized_response(text=None, headers=None):
     text = text or _default_unauthorized_html
@@ -67,7 +70,7 @@ def _check_token():
 
 
 def _check_http_auth():
-    auth = request.authorization or dict(username=None, password=None)
+    auth = request.authorization or BasicAuth(username=None, password=None)
     user = _security.datastore.find_user(email=auth.username)
 
     if user and utils.verify_and_update_password(auth.password, user):

flask_security/passwordless.py

@@ -36,8 +36,8 @@ def send_login_instructions(user):
     send_mail(config_value('EMAIL_SUBJECT_PASSWORDLESS'), user.email,
               'login_instructions', user=user, login_link=login_link)
 
-    login_instructions_sent.send(dict(user=user, login_token=token),
+    login_instructions_sent.send(app._get_current_object(),
-                                 app=app._get_current_object())
+                                 user=user, login_token=token)
 
 
 def generate_login_token(user):

flask_security/recoverable.py

@@ -36,8 +36,8 @@ def send_reset_password_instructions(user):
               'reset_instructions',
               user=user, reset_link=reset_link)
 
-    reset_password_instructions_sent.send(dict(user=user, token=token),
+    reset_password_instructions_sent.send(app._get_current_object(),
-                                          app=app._get_current_object())
+                                          user=user, token=token)
 
 
 def send_password_reset_notice(user):
@@ -77,4 +77,4 @@ def update_password(user, password):
     user.password = encrypt_password(password)
     _datastore.put(user)
     send_password_reset_notice(user)
-    password_reset.send(user, app=app._get_current_object())
+    password_reset.send(app._get_current_object(), user=user)

flask_security/registerable.py

@@ -33,8 +33,8 @@ def register_user(**kwargs):
         confirmation_link, token = generate_confirmation_link(user)
         do_flash(*get_message('CONFIRM_REGISTRATION', email=user.email))
 
-    user_registered.send(dict(user=user, confirm_token=token),
+    user_registered.send(app._get_current_object(),
-                         app=app._get_current_object())
+                         user=user, confirm_token=token)
 
     if config_value('SEND_REGISTER_EMAIL'):
         send_mail(config_value('EMAIL_SUBJECT_REGISTER'), user.email, 'welcome',

flask_security/utils.py

@@ -273,7 +273,7 @@ def get_token_status(token, serializer, max_age=None):
 def capture_passwordless_login_requests():
     login_requests = []
 
-    def _on(data, app):
+    def _on(app, **data):
         login_requests.append(data)
 
     login_instructions_sent.connect(_on)
@@ -293,7 +293,7 @@ def capture_registrations():
     """
     registrations = []
 
-    def _on(data, app):
+    def _on(app, **data):
         registrations.append(data)
 
     user_registered.connect(_on)
@@ -313,8 +313,8 @@ def capture_reset_password_requests(reset_password_sent_at=None):
     """
     reset_requests = []
 
-    def _on(request, app):
+    def _on(app, **data):
-        reset_requests.append(request)
+        reset_requests.append(data)
 
     reset_password_instructions_sent.connect(_on)
 

setup.py

@@ -20,7 +20,7 @@ from setuptools import setup
 
 setup(
     name='Flask-Security',
-    version='1.6.0',
+    version='1.6.3',
     url='https://github.com/mattupstate/flask-security',
     license='MIT',
     author='Matt Wright',

tests/functional_tests.py

@@ -142,6 +142,13 @@ class DefaultSecurityTests(SecurityTest):
         })
         self.assertIn('HTTP Authentication', r.data)
 
+    def test_http_auth_no_authorization(self):
+        r = self._get('/http', headers={})
+        self.assertIn('<h1>Unauthorized</h1>', r.data)
+        self.assertIn('WWW-Authenticate', r.headers)
+        self.assertEquals('Basic realm="Login Required"',
+                          r.headers['WWW-Authenticate'])
+
     def test_invalid_http_auth_invalid_username(self):
         r = self._get('/http', headers={
             'Authorization': 'Basic ' + base64.b64encode("bogus:bogus")
@@ -224,11 +231,11 @@ class MongoEngineSecurityTests(DefaultSecurityTests):
         return create_app(auth_config, **kwargs)
 
 
-# class PeeweeSecurityTests(DefaultSecurityTests):
+class PeeweeSecurityTests(DefaultSecurityTests):
 
-#     def _create_app(self, auth_config, **kwargs):
+    def _create_app(self, auth_config, **kwargs):
-#         from tests.test_app.peewee_app import create_app
+        from tests.test_app.peewee_app import create_app
-#         return create_app(auth_config, **kwargs)
+        return create_app(auth_config, **kwargs)
 
 
 class DefaultDatastoreTests(SecurityTest):

tests/signals_tests.py

@@ -31,9 +31,9 @@ class RegisterableSignalsTests(SecurityTest):
         calls = mocks[user_registered]
         self.assertEqual(len(calls), 1)
         args, kwargs = calls[0]
-        self.assertTrue(compare_user(args[0]['user'], user))
+        self.assertTrue(compare_user(kwargs['user'], user))
-        self.assertIn('confirm_token', args[0])
+        self.assertIn('confirm_token', kwargs)
-        self.assertEqual(kwargs['app'], self.app)
+        self.assertEqual(args[0], self.app)
 
     def test_register_without_password(self):
         e = 'dude@lp.com'
@@ -61,8 +61,8 @@ class ConfirmableSignalsTests(SecurityTest):
         calls = mocks[user_confirmed]
         self.assertEqual(len(calls), 1)
         args, kwargs = calls[0]
-        self.assertEqual(args[0].id, user.id)
+        self.assertEqual(args[0], self.app)
-        self.assertEqual(kwargs['app'], self.app)
+        self.assertTrue(compare_user(kwargs['user'], user))
 
     def test_confirm_bad_token(self):
         e = 'dude@lp.com'
@@ -94,8 +94,8 @@ class ConfirmableSignalsTests(SecurityTest):
         calls = mocks[confirm_instructions_sent]
         self.assertEqual(len(calls), 1)
         args, kwargs = calls[0]
-        self.assertTrue(compare_user(args[0], user))
+        self.assertTrue(compare_user(kwargs['user'], user))
-        self.assertEqual(kwargs['app'], self.app)
+        self.assertEqual(args[0], self.app)
 
     def test_send_confirmation_bad_email(self):
         with capture_signals() as mocks:
@@ -120,9 +120,9 @@ class RecoverableSignalsTests(SecurityTest):
         calls = mocks[reset_password_instructions_sent]
         self.assertEqual(len(calls), 1)
         args, kwargs = calls[0]
-        self.assertTrue(compare_user(args[0]['user'], user))
+        self.assertTrue(compare_user(kwargs['user'], user))
-        self.assertIn('token', args[0])
+        self.assertIn('token', kwargs)
-        self.assertEqual(kwargs['app'], self.app)
+        self.assertEqual(args[0], self.app)
 
     def test_reset_password(self):
         with capture_reset_password_requests() as requests:
@@ -137,8 +137,8 @@ class RecoverableSignalsTests(SecurityTest):
         calls = mocks[password_reset]
         self.assertEqual(len(calls), 1)
         args, kwargs = calls[0]
-        self.assertTrue(compare_user(args[0], user))
+        self.assertTrue(compare_user(kwargs['user'], user))
-        self.assertEqual(kwargs['app'], self.app)
+        self.assertEqual(args[0], self.app)
 
     def test_reset_password_invalid_emails(self):
         with capture_signals() as mocks:
@@ -233,6 +233,6 @@ class PasswordlessTests(SecurityTest):
         calls = mocks[login_instructions_sent]
         self.assertEqual(len(calls), 1)
         args, kwargs = calls[0]
-        self.assertTrue(compare_user(args[0]['user'], user))
+        self.assertTrue(compare_user(kwargs['user'], user))
-        self.assertIn('login_token', args[0])
+        self.assertIn('login_token', kwargs)
-        self.assertEqual(kwargs['app'], self.app)
+        self.assertEqual(args[0], self.app)

tests/test_app/peewee_app.py

@@ -14,11 +14,12 @@ from flask.ext.security import Security, UserMixin, RoleMixin, \
 from tests.test_app import create_app as create_base_app, populate_data, \
      add_context_processors
 
+
 def create_app(config, **kwargs):
     app = create_base_app(config)
     app.config['DATABASE'] = {
         'name': 'example2.db',
-        'engine': 'peewee.SqliteDatabase',
+        'engine': 'peewee.SqliteDatabase'
     }
     db = Database(app)