kunthawat/sales-trainer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add username-based login + mandatory first-time admin setup; push-ready

Browse Source 
- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.
This commit is contained in:
Macky
2026-08-07 17:56:59 +07:00
parent eadf4f727a
commit e8a95bf561
16 changed files with 349 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/scripts/test_e2e.py
View File

@@ -28,7 +28,7 @@ def main():
client = app.test_client()
# admin login
r = client.post("/api/auth/login", json={"email": "admin@salestrainer.local", "password": "admin123"})
r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
AT = r.get_json()["token"]
AH = {"Authorization": f"Bearer {AT}"}
@@ -57,8 +57,8 @@ def main():
# create a trainee
client.post("/api/admin/users", json={
"name": "Trainee", "email": "t@x.com", "password": "pass123", "role": "user"}, headers=AH)
r = client.post("/api/auth/login", json={"email": "t@x.com", "password": "pass123"})
"name": "Trainee", "username": "trainee9", "password": "pass123", "role": "user"}, headers=AH)
r = client.post("/api/auth/login", json={"username": "trainee9", "password": "pass123"})
UT = r.get_json()["token"]
UH = {"Authorization": f"Bearer {UT}"}

20
backend/scripts/test_m0.py
View File

@@ -36,10 +36,10 @@ def main() -> None:
assert r.status_code == 404, f"register should not exist, got {r.status_code}"
print("[ok] no self-registration (register -> 404)")
# 3. Bootstrap super-admin login
# 3. Bootstrap super-admin login (username admin / 1234)
r = client.post(
"/api/auth/login",
json={"email": "admin@salestrainer.local", "password": "admin123"},
json={"username": "admin", "password": "1234"},
)
assert r.status_code == 200, r.get_json()
admin_token = r.get_json()["token"]
@@ -54,14 +54,14 @@ def main() -> None:
# 5. Create a regular user (admin)
r = client.post(
"/api/admin/users",
json={"name": "Trainee One", "email": "t1@x.com", "password": "pass123", "role": "user"},
json={"name": "Trainee One", "username": "trainee1", "password": "pass123", "role": "user"},
headers={"Authorization": f"Bearer {admin_token}"},
)
assert r.status_code == 201, r.get_json()
print("[ok] admin creates user")
# 6. Trainee login + cannot access admin users list (403)
r = client.post("/api/auth/login", json={"email": "t1@x.com", "password": "pass123"})
r = client.post("/api/auth/login", json={"username": "trainee1", "password": "pass123"})
user_token = r.get_json()["token"]
r = client.get("/api/admin/users", headers={"Authorization": f"Bearer {user_token}"})
assert r.status_code == 403, f"trainee should be denied, got {r.status_code}"
@@ -76,29 +76,29 @@ def main() -> None:
# create an 'admin' actor first
client.post(
"/api/admin/users",
json={"name": "Admin Two", "email": "a2@x.com", "password": "pass123", "role": "admin"},
json={"name": "Admin Two", "username": "admin2", "password": "pass123", "role": "admin"},
headers={"Authorization": f"Bearer {admin_token}"},
)
r = client.post(
"/api/auth/login", json={"email": "a2@x.com", "password": "pass123"}
"/api/auth/login", json={"username": "admin2", "password": "pass123"}
)
admin2_token = r.get_json()["token"]
r = client.post(
"/api/admin/users",
json={"name": "Bogus Admin", "email": "ba@x.com", "password": "pass123", "role": "super_admin"},
json={"name": "Bogus Admin", "username": "bogus", "password": "pass123", "role": "super_admin"},
headers={"Authorization": f"Bearer {admin2_token}"},
)
assert r.status_code == 403, f"admin should not promote, got {r.status_code}"
print("[ok] admin cannot grant super_admin (403)")
# 9. Duplicate email rejected
# 9. Duplicate username rejected
r = client.post(
"/api/admin/users",
json={"name": "Dup", "email": "t1@x.com", "password": "pass123", "role": "user"},
json={"name": "Dup", "username": "trainee1", "password": "pass123", "role": "user"},
headers={"Authorization": f"Bearer {admin_token}"},
)
assert r.status_code == 400
print("[ok] duplicate email rejected (400)")
print("[ok] duplicate username rejected (400)")
print("\nALL M0 TESTS PASSED")

6
backend/scripts/test_m1.py
View File

@@ -29,7 +29,7 @@ def main():
# login as super-admin
r = client.post("/api/auth/login", json={
"email": "admin@salestrainer.local", "password": "admin123"})
"username": "admin", "password": "1234"})
assert r.status_code == 200, r.get_json()
token = r.get_json()["token"]
H = {"Authorization": f"Bearer {token}"}
@@ -64,8 +64,8 @@ def main():
# trainee created; can list groups but only 'ready' ones (this one is 'failed' -> hidden)
client.post("/api/admin/users", json={
"name": "Trainee", "email": "t@x.com", "password": "pass123", "role": "user"}, headers=H)
r = client.post("/api/auth/login", json={"email": "t@x.com", "password": "pass123"})
"name": "Trainee", "username": "trainee1", "password": "pass123", "role": "user"}, headers=H)
r = client.post("/api/auth/login", json={"username": "trainee1", "password": "pass123"})
ut = r.get_json()["token"]
UH = {"Authorization": f"Bearer {ut}"}
r = client.get("/api/groups", headers=UH)

4
backend/scripts/test_routes.py
View File

@@ -24,8 +24,8 @@ def main():
app = create_app()
rules = sorted({str(rule) for rule in app.url_map.iter_rules() if str(rule).startswith("/api")})
expected = [
"/api/auth/login", "/api/auth/me",
"/api/admin/users", "/api/admin/users/<email>",
"/api/auth/login", "/api/auth/me", "/api/auth/setup",
"/api/admin/users", "/api/admin/users/<username>",
"/api/groups", "/api/groups/<gid>",
"/api/groups/<gid>/analyze", "/api/groups/<gid>/personas",
"/api/groups/<gid>/personas/<pid>", "/api/groups/<gid>/personas/<pid>",

13
backend/scripts/test_security.py
View File

@@ -26,8 +26,7 @@ def main():
client = app.test_client()
# admin login (org-default)
client.post("/api/auth/login", json={"email": "admin@salestrainer.local", "password": "admin123"})
r = client.post("/api/auth/login", json={"email": "admin@salestrainer.local", "password": "admin123"})
r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
AT = r.get_json()["token"]
AH = {"Authorization": f"Bearer {AT}"}
@@ -56,7 +55,7 @@ def main():
# Cross-org IDOR: create org B + a group in org-default; org B user must be denied.
client.post("/api/admin/users", json={
"name": "Other Admin", "email": "b-admin@x.com", "password": "pass123", "role": "admin"},
"name": "Other Admin", "username": "badmin", "password": "pass123", "role": "admin"},
headers=AH)
# Create a group as A (current default org)
r = client.post("/api/groups", json={"product": "A product"}, headers=AH)
@@ -68,8 +67,8 @@ def main():
# and admin cannot read a PERSONAL group belonging to a different user.
# Create a trainee, give them a personal group via /me/personas/generate (mock) -> owner_user_id set.
client.post("/api/admin/users", json={
"name": "Trainee T", "email": "t2@x.com", "password": "pass123", "role": "user"}, headers=AH)
r = client.post("/api/auth/login", json={"email": "t2@x.com", "password": "pass123"})
"name": "Trainee T", "username": "trainee2", "password": "pass123", "role": "user"}, headers=AH)
r = client.post("/api/auth/login", json={"username": "trainee2", "password": "pass123"})
TT = r.get_json()["token"]
TH = {"Authorization": f"Bearer {TT}"}
# trainee creates own persona -> personal group owned by t2
@@ -81,8 +80,8 @@ def main():
# The admin (different actor) must be able to access it (super_admin not needed; admin same org).
# For a strict IDOR test, a DIFFERENT trainee must be denied. Create t3.
client.post("/api/admin/users", json={
"name": "Trainee T3", "email": "t3@x.com", "password": "pass123", "role": "user"}, headers=AH)
r = client.post("/api/auth/login", json={"email": "t3@x.com", "password": "pass123"})
"name": "Trainee T3", "username": "trainee3", "password": "pass123", "role": "user"}, headers=AH)
r = client.post("/api/auth/login", json={"username": "trainee3", "password": "pass123"})
T3T = r.get_json()["token"]
T3H = {"Authorization": f"Bearer {T3T}"}
# t3 tries to read t2's personal group personas -> must be denied (owner check)

67
backend/scripts/test_setup.py Normal file
View File

@@ -0,0 +1,67 @@
"""Test the first-time admin setup flow: admin/1234 -> must_setup -> set email+password."""
import os
import sys
import tempfile
import warnings
from pathlib import Path
warnings.filterwarnings("ignore", message="The HMAC key is")
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
tempdir = tempfile.mkdtemp(prefix="st_setup_")
os.environ["DATA_DIR"] = tempdir
os.environ["JWT_SECRET"] = "test-secret-key-0123456789abcdef"
from app.factory import create_app # noqa: E402
from app.config import Config # noqa: E402
Config.DATA_DIR = Path(tempdir)
Config.LLM_API_KEY = ""
Config.LLM_BASE_URL = ""
def main():
app = create_app()
client = app.test_client()
# 1. Default admin logs in with admin / 1234 and must_setup is true
r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
assert r.status_code == 200, r.get_json()
assert r.get_json()["must_setup"] is True, "default admin should require setup"
token = r.get_json()["token"]
H = {"Authorization": f"Bearer {token}"}
me = client.get("/api/auth/me", headers=H).get_json()["user"]
assert me.get("must_setup") is True
print("[ok] default admin login admin/1234 -> must_setup=true")
# 2. Cannot set up with short password / bad email
r = client.post("/api/auth/setup", json={"username": "admin", "email": "bad", "password": "12"}, headers=H)
assert r.status_code == 400, r.get_json()
print("[ok] setup rejects bad email/short password")
# 3. Successful setup: email + new password, clears must_setup
r = client.post("/api/auth/setup", json={"username": "admin", "email": "admin@corp.com", "password": "NewPass!42"}, headers=H)
assert r.status_code == 200, r.get_json()
assert r.get_json()["must_setup"] is False
print("[ok] setup completes -> must_setup=false")
# 4. Old password no longer works; new one does
r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
assert r.status_code == 401, "old default password should be invalid"
r = client.post("/api/auth/login", json={"username": "admin", "password": "NewPass!42"})
assert r.status_code == 200
new_token = r.get_json()["token"]
assert r.get_json()["must_setup"] is False
print("[ok] old password rejected; new password logs in")
# 5. Admin can now use the app (create user, etc.)
NH = {"Authorization": f"Bearer {new_token}"}
r = client.post("/api/admin/users", json={"name": "T1", "username": "t1", "password": "pass123", "role": "user"}, headers=NH)
assert r.status_code == 201, r.get_json()
print("[ok] admin can use the app after setup")
print("\nALL SETUP TESTS PASSED")
if __name__ == "__main__":
main()