init CTFd source

tests/api/v1/teams/test_scoring.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from CTFd.models import Users
+from CTFd.utils import set_config
+from tests.helpers import create_ctfd, destroy_ctfd, gen_award, gen_team, login_as_user
+
+
+def test_api_team_place_score_hidden_if_scores_hidden():
+    """/api/v1/teams/me should not reveal team place if scores aren't visible"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_team(app.db)
+        app.db.session.commit()
+
+        gen_award(app.db, user_id=2, team_id=1)
+
+        u = Users.query.filter_by(id=2).first()
+
+        with login_as_user(app, name=u.name) as client:
+            r = client.get("/api/v1/teams/me", json="")
+            resp = r.get_json()
+            assert resp["data"]["place"] == "1st"
+            assert resp["data"]["score"] == 100
+
+        set_config("score_visibility", "hidden")
+        with login_as_user(app, name=u.name) as client:
+            r = client.get("/api/v1/teams/me", json="")
+            resp = r.get_json()
+            # Teams can see their own score but they cannot see their place
+            # This is because a team can always sum up their own score but
+            # they cannot determine their place without social information
+            assert resp["data"]["place"] is None
+            assert resp["data"]["score"] == 100
+
+        set_config("score_visibility", "admins")
+        with login_as_user(app, name=u.name) as client:
+            r = client.get("/api/v1/teams/me", json="")
+            resp = r.get_json()
+            # The same behavior as above applies even under admins only score mode
+            # The rationale is the same. Teams can always sum their own score
+            assert resp["data"]["place"] is None
+            assert resp["data"]["score"] == 100
+
+        with login_as_user(app, name="admin") as client:
+            r = client.get("/api/v1/teams/1", json="")
+            resp = r.get_json()
+            print(resp)
+            assert resp["data"]["place"] == "1st"
+            assert resp["data"]["score"] == 100
+    destroy_ctfd(app)
+
+
+def test_api_public_team_place_score_hidden_if_scores_hidden():
+    """/api/v1/teams/<team_id> should not reveal team place if scores aren't visible"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_team(app.db)
+        app.db.session.commit()
+
+        gen_award(app.db, user_id=2, team_id=1)
+
+        u = Users.query.filter_by(id=2).first()
+
+        with login_as_user(app, name=u.name) as client:
+            r = client.get("/api/v1/teams/1", json="")
+            resp = r.get_json()
+            assert resp["data"]["place"] == "1st"
+            assert resp["data"]["place"] is not None
+
+        set_config("score_visibility", "hidden")
+        with login_as_user(app, name=u.name) as client:
+            r = client.get("/api/v1/teams/1", json="")
+            resp = r.get_json()
+            assert resp["data"]["place"] is None
+            assert resp["data"]["score"] is None
+
+        set_config("score_visibility", "admins")
+        with login_as_user(app, name=u.name) as client:
+            r = client.get("/api/v1/teams/1", json="")
+            resp = r.get_json()
+            assert resp["data"]["place"] is None
+            assert resp["data"]["score"] is None
+
+        with login_as_user(app, name="admin") as client:
+            r = client.get("/api/v1/teams/1", json="")
+            resp = r.get_json()
+            assert resp["data"]["place"] == "1st"
+            assert resp["data"]["score"] is not None
+    destroy_ctfd(app)

tests/api/v1/teams/test_team_members.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from CTFd.models import Awards, Solves, Submissions, Unlocks, Users
+from tests.helpers import (
+    create_ctfd,
+    destroy_ctfd,
+    gen_team,
+    gen_user,
+    login_as_user,
+    simulate_user_activity,
+)
+
+
+def test_api_team_get_members():
+    """Can a user get /api/v1/teams/<team_id>/members only if admin"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_team(app.db)
+        app.db.session.commit()
+
+        gen_user(app.db, name="user_name")
+        with login_as_user(app, name="user_name") as client:
+            r = client.get("/api/v1/teams/1/members", json="")
+            assert r.status_code == 403
+
+        with login_as_user(app, name="admin") as client:
+            r = client.get("/api/v1/teams/1/members", json="")
+            assert r.status_code == 200
+
+            resp = r.get_json()
+            # The following data is sorted b/c in Postgres data isn't necessarily returned ordered.
+            assert sorted(resp["data"]) == sorted([2, 3, 4, 5])
+    destroy_ctfd(app)
+
+
+def test_api_team_remove_members():
+    """Can a user remove /api/v1/teams/<team_id>/members only if admin"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        team = gen_team(app.db)
+        assert len(team.members) == 4
+        app.db.session.commit()
+
+        gen_user(app.db, name="user1")
+        with login_as_user(app, name="user1") as client:
+            r = client.delete("/api/v1/teams/1/members", json={"user_id": 2})
+            assert r.status_code == 403
+
+        with login_as_user(app, name="admin") as client:
+            r = client.delete("/api/v1/teams/1/members", json={"user_id": 2})
+            assert r.status_code == 200
+
+            resp = r.get_json()
+            # The following data is sorted b/c in Postgres data isn't necessarily returned ordered.
+            assert sorted(resp["data"]) == sorted([3, 4, 5])
+
+            r = client.delete("/api/v1/teams/1/members", json={"user_id": 2})
+
+            resp = r.get_json()
+            assert "User is not part of this team" in resp["errors"]["id"]
+            assert r.status_code == 400
+    destroy_ctfd(app)
+
+
+def test_api_removing_members_deletes_information():
+    """If an admin removes a user, their score information should also be removed"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        team = gen_team(app.db)
+        assert len(team.members) == 4
+        app.db.session.commit()
+
+        user = Users.query.filter_by(id=2).first()
+        simulate_user_activity(app.db, user)
+        assert Solves.query.filter_by(user_id=2).count() == 1
+        assert Submissions.query.filter_by(user_id=2).count() == 6
+        assert Awards.query.filter_by(user_id=2).count() == 1
+        assert Unlocks.query.filter_by(user_id=2).count() == 1
+
+        with login_as_user(app, name="admin") as client:
+            r = client.delete("/api/v1/teams/1/members", json={"user_id": 2})
+            assert r.status_code == 200
+
+        user = Users.query.filter_by(id=2).first()
+        assert Solves.query.filter_by(user_id=2).count() == 0
+        assert Submissions.query.filter_by(user_id=2).count() == 0
+        assert Awards.query.filter_by(user_id=2).count() == 0
+        assert Unlocks.query.filter_by(user_id=2).count() == 0
+    destroy_ctfd(app)
+
+
+def test_api_admin_can_change_captain():
+    """Can admins/captains change captains for teams"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        user1 = gen_user(app.db, name="user1", email="user1@examplectf.com")  # ID 2
+        user2 = gen_user(app.db, name="user2", email="user2@examplectf.com")  # ID 3
+        team = gen_team(app.db)
+        team.members.append(user1)
+        team.members.append(user2)
+        team.captain_id = 2
+        user1.team_id = team.id
+        user2.team_id = team.id
+        app.db.session.commit()
+
+        # I am not the captain
+        with login_as_user(app, name="user2") as client:
+            r = client.patch("/api/v1/teams/1", json={"captain_id": 3})
+            assert r.status_code == 403
+
+        # Look at me, I'm the captain now
+        with login_as_user(app, name="user1") as client:
+            r = client.patch("/api/v1/teams/1", json={"captain_id": 3})
+            # We should still receive a 403 because admins are the only people who can change captains for specific teams
+            assert r.status_code == 403
+
+        # Escalate to admin
+        with login_as_user(app, name="admin") as client:
+            r = client.patch("/api/v1/teams/1", json={"captain_id": 3})
+            resp = r.get_json()
+            assert resp["data"]["captain_id"] == 3
+            assert r.status_code == 200
+    destroy_ctfd(app)
+
+
+def test_api_users_can_change_captain_on_self_team():
+    """Can admins/captains change captains for their own team"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        user1 = gen_user(app.db, name="user1", email="user1@examplectf.com")  # ID 2
+        user2 = gen_user(app.db, name="user2", email="user2@examplectf.com")  # ID 3
+        team = gen_team(app.db)
+        team.members.append(user1)
+        team.members.append(user2)
+        team.captain_id = 2
+        user1.team_id = team.id
+        user2.team_id = team.id
+        app.db.session.commit()
+
+        # I am not the captain
+        with login_as_user(app, name="user2") as client:
+            r = client.patch("/api/v1/teams/me", json={"captain_id": 3})
+            assert r.status_code == 403
+
+        # Look at me, I'm the captain now
+        with login_as_user(app, name="user1") as client:
+            r = client.patch("/api/v1/teams/me", json={"captain_id": 3})
+            resp = r.get_json()
+            assert resp["data"]["captain_id"] == 3
+            assert r.status_code == 200
+    destroy_ctfd(app)

tests/api/v1/teams/test_teams.py

@@ -0,0 +1,92 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from CTFd.models import Teams, Users, db
+from CTFd.utils.crypto import verify_password
+from tests.helpers import (
+    create_ctfd,
+    destroy_ctfd,
+    gen_team,
+    login_as_user,
+    register_user,
+)
+
+
+def test_api_can_query_by_team_emails():
+    """Can an admin user query /api/v1/teams using a teams's email address"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_team(app.db, email="team@findme.com")
+        register_user(app, name="testuser", email="user@findme.com")
+        with login_as_user(app, "testuser") as client:
+            r = client.get("/api/v1/teams?field=email&q=findme", json=True)
+            assert r.status_code == 400
+            assert r.get_json()["errors"].get("field")
+        with login_as_user(app, "admin") as client:
+            r = client.get("/api/v1/teams?field=email&q=findme", json=True)
+            assert r.status_code == 200
+            assert r.get_json()["data"][0]["id"] == 1
+            assert r.get_json()["data"][0]["name"] == "team_name"
+    destroy_ctfd(app)
+
+
+def test_api_team_can_update_password_if_none_not_if_set():
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        # Create a user with a null password. Use raw SQL to bypass SQLAlchemy validates
+        gen_team(app.db, name="testteam", email="team@examplectf.com")
+        db.session.execute("UPDATE teams SET password=NULL WHERE name='testteam'")
+        team = Teams.query.filter_by(id=1).first()
+        db.session.commit()
+        assert team.password is None
+
+        # Login and test that we are authed
+        captain = Users.query.filter_by(id=2).first()
+        normal_user = Users.query.filter_by(id=3).first()
+        with login_as_user(app, captain.name) as client:
+            r = client.get("/api/v1/teams/me", json=True)
+            assert r.get_json()["data"]["id"] == team.id
+            assert r.status_code == 200
+
+            # Patch the team's password from NULL
+            team = Teams.query.filter_by(name="testteam").first()
+            assert team.password is None
+            data = {"password": "12345", "confirm": "password"}
+            r = client.patch("/api/v1/teams/me", json=data)
+            assert r.status_code == 200
+
+            # Verify password is now set
+            team = Teams.query.filter_by(name="testteam").first()
+            assert verify_password(plaintext="12345", ciphertext=team.password)
+
+            # Verify that password cannot be changed without valid password
+            data = {"password": "noset", "confirm": "noset"}
+            r = client.patch("/api/v1/teams/me", json=data)
+            resp = r.get_json()
+            assert resp["errors"]["confirm"] == ["Your previous password is incorrect"]
+            assert r.status_code == 400
+
+            # Verify that a normal user cannot change the team password
+            with login_as_user(app, normal_user.name) as client:
+                # Try changing the password for the team
+                data = {"password": "newpassword", "confirm": "12345"}
+                r = client.patch("/api/v1/teams/me", json=data)
+                assert r.status_code == 403
+
+                # Verify that team password has not changed
+                team = Teams.query.filter_by(name="testteam").first()
+                assert verify_password(plaintext="12345", ciphertext=team.password)
+
+            # Create a new team
+            new_team = gen_team(app.db, name="newteam", email="newteam@examplectf.com")
+            new_captain = Users.query.filter_by(id=new_team.captain_id).first()
+
+            # Verify that the captain from the new team cannot change the password of the original team
+            with login_as_user(app, new_captain.name) as client:
+                data = {"password": "newpassword", "confirm": "12345"}
+                r = client.patch("/api/v1/teams/1", json=data)
+                assert r.status_code == 403
+
+                # Verify that old test team password has not changed
+                team = Teams.query.filter_by(name="testteam").first()
+                assert verify_password(plaintext="12345", ciphertext=team.password)