Scenarios

Scenarios describe what you need. They define the tests and the necessary devices for them. Here you can find all scenarios that are implemented in this BalderHub package.

Login Scenarios

class balderhub.auth.scenarios.ScenarioSimpleLogin

Bases: Scenario

This is a simple scenario that evaluates if a user can be logged in.

class Client

Bases: Device

client device where the login can be executed

login = <balderhub.auth.lib.scenario_features.client.user_login_feature.UserLoginFeature object>

login feature allowing to perform the login process

role = <balderhub.auth.lib.scenario_features.client.role.user_role_feature.UserRoleFeature object>

user role describing username and password

test_login()

This test executes a simple login and validates if the login succeeds.

Registration Scenarios

class balderhub.auth.scenarios.ScenarioRegisterNewAsUnauth

Bases: Scenario

Represents the scenario for registering a new user as an unauthenticated client.

The purpose of this class is to test the workflow of registering a user who is unauthenticated and validate the login process before and after the registration. It consists of a Server device that provides resources and an UnauthClient device that performs the registration and login process.

class UnauthClient

Bases: Device

the unauthenticated client device that registers itself

login = <balderhub.auth.lib.scenario_features.client.user_login_feature.UserLoginFeature object>

login feature allowing to perform the login process

register_user = <balderhub.auth.lib.scenario_features.client.register_self_feature.RegisterSelfFeature object>

feature for registering the user

role = <balderhub.auth.lib.scenario_features.client.role.user_role_feature.UserRoleFeature object>

user role describing username and password

test_register_new_user() → None

Tests the functionality of registering a new user as an unauthenticated user and validates the login process for a new user before and after registration.

Password-Reset Scenarios

class balderhub.auth.scenarios.ScenarioPasswordResetWithUnauth

Bases: Scenario

This class defines a scenario for testing password reset functionality with an unauthenticated client. It ensures that the password reset process works as intended and validates that the user cannot log in with the old password after the reset, but can log in with the new password.

class UnauthClient

Bases: Device

he unauthenticated client device used for performing the password-reset.

login = <balderhub.auth.lib.scenario_features.client.user_login_feature.UserLoginFeature object>

login feature allowing to perform the login process

passwd_provider = <balderhub.auth.lib.scenario_features.client.password_field_value_provider.PasswordFieldValueProvider object>

provider for password field values

password_reset = <balderhub.auth.lib.scenario_features.client.password_reset_feature.PasswordResetFeature object>

feature for resetting the password

role = <balderhub.auth.lib.scenario_features.client.role.user_role_feature.UserRoleFeature object>

user role describing username and password

test_password_reset()

Tests the password reset functionality by ensuring that a user can reset their password successfully, and the old password becomes invalid while the new password permits access.

class balderhub.auth.scenarios.ScenarioPasswordResetWithOtherAuth

Bases: Scenario

Scenario for resetting a user’s password with the involvement of another client.

This scenario outlines the process for securely resetting a user’s password through interactions between a Master Client and a Slave Client, as well as confirming the reset process and validating the new password.

class MasterClient

Bases: Device

The client device that initiates and manages the password reset process for another user, while ensuring authentication security.

password_reset = <balderhub.auth.lib.scenario_features.client.password_reset_for_other_user_feature.PasswordResetForOtherUserFeature object>

feature for resetting the password for another user

sm_auth = <balderhub.auth.lib.scenario_features.client.authentification_state_machine.AuthenticationStateMachine object>

state machine for the authentication

class Server

Bases: Device

the server device that provides the resources

class SlaveClient

Bases: Device

The client device associated with the user whose password will be reset. Handles login, logout, and second-factor-based reset confirmation.

login = <balderhub.auth.lib.scenario_features.client.user_login_feature.UserLoginFeature object>

login feature allowing to perform the login process

logout = <balderhub.auth.lib.scenario_features.client.user_logout_feature.UserLogoutFeature object>

logout feature allowing to perform the logout process

passwd_provider = <balderhub.auth.lib.scenario_features.client.password_field_value_provider.PasswordFieldValueProvider object>

provider for password field values

password_reset = <balderhub.auth.lib.scenario_features.client.password_reset_feature.PasswordResetFeature object>

feature for resetting the password

role = <balderhub.auth.lib.scenario_features.client.role.user_role_feature.UserRoleFeature object>

user role describing username and password

test_password_reset()

Tests the password reset functionality to ensure that a user can reset their password, confirm the reset via a secondary factor, and successfully log in with the new password while being denied access with the old password.

The test validates multiple authentication scenarios during and after the password reset process to confirm correct behavior. The old password should become invalid after the reset, and the new password should grant access.

Permission Test Scenarios

Permission Scenarios

class balderhub.auth.scenarios.ScenarioAuthpermAuthenticated

Bases: AbstractScenarioAuthpermAuthenticated

This scenario tests authentication and permission handling for an authenticated client by verifying the behavior of non-existing resources, resources that require no authentication, resources the client has no permission for, and resources the client has permission for.

class Client

Bases: Client

the authenticated client device that accesses the resources

has_perm_for = <balderhub.auth.lib.scenario_features.client.has_permissions_for_config.HasPermissionsForConfig object>

feature for permission configuration

operation = <balderhub.auth.lib.scenario_features.client.operation_handling_feature.OperationHandlingFeature object>

feature for operation handling

sm_auth = <balderhub.auth.lib.scenario_features.client.authentification_state_machine.AuthenticationStateMachine object>

state machine for the authentication

class Server

Bases: Server

the server device that provides the resources

existence = <balderhub.auth.lib.scenario_features.server.existence_for_config.ExistenceForConfig object>

feature for existence configuration

needs_auth_for = <balderhub.auth.lib.scenario_features.server.authentication_for_config.AuthenticationForConfig object>

feature for authentication configuration

make_sure_to_be_authenticated()

Makes sure that the client is authenticated before the testcase starts.

test_client_has_no_perm_for_resources(resource_rule: ResourceRule)

Tests that accessing a resource the client has no permission for raises the expected exception or returns False.

Parameters:

resource_rule – the resource rule for a resource the client has no permission for

test_client_has_perm_for_resources(resource_rule: ResourceRule)

Tests that accessing a resource the client has permission for can be entered and left successfully.

Parameters:

resource_rule – the resource rule for a resource the client has permission for

test_no_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing a resource that requires no authentication can be entered and left successfully.

Parameters:

resource_rule – the resource rule for a resource that requires no authentication

test_non_existing_resources(resource_rule: ResourceRule)

Tests that accessing a non-existing resource raises the expected exception or returns False.

Parameters:

resource_rule – the resource rule for a non-existing resource

class balderhub.auth.scenarios.ScenarioAuthpermUnauthenticated

Bases: AbstractScenarioAuthpermUnauthenticated

This scenario tests authentication and permission handling for an unauthenticated client by verifying the behavior of non-existing resources, resources that require no authentication, and resources that require authentication.

class Server

Bases: Server

the server device that provides the resources

existence = <balderhub.auth.lib.scenario_features.server.existence_for_config.ExistenceForConfig object>

feature for existence configuration

needs_auth_for = <balderhub.auth.lib.scenario_features.server.authentication_for_config.AuthenticationForConfig object>

feature for authentication configuration

class UnauthClient

Bases: UnauthClient

the unauthenticated client device that accesses the resources

is_unauth = <balderhub.auth.lib.scenario_features.client.is_unauthenticated_feature.IsUnauthenticatedFeature object>

feature for unauthenticated check

operation = <balderhub.auth.lib.scenario_features.client.operation_handling_feature.OperationHandlingFeature object>

feature for operation handling

test_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing a resource that requires authentication raises the expected exception or returns False.

Parameters:

resource_rule – the resource rule for a resource that requires authentication

test_no_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing a resource that requires no authentication can be entered and left successfully.

Parameters:

resource_rule – the resource rule for a resource that requires no authentication

test_non_existing_resources(resource_rule: ResourceRule)

Tests that accessing a non-existing resource raises the expected exception or returns False.

Parameters:

resource_rule – the resource rule for a non-existing resource

Object-Permission Specific Scenarios

class balderhub.auth.scenarios.ScenarioAuthpermAuthenticatedObjperm

Bases: AbstractScenarioAuthpermAuthenticated

This scenario tests authentication and permission handling for an authenticated client with object-level permissions by resolving unresolved resources with parameters and verifying the behavior of non-existing resources, resources that require no authentication, resources the client has no permission for, and resources the client has permission for.

class Client

Bases: Client

the authenticated client device that accesses the resources with object-level permissions

has_perm_for = <balderhub.auth.lib.scenario_features.client.has_permissions_for_config.HasPermissionsForConfig object>

feature for permission configuration

operation = <balderhub.auth.lib.scenario_features.client.operation_handling_feature.OperationHandlingFeature object>

feature for operation handling

param_provider = <balderhub.auth.lib.scenario_features.client.unresolved_resource_parameter_config.UnresolvedResourceParameterConfig object>

configuration provider for unresolved resource parameters

sm_auth = <balderhub.auth.lib.scenario_features.client.authentification_state_machine.AuthenticationStateMachine object>

state machine for the authentication

class Server

Bases: Server

the server device that provides the resources

existence = <balderhub.auth.lib.scenario_features.server.existence_for_config.ExistenceForConfig object>

feature for existence configuration

needs_auth_for = <balderhub.auth.lib.scenario_features.server.authentication_for_config.AuthenticationForConfig object>

feature for authentication configuration

make_sure_to_be_authenticated()

Makes sure that the client is authenticated before the testcase starts.

test_client_has_no_perm_for_resources(resource_rule: ResourceRule)

Tests that accessing an unresolved resource the client has no permission for raises the expected exception or returns False. Resolves the resource rule with each parameter and verifies the behavior for each resulting operation.

Parameters:

resource_rule – the resource rule for an unresolved resource the client has no permission for

test_client_has_perm_for_resources(resource_rule: ResourceRule)

Tests that accessing an unresolved resource the client has permission for can be entered and left successfully. Resolves the resource rule with each parameter and verifies the behavior for each resulting operation.

Parameters:

resource_rule – the resource rule for an unresolved resource the client has permission for

test_no_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing an unresolved resource that requires no authentication can be entered and left successfully. Resolves the resource rule with each parameter and verifies the behavior for each resulting operation.

Parameters:

resource_rule – the resource rule for an unresolved resource that requires no authentication

test_non_existing_resources(resource_rule: ResourceRule)

Tests that accessing a non-existing unresolved resource raises the expected exception or returns False. Resolves the resource rule with each parameter and verifies the behavior for each resulting operation.

Parameters:

resource_rule – the resource rule for a non-existing unresolved resource

class balderhub.auth.scenarios.ScenarioAuthpermUnauthenticatedObjperm

Bases: AbstractScenarioAuthpermUnauthenticated

This scenario tests the authentication and permission handling for unauthenticated access with object-level permissions. It resolves unresolved resources using parameters provided by the client and validates that the system correctly handles non-existing resources, resources that do not require authentication, and resources that require authentication.

class Server

Bases: Server

The server device that provides existence and authentication configuration features.

existence = <balderhub.auth.lib.scenario_features.server.existence_for_config.ExistenceForConfig object>

feature for existence configuration

needs_auth_for = <balderhub.auth.lib.scenario_features.server.authentication_for_config.AuthenticationForConfig object>

feature for authentication configuration

class UnauthClient

Bases: UnauthClient

The unauthenticated client device that provides parameter resolution and operation handling features.

is_unauth = <balderhub.auth.lib.scenario_features.client.is_unauthenticated_feature.IsUnauthenticatedFeature object>

feature for unauthenticated check

operation = <balderhub.auth.lib.scenario_features.client.operation_handling_feature.OperationHandlingFeature object>

feature for operation handling

param_provider = <balderhub.auth.lib.scenario_features.client.unresolved_resource_parameter_config.UnresolvedResourceParameterConfig object>

configuration provider for unresolved resource parameters

test_auth_requiring_resources(resource_rule: ResourceRule)

Tests that resources which require authentication cannot be accessed by an unauthenticated client. Resolves each resource rule with available parameters and verifies that entering the operation either returns False or raises one of the expected exceptions.

test_no_auth_requiring_resources(resource_rule: ResourceRule)

Tests that resources which do not require authentication can be successfully accessed by an unauthenticated client. Resolves each resource rule with available parameters and verifies that the operation can be entered and left successfully.

test_non_existing_resources(resource_rule: ResourceRule)

Tests that accessing non-existing resources with an unauthenticated client fails as expected. Resolves each resource rule with available parameters and verifies that entering the operation either returns False or raises one of the expected exceptions.

Abstract Helper Scenarios for Permissions

class balderhub.auth.scenarios.abstract_scenario_authperm_authenticated.AbstractScenarioAuthpermAuthenticated

Bases: Scenario

This is an abstract scenario for testing authentication and permissions when the user is already authenticated.

class Client

Bases: Device

the client device that accesses the resources

has_perm_for = <balderhub.auth.lib.scenario_features.client.has_permissions_for_config.HasPermissionsForConfig object>

feature for permission configuration

operation = <balderhub.auth.lib.scenario_features.client.operation_handling_feature.OperationHandlingFeature object>

feature for operation handling

sm_auth = <balderhub.auth.lib.scenario_features.client.authentification_state_machine.AuthenticationStateMachine object>

state machine for the authentication

class Server

Bases: Device

the server device that provides the resources

existence = <balderhub.auth.lib.scenario_features.server.existence_for_config.ExistenceForConfig object>

feature for existence configuration

needs_auth_for = <balderhub.auth.lib.scenario_features.server.authentication_for_config.AuthenticationForConfig object>

feature for authentication configuration

expected_operation_enter_exc_for_no_auth = [<class 'balderhub.auth.lib.utils.base_resource.BaseResource.UnauthorizedError'>, <class 'balderhub.auth.lib.utils.operation.Operation.UnauthorizedError'>]

the expected exception(s) that should be raised when entering a resource/operation that requires authentication (but the client is already authenticated - this should only be raised if the resource is not existing or the user has no permissions)

expected_operation_enter_exc_for_no_perm = [<class 'balderhub.auth.lib.utils.base_resource.BaseResource.NoPermissionError'>, <class 'balderhub.auth.lib.utils.operation.Operation.NoPermissionError'>]

the expected exception(s) that should be raised when entering a resource/operation that the client has no permission for

expected_operation_enter_exc_for_non_existing = [<class 'balderhub.auth.lib.utils.base_resource.BaseResource.DoesNotExistError'>, <class 'balderhub.auth.lib.utils.operation.Operation.DoesNotExistError'>]

the expected exception(s) that should be raised when entering a non-existing resource/operation

make_sure_to_be_authenticated()

Makes sure that the client is authenticated before the testcase starts.

test_client_has_no_perm_for_resources(resource_rule: ResourceRule)

Tests that accessing a resource the client has no permission for raises the expected exception.

Parameters:

resource_rule – the resource rule to test

test_client_has_perm_for_resources(resource_rule: ResourceRule)

Tests that accessing a resource the client has permission for is possible.

Parameters:

resource_rule – the resource rule to test

test_no_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing a resource that requires no authentication is possible even with an authentificated user.

Parameters:

resource_rule – the resource rule to test

test_non_existing_resources(resource_rule: ResourceRule)

Tests that accessing a non-existing resource raises the expected exception.

Parameters:

resource_rule – the resource rule to test

class balderhub.auth.scenarios.abstract_scenario_authperm_unauthenticated.AbstractScenarioAuthpermUnauthenticated

Bases: Scenario

This is an abstract scenario for testing authentication and permissions when the user is not authenticated.

class Server

Bases: Device

the server device that provides the resources

existence = <balderhub.auth.lib.scenario_features.server.existence_for_config.ExistenceForConfig object>

feature for existence configuration

needs_auth_for = <balderhub.auth.lib.scenario_features.server.authentication_for_config.AuthenticationForConfig object>

feature for authentication configuration

class UnauthClient

Bases: Device

the client device that is unauthenticated

is_unauth = <balderhub.auth.lib.scenario_features.client.is_unauthenticated_feature.IsUnauthenticatedFeature object>

feature for unauthenticated check

operation = <balderhub.auth.lib.scenario_features.client.operation_handling_feature.OperationHandlingFeature object>

feature for operation handling

expected_operation_enter_exc_for_no_auth = [<class 'balderhub.auth.lib.utils.base_resource.BaseResource.UnauthorizedError'>, <class 'balderhub.auth.lib.utils.operation.Operation.UnauthorizedError'>]

the expected exception(s) that should be raised when entering a resource/operation that requires authentication (but the client is not authenticated)

expected_operation_enter_exc_for_non_existing = [<class 'balderhub.auth.lib.utils.base_resource.BaseResource.DoesNotExistError'>, <class 'balderhub.auth.lib.utils.operation.Operation.DoesNotExistError'>]

the expected exception(s) that should be raised when entering a non-existing resource/operation

test_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing a resource that requires authentication raises the expected exception.

Parameters:

resource_rule – the resource rule to test

test_no_auth_requiring_resources(resource_rule: ResourceRule)

Tests that accessing a resource that requires no authentication is possible.

Parameters:

resource_rule – the resource rule to test

test_non_existing_resources(resource_rule: ResourceRule)

Tests that accessing a non-existing resource raises the expected exception.

Parameters:

resource_rule – the resource rule to test