Yasuke/moto
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cognito-idp – Correct exception when user does not exist (#4482)

Browse Source
This commit is contained in:
Maksymilian Babarowski 2021-10-27 12:43:37 +02:00 committed by GitHub
parent 2f05bca27b
commit 98ca9b82e1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 33 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
moto/cognitoidp/models.py
View File

@ -632,8 +632,7 @@ class CognitoIdpBackend(BaseBackend):
user_pool = self.describe_user_pool(user_pool_id) user_pool = self.describe_user_pool(user_pool_id)
if message_action and message_action == "RESEND": if message_action and message_action == "RESEND":
if not user_pool._get_user(username): self.admin_get_user(user_pool_id, username)
raise UserNotFoundError(username)
elif user_pool._get_user(username): elif user_pool._get_user(username):
raise UsernameExistsException(username) raise UsernameExistsException(username)
@ -690,12 +689,7 @@ class CognitoIdpBackend(BaseBackend):
return user return user
def admin_confirm_sign_up(self, user_pool_id, username): def admin_confirm_sign_up(self, user_pool_id, username):
user_pool = self.describe_user_pool(user_pool_id) user = self.admin_get_user(user_pool_id, username)
user = user_pool._get_user(username)
if not user:
raise UserNotFoundError(f"User does not exist.")
user.status = UserStatus["CONFIRMED"] user.status = UserStatus["CONFIRMED"]
return "" return ""
@ -704,14 +698,14 @@ class CognitoIdpBackend(BaseBackend):
user = user_pool._get_user(username) user = user_pool._get_user(username)
if not user: if not user:
raise UserNotFoundError(username) raise UserNotFoundError("User does not exist.")
return user return user
def get_user(self, access_token): def get_user(self, access_token):
for user_pool in self.user_pools.values(): for user_pool in self.user_pools.values():
if access_token in user_pool.access_tokens: if access_token in user_pool.access_tokens:
_, username = user_pool.access_tokens[access_token] _, username = user_pool.access_tokens[access_token]
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if ( if (
not user not user
or not user.enabled or not user.enabled
@ -737,10 +731,7 @@ class CognitoIdpBackend(BaseBackend):
def admin_delete_user(self, user_pool_id, username): def admin_delete_user(self, user_pool_id, username):
user_pool = self.describe_user_pool(user_pool_id) user_pool = self.describe_user_pool(user_pool_id)
user = self.admin_get_user(user_pool_id, username)
user = user_pool._get_user(username)
if not user:
raise UserNotFoundError(username)
for group in user.groups: for group in user.groups:
group.users.remove(user) group.users.remove(user)
@ -773,9 +764,7 @@ class CognitoIdpBackend(BaseBackend):
if auth_flow in ("ADMIN_USER_PASSWORD_AUTH", "ADMIN_NO_SRP_AUTH"): if auth_flow in ("ADMIN_USER_PASSWORD_AUTH", "ADMIN_NO_SRP_AUTH"):
username = auth_parameters.get("USERNAME") username = auth_parameters.get("USERNAME")
password = auth_parameters.get("PASSWORD") password = auth_parameters.get("PASSWORD")
user = user_pool._get_user(username) user = self.admin_get_user(user_pool_id, username)
if not user:
raise UserNotFoundError(username)
if user.password != password: if user.password != password:
raise NotAuthorizedError(username) raise NotAuthorizedError(username)
@ -829,9 +818,7 @@ class CognitoIdpBackend(BaseBackend):
if challenge_name == "NEW_PASSWORD_REQUIRED": if challenge_name == "NEW_PASSWORD_REQUIRED":
username = challenge_responses.get("USERNAME") username = challenge_responses.get("USERNAME")
new_password = challenge_responses.get("NEW_PASSWORD") new_password = challenge_responses.get("NEW_PASSWORD")
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
user.password = new_password user.password = new_password
user.status = UserStatus.CONFIRMED user.status = UserStatus.CONFIRMED
@ -840,9 +827,7 @@ class CognitoIdpBackend(BaseBackend):
return self._log_user_in(user_pool, client, username) return self._log_user_in(user_pool, client, username)
elif challenge_name == "PASSWORD_VERIFIER": elif challenge_name == "PASSWORD_VERIFIER":
username = challenge_responses.get("USERNAME") username = challenge_responses.get("USERNAME")
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
password_claim_signature = challenge_responses.get( password_claim_signature = challenge_responses.get(
"PASSWORD_CLAIM_SIGNATURE" "PASSWORD_CLAIM_SIGNATURE"
@ -876,9 +861,7 @@ class CognitoIdpBackend(BaseBackend):
return self._log_user_in(user_pool, client, username) return self._log_user_in(user_pool, client, username)
elif challenge_name == "SOFTWARE_TOKEN_MFA": elif challenge_name == "SOFTWARE_TOKEN_MFA":
username = challenge_responses.get("USERNAME") username = challenge_responses.get("USERNAME")
user = user_pool._get_user(username) self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
software_token_mfa_code = challenge_responses.get("SOFTWARE_TOKEN_MFA_CODE") software_token_mfa_code = challenge_responses.get("SOFTWARE_TOKEN_MFA_CODE")
if not software_token_mfa_code: if not software_token_mfa_code:
@ -948,9 +931,7 @@ class CognitoIdpBackend(BaseBackend):
for user_pool in self.user_pools.values(): for user_pool in self.user_pools.values():
if access_token in user_pool.access_tokens: if access_token in user_pool.access_tokens:
_, username = user_pool.access_tokens[access_token] _, username = user_pool.access_tokens[access_token]
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
if user.password != previous_password: if user.password != previous_password:
raise NotAuthorizedError(username) raise NotAuthorizedError(username)
@ -967,20 +948,13 @@ class CognitoIdpBackend(BaseBackend):
raise NotAuthorizedError(access_token) raise NotAuthorizedError(access_token)
def admin_update_user_attributes(self, user_pool_id, username, attributes): def admin_update_user_attributes(self, user_pool_id, username, attributes):
user_pool = self.describe_user_pool(user_pool_id) user = self.admin_get_user(user_pool_id, username)
user = user_pool._get_user(username)
if not user:
raise UserNotFoundError(username)
user.update_attributes(attributes) user.update_attributes(attributes)
def admin_user_global_sign_out(self, user_pool_id, username): def admin_user_global_sign_out(self, user_pool_id, username):
user_pool = self.describe_user_pool(user_pool_id) user_pool = self.describe_user_pool(user_pool_id)
self.admin_get_user(user_pool_id, username)
user = user_pool._get_user(username)
if not user:
raise UserNotFoundError(username)
for token, token_tuple in list(user_pool.refresh_tokens.items()): for token, token_tuple in list(user_pool.refresh_tokens.items()):
_, username = token_tuple _, username = token_tuple
@ -1068,9 +1042,7 @@ class CognitoIdpBackend(BaseBackend):
if user_pool is None: if user_pool is None:
raise ResourceNotFoundError(client_id) raise ResourceNotFoundError(client_id)
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
user.status = UserStatus.CONFIRMED user.status = UserStatus.CONFIRMED
return "" return ""
@ -1097,9 +1069,7 @@ class CognitoIdpBackend(BaseBackend):
): ):
raise NotAuthorizedError(secret_hash) raise NotAuthorizedError(secret_hash)
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
if user.status is UserStatus.UNCONFIRMED: if user.status is UserStatus.UNCONFIRMED:
raise UserNotConfirmedException("User is not confirmed.") raise UserNotConfirmedException("User is not confirmed.")
@ -1122,7 +1092,7 @@ class CognitoIdpBackend(BaseBackend):
username = auth_parameters.get("USERNAME") username = auth_parameters.get("USERNAME")
password = auth_parameters.get("PASSWORD") password = auth_parameters.get("PASSWORD")
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user: if not user:
raise UserNotFoundError(username) raise UserNotFoundError(username)
@ -1190,9 +1160,7 @@ class CognitoIdpBackend(BaseBackend):
for user_pool in self.user_pools.values(): for user_pool in self.user_pools.values():
if access_token in user_pool.access_tokens: if access_token in user_pool.access_tokens:
_, username = user_pool.access_tokens[access_token] _, username = user_pool.access_tokens[access_token]
user = user_pool._get_user(username) self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
return {"SecretCode": str(uuid.uuid4())} return {"SecretCode": str(uuid.uuid4())}
else: else:
@ -1202,9 +1170,7 @@ class CognitoIdpBackend(BaseBackend):
for user_pool in self.user_pools.values(): for user_pool in self.user_pools.values():
if access_token in user_pool.access_tokens: if access_token in user_pool.access_tokens:
_, username = user_pool.access_tokens[access_token] _, username = user_pool.access_tokens[access_token]
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
user.token_verified = True user.token_verified = True
@ -1218,9 +1184,7 @@ class CognitoIdpBackend(BaseBackend):
for user_pool in self.user_pools.values(): for user_pool in self.user_pools.values():
if access_token in user_pool.access_tokens: if access_token in user_pool.access_tokens:
_, username = user_pool.access_tokens[access_token] _, username = user_pool.access_tokens[access_token]
user = user_pool._get_user(username) user = self.admin_get_user(user_pool.id, username)
if not user:
raise UserNotFoundError(username)
if software_token_mfa_settings["Enabled"]: if software_token_mfa_settings["Enabled"]:
if user.token_verified: if user.token_verified:

33
tests/test_cognitoidp/test_cognitoidp.py
View File

@ -1389,18 +1389,16 @@ def test_admin_resend_invitation_missing_user():
value = str(uuid.uuid4()) value = str(uuid.uuid4())
user_pool_id = conn.create_user_pool(PoolName=str(uuid.uuid4()))["UserPool"]["Id"] user_pool_id = conn.create_user_pool(PoolName=str(uuid.uuid4()))["UserPool"]["Id"]
caught = False with pytest.raises(ClientError) as exc:
try:
conn.admin_create_user( conn.admin_create_user(
UserPoolId=user_pool_id, UserPoolId=user_pool_id,
Username=username, Username=username,
UserAttributes=[{"Name": "thing", "Value": value}], UserAttributes=[{"Name": "thing", "Value": value}],
MessageAction="RESEND", MessageAction="RESEND",
) )
except conn.exceptions.UserNotFoundException: err = exc.value.response["Error"]
caught = True err["Code"].should.equal("UserNotFoundException")
err["Message"].should.equal(f"User does not exist.")
caught.should.be.true
@mock_cognitoidp @mock_cognitoidp
@ -1481,13 +1479,12 @@ def test_admin_get_missing_user():
username = str(uuid.uuid4()) username = str(uuid.uuid4())
user_pool_id = conn.create_user_pool(PoolName=str(uuid.uuid4()))["UserPool"]["Id"] user_pool_id = conn.create_user_pool(PoolName=str(uuid.uuid4()))["UserPool"]["Id"]
caught = False with pytest.raises(ClientError) as exc:
try:
conn.admin_get_user(UserPoolId=user_pool_id, Username=username) conn.admin_get_user(UserPoolId=user_pool_id, Username=username)
except conn.exceptions.UserNotFoundException:
caught = True
caught.should.be.true err = exc.value.response["Error"]
err["Code"].should.equal("UserNotFoundException")
err["Message"].should.equal(f"User does not exist.")
@mock_cognitoidp @mock_cognitoidp
@ -1499,11 +1496,12 @@ def test_admin_get_missing_user_with_username_attributes():
PoolName=str(uuid.uuid4()), UsernameAttributes=["email"] PoolName=str(uuid.uuid4()), UsernameAttributes=["email"]
)["UserPool"]["Id"] )["UserPool"]["Id"]
with pytest.raises(ClientError) as ex: with pytest.raises(ClientError) as exc:
conn.admin_get_user(UserPoolId=user_pool_id, Username=username) conn.admin_get_user(UserPoolId=user_pool_id, Username=username)
err = ex.value.response["Error"] err = exc.value.response["Error"]
err["Code"].should.equal("UserNotFoundException") err["Code"].should.equal("UserNotFoundException")
err["Message"].should.equal(f"User does not exist.")
@mock_cognitoidp @mock_cognitoidp
@ -1846,13 +1844,11 @@ def test_admin_delete_user():
conn.admin_create_user(UserPoolId=user_pool_id, Username=username) conn.admin_create_user(UserPoolId=user_pool_id, Username=username)
conn.admin_delete_user(UserPoolId=user_pool_id, Username=username) conn.admin_delete_user(UserPoolId=user_pool_id, Username=username)
caught = False with pytest.raises(ClientError) as exc:
try:
conn.admin_get_user(UserPoolId=user_pool_id, Username=username) conn.admin_get_user(UserPoolId=user_pool_id, Username=username)
except conn.exceptions.UserNotFoundException:
caught = True
caught.should.be.true err = exc.value.response["Error"]
err["Code"].should.equal("UserNotFoundException")
@mock_cognitoidp @mock_cognitoidp
@ -2351,6 +2347,7 @@ def test_admin_user_global_sign_out_unknown_user():
) )
err = ex.value.response["Error"] err = ex.value.response["Error"]
err["Code"].should.equal("UserNotFoundException") err["Code"].should.equal("UserNotFoundException")
err["Message"].should.equal("User does not exist.")
@mock_cognitoidp @mock_cognitoidp