Merge pull request #23 from makes-hacks-hip/refactor_doc_test

fix one time login

rc_hip/repapp/tests.py

@@ -1,7 +1,9 @@
 """
 Tests for RepApp.
 """
+from hashlib import sha256
 from datetime import datetime, timedelta
+
 import django.utils.timezone
 
 from django.test import TestCase
@@ -24,8 +26,9 @@ class OneTimeLoginTest(TestCase):
         user.save()
         self.user = user
 
+        secret_hash = sha256("LetMeIn".encode('utf-8')).hexdigest()
         otl = OneTimeLogin(
-            secret="LetMeIn",
+            secret=secret_hash,
             user=user,
             url="/test/url",
         )

rc_hip/repapp/views.py

@@ -152,9 +152,9 @@ def create_one_time_login(user, url) -> str:
         f'{user.email}{url}{datetime.datetime.now()}{random.randint(0,9999999)}'.encode(
             'utf-8')
     ).hexdigest()
-    hash = sha256(secret.encode('utf-8')).hexdigest()
+    secret_hash = sha256(secret.encode('utf-8')).hexdigest()
     otl = OneTimeLogin(
-        secret=hash,
+        secret=secret_hash,
         user=user,
         url=url,
     )
@@ -412,21 +412,21 @@ def one_time_login(request, secret: str):
     # waste a little time as brute force protection
     time.sleep(1)
 
-    hash = sha256(secret.encode('utf-8')).hexdigest()
-    otl = get_object_or_404(OneTimeLogin, secret=hash)
+    secret_hash = sha256(secret.encode('utf-8')).hexdigest()
+    otl = get_object_or_404(OneTimeLogin, secret=secret_hash)
 
     if otl.login_used:
         messages.add_message(request, messages.ERROR,
                              'Der Einmal-Login wurde schon verwendet und ist nichtmehr gültig.')
-        secret = create_one_time_login(otl.user, otl.url)
-        send_one_time_login_mail(secret, otl.user.email, request)
+        new_secret = create_one_time_login(otl.user, otl.url)
+        send_one_time_login_mail(new_secret, otl.user.email, request)
         return HttpResponseRedirect(reverse_lazy('index'))
     else:
         otl.login_used = True
         otl.login_date = now()
         otl.save()
 
-    user = authenticate(request, username=secret, password=None)
+    user = authenticate(request, username=secret_hash, password=None)
 
     if user is not None:
         login(request, user)