[Django]-How to test an API endpoint with Django-rest-framework using Django-oauth-toolkit for authentication

by

31👍

✅

When you are writing tests, you should aim to extract anything you are not testing from the test itself, typically putting any setup code in the setUp method of the test. In the case of API tests with OAuth, this usually includes the test user, OAuth application, and the active access token.

For django-oauth-toolkit, and other Django applications, I would always recommend looking at the tests to see how they do it. This allows you to avoid making unneeded API calls, especially for multi-part processes like OAuth, and only create the few model objects that are required.

def setUp(self):
    self.test_user = UserModel.objects.create_user("test_user", "test@user.com", "123456")

    self.application = Application(
        name="Test Application",
        redirect_uris="http://localhost",
        user=self.test_user,
        client_type=Application.CLIENT_CONFIDENTIAL,
        authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
    )
    self.application.save()

def test_revoke_access_token(self):
    from datetime import datetime
    from django.utils import timezone

    tok = AccessToken.objects.create(
        user=self.test_user, token='1234567890',
        application=self.application, scope='read write',
        expires=timezone.now() + datetime.timedelta(days=1)
    )

From there you just need to authenticate using the token that has been generated. You can do this by injecting the Authorization header, or you can use the force_authenticate method provided by Django REST Framework.

👤Kevin Brown-Silva

5👍

I have used the same library for OAuth2,

This worked for me 

from oauth2_provider.settings import oauth2_settings
from oauth2_provider.models import get_access_token_model, 
get_application_model
from django.contrib.auth import get_user_model
from django.utils import timezone
from rest_framework.test import APITestCase

Application = get_application_model()
AccessToken = get_access_token_model()
UserModel = get_user_model()

class Test_mytest(APITestCase):

    def setUp(self):

        oauth2_settings._SCOPES = ["read", "write", "scope1", "scope2", "resource1"]

        self.test_user = UserModel.objects.create_user("test_user", "test@example.com", "123456")

        self.application = Application.objects.create(
                                                name="Test Application",
                                                redirect_uris="http://localhost http://example.com http://example.org",
                                                user=self.test_user,
                                                client_type=Application.CLIENT_CONFIDENTIAL,
                                                authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
                                            )

        self.access_token = AccessToken.objects.create(
                                                    user=self.test_user,
                                                    scope="read write",
                                                    expires=timezone.now() + timezone.timedelta(seconds=300),
                                                    token="secret-access-token-key",
                                                    application=self.application
                                                )
        # read or write as per your choice
        self.access_token.scope = "read"
        self.access_token.save()

        # correct token and correct scope
        self.auth =  "Bearer {0}".format(self.access_token.token)

    def test_success_response(self):

        url = reverse('my_url',)

        # Obtaining the POST response for the input data
        response = self.client.get(url, HTTP_AUTHORIZATION=self.auth)

        # checking wether the response is success
        self.assertEqual(response.status_code, status.HTTP_200_OK)

Now everything will work as expected.
Hope this helps. Thanks

👤Shinto Joseph

0👍

from oauth2_provider.models import (
get_access_token_model,
get_application_model,
get_id_token_model,
get_refresh_token_model,
)

 class TestOauth(APITestCase):
    def setUp(self):
            """ create and register user """
            self.test_user = User.create..

    def test_oauth_application_and_tokens_add(self):
        print(self.test_user, self.test_user.id)
        """Applications"""
        Application = get_application_model()
        app = Application()
        app.name = "test"
        app.client_type = "confidential"
        app.authorization_grant_type = "password"
        app.user_id = self.test_user.id
        app.save()

        # client_id:
        print("Application Client ID: ", app.client_id)

        # client_secret:
        print("Application Client SECRET: ", app.client_secret)

        """Access Token"""
        AccessToken = get_access_token_model()
        token = AccessToken()
        token.user_id = self.test_user.id
        token.scope = "read write"
        token.expires = timezone.now() + timezone.timedelta(seconds=300)
        token.token = "secret-access-token-key"
        token.application = app
        token.save()

        # token
        print("Access Token: ", token)

        self.auth = "Bearer {0}".format(token.token)

        """ ID Token """
        IDToken = get_id_token_model()
        idt = IDToken()
        idt.user_id = self.test_user.id
        idt.application = app
        idt.expires = timezone.now() + timezone.timedelta(days=10)
        idt.scope = "read write"
        idt.save()

        # id token - returns jti token - successfull
        print("ID Token: ", idt)

        """ Refresh Token """
        RefreshToken = get_refresh_token_model()
        refr = RefreshToken()
        refr.user_id = self.test_user.id
        refr.application = app
        refr.token = "statictoken"  # The token is issued statically.
        refr.access_token = (
            token  # The access token must not have been used before.
        )
        refr.revoked = timezone.now() + timezone.timedelta(days=10)
        refr.save()

        # refresh token
        print("Refresh Token: ", refr)
👤Ayse

Leave a comment