Fix/session secure club auth #341
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Updated showSummary() in server.py to handle email validation and error messages - Modified index.html to display flash messages correctly - Created tests/ folder with conftest.py and test_show_summary.py for unit testing - Added .flaskenv for local environment configuration - Updated .gitignore to include .venv and exclude tests/ folder - Updated requirements.txt to add pytest dependency
- Updated purchasePlaces() to check if the club has enough points before confirming a booking - Added a new test file with 2 unit tests to verify point validation logic
- Updated purchasePlaces() to check avoid clubs booking more than 12 places per competition - Added a new test file with 2 unit tests to verify point validation logic
- Updated book() to avoid clubs booking in past competition - Added a new test file with 2 unit tests
- Added missing line in purchasePlaces() to decrease club points after a valid booking - Created test to verify: - club points decrease when booking succeeds
- Updated index.html to include a simple grey table listing all clubs and their points - Modified server.py to pass the clubs data to the index template - Added test_display_clubs_points.py to verify that: - the page loads successfully - each club name and its points appear correctly in the HTML
- Updated purchasePlaces() to handle invalid inputs: • Added a check for empty input • Added a try/except block to catch non-numeric values • Added a condition to reject zero or negative values - Created test_invalid_number_of_places_booking.py: • Test 1: valid booking (success) • Test 2: zero places (error) • Test 3: negative places (error) • Test 4: empty input (error) • Test 5: non-numeric input (error)
- Added validation in purchasePlaces() to prevent users from booking more places than the competition has available - Added test_booking_more_than_available.py to verify: • booking above available places shows proper error message • competition and club data remain unchanged
- Update server.py to add cumulative validation to purchasePlaces() - Update existing test file with: • cumulative booking rejected (6 + 7) • cumulative booking accepted (6 + 5)
- Updated showSummary() and purchasePlaces() to use the club from the session rather than form data, preventing users from booking on behalf of other clubs. - Removed the club field from the booking.html form - Updated conftest.py to add the session logic - Updated test_book_place_with_enough_point, just to change the name of the club in the test (club A, because it's club A in the confest session) - Created test_session_secure_club_auth to ensure bookings are made for the logged-in club only.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This pull request secure club booking using session authentication
Changes Made
showSummary()andpurchasePlaces()to use the club from the session rather than form data, preventing users from booking on behalf of other clubs.booking.htmlformconftest.pyto add the session logictest_book_place_with_enough_point, just to change the name of the club in the test (club A, because it's club A in the confest session)test_session_secure_club_authto ensure bookings are made for the logged-in club only.Testing
1 new test pass successfully with pytest :
Test1 : simulate club A logged in and trying to book places by sending club B in the form
result : booking should be made for club A and not club B