MIDRC-1071 Enforce user registration #1286

paulineribeyre · 2025-08-01T16:13:13Z

Link to JIRA ticket if there is one: https://ctds-planx.atlassian.net/browse/MIDRC-1071
Closes #1149

New Features

The user registration flow has been modified in order to enforce registration before a user is officially logged in and can access website pages and data (when user registration is enabled)

Breaking Changes

Bug Fixes

Improvements

Dependency updates

Deployment changes

coveralls · 2025-08-01T16:19:09Z

Pull Request Test Coverage Report for Build 17286237580

Details

0 of 0 changed or added relevant lines in 0 files are covered.
183 unchanged lines in 10 files lost coverage.
Overall coverage increased (+0.2%) to 74.91%

Files with Coverage Reduction	New Missed Lines	%
blueprints/admin.py	3	67.19%
blueprints/login/shib.py	3	94.0%
blueprints/login/fence_login.py	8	81.03%
init.py	9	89.96%
resources/user/user_session.py	11	86.59%
auth.py	14	88.14%
blueprints/login/base.py	27	79.33%
resources/user/init.py	27	59.26%
blueprints/register.py	28	43.55%
resources/openid/idp_oauth2.py	53	50.23%

Totals
Change from base Build 17272232798:	0.2%
Covered Lines:	8360
Relevant Lines:	11160

💛 - Coveralls

github-actions · 2025-08-01T16:52:03Z

filepath	passed	failed	skipped	SUBTOTAL
tests/test_audit_service.py	2	1	3	6
tests/test_centralized_auth.py	9	7	0	16
tests/test_data_upload.py	6	2	1	9
tests/test_oauth2.py	9	6	0	15
tests/test_ras_authn.py	0	0	3	3
tests/test_dbgap.py	4	0	1	5
tests/test_register_user.py	0	0	2	2
tests/test_user_token.py	5	0	0	5
tests/test_drs_endpoint.py	4	0	0	4
tests/test_oidc_client.py	2	0	0	2
tests/test_google_data_access.py	1	0	0	1
tests/test_client_credentials.py	1	0	0	1
tests/test_presigned_url.py	7	0	0	7
TOTAL	50	16	10	76

Please find the detailed integration test report here (login here first)

github-actions · 2025-08-01T21:34:09Z

filepath	passed	failed	skipped	SUBTOTAL
tests/test_oauth2.py	15	0	0	15
tests/test_centralized_auth.py	15	1	0	16
tests/test_data_upload.py	8	0	1	9
tests/test_google_data_access.py	1	0	0	1
tests/test_audit_service.py	3	0	3	6
TOTAL	42	1	4	47

Please find the detailed integration test report here (login here first)

github-actions · 2025-08-01T22:02:40Z

filepath	passed	SUBTOTAL
tests/test_centralized_auth.py	16	16
TOTAL	16	16

Please find the detailed integration test report here (login here first)

paulineribeyre · 2025-08-01T16:39:51Z

fence/blueprints/register.py

 blueprint = flask.Blueprint("register", __name__)


-def xor_with_user_email(form, field):


Can't use this anymore when flask.g.user is not set anymore

paulineribeyre · 2025-08-01T18:02:47Z

fence/auth.py

    return f"flask.request.remote_addr={flask.request.remote_addr} x_forwarded_headers={x_forwarded_headers}"


-def login_user(


I split login_user into _identify_user_and_update_database and login_user_unless_unregistered

paulineribeyre · 2025-08-01T18:18:03Z

fence/templates/register_user.html

          {% endif %}
      </li>
    </ul>
+    <p>By registering and submitting this form, you hereby acknowledge and consent to be bound by our <a href="/dashboard/Public/documentation/DUA.html">data use agreement (DUA)</a>.</p><br>


Adding the change from #1149

paulineribeyre · 2025-08-01T18:20:58Z

tests/login/test_user_registration.py

+    config["OPENID_CONNECT"]["mock_idp"] = {"enable_idp_users_registration": False}
+
+
+def test_login_existing_user_without_registration(app, db_session):


Registration-specific tests moved from tests/login/test_base.py, renamed for clarity, and fixed (see this):

test_login_existing_user
test_login_with_registration
test_login_with_missing_email
test_login_redirect_to_registration_page
test_login_redirect_after_authentication

paulineribeyre · 2025-08-01T18:23:44Z

tests/conftest.py

+
+
+@pytest.fixture
+def mocks_for_idp_oauth2_callbacks(idp, rsa_private_key, mock_arborist_requests):


moved from tests/test_metrics.py for reusability

paulineribeyre · 2025-08-01T20:24:35Z

tests/conftest.py

-    "generic_additional_params",
-]
+# some tests run on all the IdPs for which a login blueprint exists
+def all_available_idps():


This results in fewer tests than LOGIN_IDPS and the same coverage (the generic implementation was tested multiple times).

The multiple generic logins with different configs are only needed in this test, which has its own parametrization

github-actions · 2025-08-05T20:37:16Z

filepath	passed	SUBTOTAL
tests/test_centralized_auth.py	16	16
TOTAL	16	16

Please find the detailed integration test report here (login here first)

github-actions · 2025-08-07T17:10:14Z

filepath	passed	SUBTOTAL
tests/test_centralized_auth.py	16	16
TOTAL	16	16

Please find the detailed integration test report here (login here first)

nss10

I’ve completed my first pass of the review, but I still need to go through the unit tests. Sharing my comments now so I don’t block you in the meantime

fence/auth.py

nss10 · 2025-08-07T17:42:08Z

fence/blueprints/admin.py

 def get_registered_users():
    """
-    DEPRECATED: This endpoint is deprecated and will be removed in a future release.
-


If this function is no longer deprecated, this warning should be removed as well.

logger.warning( f"Deprecated endpoint accessed: {request.path}. This endpoint is deprecated and will be removed in a future release." )

fence/auth.py

fence/blueprints/login/base.py

nss10 · 2025-08-07T19:42:22Z

fence/blueprints/login/base.py

+                    user_is_logged_in,
                )

    if flask.session.get("redirect"):


Any reason we did not choose

if "redirect" in flask.session:

Just wanted to confirm—was it intentional to filter out both a missing 'redirect' key and an empty session['redirect']?

this is existing code 🤷‍♀️ i see no reason to change it since the current version catches more cases

fence/blueprints/register.py

fence/config-default.yaml

fence/resources/user/__init__.py

nss10

I’ve reviewed the rest of the changes — almost everything looks good. I just have a few small questions, that’s all.

nss10 · 2025-08-07T21:55:25Z

tests/login/test_conftest_idps.py

+from tests.conftest import all_available_idps


 def test_contfest_idps():


Suggested change

def test_contfest_idps():

def test_conftest_idps():

I can make this change too. No worries.

nss10 · 2025-08-07T22:01:13Z

tests/login/test_conftest_idps.py

-    OPENID_CONNECT, or the new file names do not match the convention and
-    cannot be parsed by this test.
+    If you added an IdP and this test fails, DO NOT edit this test. Either the
+    new IdP should be added to test-fence-config.yaml's OPENID_CONNECT+LOGIN_OPTIONS,


Suggested change

new IdP should be added to test-fence-config.yaml's OPENID_CONNECT+LOGIN_OPTIONS,

new IdP should be added to test-fence-config.yaml's OPENID_CONNECT and LOGIN_OPTIONS,

tests/login/test_conftest_idps.py

nss10 · 2025-08-07T22:27:57Z

tests/login/test_user_registration.py

+    enable_registration = (
+        hasattr(request, "param") and request.param.get("enable_registration")
+    ) or True


Doesn't this always evaluate to True? Was that intentional. Could you explain the reason behind writing it this way?

Oops, the goal was to default to True if request.param["enable_registration"] is None or not set. I think this does what i want:

enable_registration = ( request.param.get("enable_registration", True) if hasattr(request, "param") else True )

I haven't checked auto_register_users but i assume i made the same mistake

Got it, thanks. I think we can just use:

enable_registration = getattr(request, "param", {}).get("enable_registration", True)

For auto_register_users, it already works fine since it defaults to False. If it’s overridden in the request as True, then True or False will evaluate to True.

That said, I’d prefer we keep both of them consistent for readability.

github-actions · 2025-08-19T22:42:57Z

filepath	passed	SUBTOTAL
tests/test_centralized_auth.py	16	16
TOTAL	16	16

Please find the detailed integration test report here

…gistration

github-actions · 2025-08-28T05:40:46Z

filepath	passed	SUBTOTAL
tests/test_centralized_auth.py	16	16
TOTAL	16	16

Please find the detailed integration test report here

paulineribeyre added 24 commits June 10, 2025 11:41

Fix REGISTERED_USERS_GROUP logic

63a7ed6

catch edge case

a50cbf3

wip

da1967d

wip

acafb08

add registration flow to fence login

155cf8c

master merge

2400e7b

fix old registration tests

76254b1

registration tests + some clean up

61b0215

fix unit tests

e7b95cb

fix redirect url missing fence prefix

9a6f599

avoid state mismatch error?

418a262

avoid state mismatch error?

2f0bdb3

fix when audit-service enabled

f09c4d8

fix when mock login enabled

6188791

fix unit tests and simplify logic

0eb923c

clean up

f24c0d7

refactor login_user function

f92e413

update doc

33b79e5

update registration page (#1149)

d219ed2

update doc

1c88042

test post_registration_redirect in all idps

7b044df

do some TODOs

db612b8

strip whitespace from form fields

99dd18b

clean up

a21bb82

paulineribeyre added 4 commits August 1, 2025 12:57

add line back

6baf9b2

change audit back - flask.g.user should be there

8ea7192

Merge branch 'master' of github.com:uc-cdis/fence into fix/registration

326332a

simplify since not used for audit data

518d959

PlanXCyborg added TestOauth2 TestDataUpload TestAuditService labels Aug 1, 2025

PlanXCyborg removed TestDataUpload TestGoogleDataAccess TestAuditService TestOauth2 labels Aug 1, 2025

paulineribeyre commented Aug 5, 2025

View reviewed changes

paulineribeyre added 4 commits August 5, 2025 14:34

autoregister: actually use the configured claims fields

0ca221a

let user know about double login

0840a36

from master

3ccebc3

registration page: remove extra empty space

96dae73

remove deprecation comment

c55201b

nss10 requested changes Aug 7, 2025

View reviewed changes

nss10 reviewed Aug 7, 2025

View reviewed changes

nss10 added 2 commits August 17, 2025 14:09

Make changes to respond to PR comments

58ab35d

Do Not Merge, pushing to isolate troubling Unit tests

4274b7d

nss10 added 3 commits August 27, 2025 23:46

Add db_session fixture to ensure test isolation

836012d

Merge branch 'master' of https://github.com/uc-cdis/fence into fix/re…

93550fc

…gistration

Update import flask in test_metrics

4522339

nss10 self-requested a review August 28, 2025 05:10

nss10 approved these changes Aug 28, 2025

View reviewed changes

nss10 merged commit 5a20003 into master Aug 28, 2025
12 of 13 checks passed

nss10 deleted the fix/registration branch August 28, 2025 05:44

		blueprint = flask.Blueprint("register", __name__)


		def xor_with_user_email(form, field):

		return f"flask.request.remote_addr={flask.request.remote_addr} x_forwarded_headers={x_forwarded_headers}"


		def login_user(

		config["OPENID_CONNECT"]["mock_idp"] = {"enable_idp_users_registration": False}


		def test_login_existing_user_without_registration(app, db_session):



		@pytest.fixture
		def mocks_for_idp_oauth2_callbacks(idp, rsa_private_key, mock_arborist_requests):

		from tests.conftest import all_available_idps


		def test_contfest_idps():

	new IdP should be added to test-fence-config.yaml's OPENID_CONNECT+LOGIN_OPTIONS,
	new IdP should be added to test-fence-config.yaml's OPENID_CONNECT and LOGIN_OPTIONS,

MIDRC-1071 Enforce user registration #1286

MIDRC-1071 Enforce user registration #1286

Uh oh!

Conversation

paulineribeyre commented Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New Features

Breaking Changes

Bug Fixes

Improvements

Dependency updates

Deployment changes

Uh oh!

coveralls commented Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 17286237580

Details

💛 - Coveralls

Uh oh!

github-actions bot commented Aug 1, 2025

Uh oh!

github-actions bot commented Aug 1, 2025

Uh oh!

github-actions bot commented Aug 1, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 5, 2025

Uh oh!

github-actions bot commented Aug 7, 2025

Uh oh!

nss10 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nss10 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

paulineribeyre Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nss10 Aug 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 19, 2025

Uh oh!

paulineribeyre commented Aug 1, 2025 •

edited

Loading

coveralls commented Aug 1, 2025 •

edited

Loading

paulineribeyre Aug 15, 2025 •

edited

Loading

nss10 Aug 17, 2025 •

edited

Loading