First draft for user permissions test

Updates to test scope based on Jenkins job. isort fixes.

Broadening test scope. Adding settings, monitoring, policy_registry and partners. Replacing page.is_displayed with more general check.

Removing APIDocsView based on Jenkins job

Add tests for the bot protection of the admin portal

Author: cathal-bailey

testsuite/tests/ui/auth/test_login_recaptcha.py

@@ -0,0 +1,75 @@
+"""Test for login into admin portal with bot protection (recaptcha) enabled"""
+
+import pytest
+from packaging.version import Version
+
+from testsuite import TESTED_VERSION, settings
+from testsuite.ui.views.admin.login import LoginView, RequestAdminPasswordView
+from testsuite.ui.views.admin.settings.bot_protection import AdminBotProtection
+
+pytestmark = [
+    pytest.mark.usefixtures("login"),
+    pytest.mark.usefixtures("bot_protection_setup"),
+    pytest.mark.issue("https://redhat.atlassian.net/browse/THREESCALE-765"),
+    pytest.mark.skipif(TESTED_VERSION < Version("2.16"), reason="TESTED_VERSION < Version('2.16')"),
+]
+
+
+@pytest.fixture(scope="module")
+def bot_protection_setup(navigator, browser):
+    """
+    Enables admin portal bot protection via UI,
+    then clears session so subsequent tests see the unauthenticated login page.
+    Requires recaptcha keys to be configured in 3scale settings.
+    Session cookies are saved before deletion and restored in teardown to avoid
+    circular dependency (recaptcha blocks selenium login during teardown).
+    """
+    bot_page = navigator.navigate(AdminBotProtection)
+    bot_page.enable_protection()
+    saved_cookies = browser.selenium.get_cookies()
+    browser.selenium.delete_all_cookies()
+
+    yield
+
+    browser.selenium.get(settings["threescale"]["admin"]["url"])
+    for cookie in saved_cookies:
+        browser.selenium.add_cookie(cookie)
+    browser.selenium.refresh()
+    navigator.navigate(AdminBotProtection).disable_protection()
+
+
+def test_admin_login_blocked_by_recaptcha(navigator):
+    """
+    Test
+        - Navigates to the admin portal login page
+        - Waits for reCAPTCHA to load and generate a token
+        - Attempts to log in with valid credentials
+        - Asserts that login is rejected due to low reCAPTCHA score from automated browser
+    """
+    login_page = navigator.open(LoginView, url=settings["threescale"]["admin"]["url"], wait_displayed=False)
+    assert login_page.recaptcha.is_displayed, "Recaptcha was not found on the admin portal login page"
+    login_page.browser.execute_script(  # hack to force reCAPTCHA V3 get bad score
+        "window.grecaptcha.execute = () => Promise.resolve('');"
+    )
+    login_page.login_widget.do_login(
+        settings["threescale"]["admin"]["username"], settings["threescale"]["admin"]["password"]
+    )
+    assert login_page.error_message.is_displayed, "Expected reCAPTCHA error message to be displayed"
+
+
+@pytest.mark.xfail  # not implemented yet
+def test_admin_forgot_password_blocked_by_recaptcha(navigator):
+    """
+    Test
+        - Navigates to the admin portal forgot password page
+        - Overrides reCAPTCHA token to force rejection
+        - Submits a password reset request
+        - Asserts that the request is rejected due to invalid reCAPTCHA token
+    """
+    forgot_pass = navigator.open(RequestAdminPasswordView, url=settings["threescale"]["admin"]["url"])
+    assert forgot_pass.recaptcha.is_displayed, "Recaptcha was not found on the admin portal forgot password page"
+    forgot_pass.browser.execute_script(  # hack to force reCAPTCHA V3 get bad score
+        "window.grecaptcha.execute = () => Promise.resolve('');"
+    )
+    forgot_pass.reset_password(settings["threescale"]["admin"]["username"])
+    assert forgot_pass.error_message.is_displayed, "Expected reCAPTCHA error message to be displayed"

testsuite/tests/ui/test_login_page.py

@@ -62,4 +62,4 @@ def test_log_with_random_username_password(refreshed_browser):
     login_view.login_widget.fill_passwd("password")
     assert login_view.login_widget.submit.is_enabled
     login_view.login_widget.submit.click()
-    assert "Incorrect email or password. Please try again." in login_view.error_message.text
+    assert "Incorrect email or password. Please try again." in login_view.error_message.title

testsuite/tests/ui/users_and_roles/conftest.py

@@ -0,0 +1,33 @@
+"""Conftest for user permissions tests"""
+
+import pytest
+from selenium.common.exceptions import NoSuchElementException, WebDriverException
+from widgetastic.widget import GenericLocatorWidget
+
+
+@pytest.fixture
+def is_page_accessible():
+    """
+    Helper function for permission tests to check if a page is accessible.
+
+    This checks for successful page access by verifying:
+    1. Correct URL path is loaded
+    2. The masthead header is present (exists on all allowed pages, not on access denied)
+    """
+
+    def _check(page):
+        if page.path not in page.browser.url:
+            return False
+
+        try:
+            masthead = GenericLocatorWidget(
+                page, locator="//header[contains(@class, 'pf-c-masthead') and contains(@class, 'pf-m-display-inline')]"
+            )
+            if not masthead.is_displayed:
+                return False
+        except (NoSuchElementException, WebDriverException):
+            return False
+
+        return True
+
+    return _check

testsuite/tests/ui/users_and_roles/test_permissions.py

@@ -2,76 +2,68 @@
 
 import pytest
 
-from testsuite.ui.views.admin.audience.billing import BillingSettingsView, BillingView
+from testsuite.ui.views.admin.audience.account import AccountsView
+from testsuite.ui.views.admin.audience.billing import (
+    BillingSettingsView,
+    BillingView,
+)
 from testsuite.ui.views.admin.audience.developer_portal import (
     ActiveDocsView,
     CMSNewPageView,
     CMSNewSectionView,
     DeveloperPortalContentView,
 )
+from testsuite.ui.views.admin.backend.analytics import BackendTrafficView
 from testsuite.ui.views.admin.foundation import AccessDeniedView
 
-PERMISSION_DICT = [
-    pytest.param("portal", DeveloperPortalContentView),
-    pytest.param("portal", DeveloperPortalContentView),
-    pytest.param("portal", CMSNewPageView),
-    pytest.param("portal", CMSNewSectionView),
-    pytest.param("finance", BillingView),
-    pytest.param(
-        "finance",
-        BillingSettingsView,
-        marks=[pytest.mark.xfail, pytest.mark.issue("https://issues.redhat.com/browse/THREESCALE-10995")],
-    ),
-    pytest.param("plans", ActiveDocsView),
-]
-
-
-@pytest.fixture()
-def all_page_objects():
-    """Returns all page objects from permissions tuple filtered of views with same permission"""
-
-    def _all_page_objects(except_permission, current_view):
+PERMISSIONS = ["portal", "finance", "settings", "partners", "monitoring", "plans", "policy_registry"]
 
-        all_views = [
-            view
-            for perm, view in [param.values for param in PERMISSION_DICT]
-            if perm != except_permission or view == current_view
-        ]
-
-        return all_views
-
-    return _all_page_objects
+VIEWS = [
+    ("portal", DeveloperPortalContentView),
+    ("portal", CMSNewPageView),
+    ("portal", CMSNewSectionView),
+    ("finance", BillingView),
+    ("finance", BillingSettingsView),
+    ("plans", ActiveDocsView),
+    ("monitoring", BackendTrafficView),
+    ("partners", AccountsView),
+]
 
 
 # pylint: disable=too-many-arguments
-@pytest.mark.parametrize("permission, page_view", PERMISSION_DICT)
+@pytest.mark.parametrize("user_permission", PERMISSIONS)
+@pytest.mark.parametrize("required_permission, page_view", VIEWS)
 def test_member_user_permissions_per_section(
+    account_password,
     custom_admin_login,
     navigator,
     provider_member_user,
-    all_page_objects,
-    permission,
+    backend_default,
+    user_permission,
+    required_permission,
     page_view,
-    allowed_services=False,
+    is_page_accessible,
 ):
-    """Tests user permissions permission per permission section"""
-    member_user = provider_member_user(allowed_sections=permission, allowed_services=allowed_services)
-    custom_admin_login(member_user.entity_name, "123456")
-
-    page_objects = all_page_objects(permission, page_view)
+    """
+    Tests user permissions permission per permission section
+        - Creates a member user with a specific permission
+        - Logs in as that member user
+        - Attempts to access a specific UI page
+        - If users permission matches page's required permission -> allowed
+        - Else, access denied
+    """
+    member_user = provider_member_user(allowed_sections=[user_permission], allowed_services=None)
+    custom_admin_login(member_user.entity_name, account_password)
 
-    for pg_obj in page_objects:
-        # Dynamically import the view class
-        view_module = __import__(pg_obj.__module__, fromlist=[pg_obj.__name__])
-        page_class = getattr(view_module, pg_obj.__name__)
-        page = navigator.open(page_class, wait_displayed=False)
+    if page_view == BackendTrafficView:
+        page = navigator.open(page_view, backend=backend_default, wait_displayed=False)
+    else:
+        page = navigator.open(page_view, wait_displayed=False)
 
-        if pg_obj == page_view:
-            assert (
-                page.is_displayed
-            ), f"{pg_obj.__name__} should be displayed for permissions {permission} and services {allowed_services}"
-        else:
-            assert AccessDeniedView(navigator.browser.root_browser).is_displayed, (
-                f"{pg_obj.__name__}"
-                f" should not be displayed for permissions {permission} and services {allowed_services}"
-            )
+    if user_permission == required_permission:
+        assert is_page_accessible(page), f"A user with {user_permission} should be able to access {page_view}"
+    else:
+        access_denied_view = AccessDeniedView(navigator.browser.root_browser)
+        assert (
+            access_denied_view.is_displayed
+        ), f"A user with {user_permission} should not be able to access {page_view}"

testsuite/ui/views/admin/login.py

@@ -1,7 +1,7 @@
 """Representation of Login specific views"""
 
 from widgetastic.widget import GenericLocatorWidget, Text, TextInput, View
-from widgetastic_patternfly4.ouia import Button
+from widgetastic_patternfly4.ouia import Alert, Button
 
 from testsuite.ui.exception import UIException
 from testsuite.ui.navigation import Navigable, step
@@ -10,6 +10,17 @@
 from testsuite.ui.views.common.login import LoginForm
 
 
+class AdminReCaptcha(View):
+    """ReCaptcha badge for admin portal — searches from browser root to escape view ROOT scoping."""
+
+    @property
+    def is_displayed(self):
+        element = self.browser.wait_for_element(
+            "//div[contains(@class,'grecaptcha-logo')]", timeout=10, exception=False
+        )
+        return element is not None
+
+
 class LoginView(View, Navigable):
     """
     Basic login view page object that can be found on path
@@ -18,9 +29,10 @@ class LoginView(View, Navigable):
     path = "/p/login"
     ROOT = "/html//div[@id='pf-login-page-container']"
     header = Text("//main/header/h2")
-    error_message = Text("//h4[@class='pf-c-alert__title']")
+    error_message = Alert(component_id="OUIA-Generated-Alert-danger-1")
     login_widget = View.nested(LoginForm)
     password_reset_link = Text("//a[@href='/p/password/reset']")
+    recaptcha = View.nested(AdminReCaptcha)
     auth0_link = Text("//*[@class='login-provider-link' and contains(@href,'auth0')]")
     rhsso_link = Text("//*[@class='login-provider-link' and contains(@href,'keycloak')]")
 
@@ -91,6 +103,8 @@ class RequestAdminPasswordView(View, Navigable):
     path = "/p/password/reset"
     password_reset_field = TextInput(id="email")
     passwd_reset_btn = Button(component_id="OUIA-Generated-Button-primary-1")
+    recaptcha = View.nested(AdminReCaptcha)
+    error_message = Alert(component_id="OUIA-Generated-Alert-danger-1")
 
     def reset_password(self, email):
         """Reset password of email address user"""

testsuite/ui/views/admin/settings/bot_protection.py

@@ -0,0 +1,37 @@
+"""View representation of Admin Portal Bot Protection settings page"""
+
+from widgetastic.widget import Text
+
+from testsuite.ui.views.admin.settings import BaseSettingsView
+from testsuite.ui.widgets.buttons import ThreescaleSubmitButton
+
+
+class AdminBotProtection(BaseSettingsView):
+    """View representation of Admin Portal Bot Protection settings"""
+
+    path_pattern = "/p/admin/bot_protection/edit"
+    no_protection = Text('//*[@id="settings_admin_bot_protection_level_none"]')
+    recaptcha_protection = Text('//*[@id="settings_admin_bot_protection_level_captcha"]')
+    submit_button = ThreescaleSubmitButton()
+
+    def prerequisite(self):
+        return BaseSettingsView
+
+    def disable_protection(self):
+        """Disables admin portal bot protection by selecting None and submitting."""
+        self.no_protection.click()
+        self.submit_button.click()
+
+    def enable_protection(self):
+        """Enables admin portal bot protection by selecting reCAPTCHA v3 and submitting."""
+        self.recaptcha_protection.click()
+        self.submit_button.click()
+
+    @property
+    def is_displayed(self):
+        return (
+            BaseSettingsView.is_displayed.fget(self)
+            and self.path in self.browser.url
+            and self.no_protection.is_displayed
+            and self.recaptcha_protection.is_displayed
+        )