deps: Update django-axes (#6671)

Author: matthewelwell

api/poetry.lock

@@ -152,7 +152,7 @@ django-environ = "~0.4.5"
 influxdb-client = "~1.50.0"
 django-ordered-model = "~3.4.1"
 django-ses = "~3.5.0"
-django-axes = "~5.32.0"
+django-axes = "^8.1.0"
 pydantic = "^2.12.0"
 pyngo = "~2.4.1"
 flagsmith = "^3.10.0"
@@ -220,7 +220,9 @@ pre-commit = "^4.0.1"
 pytest-mock = "~3.10.0"
 pytest-lazy-fixture = "~0.6.3"
 moto = "~4.1.3"
-pytest-freezegun = "~0.4.2"
+# TODO: move to https://github.com/adamchainz/time-machine
+pytest-freezegun = "^0.4.2"
+setuptools = "*"  # this only exists because pytest-freezegun fails without it
 pytest-xdist = "~3.6.1"
 pylint = "~2.16.2"
 pep8 = "~1.7.1"

api/pyproject.toml

@@ -1,10 +1,6 @@
 from unittest.mock import MagicMock
 
 import pytest
-from axes.models import AccessAttempt  # type: ignore[import-untyped]
-from django.contrib.auth import authenticate
-from django.http import HttpRequest
-from pytest_django.fixtures import SettingsWrapper
 from rest_framework.exceptions import AuthenticationFailed
 
 from environments.authentication import EnvironmentKeyAuthentication
@@ -64,18 +60,3 @@ def test_authenticate_raises_authentication_failed_if_organisation_set_to_stop_s
     # When / Then
     with pytest.raises(AuthenticationFailed):
         authenticator.authenticate(request)  # type: ignore[no-untyped-call]
-
-
-# TODO: this test should not be here?
-def test_brute_force_access_attempts(db: None, settings: SettingsWrapper) -> None:
-    invalid_user_name = "invalid_user@mail.com"
-    login_attempts_to_make = settings.AXES_FAILURE_LIMIT + 1
-
-    assert AccessAttempt.objects.all().count() == 0
-
-    for _ in range(login_attempts_to_make):
-        request = HttpRequest()
-        request.path = "/api/v1/auth/login/"
-        authenticate(request, username=invalid_user_name, password="invalid_password")
-
-    assert AccessAttempt.objects.filter(username=invalid_user_name).count() == 1

api/tests/unit/environments/test_unit_environments_authentication.py

@@ -0,0 +1,21 @@
+from axes.models import AccessAttempt  # type: ignore[import-untyped]
+from django.urls import reverse
+from pytest_django.fixtures import SettingsWrapper
+from rest_framework.test import APIClient
+
+
+def test_brute_force_access_attempts(
+    db: None, settings: SettingsWrapper, api_client: APIClient
+) -> None:
+    invalid_user_name = "invalid_user@mail.com"
+    login_attempts_to_make = settings.AXES_FAILURE_LIMIT + 1
+
+    assert AccessAttempt.objects.all().count() == 0
+
+    login_url = reverse("api-v1:custom_auth:custom-mfa-authtoken-login")
+    login_data = {"email": invalid_user_name, "password": "invalid_password"}
+
+    for _ in range(login_attempts_to_make):
+        api_client.post(login_url, login_data, format="json")
+
+    assert AccessAttempt.objects.filter(username=invalid_user_name).count() == 1