source: main/waeup.sirp/branches/ulif-experimental-folders/src/waeup/sirp/authentication.txt @ 11102

WAeUP portal authentication
***************************

:Test-Layer: functional

We need to protect most pieces of our portals from unauthenticated
access.

Therefore users have to login to access main functionality and they
are able to log out afterwards.

Before we can check access we have to create an app:

  >>> from waeup.sirp.app import University
  >>> root = getRootFolder()
  >>> u = University()
  >>> root['app'] = u

To make sure, we can 'watch' pages, we first have to initialize our
test browser:

  >>> from zope.testbrowser.testing import Browser
  >>> browser = Browser()
  >>> browser.handleErrors = False

Creating users (principals)
===========================

Before we can login, we have to provide a user (``principal`` in Zope
terms) with a password (and optional a title or description):

  >>> root['app']['users'].addUser('bob', 'bobsecret',
  ...                           title='Bob', description='A sample user')

We can also add complete `Account` objects. An `Account` stores the
user credentials and some metadata persistently:

  >>> from waeup.sirp.authentication import Account
  >>> alice = Account('alice', 'alicesecret')
  >>> root['app']['users'].addAccount(alice)

See ``users.txt`` for details about the UserContainer we use here.


Logging in via side bar
=======================

We can access the front page without restrictions:

  >>> browser.open('http://localhost/app')
  >>> print browser.headers['Status']
  200 Ok

There is a login form on the front page sidebar:

  >>> 'form.login' in browser.contents
  True

  >>> 'form.logout' in browser.contents
  False

We use this form:

  >>> browser.getControl(name='form.login').value = 'bob'
  >>> browser.getControl(name='form.password').value = 'bobsecret'
  >>> browser.getControl('Login').click()

Now the login form is gone. Instead we have the opportunity to logout:

  >>> 'form.login' in browser.contents
  False

  >>> logout = browser.getLink('Logout')
  >>> logout
  <Link text='Logout' url='http://localhost/app/@@logout'>

The user title is also displayed in the sidebar:

  >>> 'Bob' in browser.contents
  True

We can also log out afterwards:

  >>> logout.click()

Now we are logged out again:

  >>> 'form.login' in browser.contents
  True