engineering/remarkbox
1
0
Fork 0
Code Issues 3 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix GDPR delete account test for two-step sudo OTP flow.

Browse source 
Update test to perform both steps: POST with DELETE to get OTP form,
then POST with OTP code to complete deletion. Add SMTP mock since
the OTP step now sends email.
This commit is contained in:
russell@unturf.com 2026-02-05 16:25:48 -05:00
parent 0667917318
commit c7e624fdd7
1 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
remarkbox/tests/test_views.py
View file

@ -1743,12 +1743,30 @@ class GDPRDeleteAccountFunctionalTests(FunctionalTests):
user = self.dbsession.query(User).filter(User.id == self.user_id).one_or_none()
self.assertIsNotNone(user)
def test_3_delete_account_anonymizes_and_keeps_tombstone(self):
@patch("smtplib.SMTP")
def test_3_delete_account_anonymizes_and_keeps_tombstone(self, mock_smtp):
"""POST with DELETE confirmation scrubs PII and keeps user as tombstone."""
self._log_in_test_user()
redirect_res = self.testapp.post(
# Step 1: POST with DELETE triggers OTP generation, returns 200 with OTP form.
otp_res = self.testapp.post(
"/u/delete-account",
{"csrf_token": self.csrf, "confirm-delete": "DELETE"},
status=200,
)
self.assertIn(b"Confirmation code", otp_res.body)
# Retrieve the OTP code from the database.
from remarkbox.models.sudo_otp import SudoOtp
action_key = "delete_account:gdpr-delete@remarkbox.com"
otp_row = self.dbsession.query(SudoOtp).get(action_key)
self.assertIsNotNone(otp_row, "OTP row should exist after step 1")
code = otp_row.code
# Step 2: POST with the OTP code completes deletion.
redirect_res = self.testapp.post(
"/u/delete-account",
{"csrf_token": self.csrf, "sudo_otp": code},
status=302,
)
res = redirect_res.follow()