fixes bug 1369475 - Switch to new MIDDLEWARE setting

Author: peterbe

pytest.ini

@@ -13,6 +13,8 @@ DJANGO_CONFIGURATION = Test
 ;; Not sure if I need this because this should be mocked anyway
 ;blockade-http-whitelist = s3.example.com localhost
 
+# Transform all warnings into errors
+filterwarnings = error
 
 [pytest-watch]
 ignore = frontend .git docs test-with-nginx .cache htmlcov

tecken/settings.py

@@ -105,7 +105,7 @@ class Core(AWS, Configuration, Celery, S3):
     # to check that a once-authenticated user is still a valid user.
     # So if that's "disabled", that's why we have rather short session
     # cookie age.
-    MIDDLEWARE_CLASSES = (
+    MIDDLEWARE = (
         'django.middleware.security.SecurityMiddleware',
         'dockerflow.django.middleware.DockerflowMiddleware',
         # 'django.middleware.csrf.CsrfViewMiddleware',
@@ -328,6 +328,11 @@ def LOGGING(self):
                 'handlers': ['sentry', 'console'],
             },
             'loggers': {
+                'django': {
+                    'level': 'WARNING',
+                    'handlers': ['console'],
+                    'propagate': False,
+                },
                 'django.db.backends': {
                     'level': 'ERROR',
                     'handlers': ['console'],
@@ -709,10 +714,10 @@ def DATABASES(self):
     # Sentry setup
     SENTRY_DSN = values.Value(environ_prefix=None)
 
-    MIDDLEWARE_CLASSES = (
+    MIDDLEWARE = (
         'raven.contrib.django.raven_compat.middleware'
         '.SentryResponseErrorIdMiddleware',
-    ) + Base.MIDDLEWARE_CLASSES
+    ) + Base.MIDDLEWARE
 
     INSTALLED_APPS = Base.INSTALLED_APPS + [
         'raven.contrib.django.raven_compat',

tecken/tokens/middleware.py

@@ -9,7 +9,6 @@
 from django.contrib import auth
 from django.conf import settings
 from django.core.exceptions import MiddlewareNotUsed
-from django.utils.deprecation import MiddlewareMixin
 
 from .models import Token
 
@@ -22,15 +21,21 @@ def has_perm(all, codename, obj=None):
     return all.filter(codename=codename).count()
 
 
-class APITokenAuthenticationMiddleware(MiddlewareMixin):
+class APITokenAuthenticationMiddleware:
 
-    def __init__(self):
+    def __init__(self, get_response=None):
         if not settings.ENABLE_TOKENS_AUTHENTICATION:  # pragma: no cover
-            logger.warn('API Token authentication disabled')
+            logger.warning('API Token authentication disabled')
             raise MiddlewareNotUsed
+        self.get_response = get_response
 
-    def process_request(self, request):
+    def __call__(self, request):
+        response = self.process_request(request)
+        if not response:
+            response = self.get_response(request)
+        return response
 
+    def process_request(self, request):
         key = request.META.get('HTTP_AUTH_TOKEN')
         if not key:
             return

tecken/useradmin/middleware.py

@@ -11,7 +11,6 @@
 from django.conf import settings
 from django.core.cache import cache
 from django.core.exceptions import MiddlewareNotUsed
-from django.utils.deprecation import MiddlewareMixin
 from django.contrib import auth
 
 from tecken.base.utils import requests_retry_session
@@ -73,7 +72,7 @@ def find_users(client_id, client_secret, domain, email, session):
     return response.json()
 
 
-class NotBlockedInAuth0Middleware(MiddlewareMixin):
+class NotBlockedInAuth0Middleware:
     """If the user is found in Auth0's User Management API *and*
     is "blocked" make the user inactive. In active users can't have any
     permissions but we don't have to destroy or change any API tokens.
@@ -90,10 +89,17 @@ class NotBlockedInAuth0Middleware(MiddlewareMixin):
     at throttled interval.
     """
 
-    def __init__(self):
+    def __init__(self, get_response=None):
         if not settings.ENABLE_AUTH0_BLOCKED_CHECK:  # pragma: no cover
-            logger.warn('Auth0 blocked check disabled')
+            logger.warning('Auth0 blocked check disabled')
             raise MiddlewareNotUsed
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.process_request(request)
+        if not response:
+            response = self.get_response(request)
+        return response
 
     def process_request(self, request):
         if not request.user.is_active or not request.user.email:
@@ -105,7 +111,7 @@ def process_request(self, request):
                 # oh my!
                 request.user.is_active = False
                 request.user.save()
-                logger.warn(
+                logger.warning(
                     f'User {request.user.email} is blocked in Auth0 '
                     f'and now made inactive'
                 )

tecken/views.py

@@ -42,11 +42,11 @@ def handler500(request):
     return http.JsonResponse({'error': 'Internal Server Error'}, status=500)
 
 
-def handler400(request):
+def handler400(request, exception):
     return http.JsonResponse({'error': 'Bad Request'}, status=400)
 
 
-def handler403(request):
+def handler403(request, exception):
     return http.JsonResponse({'error': 'Forbidden'}, status=403)
 
 

tests/test_views.py

@@ -9,6 +9,7 @@
 import mock
 
 from django.core.urlresolvers import reverse
+from django.core.exceptions import PermissionDenied
 from django.core.cache import cache
 
 from tecken.tasks import sample_task
@@ -108,15 +109,15 @@ def test_handler500(rf):
 
 def test_handler400(rf):
     request = rf.get('/')
-    response = handler400(request)
+    response = handler400(request, NameError())
     assert response.status_code == 400
     assert response['Content-type'] == 'application/json'
     assert json.loads(response.content.decode('utf-8'))['error']
 
 
 def test_handler403(rf):
     request = rf.get('/')
-    response = handler403(request)
+    response = handler403(request, PermissionDenied())
     assert response.status_code == 403
     assert response['Content-type'] == 'application/json'
     assert json.loads(response.content.decode('utf-8'))['error']