DEV Community: Luis Solis

Unit test newbie - how a novice writes his first unit tests

Luis Solis — Fri, 05 Jun 2020 14:15:21 +0000

I did have to test if that stack overflow code would worked. I made some changes to follow the recommendations of the moment js documentation

function weekDays(month, year) {
    const endDate = moment.utc().year(year).month(month).endOf('month');

    return Array(endDate.date()).fill(0).map((_, i) => moment.utc().year(year).month(month).date(i + 1))
        .map((day) => ({day, week: day.week()}))
        .filter(({week}, i, arr) => arr.findIndex((info) => info.week === week) === i)
        .map(({day, week}) => ({
            week,
            days: Array(7).fill(0).map((_, i) => moment.utc(day).week(week).startOf('week').add(i, 'day'))
        }));

}

Test with Jest Framework

let testAll = (month, year) => {
    const monthYear = moment().year(year).month(month)
    const firstDay = monthYear.startOf('month');
    // console.log(firstDay)
    const endDay = moment().year(year).month(month).endOf("month");
    const calendar = weekDays(month, year);

    describe("testing calendar", () => {
        it('check if first date is in first week / should be true', () => {
            expect(calendar[0]["days"].filter((day) => day.date() === firstDay.date())[0].format("YYYY-MM-DD") === firstDay.format("YYYY-MM-DD")).toBe(true);
        });

       it('check if end date is in end week / should be true', () => {
            expect(calendar[calendar.length - 1]["days"].filter((day) => day.date() === endDay.date())[0].format("YYYY-MM-DD") === endDay.format("YYYY-MM-DD")).toBe(true);
        });
    });
}

Once modified I had to know if it would work, and so the need arise to test the code until 80 years

let locale = ["en", "es", "fr", "de"]
for (let i in locale){
    moment.locale(`${locale[i]}`)
    for (let y = 2000; y < 2100; y++) {
        for (let m = 0; m <= 11; m++) {
            testAll(m, y)
            console.log(m)
        }
    }
}

P.S: I'm not an expert in javascript and it's my first unit test

Django validate_unique method already exists message

Luis Solis — Wed, 22 Apr 2020 23:15:16 +0000

As always to write in stack overflow it's something beginners developers like me can't do

I made this post and get answers from people who have not read the question well.

the question is this: How to show admin users which is the instance that already exists so they can edit it if they want?

it is not a good practice to overwrite the method validate_unique and I don't know if it would be correct to validate unique fields in the clean() method.

but imagine💡 the following situation: you want to show admin users which is the instance that already exists so they can edit it if they want, I think it would be more intuitive when working with thousands of data.

This's what I've done:

the following code is just an example - think about it as a pseudocode although I tried it and it works, I know it could be better

 def clean(self):
        lockup ={}

        unique_togethers = self._meta.unique_together[0]#these could throw an error

        for field in unique_togethers:
            f = self._meta.get_field(field)

            value = getattr(self, f.attname)

            if value is None:
                 continue

            if f.primary_key and not self._state.adding:
                    continue

            lockup[str(field)] = value

        qs = snippet.objects.filter(**lockup)

        if qs.exists and self._state.adding:
            raise ValidationError(
                     format_html('''this object already exist plese edit it on <a href="{}">Edit</a>''', 
                                  reverse('admin:testing_snippet_change', args=(qs[0].pk,))))

Results:

Is this approach correct, how to apply it to the validation_unique method to works in all unique validations?

How to set token authentication via AJAX in Django to secure the API URL

Luis Solis — Mon, 20 Apr 2020 12:40:45 +0000

After asking a question in stack overflow, by the way without finding an answer, but rather questions about why I did it this way, I saw that I was not the only one who had this approach.

So far no one has addressed this issue how to secure GET or POST requests in Django, AJAX, JS only that website can use it nobody else

Someone asked this question and this was my answer:

they always recommend "JWT, token authentication and session authentication", etc. But all those solutions require a user registered, and what happens if I want to protect a search autocomplete field or anything on the frontend that is public.

I have created a rest framework custom permission and I using django csrfmiddlewaretoken:

it behaves the same like Django post form, csrf token middleware send an input type hidden with

#{% csrf_token %}

(input hidden with the token) but and this case only needs

#{{ csrf_token }}

(the token), Django compares the request token with cookie token which are encrypted

permission.py
    from django.middleware.csrf import _compare_salted_tokens, rotate_token
    from rest_framework.permissions import BasePermission


    class HasCsrfTokenValid(BasePermission):
        def has_permission(self, request, view):
            token_valid = False
            try:
                csrf_token = request.headers.get("api-csrftoken")
                csrf_cookie = request.META.get("CSRF_COOKIE")

                """
                Check if both alphanumerics(strings) values are differents to prevent 
                a malicious user get the csrf cookie and send it from the ajax.
                """
                if csrf_token == csrf_cookie:
                    rotate_token(request)
                    return False

                token_valid =  _compare_salted_tokens(csrf_token, csrf_cookie)
            except ValueError: # if csrf_token & csrf_cookie are not a valid alphanumeric
                return False
            return token_valid

add permission class to api view

#views.py
class SnippetSearchAPI(generics.ListAPIView):
    model = Snippet
    serializer_class = SnippetSearcSerializer
    permission_classes = [HasCsrfTokenValid,]
    queryset = Snippet.objects.all()


//Ajax request:

$('#search-snippet').keyup(function () {
    $.ajax({
       url:"{% url 'snippet-search-space:api' %}",
       headers:{'api-csrftoken':'{{ csrf_token }}'},
       success:function(data){
         console.log(data)
       }
   });
 });

conclusion:

So far I have solved it, but I don't know the security implications for the future, I tried it and it seems safe. but there will always be someone out there who can hack this, at least I think so.

what do you think?