From de5582fa397d5ae767489ee0bcaac1229b27055c Mon Sep 17 00:00:00 2001
From: Nicolas ROCHE <nroche@entrouvert.com>
Date: Fri, 4 Dec 2020 10:52:24 +0100
Subject: [PATCH] admin: suggest a random key on api new form (#49117)

---
 tests/admin_pages/test_api_access.py | 4 +---
 wcs/admin/api_access.py              | 4 +++-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/admin_pages/test_api_access.py b/tests/admin_pages/test_api_access.py
index af08410b..61afdedc 100644
--- a/tests/admin_pages/test_api_access.py
+++ b/tests/admin_pages/test_api_access.py
@@ -72,29 +72,28 @@ def test_api_access_new(pub):
     assert resp.location == 'http://example.net/backoffice/settings/api-access/'
 
     # go to the page and add an API access
     resp = app.get('/backoffice/settings/api-access/')
     resp = resp.click('New API access')
     resp.form['name'] = 'a new API access'
     resp.form['description'] = 'description'
     resp.form['access_identifier'] = 'new_access'
-    resp.form['access_key'] = '1234'
+    assert len(resp.form['access_key'].value) == 36
     resp = resp.form.submit('submit')
     assert resp.location == 'http://example.net/backoffice/settings/api-access/'
     resp = resp.follow()
     assert 'a new API access' in resp.text
     resp = resp.click('a new API access')
     assert 'API access - a new API access' in resp.text
 
     # check name unicity
     resp = app.get('/backoffice/settings/api-access/new')
     resp.form['name'] = 'a new API access'
     resp.form['access_identifier'] = 'changed'
-    resp.form['access_key'] = '1234'
     resp = resp.form.submit('submit')
     assert resp.html.find('div', {'class': 'error'}).text == 'This name is already used.'
 
     # check access_identifier unicity
     resp.form['name'] = 'new one'
     resp.form['access_identifier'] = 'new_access'
     resp = resp.form.submit('submit')
     assert resp.html.find('div', {'class': 'error'}).text == 'This value is already used.'
@@ -135,17 +134,16 @@ def test_api_access_edit(pub, api_access):
     assert api_access.description == 'bla bla bla'
     assert api_access.access_identifier == 'smith2'
     assert api_access.access_key == '5678'
 
     # check name unicity
     resp = app.get('/backoffice/settings/api-access/new')
     resp.form['name'] = 'Jhon'
     resp.form['access_identifier'] = 'jhon'
-    resp.form['access_key'] = '1234'
     resp = resp.form.submit('submit')
     resp = app.get('/backoffice/settings/api-access/1/')
     resp = resp.click(href='edit')
     resp.form['name'] = 'Jhon'
     resp = resp.form.submit('submit')
     assert resp.html.find('div', {'class': 'error'}).text == 'This name is already used.'
 
 
diff --git a/wcs/admin/api_access.py b/wcs/admin/api_access.py
index 44574763..48dc48d7 100644
--- a/wcs/admin/api_access.py
+++ b/wcs/admin/api_access.py
@@ -9,16 +9,18 @@
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <http://www.gnu.org/licenses/>.
 
+import uuid
+
 from quixote import get_response, redirect
 from quixote.directory import Directory
 from quixote.html import TemplateIO, htmltext
 
 from wcs.qommon import _, errors, template
 from wcs.qommon.form import Form, StringWidget, TextWidget, HtmlWidget
 from wcs.qommon.backoffice.menu import html_top
 from wcs.api_access import ApiAccess
@@ -37,17 +39,17 @@ class ApiAccessUI(object):
                  value=self.api_access.name)
         form.add(TextWidget, 'description', title=_('Description'),
                  cols=40, rows=5,
                  value=self.api_access.description)
         form.add(StringWidget, 'access_identifier', title=_('Access identifier'),
                  required=True, size=30,
                  value=self.api_access.access_identifier)
         form.add(StringWidget, 'access_key', title=_('Access key'), required=True, size=30,
-                 value=self.api_access.access_key)
+                 value=self.api_access.access_key or str(uuid.uuid4()))
         if not self.api_access.is_readonly():
             form.add_submit('submit', _('Submit'))
         form.add_submit('cancel', _('Cancel'))
         return form
 
     def submit_form(self, form):
         name = form.get_widget('name').parse()
         access_identifier = form.get_widget('access_identifier').parse()
-- 
2.29.2

