From 1cdd94c5464587af12e87c2a0713c20fdc081fff Mon Sep 17 00:00:00 2001
From: Paul Marillonnet <pmarillonnet@entrouvert.com>
Date: Wed, 30 Nov 2022 11:15:12 +0100
Subject: [PATCH] auth_fc: discard deprecated scopes (#71868)

---
 .../migrations/0005_fcauthenticator.py             |  2 --
 src/authentic2_auth_fc/models.py                   |  4 +---
 tests/auth_fc/test_auth_fc.py                      |  6 +++---
 tests/test_manager_authenticators.py               | 14 ++++++++++++++
 4 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/authentic2_auth_fc/migrations/0005_fcauthenticator.py b/src/authentic2_auth_fc/migrations/0005_fcauthenticator.py
index 008d264e4..fae9f4285 100644
--- a/src/authentic2_auth_fc/migrations/0005_fcauthenticator.py
+++ b/src/authentic2_auth_fc/migrations/0005_fcauthenticator.py
@@ -63,8 +63,6 @@ class Migration(migrations.Migration):
                                 ('family_name', 'family name (family_name)'),
                                 ('email', 'email (email)'),
                                 ('preferred_username', 'usual family name (preferred_username)'),
-                                ('address', 'address (address)'),
-                                ('phone', 'phone (phone)'),
                                 ('identite_pivot', 'core id (identite_pivot)'),
                                 ('profile', 'profile (profile)'),
                                 ('birth', 'birth profile (birth)'),
diff --git a/src/authentic2_auth_fc/models.py b/src/authentic2_auth_fc/models.py
index 304cc0bfb..f767c7201 100644
--- a/src/authentic2_auth_fc/models.py
+++ b/src/authentic2_auth_fc/models.py
@@ -40,8 +40,6 @@ SCOPE_CHOICES = [
     ('family_name', _('family name (family_name)')),
     ('email', _('email (email)')),
     ('preferred_username', _('usual family name (preferred_username)')),
-    ('address', _('address (address)')),
-    ('phone', _('phone (phone)')),
     ('identite_pivot', _('core id (identite_pivot)')),
     ('profile', _('profile (profile)')),
     ('birth', _('birth profile (birth)')),
@@ -90,7 +88,7 @@ class FcAuthenticator(BaseAuthenticator):
 
     def get_scopes_display(self):
         scope_dict = {k: v for k, v in SCOPE_CHOICES}
-        return ', '.join(str(scope_dict[scope]) for scope in self.scopes)
+        return ', '.join(str(scope_dict[scope]) for scope in self.scopes if scope in scope_dict)
 
     @property
     def authorize_url(self):
diff --git a/tests/auth_fc/test_auth_fc.py b/tests/auth_fc/test_auth_fc.py
index a3852306d..1a1bf5ef0 100644
--- a/tests/auth_fc/test_auth_fc.py
+++ b/tests/auth_fc/test_auth_fc.py
@@ -326,14 +326,14 @@ def test_no_password_with_fc_account_can_reset_password(app, db, mailoutbox):
 def test_login_with_missing_required_attributes(settings, app, franceconnect):
     Attribute.objects.create(label='Title', name='title', required=True, user_editable=True, kind='title')
     Attribute.objects.create(
-        label='Phone', name='phone', required=True, user_editable=True, kind='phone_number'
+        label='Birth country', name='birthcountry', required=True, user_editable=True, kind='string'
     )
 
     assert User.objects.count() == 0
     assert models.FcAccount.objects.count() == 0
 
-    franceconnect.user_info['phone'] = '0102030405'
-    settings.A2_FC_USER_INFO_MAPPINGS = {'phone': {'ref': 'phone'}}
+    franceconnect.user_info['birthcountry'] = '99512'  # Solomon Islands
+    settings.A2_FC_USER_INFO_MAPPINGS = {'birthcountry': {'ref': 'birthcountry'}}
 
     response = app.get('/login/?service=portail&next=/idp/')
     response = response.click(href='callback')
diff --git a/tests/test_manager_authenticators.py b/tests/test_manager_authenticators.py
index e60b09e18..7b8d7873a 100644
--- a/tests/test_manager_authenticators.py
+++ b/tests/test_manager_authenticators.py
@@ -420,6 +420,9 @@ def test_authenticators_fc(app, superuser):
         'scopes',
         None,
     ]
+    assert 'phone' not in resp.pyquery('#id_scopes').html()
+    assert 'address' not in resp.pyquery('#id_scopes').html()
+
     resp.form['platform'] = 'prod'
     resp.form['client_id'] = '211286433e39cce01db448d80181bdfd005554b19cd51b3fe7943f6b3b86ab6k'
     resp.form['client_secret'] = '211286433e39cce01db448d80181bdfd005554b19cd51b3fe7943f6b3b86ab6d'
@@ -442,6 +445,17 @@ def test_authenticators_fc(app, superuser):
     resp = app.get('/manage/authenticators/')
     assert 'class="section disabled"' not in resp.text
 
+    provider.refresh_from_db()
+    provider.scopes.extend(['phone', 'address'])  # deprecated scopes
+    provider.save()
+
+    resp = app.get(provider.get_absolute_url())
+    resp = resp.click('Edit')
+    resp.form.submit().follow()
+    provider.refresh_from_db()
+    assert 'phone' not in provider.scopes
+    assert 'address' not in provider.scopes
+
 
 def test_authenticators_saml(app, superuser, ou1, ou2):
     resp = login(app, superuser, path='/manage/authenticators/')
-- 
2.38.1

