akvo / akvo-mis / #1382

91%

push

coveralls-python

[#511] Refuse reserved, country and profane workspace names at sign-up (#519)

* [#511] Vendor the LDNOOBW profanity wordlist and pin its two libraries

The workspace-name rules need a profanity list and a list of country
names. `better_profanity` supplies the matching engine but not the
words: its bundled wordlist refuses `hiv`, `menstruation`, `urine` and
`gay` as whole tokens, which on a public-health and WASH information
system is a worse failure than anything it prevents. So the words come
from LDNOOBW's `en` and `fr` files, vendored here under CC BY 4.0 with
the upstream commit recorded, which keeps registration off the network
and makes a future refresh a diff somebody reads.

`pycountry` is held at 24.6.1 on purpose: it is the last release that
supports Python 3.8, which is what the backend image runs. Unpinning it
breaks the build rather than upgrading anything.

The smoke test exists because the usual failure here is a container
still running a pre-requirements image, which surfaces as an unrelated
ModuleNotFoundError somewhere else entirely.

* [#511] Move the duplicated subdomain host checks into one module

`RegisterSerializer` and `TenantRenameSerializer` each carried a
byte-identical copy of the console-host and embed-host checks. Both now
call `utils.workspace_name.host_collision_reason`.

The new module is where the rest of issue #511's rules will go, and the
split it introduces is the scope decision: host collisions are security
properties and apply to every path that sets a subdomain, while the
rules coming next apply only to self-service sign-up. Doing the
de-duplication first means those rules get added in one place instead
of two.

`host_collision_reason` returns the message rather than raising, so the
rules can be tested without a serializer and the caller keeps control
of the status code and the field the error attaches to. No behaviour
changed; the existing register and rename suites are the test.

* [#511] Refuse reserved sys... (continued)

8347 of 9452 branches covered (88.31%)

Branch coverage included in aggregate %.

15382 of 16743 relevant lines covered (91.87%)

0.92 hits per line