Merge pull request #217 from edx/ahtisham/PROD-1916-p

Error incase of disabled user social login

openedx/core/djangoapps/auth_exchange/forms.py

@@ -187,6 +187,17 @@ class AccessTokenExchangeForm(forms.Form):
             user = backend.do_auth(access_token, allow_inactive_user=True)
         except (HTTPError, AuthException):
             pass
+        # check if user is disabled
+        if isinstance(user, User) and not user.has_usable_password():
+            self.request.social_strategy.clean_partial_pipeline(access_token)
+            raise OAuthValidationError(
+                {
+                    "error": "account_disabled",
+                    "error_description": 'user account is disabled',
+                    "error_code": 403
+                }
+            )
+
         if user and isinstance(user, User):
             self.cleaned_data["user"] = user
         else:

openedx/core/djangoapps/auth_exchange/tests/test_views.py

@@ -42,13 +42,16 @@ class AccessTokenExchangeViewTest(AccessTokenExchangeTestMixin):
         super(AccessTokenExchangeViewTest, self).tearDown()
         Partial.objects.all().delete()
 
-    def _assert_error(self, data, expected_error, expected_error_description):
+    def _assert_error(self, data, expected_error, expected_error_description, error_code=None):
         response = self.csrf_client.post(self.url, data)
-        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.status_code, error_code if error_code else 400)
         self.assertEqual(response["Content-Type"], "application/json")
+        expected_data = {u"error": expected_error, u"error_description": expected_error_description}
+        if error_code:
+            expected_data['error_code'] = error_code
         self.assertEqual(
             json.loads(response.content.decode('utf-8')),
-            {u"error": expected_error, u"error_description": expected_error_description}
+            expected_data
         )
 
     def _assert_success(self, data, expected_scopes):
@@ -127,6 +130,15 @@ class AccessTokenExchangeViewTest(AccessTokenExchangeTestMixin):
         """
         pass
 
+    def test_disabled_user(self):
+        """
+        Test if response status code is correct in case of disabled user.
+        """
+        self.user.set_unusable_password()
+        self.user.save()
+        self._setup_provider_response(success=True)
+        self._assert_error(self.data, "account_disabled", "user account is disabled", 403)
+
 
 @unittest.skipUnless(TPA_FEATURE_ENABLED, TPA_FEATURES_KEY + " not enabled")
 @httpretty.activate

openedx/core/djangoapps/auth_exchange/tests/utils.py

@@ -28,7 +28,7 @@ class AccessTokenExchangeTestMixin(ThirdPartyOAuthTestMixin):
             "client_id": self.client_id,
         }
 
-    def _assert_error(self, _data, _expected_error, _expected_error_description):
+    def _assert_error(self, _data, _expected_error, _expected_error_description, error_code):
         """
         Given request data, execute a test and check that the expected error
         was returned (along with any other appropriate assertions).

openedx/core/djangoapps/auth_exchange/views.py

@@ -114,7 +114,8 @@ class DOTAccessTokenExchangeView(AccessTokenExchangeBase, DOTAccessTokenView):
         """
         Return an error response consisting of the errors in the form
         """
-        return Response(status=400, data=form_errors, **kwargs)
+        error_code = form_errors.get('error_code', 400)
+        return Response(status=error_code, data=form_errors, **kwargs)
 
 
 class LoginWithAccessTokenView(APIView):