apiuser: imposes 256 bits for signature key of new users (#43120)

passerelle/base/models.py

@@ -74,6 +74,8 @@ class ApiUser(models.Model):
     def clean(self):
         if self.keytype and not self.key:
             raise ValidationError(_('Key can not be empty for type %s.') % self.keytype)
+        if self.keytype == 'SIGN' and len(self.key) * 8 < 256:
+            raise ValidationError(_('Signature Key length must be at least 256 bits.'))
 
     def export_json(self):
         return {

tests/test_manager.py

@@ -125,6 +125,15 @@ def test_access_management(app, admin_user):
     resp = resp.form.submit()
     assert 'Key can not be empty' in resp.text
 
+    resp = resp.click('Add API User')
+    resp.form['username'] = 'bar'
+    resp.form['fullname'] = 'Bar'
+    resp.form['keytype'] = 'SIGN'
+    resp.form['key'] = '123'
+    resp = resp.form.submit()
+    assert 'Signature Key length must be at least 256 bits.' in resp.text
+
+
 def test_menu_json(app, admin_user):
     app.get('/manage/menu.json', status=302)