fix: [Trust mark status endpoint] HTTP POST instead of GET, aligned t…

…o DRAFT 25

docs/technical_specifications/AUTHORITY.md

@@ -86,7 +86,8 @@ An entity MAY use the resolve endpoint to fetch resolved metadata and trust mark
 
 #### trust mark status
 
-This is to allow an entity to check whether a trust mark is still active or not. The query MUST be sent to the trust mark issuer.
+This is to allow an entity to check whether a trust mark is still active or not. The query MUST be sent to the trust mark issuer and using HTTP POST.
+For sake of readability here an example in GET format (that shouldn't, it must be in POST).
 
 - `http://127.0.0.1:8000/trust_mark_status/?id=https://www.spid.gov.it/openid-federation/agreement/op-public/&sub=http://127.0.0.1:8000/oidc/op`
 - `http://127.0.0.1:8000/trust_mark_status/?trust_mark= ...`

spid_cie_oidc/__init__.py

@@ -1 +1 @@
-__version__ = "0.8.8"
+__version__ = "0.8.9"

spid_cie_oidc/authority/tests/test_02_trust_anchor_intermediary.py

@@ -254,7 +254,7 @@ def test_trust_mark_status_endpoint(self):
         url = reverse("oidcfed_trust_mark_status")
 
         c = Client()
-        res = c.get(
+        res = c.post(
             url,
             data={
                 "id": self.rp_assigned_profile.profile.profile_id,
@@ -264,7 +264,7 @@ def test_trust_mark_status_endpoint(self):
         self.assertTrue(res.status_code == 200)
         self.assertTrue(res.json() == {"active": True})
 
-        res = c.get(
+        res = c.post(
             url,
             data={
                 "trust_mark": self.rp_assigned_profile.trust_mark["trust_mark"],

spid_cie_oidc/authority/views.py

@@ -187,14 +187,14 @@ def advanced_entity_listing(request):
 )
 def trust_mark_status(request):
     failed_data = {"active": False}
-    if request.GET.get("sub", "") and request.GET.get("id", ""):
-        sub = request.GET["sub"]
-        _id = request.GET["id"]
-
-    elif request.GET.get("trust_mark", ""):
+    if request.POST.get("sub", "") and request.POST.get("id", ""):
+        sub = request.POST["sub"]
+        _id = request.POST["id"]
+    
+    elif request.POST.get("trust_mark", ""):
         try:
-            unpad_jwt_head(request.GET["trust_mark"])
-            payload = unpad_jwt_payload(request.GET["trust_mark"])
+            unpad_jwt_head(request.POST["trust_mark"])
+            payload = unpad_jwt_payload(request.POST["trust_mark"])
             sub = payload.get("sub", "")
             _id = payload.get("id", "")
         except Exception:

spid_cie_oidc/onboarding/tests/test_02_tools.py

@@ -206,17 +206,17 @@ def test_validate_metadata(self):
 
     def test_validating_trust_mark(self):
         url = reverse("oidc_onboarding_validating_trustmark")
-        res = self.client.get(url)
+        res = self.client.post(url)
         self.assertEqual(res.status_code, 200)
 
-        res = self.client.get(url, {
+        res = self.client.post(url, data={
             "id": "https://www.ciao.gov.it/certification/rp",
             "sub": "http://ciao.it/oidc/rp/",
         })
         self.assertEqual(res.status_code, 200)
         self.assertIn("alert-error", res.content.decode())
 
-        res = self.client.get(url, {
+        res = self.client.post(url, data={
             "id": "https://www.spid.gov.it/certification/rp",
             "sub": "http://rp-test.it/oidc/rp/",
         })
@@ -226,7 +226,7 @@ def test_validating_trust_mark(self):
 
         trust_mark = self.rp_assigned_profile.trust_mark_as_jws
 
-        res = self.client.get(url, {
+        res = self.client.post(url, data={
             "trust_mark": trust_mark,
         })
         self.assertEqual(res.status_code, 200)

spid_cie_oidc/onboarding/views.py

@@ -168,8 +168,8 @@ def onboarding_resolve_statement(request):
 
 
 def onboarding_validating_trustmark(request):
-    if "id" in request.GET or "trust_mark" in request.GET:
-        form = OnboardingValidatingTrustMarkForm(request.GET)
+    if "id" in request.POST or "trust_mark" in request.POST:
+        form = OnboardingValidatingTrustMarkForm(request.POST)
     else:
         form = OnboardingValidatingTrustMarkForm()