How do I fully authenticate a test user in my test cases with django-two-factor-auth to access OTPRequiredMixin views?

Question

I'm trying to write test cases for my class views that are secure behind django-two-factor-auth OTPRequiredMixin. I'm not sure how to write the setUp function to fully authenticate the user through OTP. I've tried self.client.force_login() but when I try to browse to that url in my test function, I am landing on the "Permission Denied" page that prompts to enable two-factor authentication for the user, instead of the expected url.

Permission Denied

The page you requested, enforces users to verify using two-factor authentication for security reasons. You need to enable these security features in order to access this page.

Two-factor authentication is not enabled for your account. Enable two-factor authentication for enhanced account security.

Here's an example of one of the class views:

class ProjectCreateView(OTPRequiredMixin, CreateView):
    model = Project
    template_name = 'project_create.html'
    fields = ['name', 'description']

And here's an example of my setup and a test:

class ProjectTestCase(TestCase):
    def setUp(self):
        self.user = get_user_model().objects.create(
            username='jsmith', first_name='John', last_name='Smith', email='[email protected]', password='secure'
        )
        [...]
        self.client.force_login(self.user)

    def test_project_create(self):
        response = self.client.post(
            '/project/create/', {'name': 'Test Project', 'description': 'A basic test project'}
        )
        self.assertEqual(response.status_code, 200)

Answer 1

I spent a while looking through the django-two-factor-auth source code to figure this out.

https://github.com/jazzband/django-two-factor-auth/blob/d7abfd74363ba27ceb5ea3c61a8784ebffb46c6c/tests/test_views_login.py#L21

The "test_with_backup_token" is where I found an example of what appears to be working for me. It basically creates a backup token and then uses it to complete 2FA authentication.

from django_otp.util import random_hex



# Create your tests here.
class WonderfulTestCase(TestCase):

    def setUp(self):

       # username, email, password
       self.cool_user = User.objects.create_user("bob_is_cool", 
                                                 "[email protected]", 
                                                 "super_cool_password")

        # create OTP stuff including a backup token
        self.cool_user.totpdevice_set.create(name='default', key=random_hex())
        device = self.cool_user.staticdevice_set.create(name='backup')
        device.token_set.create(token='abcdef123')

        # first auth step
        response = self.client.post(reverse('two_factor:login'), {'auth-username': "bob_is_cool", 'auth-password': "super_cool_password", 'login_view-current_step': 'auth'})

        # go to backup step
        response = self.client.post(reverse('two_factor:login'), {'wizard_goto_step': 'backup'})

        # Valid token should be accepted.
        response = self.client.post(reverse('two_factor:login'), {'backup-otp_token': 'abcdef123', 'login_view-current_step': 'backup'})