SecureDrop 1.3.0 QA - script to test orphaned reply API response

orphanreplytest.py

# Script adapted from @rmol's, to test SecureDrop API behaviour with orphaned replies
#
# 1) copy the file to your Admin workstation
# 2) fill in the address and admin account values for your instance
# 3) activate the securedrop admin venv with the command `source ~/Persistent/securedrop/admin/.venv3/bin/activate`
# 4) install the script dependencies with `torify pip install pyotp requests`
# 4) run the script with `python3 orphanreplytest.py
# 5) note times for first and subsequent get_all_sources call 

import time

import pyotp
import requests

JI_ADDRESS="r46csipus22e5nbpkhxwfmdsyyztzku5lj4xup2tfnntf7xiwmw67kqd.onion"
ADMIN_USER="admin"
ADMIN_PWD="manifesto ember snowsuit bullring cinema abacus dumping"
ADMIN_SECRET="cheoecmswmvhfc3s"


def api_url(path):
    return "http://{}{}".format(JI_ADDRESS, path)

def get_first_source(headers):
    response = requests.get(api_url("/api/v1/sources"), headers=headers)
    first_source = response.json()["sources"][0]
    # print(first_source)
    return first_source

def get_source_replies(source, headers):
    response = requests.get(api_url(source["replies_url"]), headers=headers)
    return response.json()


if __name__ == "__main__":
    token_data = {
        "username": ADMIN_USER,
        "passphrase": ADMIN_PWD,
        "one_time_code": pyotp.TOTP(ADMIN_SECRET).now(),
    }
    token_response = requests.post(api_url("/api/v1/token"), json=token_data).json()
    headers = {
        "Authorization": "Token {}".format(token_response["token"])
    }

    fs = get_first_source(headers)
    print("source {} found".format(fs["journalist_designation"]))
    print("reply url: {}".format(fs["replies_url"]))
    replies = get_source_replies(fs, headers)
    print("{:d} replies found for {}".format(len(replies['replies']), fs["journalist_designation"]))
    print(replies)