class ApplicationTestMixin(object): def setUp(self): super(ApplicationTestMixin, self).setUp() self.config = {"db": {"url": "sqlite://"}} self.great = create_app(config=self.config) self.app = TestApp(wsgi.create_app(self.great)) METADATA.create_all(self.great.bin.provide("engine").connect()) def create(self, **params): return self.app.post_json(self.url.to_text(), params=params).json def delete(self, **params): return self.app.delete_json(self.url.to_text(), params=params) def list(self, **params): return self.app.get(self.url.to_text(), params=params).json def tracked(self, **params): return self.app.get( self.url.child(u"tracked").to_text(), params=params, ).json def test_invalid_json(self): self.app.post(self.url.to_text(), params="", status=400) def test_unknown_method(self): self.app.request(self.url.to_text(), method=b"TRACE", status=405)
class TestDecorator(unittest.TestCase): """ Ensure the decorators are applied and route correctly """ def setUp(self): """ Start each test with a new Router instance """ self.app = TestApp(router) def test_root_route(self): """ WebTest a basic route """ resp = self.app.get('/foo') self.assertEqual(resp.status_int, 200) self.assertEqual(resp.content_type, 'text/plain') self.assertIn('wor', resp) self.assertEqual(1, len(router.mapping)) def test_route_not_found(self): """ WebTest to make sure a route doesn't show up """ resp = self.app.get('/bar', status=404) self.assertEqual(resp.status_int, 404) def test_method_not_allowed(self): """ WebTest to check that method is not accepted """ for method in ['HEAD', 'GET']: resp = self.app.request('/foo', method=method) self.assertEqual(resp.status_int, 200) for method in ['POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS', 'TRACE']: resp = self.app.request('/foo', method=method, status=405) self.assertEqual(resp.status_int, 405) @unittest.skip("WebTest does not support HTTP 501 NOT IMPLEMENTED yet") def test_not_implemented(self): """ WebTest to check response returns 'NOT IMPLEMENTED' on unrecognized methods """ resp = self.app.request('/foo', method='HERPS', status=501) self.assertEqual(resp.status_int, 501)
def test_request(testapp: TestApp, url: str, method: str, expected_status: HTTPStatus): response = testapp.request(url, method=method, expect_errors=True) # type: TestResponse assert response.status_code == expected_status assert 'json' in response.content_type assert isinstance(response.json, Dict) assert len(response.json) > 0
def test_bad_rest(self): class ThingsController(RestController): pass class RootController(object): things = ThingsController() # create the app app = TestApp(make_app(RootController())) # test get_all r = app.get('/things', status=404) assert r.status_int == 404 # test get_one r = app.get('/things/1', status=404) assert r.status_int == 404 # test post r = app.post('/things', {'value': 'one'}, status=404) assert r.status_int == 404 # test edit r = app.get('/things/1/edit', status=404) assert r.status_int == 404 # test put r = app.put('/things/1', {'value': 'ONE'}, status=404) # test put with _method parameter and GET r = app.get('/things/1?_method=put', {'value': 'ONE!'}, status=405) assert r.status_int == 405 # test put with _method parameter and POST r = app.post('/things/1?_method=put', {'value': 'ONE!'}, status=404) assert r.status_int == 404 # test get delete r = app.get('/things/1/delete', status=404) assert r.status_int == 404 # test delete r = app.delete('/things/1', status=404) assert r.status_int == 404 # test delete with _method parameter and GET r = app.get('/things/1?_method=DELETE', status=405) assert r.status_int == 405 # test delete with _method parameter and POST r = app.post('/things/1?_method=DELETE', status=404) assert r.status_int == 404 # test "RESET" custom action with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things', method='RESET', status=404) assert r.status_int == 404
def test_bad_rest(self): class ThingsController(RestController): pass class RootController(object): things = ThingsController() # create the app app = TestApp(make_app(RootController())) # test get_all r = app.get('/things', status=405) assert r.status_int == 405 # test get_one r = app.get('/things/1', status=405) assert r.status_int == 405 # test post r = app.post('/things', {'value': 'one'}, status=405) assert r.status_int == 405 # test edit r = app.get('/things/1/edit', status=405) assert r.status_int == 405 # test put r = app.put('/things/1', {'value': 'ONE'}, status=405) # test put with _method parameter and GET r = app.get('/things/1?_method=put', {'value': 'ONE!'}, status=405) assert r.status_int == 405 # test put with _method parameter and POST r = app.post('/things/1?_method=put', {'value': 'ONE!'}, status=405) assert r.status_int == 405 # test get delete r = app.get('/things/1/delete', status=405) assert r.status_int == 405 # test delete r = app.delete('/things/1', status=405) assert r.status_int == 405 # test delete with _method parameter and GET r = app.get('/things/1?_method=DELETE', status=405) assert r.status_int == 405 # test delete with _method parameter and POST r = app.post('/things/1?_method=DELETE', status=405) assert r.status_int == 405 # test "RESET" custom action with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things', method='RESET', status=405) assert r.status_int == 405
class TestTASRAppClient(TASRTestCase): ''' This is a wrapper class to encapsulate the route_to_testapp method, allowing us to use both httmock (in the test) and requests (in the client). ''' def setUp(self): self.app = APP self.tasr = TestApp(APP) @httmock.urlmatch(netloc=HOST_PORT) def route_to_testapp(self, url, requests_req): '''This is some tricky stuff. To test the client methods, we need the responses package calls to route to our webtest TestApp WSGI wrapper. We use httmock to intercept the requests call, then we handle processing in this function instead -- calling the TestApp wrapper. ''' if url.geturl() != requests_req.url: logging.warn('%s != %s', url.geturl(), requests_req.url) # create a webtest TestRequest from the requests PreparedRequest webtest_req = TestRequest.blank(requests_req.url, method=requests_req.method, body=requests_req.body, headers=requests_req.headers) # have the TestApp wrapper process the TestRequest webtest_resp = self.tasr.request(webtest_req) '''webtest responses support multiple headers with the same key, while the requests package holds them in a case-insensitive dict of lists of (key,value) tuples. We need to translate by hand here to keep cases with multiple headers with the same key ''' headers = HTTPHeaderDict() for key, value in webtest_resp.headers.iteritems(): headers.add(key, value) # use the webtest TestResponse to build a new requests HTTPResponse requests_http_resp = HTTPResponse(body=webtest_resp.body, headers=headers, status=webtest_resp.status_code) # get an HTTPAdaptor, then use it to build the requests Response object adap = requests.adapters.HTTPAdapter() requests_resp = adap.build_response(requests_req, requests_http_resp) '''For some reason, we need to explicitly set the _content attribute after the response object is built -- it is already in there as raw.data, but it doesn't make it to _content, so it never hits content() without this intervention. ''' requests_resp._content = webtest_resp.body return requests_resp
class TestLoginController(TestController): def setUp(self): self.app = TestApp("config:test.ini", relative_to="/Users/tonky/projects/Croner") def tearDown(self): pass def test_login_index(self): response = self.app.get(url(controller='login')) ok_('Login' in response.body) def test_bad_password(self): response = self.app.request("/login/save", POST={'login': '******', 'password': '******'}) ok_('wrong' in response.body) def test_do_login(self): response = self.app.request("/login/save", POST={'login': '******', 'password': '******'}) eq_(response.status, "302 Found") home = response.follow() ok_('Welcome, Joe!' in home.body)
class TestJWTAuthenticationPolicy_with_RSA(unittest.TestCase): """Testcases for the JWTAuthenticationPolicy class.""" def setUp(self): self.config = Configurator( settings={ "jwtauth.private_key_file": 'pyramid_jwtauth/tests/testkey', "jwtauth.public_key_file": 'pyramid_jwtauth/tests/testkey.pub', "jwtauth.algorithm": "RS256", }) self.config.include("pyramid_jwtauth") self.config.add_route("public", "/public") self.config.add_view(stub_view_public, route_name="public") self.config.add_route("auth", "/auth") self.config.add_view(stub_view_auth, route_name="auth") self.config.add_route("groups", "/groups") self.config.add_view(stub_view_groups, route_name="groups") self.app = TestApp(self.config.make_wsgi_app()) self.policy = self.config.registry.queryUtility(IAuthenticationPolicy) def _make_request(self, *args, **kwds): return make_request(self.config, *args, **kwds) def test_from_settings_with_RSA_public_private_key(self): self.assertEqual(self.policy.algorithm, 'RS256') self.assertEqual(self.policy.master_secret, None) # from Crypto.PublicKey import RSA with open('pyramid_jwtauth/tests/testkey', 'r') as rsa_priv_file: private_key = rsa_priv_file.read() self.assertEqual(self.policy.private_key, private_key) with open('pyramid_jwtauth/tests/testkey.pub', 'r') as rsa_pub_file: public_key = rsa_pub_file.read() self.assertEqual(self.policy.public_key, public_key) self.assertNotEqual(private_key, public_key) req = self._make_request("/auth") claims = make_claims(userid="*****@*****.**") jwt_authenticate_request(req, claims, private_key, 'RS256') token = pyramid_jwtauth.utils.parse_authz_header(req)["token"] userid = self.policy.authenticated_userid(req) self.assertEqual(userid, "*****@*****.**") import jwt payload = jwt.decode(token, key=public_key, verify=True) self.assertIn('sub', payload) self.assertEqual(payload['sub'], "*****@*****.**") r = self.app.request(req) self.assertEqual(r.body, b"*****@*****.**")
class TestJWTAuthenticationPolicy_with_RSA(unittest.TestCase): """Testcases for the JWTAuthenticationPolicy class.""" def setUp(self): self.config = Configurator(settings={ "jwtauth.private_key_file": 'pyramid_jwtauth/tests/testkey', "jwtauth.public_key_file": 'pyramid_jwtauth/tests/testkey.pub', "jwtauth.algorithm": "RS256", }) self.config.include("pyramid_jwtauth") self.config.add_route("public", "/public") self.config.add_view(stub_view_public, route_name="public") self.config.add_route("auth", "/auth") self.config.add_view(stub_view_auth, route_name="auth") self.config.add_route("groups", "/groups") self.config.add_view(stub_view_groups, route_name="groups") self.app = TestApp(self.config.make_wsgi_app()) self.policy = self.config.registry.queryUtility(IAuthenticationPolicy) def _make_request(self, *args, **kwds): return make_request(self.config, *args, **kwds) def test_from_settings_with_RSA_public_private_key(self): self.assertEqual(self.policy.algorithm, 'RS256') self.assertEqual(self.policy.master_secret, None) # from Crypto.PublicKey import RSA with open('pyramid_jwtauth/tests/testkey', 'r') as rsa_priv_file: private_key = rsa_priv_file.read() self.assertEqual(self.policy.private_key, private_key) with open('pyramid_jwtauth/tests/testkey.pub', 'r') as rsa_pub_file: public_key = rsa_pub_file.read() self. assertEqual(self.policy.public_key, public_key) self.assertNotEqual(private_key, public_key) req = self._make_request("/auth") claims = make_claims(userid="*****@*****.**") jwt_authenticate_request(req, claims, private_key, 'RS256') token = pyramid_jwtauth.utils.parse_authz_header(req)["token"] userid = self.policy.authenticated_userid(req) self.assertEqual(userid, "*****@*****.**") import jwt payload = jwt.decode(token, key=public_key, verify=True) self.assertIn('sub', payload) self.assertEqual(payload['sub'], "*****@*****.**") r = self.app.request(req) self.assertEqual(r.body, b"*****@*****.**")
def test_basic_rest(self): class OthersController(object): @expose() def index(self): return 'OTHERS' @expose() def echo(self, value): return str(value) class ThingsController(RestController): data = ['zero', 'one', 'two', 'three'] _custom_actions = {'count': ['GET'], 'length': ['GET', 'POST']} others = OthersController() @expose() def get_one(self, id): return self.data[int(id)] @expose('json') def get_all(self): return dict(items=self.data) @expose() def length(self, id, value=None): length = len(self.data[int(id)]) if value: length += len(value) return str(length) @expose() def get_count(self): return str(len(self.data)) @expose() def new(self): return 'NEW' @expose() def post(self, value): self.data.append(value) response.status = 302 return 'CREATED' @expose() def edit(self, id): return 'EDIT %s' % self.data[int(id)] @expose() def put(self, id, value): self.data[int(id)] = value return 'UPDATED' @expose() def get_delete(self, id): return 'DELETE %s' % self.data[int(id)] @expose() def delete(self, id): del self.data[int(id)] return 'DELETED' @expose() def reset(self): return 'RESET' @expose() def post_options(self): return 'OPTIONS' @expose() def options(self): abort(500) @expose() def other(self): abort(500) class RootController(object): things = ThingsController() # create the app app = TestApp(make_app(RootController())) # test get_all r = app.get('/things') assert r.status_int == 200 assert r.body == b_(dumps(dict(items=ThingsController.data))) # test get_one for i, value in enumerate(ThingsController.data): r = app.get('/things/%d' % i) assert r.status_int == 200 assert r.body == b_(value) # test post r = app.post('/things', {'value': 'four'}) assert r.status_int == 302 assert r.body == b_('CREATED') # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('four') # test edit r = app.get('/things/3/edit') assert r.status_int == 200 assert r.body == b_('EDIT three') # test put r = app.put('/things/4', {'value': 'FOUR'}) assert r.status_int == 200 assert r.body == b_('UPDATED') # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('FOUR') # test put with _method parameter and GET r = app.get('/things/4?_method=put', {'value': 'FOUR!'}, status=405) assert r.status_int == 405 # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('FOUR') # test put with _method parameter and POST r = app.post('/things/4?_method=put', {'value': 'FOUR!'}) assert r.status_int == 200 assert r.body == b_('UPDATED') # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('FOUR!') # test get delete r = app.get('/things/4/delete') assert r.status_int == 200 assert r.body == b_('DELETE FOUR!') # test delete r = app.delete('/things/4') assert r.status_int == 200 assert r.body == b_('DELETED') # make sure it works r = app.get('/things') assert r.status_int == 200 assert len(loads(r.body.decode())['items']) == 4 # test delete with _method parameter and GET r = app.get('/things/3?_method=DELETE', status=405) assert r.status_int == 405 # make sure it works r = app.get('/things') assert r.status_int == 200 assert len(loads(r.body.decode())['items']) == 4 # test delete with _method parameter and POST r = app.post('/things/3?_method=DELETE') assert r.status_int == 200 assert r.body == b_('DELETED') # make sure it works r = app.get('/things') assert r.status_int == 200 assert len(loads(r.body.decode())['items']) == 3 # test "RESET" custom action r = app.request('/things', method='RESET') assert r.status_int == 200 assert r.body == b_('RESET') # test "RESET" custom action with _method parameter r = app.get('/things?_method=RESET') assert r.status_int == 200 assert r.body == b_('RESET') # test the "OPTIONS" custom action r = app.request('/things', method='OPTIONS') assert r.status_int == 200 assert r.body == b_('OPTIONS') # test the "OPTIONS" custom action with the _method parameter r = app.post('/things', {'_method': 'OPTIONS'}) assert r.status_int == 200 assert r.body == b_('OPTIONS') # test the "other" custom action with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things/other', method='MISC', status=405) assert r.status_int == 405 # test the "other" custom action with the _method parameter r = app.post('/things/other', {'_method': 'MISC'}, status=405) assert r.status_int == 405 # test the "others" custom action with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things/others/', method='MISC') assert r.status_int == 200 assert r.body == b_('OTHERS') # test the "others" custom action missing trailing slash with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things/others', method='MISC', status=302) assert r.status_int == 302 # test the "others" custom action with the _method parameter r = app.get('/things/others/?_method=MISC') assert r.status_int == 200 assert r.body == b_('OTHERS') # test an invalid custom action r = app.get('/things?_method=BAD', status=404) assert r.status_int == 404 # test custom "GET" request "count" r = app.get('/things/count') assert r.status_int == 200 assert r.body == b_('3') # test custom "GET" request "length" r = app.get('/things/1/length') assert r.status_int == 200 assert r.body == b_(str(len('one'))) # test custom "GET" request through subcontroller r = app.get('/things/others/echo?value=test') assert r.status_int == 200 assert r.body == b_('test') # test custom "POST" request "length" r = app.post('/things/1/length', {'value': 'test'}) assert r.status_int == 200 assert r.body == b_(str(len('onetest'))) # test custom "POST" request through subcontroller r = app.post('/things/others/echo', {'value': 'test'}) assert r.status_int == 200 assert r.body == b_('test')
class TestController(unittest.TestCase): def setUp(self): self.app = TestApp(server(get_config())) def tearDown(self): pass # location str parser def test_01_LOCATION_load_location(self): """ location str parse and construct server info from server.txt""" loc_str = ':test/server0.txt, local:test/server1.txt, both:(hoge)test/server2.txt (gere)test/server3.txt, remote:test/server4.txt' loc = Location(loc_str) self.assertTrue(loc.has_location('')) self.assertTrue(loc.has_location('local')) self.assertTrue(loc.has_location('remote')) self.assertTrue(loc.has_location('both')) self.assertFalse(loc.has_location('nothing')) self.assertEqual({'webcache': {'http://127.0.0.1:8080': 'http://127.0.0.1:8888'}, 'container_prefix': {'http://127.0.0.1:8080': None}, 'swift': [['http://127.0.0.1:8080']]}, loc.servers_of('')) self.assertEqual({'webcache': {'http://127.0.0.1:8080': None}, 'container_prefix': {'http://127.0.0.1:8080': None}, 'swift': [['http://127.0.0.1:8080']]}, loc.servers_of('local')) self.assertEqual({'webcache': {'http://127.0.0.1:18080': None, 'http://127.0.0.1:8080': None}, 'container_prefix': {'http://127.0.0.1:18080': 'gere', 'http://127.0.0.1:8080': 'hoge'}, 'swift': [['http://127.0.0.1:8080'], ['http://127.0.0.1:18080']]}, loc.servers_of('both')) self.assertEqual({'webcache': {'http://127.0.0.1:18080': None}, 'container_prefix': {'http://127.0.0.1:18080': None}, 'swift': [['http://127.0.0.1:18080']]}, loc.servers_of('remote')) self.assertEqual([['http://127.0.0.1:8080']], loc.swift_of('')) self.assertEqual([['http://127.0.0.1:8080']], loc.swift_of('local')) self.assertEqual([['http://127.0.0.1:8080'], ['http://127.0.0.1:18080']], loc.swift_of('both')) self.assertEqual([['http://127.0.0.1:18080']], loc.swift_of('remote')) self.assertFalse(loc.is_merged('')) self.assertFalse(loc.is_merged('local')) self.assertTrue(loc.is_merged('both')) self.assertFalse(loc.is_merged('remote')) self.assertEqual(loc.is_merged('nothing') ,None) self.assertEqual(None, loc.container_prefix_of('', 'http://127.0.0.1:8080')) self.assertEqual('hoge', loc.container_prefix_of('both', 'http://127.0.0.1:8080')) self.assertEqual('gere', loc.container_prefix_of('both', 'http://127.0.0.1:18080')) self.assertEqual({'http://127.0.0.1:8080': 'http://127.0.0.1:8888'}, loc.webcache_of('')) self.assertEqual({'http://127.0.0.1:8080': None}, loc.webcache_of('local')) self.assertEqual({'http://127.0.0.1:18080': None, 'http://127.0.0.1:8080': None}, loc.webcache_of('both')) self.assertEqual({'http://127.0.0.1:18080': None}, loc.webcache_of('remote')) self.assertEqual({'http://127.0.0.1:8080': None}, loc.container_prefixes_of('')) self.assertEqual({'http://127.0.0.1:8080': None}, loc.container_prefixes_of('local')) self.assertEqual({'http://127.0.0.1:18080': 'gere', 'http://127.0.0.1:8080': 'hoge'}, loc.container_prefixes_of('both')) self.assertEqual({'http://127.0.0.1:18080': None}, loc.container_prefixes_of('remote')) self.assertEqual( ['http://127.0.0.1:8080'], loc.servers_by_container_prefix_of('both', 'hoge')) self.assertEqual( ['http://127.0.0.1:18080'], loc.servers_by_container_prefix_of('both', 'gere')) self.assertEqual('http://127.0.0.1:9999', loc._sock_connect_faster(['http://127.0.0.1:8080', 'http://127.0.0.1:18080', 'http://127.0.0.1:9999'])[2]) loc_str = ':test/server0.txt test/server1.txt' loc = Location(loc_str) self.assertEqual(True, loc.is_merged('')) def test_02_LOCATION_update_location(self): """ server.txt reload if update.""" loc_str = ':test/server0.txt, local:test/server1.txt, both:(hoge)test/server2.txt (gere)test/server3.txt, remote:test/server4.txt' loc = Location(loc_str) old_server2_swifts = loc.swift_of('remote') with open('test/server4.txt', 'r') as f: olddata = f.read() with open('test/server4.txt', 'w') as f: f.write('http://192.168.2.1:8080') loc.reload() with open('test/server4.txt', 'w') as f: f.write(olddata) self.assertEqual([['http://192.168.2.1:8080']], loc.swift_of('remote')) def test_LOCATION_invalid_location_file(self): loc_str = ':test/server00.txt' self.assertRaises(ValueError, Location, loc_str) def test_LOCATION_invalid_location_str(self): loc_str = 'test/server0.txt' self.assertRaises(ValueError, Location, loc_str) loc_str = None self.assertRaises(ValueError, Location, loc_str) # rewrite url def test_03_REWRITE_PATH_blank(self): """ rewrite path when location prefix is blank.""" res = self.app.get('/v1.0/AUTH_test', headers=dict(X_Auth_Token='t'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy0_srv.env['PATH_INFO']) def test_04_REWRITE_PATH_local(self): """ rewrite path when location prefix is 'local'.""" res = self.app.get('/local/v1.0/AUTH_test', headers=dict(X_Auth_Token='t'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy0_srv.env['PATH_INFO']) def test_05_REWRITE_PATH_both(self): """ rewrite path when location prefix is 'both' (merge mode).""" res = self.app.get('/both/v1.0/AUTH_test', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy0_srv.env['PATH_INFO']) self.assertEqual('/v1.0/AUTH_test', proxy1_srv.env['PATH_INFO']) def test_06_REWRITE_PATH_remote(self): """ rewrite path when location prefix is 'remote'.""" res = self.app.get('/remote/v1.0/AUTH_test', headers=dict(X_Auth_Token='t'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy1_srv.env['PATH_INFO']) # auth request in normal def test_07_REQUEST_normal_GET_auth(self): """ rewrite auth info from swift in normal mode. """ res = self.app.get('/local/auth/v1.0', headers={'X-Auth-User': '******', 'X-Auth-Key': 'testing'}) print res.body print res.headers body = {'storage': {'default': 'locals', 'locals': 'http://127.0.0.1:10000/local/v1.0/AUTH_test'}} self.assertEqual(res.headers['x-storage-url'], 'http://127.0.0.1:10000/local/v1.0/AUTH_test') self.assertEqual(res.headers['x-auth-token'], 'dummy') self.assertEqual(res.headers['x-storage-token'], 'dummy') self.assertEqual(body, json.loads(res.body)) # request relay def test_08_REQUEST_normal_GET_account(self): """ relay to get account (container listing) in normal mode. """ res = self.app.get('/local//v1.0/AUTH_test', headers=dict(X_Auth_Token='t')) body='TEST0\nTEST1\nTEST2\nTEST3\nTEST4' self.assertEqual(body, res.body) def test_09_REQUEST_normal_GET_container(self): """ relay to get container (object listing) in normal mode. """ res = self.app.get('/local/v1.0/AUTH_test/TEST0', headers=dict(X_Auth_Token='t')) body = 'test0.txt\ntest1.txt\ntest2.txt\ntest2.txt\ntest4.txt' print proxy0_srv.env self.assertEqual(body, res.body) def test_10_REQUEST_normal_GET_object(self): """ relay to get object in normal mode. """ res = self.app.get('/local/v1.0/AUTH_test/TEST0/test0.txt', headers=dict(X_Auth_Token='t')) body = 'This is a test0.\nOK?' self.assertEqual(body, res.body) # request via webcache def test_11_REQUEST_normal_GET_object_via_webcache(self): """ relay to get object in normal mode via WebCache. """ res = self.app.get('/v1.0/AUTH_test/TEST0/test0.txt', headers=dict(X_Auth_Token='t')) self.assertEqual('http://127.0.0.1:8080/v1.0/AUTH_test/TEST0/test0.txt', webcache0_srv.env['PATH_INFO']) # auth request in merge #@unittest.skip def test_12_REQUEST_merge_GET_auth(self): """ rewrite auth info from swift in merge mode. """ res = self.app.get('/both/auth/v1.0', headers={'X-Auth-User': '******', 'X-Auth-Key': 'testing'}) print res.body print res.headers body = {'storage': {'default': 'locals', 'locals': 'http://127.0.0.1:10000/both/v1.0/AUTH_test'}} self.assertEqual(res.headers['x-storage-url'], 'http://127.0.0.1:10000/both/v1.0/AUTH_test') self.assertEqual(res.headers['x-auth-token'], 'dummy__@@__dummy') self.assertEqual(res.headers['x-storage-token'], 'dummy__@@__dummy') self.assertEqual(body, json.loads(res.body)) res = self.app.get('/both/auth/v1.0', headers={'X-Auth-User': '******', 'X-Auth-Key': 'dummy'}, expect_errors=True) self.assertEqual(res.status, '401 Unauthorized') # request relay in merge mode #@unittest.skip def test_13_REQUEST_merge_GET_account(self): """ relay to get account (container listing) in merge mode. """ res = self.app.get('/both/v1.0/AUTH_test', headers=dict(X_Auth_Token='t__@@__v')) body = 'gere:TEST0\ngere:TEST1\ngere:TEST2\ngere:TEST3\ngere:TEST4\n' + \ 'hoge:TEST0\nhoge:TEST1\nhoge:TEST2\nhoge:TEST3\nhoge:TEST4' print res.body print res.headers self.assertEqual(res.headers['x-account-bytes-used'], '40') self.assertEqual(res.headers['x-account-container-count'], '10') self.assertEqual(res.headers['x-account-object-count'], '2') self.assertEqual(body, res.body) def test_14_REQUEST_merge_GET_account_with_marker(self): """ relay to get account (container listing) in merge mode with marker param. """ res = self.app.get('/both/v1.0/AUTH_test?marker=hoge:TEST2', headers=dict(X_Auth_Token='t__@@__v')) body = 'hoge:TEST3\nhoge:TEST4' print res.body print res.headers self.assertEqual(body, res.body) def test_15_REQUEST_merge_GET_container(self): """ relay to get container (object listing) in merge mode. """ res = self.app.get('/both/v1.0/AUTH_test/hoge:TEST0', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'test0.txt\ntest1.txt\ntest2.txt\ntest2.txt\ntest4.txt' #print self.app.app.debug print res.status print res.body print res.headers print proxy0_srv.env print proxy1_srv.env self.assertEqual(body, res.body) def test_16_REQUEST_merge_GET_object(self): """ relay to get object in merge mode. """ res = self.app.get('/both/v1.0/AUTH_test/hoge:TEST0/test0.txt', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'This is a test0.\nOK?' self.assertEqual(body, res.body) def test_17_REQUEST_merge_COPY_object_in_same_account(self): """ relay to copy object in the same account. """ res = self.app.request('/both/v1.0/AUTH_test/hoge:TEST1/copied_test0.txt', method='PUT', body='', headers={'X_Auth_Token': 't__@@__v', 'X_Copy_From': '/hoge:TEST0/test0.txt'}, expect_errors=True) print res.status print res.body self.assertEqual(proxy0_srv.env['CONTENT_LENGTH'], '0') self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST1/copied_test0.txt') self.assertEqual(proxy0_srv.env['HTTP_X_COPY_FROM'], '/TEST0/test0.txt') def test_18_REQUEST_merge_COPY_object_across_accounts(self): """ relay to copy object across accounts. """ res = self.app.request('/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', method='PUT', body='', headers={'X_Auth_Token': 't__@@__v', 'X_Copy_From': '/hoge:TEST0/test0.txt'}, expect_errors=True) print proxy0_srv.env print proxy0_srv.env['REQUEST_METHOD'] print proxy0_srv.env['PATH_INFO'] print proxy1_srv.env print proxy1_srv.env['REQUEST_METHOD'] print proxy1_srv.env['PATH_INFO'] self.assertEqual(proxy0_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy0_srv.env['SERVER_PORT'], '8080') self.assertEqual(proxy0_srv.env['REQUEST_METHOD'], 'GET') self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST0/test0.txt') self.assertEqual(proxy1_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy1_srv.env['SERVER_PORT'], '18080') self.assertEqual(proxy1_srv.env['REQUEST_METHOD'], 'PUT') self.assertEqual(proxy1_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST1/copied_test0.txt') res = self.app.get('/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'This is a test0.\nOK?' print res.body self.assertEqual(body, res.body) #@unittest.skip def test_19_REQUEST_merge_COPY_object_across_accounts_with_split_upload(self): """ relay to copy object across accounts with split uploading. """ swift_store_large_chunk_size = self.app.app.swift_store_large_chunk_size self.app.app.no_split_copy_max_size = 15 res = self.app.request('/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', method='PUT', body='', headers={'X_Auth_Token': 't__@@__v', 'X_Copy_From': '/hoge:TEST0/test0.txt'}, expect_errors=True) self.app.app.swift_store_large_chunk_size = swift_store_large_chunk_size print proxy0_srv.env print proxy0_srv.env['REQUEST_METHOD'] print proxy0_srv.env['PATH_INFO'] print proxy1_srv.env print proxy1_srv.env['REQUEST_METHOD'] print proxy1_srv.env['PATH_INFO'] self.assertEqual(proxy0_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy0_srv.env['SERVER_PORT'], '8080') self.assertEqual(proxy0_srv.env['REQUEST_METHOD'], 'GET') self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST0/test0.txt') self.assertEqual(proxy1_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy1_srv.env['SERVER_PORT'], '18080') self.assertEqual(proxy1_srv.env['REQUEST_METHOD'], 'PUT') self.assertEqual(proxy1_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST1/copied_test0.txt') res = self.app.get('/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'This is a test0.\nOK?' print res.body self.assertEqual(body, res.body) def test_get_merged_auth_resp(self): req = Request.blank('/auth/v1.0') req.headers['x-auth-user'] = '******' req.headers['x-auth-key'] = 'testing' location = 'both' self.assertEqual(self.app.app.get_merged_auth_resp(req, location).status, '200 OK') req = Request.blank('/auth/v1.0') req.headers['x-auth-user'] = '******' req.headers['x-auth-key'] = 'dummy' location = 'both' self.assertEqual(self.app.app.get_merged_auth_resp(req, location).status, '401 Unauthorized') def test_no_exist_location(self): res = self.app.get('/nothing/v1.0/auth', headers={'X-Auth-User': '******', 'X-Auth-Key': 'testing'}, expect_errors=True) self.assertEqual(res.status, '404 Not Found') res = self.app.get('/nothing/v1.0/AUTH_test', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) self.assertEqual(res.status, '404 Not Found') def test_put_container(self): req = Request.blank('/') location = 'both' cont_prefix = 'hoge' each_tokens = ['t', 'v'] account = 'AUTH_test' container = 'TEST0' res = self.app.app._create_container(req, location, cont_prefix, each_tokens, account, container) self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST0') self.assertEqual(proxy0_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy0_srv.env['SERVER_PORT'], '8080') self.assertEqual(proxy0_srv.env['REQUEST_METHOD'], 'PUT')
class TestMACAuthPlugin(unittest.TestCase): """Testcases for the main MACAuthPlugin class.""" def setUp(self): self.plugin = MACAuthPlugin() application = PluggableAuthenticationMiddleware( stub_application, [["mac", self.plugin]], [["mac", self.plugin]], [["mac", self.plugin]], [], stub_request_classifier, stub_challenge_decider) self.app = TestApp(application) def _get_credentials(self, **data): id = tokenlib.make_token(data) key = tokenlib.get_token_secret(id) return {"id": id, "key": key} def test_implements(self): verifyClass(IIdentifier, MACAuthPlugin) verifyClass(IAuthenticator, MACAuthPlugin) verifyClass(IChallenger, MACAuthPlugin) def test_make_plugin_can_explicitly_set_all_properties(self): plugin = make_plugin(decode_mac_id=dotted_name("stub_decode_mac_id"), nonce_cache="macauthlib:NonceCache") self.assertEquals(plugin.decode_mac_id, stub_decode_mac_id) self.assertTrue(isinstance(plugin.nonce_cache, macauthlib.NonceCache)) def test_make_plugin_passes_on_args_to_nonce_cache(self): plugin = make_plugin(nonce_cache="macauthlib:NonceCache", nonce_cache_nonce_timeout=42) self.assertTrue(isinstance(plugin.nonce_cache, macauthlib.NonceCache)) self.assertEquals(plugin.nonce_cache.nonce_timeout, 42) self.assertRaises(TypeError, make_plugin, nonce_cache="macauthlib:NonceCache", nonce_cache_invalid_arg="WHAWHAWHAWHA") def test_make_plugin_errors_out_on_unexpected_keyword_args(self): self.assertRaises(TypeError, make_plugin, unexpected="spanish-inquisition") def test_make_plugin_errors_out_on_args_to_a_non_callable(self): self.assertRaises(ValueError, make_plugin, nonce_cache=dotted_name("unittest"), nonce_cache_arg="invalidarg") def test_make_plugin_errors_out_if_decode_mac_id_is_not_callable(self): self.assertRaises(ValueError, make_plugin, decode_mac_id=dotted_name("unittest")) def test_make_plugin_produces_sensible_defaults(self): plugin = make_plugin() self.assertEquals(plugin.decode_mac_id.im_func, MACAuthPlugin.decode_mac_id.im_func) self.assertTrue(isinstance(plugin.nonce_cache, macauthlib.NonceCache)) def test_make_plugin_curries_args_to_decode_mac_id(self): plugin = make_plugin(decode_mac_id=dotted_name("stub_decode_mac_id"), decode_mac_id_hello="hi") self.assertEquals(plugin.decode_mac_id(None, "id")[0], "id") self.assertEquals(plugin.decode_mac_id(None, "id")[1]["hello"], "hi") def test_remember_does_nothing(self): self.assertEquals(self.plugin.remember(make_environ(), {}), []) def test_forget_gives_a_challenge_header(self): headers = self.plugin.forget(make_environ(), {}) self.assertEquals(len(headers), 1) self.assertEquals(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1] == "MAC") def test_unauthenticated_requests_get_a_challenge(self): # Requests to most URLs generate a 401, which is passed through # with the appropriate challenge. r = self.app.get("/", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC")) # Requests to URLs with "forbidden" generate a 403 in the downstream # app, which should be converted into a 401 by the plugin. r = self.app.get("/forbidden", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC")) def test_authenticated_request_works(self): creds = self._get_credentials(username="******") req = Request.blank("/") macauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") def test_authentication_fails_when_macid_has_no_userid(self): creds = self._get_credentials(hello="world") req = Request.blank("/") macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_non_mac_scheme_fails(self): req = Request.blank("/") req.authorization = "OpenID hello=world" self.app.request(req, status=401) def test_authentication_without_macid_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") macauthlib.sign_request(req, **creds) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("id", "idd") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_timestamp_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") macauthlib.sign_request(req, **creds) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("ts", "typostamp") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_nonce_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") macauthlib.sign_request(req, **creds) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("nonce", "typonce") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=200) # Now do one with a really old timestamp. ts = str(int(time.time() - 1000)) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_far_future_timestamp_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=200) # Now do one with a far future timestamp. ts = str(int(time.time() + 1000)) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_reused_nonce_fails(self): creds = self._get_credentials(username="******") # First request with that nonce should succeed. req = Request.blank("/") req.authorization = ("MAC", {"nonce": "PEPPER"}) macauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") # Second request with that nonce should fail. req = Request.blank("/") req.authorization = ("MAC", {"nonce": "PEPPER"}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_busted_macid_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") macauthlib.sign_request(req, **creds) id = macauthlib.utils.parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(id, "XXX" + id) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_busted_signature_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") macauthlib.sign_request(req, **creds) signature = macauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = Request.blank("/public") resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with valid credentials is allowed access. creds = self._get_credentials(username="******") req = Request.blank("/public") macauthlib.sign_request(req, **creds) resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with invalid credentials gets a 401. req = Request.blank("/public") macauthlib.sign_request(req, **creds) signature = macauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req, status=401) def test_authenticate_only_accepts_mac_credentials(self): # Yes, this is a rather pointless test that boosts line coverage... self.assertEquals(self.plugin.authenticate(make_environ(), {}), None)
class TestTASRTopicApp(TASRTestCase): '''These tests check that the TASR native REST API (including the get by ID calls) are working as expected. This does not check the S+V API calls. ''' def setUp(self): self.event_type = "gold" fix_rel_path = "schemas/%s.avsc" % (self.event_type) self.avsc_file = TASRTestCase.get_fixture_file(fix_rel_path, "r") self.schema_str = self.avsc_file.read() self.tasr_app = TestApp(APP) self.url_prefix = 'http://%s:%s/tasr' % (APP.config.host, APP.config.port) self.topic_url = '%s/topic/%s' % (self.url_prefix, self.event_type) self.content_type = 'application/json; charset=utf8' # clear out all the keys before beginning -- careful! APP.ASR.redis.flushdb() def tearDown(self): # this clears out redis after each test -- careful! APP.ASR.redis.flushdb() def abort_diff_status(self, resp, code): self.assertEqual(code, resp.status_code, u'Non-%s status code: %s' % (code, resp.status_code)) def register_schema(self, schema_str, expect_errors=False): return self.tasr_app.request(self.topic_url, method='PUT', expect_errors=expect_errors, content_type=self.content_type, body=schema_str) def test_get_all_topics(self): '''GET /tasr/topic - as expected''' # reg two vers for target topic and one for an alt topic self.register_schema(self.schema_str) schema_str_2 = self.schema_str.replace('tagged.events', 'tagged.events.alt', 1) self.register_schema(schema_str_2) alt_topic = 'bob' alt_url = '%s/topic/%s' % (self.url_prefix, alt_topic) self.tasr_app.request(alt_url, method='PUT', content_type=self.content_type, body=self.schema_str) # now get all with versions and check the headers url = "%s/topic" % (self.url_prefix) resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) # we expect a list of SubjectMetadata objects here meta_dict = SubjectHeaderBot.extract_metadata(resp) self.assertEqual(2, meta_dict[self.event_type].current_version, 'bad ver') self.assertEqual(1, meta_dict[alt_topic].current_version, 'bad ver') # lastly check the body buff = StringIO.StringIO(resp.body) group_names = [] for topic_line in buff: group_names.append(topic_line.strip()) buff.close() self.assertListEqual(sorted(group_names), sorted(meta_dict.keys()), 'Expected group_names in body to match headers.') def test_register_schema(self): '''PUT /tasr/topic/<topic name> - as expected''' resp = self.register_schema(self.schema_str) self.abort_diff_status(resp, 201) smeta = SchemaHeaderBot.extract_metadata(resp) self.assertIn(self.event_type, smeta.group_names, 'event_type missing') self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') self.assertTrue(smeta.group_timestamp(self.event_type), 'missing ts') def test_reg_fail_on_empty_schema(self): '''PUT /tasr/topic/<topic name> - empty schema''' resp = self.register_schema(None, expect_errors=True) self.abort_diff_status(resp, 400) def test_reg_fail_on_invalid_schema(self): '''PUT /tasr/topic/<topic name> - bad schema''' bad_schema_str = "%s }" % self.schema_str resp = self.register_schema(bad_schema_str, expect_errors=True) self.abort_diff_status(resp, 400) def test_reg_fail_on_bad_content_type(self): '''PUT /tasr/topic/<topic name> - bad Content-Type''' resp = self.tasr_app.request(self.topic_url, method='PUT', content_type='text/plain; charset=utf8', expect_errors=True, body=self.schema_str) self.abort_diff_status(resp, 406) def test_reg_and_rereg(self): '''PUT /tasr/topic/<topic name> - multiple calls, same schema''' resp = self.register_schema(self.schema_str) self.abort_diff_status(resp, 201) smeta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') # on the re-registration, we should get the same version back resp2 = self.register_schema(self.schema_str) self.abort_diff_status(resp2, 200) smeta2 = SchemaHeaderBot.extract_metadata(resp2) self.assertEqual(1, smeta2.group_version(self.event_type), 'Re-reg produced a different group version.') def test_multi_topic_reg(self): '''PUT /tasr/topic/<topic name> - multiple group_names, same schema''' put_resp = self.register_schema(self.schema_str) self.abort_diff_status(put_resp, 201) smeta = SchemaHeaderBot.extract_metadata(put_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') alt_topic = 'bob' alt_url = '%s/topic/%s' % (self.url_prefix, alt_topic) put_resp2 = self.tasr_app.request(alt_url, method='PUT', content_type=self.content_type, body=self.schema_str) self.abort_diff_status(put_resp2, 201) smeta2 = SchemaHeaderBot.extract_metadata(put_resp2) self.assertEqual(1, smeta2.group_version(alt_topic), 'bad ver') # getting by ID gives us all topic associations in headers id_url = "%s/id/%s" % (self.url_prefix, smeta.sha256_id) get_resp = self.tasr_app.request(id_url, method='GET') smeta3 = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(1, smeta3.group_version(self.event_type), 'bad ver') self.assertEqual(1, smeta3.group_version(alt_topic), 'bad ver') def test_get_latest_1(self): '''GET /tasr/topic/<topic name> - as expected''' put_resp = self.register_schema(self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body # now pull it back with a GET get_resp = self.tasr_app.request(self.topic_url, method='GET') self.abort_diff_status(get_resp, 200) smeta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_get_latest_2(self): '''GET /tasr/topic/<topic name>/latest - as expected''' put_resp = self.register_schema(self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body # now pull it back with a GET get_url = '%s/latest' % self.topic_url get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) smeta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_reg_50_and_get_by_version(self): '''GET /tasr/topic/<topic name>/version/<version> - as expected''' schemas = [] # add a bunch of versions for our topic for v in range(1, 50): ver_schema_str = self.schema_str.replace('tagged.events', 'tagged.events.%s' % v, 1) put_resp = self.register_schema(ver_schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body schemas.append(canonicalized_schema_str) self.abort_diff_status(put_resp, 201) # step through and request each version by version number for v in range(1, 50): query = "%s/version/%s" % (self.topic_url, v) get_resp = self.tasr_app.request(query, method='GET') self.abort_diff_status(get_resp, 200) self.assertEqual(schemas[v - 1], get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_get_for_topic_and_version_fail_on_bad_version(self): '''GET /tasr/topic/<topic name>/version/<version> - fail on bad ver''' put_resp = self.register_schema(self.schema_str) smeta = SchemaHeaderBot.extract_metadata(put_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') bad_ver = smeta.group_version(self.event_type) + 1 url = "%s/version/%s" % (self.topic_url, bad_ver) get_resp = self.tasr_app.request(url, method='GET', expect_errors=True) self.abort_diff_status(get_resp, 404) def test_get_for_stale_version(self): '''GET /tasr/topic/<topic name>/version/<version> - 1 schema, 2 vers''' put_resp = self.register_schema(self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body self.abort_diff_status(put_resp, 201) schema_str_2 = self.schema_str.replace('tagged.events', 'tagged.events.alt', 1) put_resp2 = self.register_schema(schema_str_2) self.abort_diff_status(put_resp2, 201) put_resp3 = self.register_schema(self.schema_str) smeta = SchemaHeaderBot.extract_metadata(put_resp3) self.assertEqual(3, smeta.group_version(self.event_type), 'bad ver') # now get version 1 -- should be same schema, but diff ver in headers url = "%s/version/%s" % (self.topic_url, 1) get_resp = self.tasr_app.request(url, method='GET', expect_errors=True) self.abort_diff_status(get_resp, 200) self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) smeta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver')
class TestVEPAuthPlugin(unittest2.TestCase): """Testcases for the main VEPAuthPlugin class.""" def setUp(self): self.plugin = VEPAuthPlugin( audiences=["localhost"], verifier=vep.DummyVerifier(), token_manager=StubTokenManager() ) application = PluggableAuthenticationMiddleware( stub_application, [["vep", self.plugin]], [["vep", self.plugin]], [["vep", self.plugin]], [], stub_request_classifier, stub_challenge_decider, ) self.app = TestApp(application) def _make_assertion(self, address, audience="http://localhost", **kwds): return vep.DummyVerifier.make_assertion(address, audience, **kwds) def _start_session(self, email="*****@*****.**", *args, **kwds): assertion = self._make_assertion(email, *args, **kwds) headers = {"Authorization": "Browser-ID " + assertion} session = self.app.get(self.plugin.token_url, headers=headers).json return {"token": session["id"], "secret": session["key"]} def test_implements(self): verifyClass(IIdentifier, VEPAuthPlugin) verifyClass(IAuthenticator, VEPAuthPlugin) verifyClass(IChallenger, VEPAuthPlugin) def test_make_plugin_can_explicitly_set_all_properties(self): plugin = make_plugin( audiences="example.com", token_url="/test_token_url", verifier="vep:DummyVerifier", token_manager="vep:LocalVerifier", nonce_timeout=42, ) self.assertEquals(plugin.audiences, ["example.com"]) self.assertEquals(plugin.token_url, "/test_token_url") self.assertTrue(isinstance(plugin.verifier, vep.DummyVerifier)) self.assertTrue(isinstance(plugin.token_manager, vep.LocalVerifier)) self.assertEquals(plugin.nonce_timeout, 42) def test_make_plugin_produces_sensible_defaults(self): # The "audiences" parameter must be set explicitly self.assertRaises(ValueError, make_plugin) plugin = make_plugin("one two") self.assertEquals(plugin.audiences, ["one", "two"]) self.assertEquals(plugin.token_url, "/request_token") self.assertTrue(isinstance(plugin.verifier, vep.RemoteVerifier)) self.assertTrue(isinstance(plugin.token_manager, SignedTokenManager)) self.assertEquals(plugin.nonce_timeout, 60) def test_make_plugin_loads_urlopen_from_dotted_name(self): plugin = make_plugin("one two", verifier="vep:LocalVerifier", verifier_urlopen="urllib2:urlopen") self.assertEquals(plugin.audiences, ["one", "two"]) self.assertTrue(isinstance(plugin.verifier, vep.LocalVerifier)) self.assertEquals(plugin.verifier.urlopen, urllib2.urlopen) def test_make_plugin_treats_empty_audiences_string_as_none(self): plugin = make_plugin("") self.assertEquals(plugin.audiences, None) plugin = make_plugin(" ") self.assertEquals(plugin.audiences, []) def test_make_plugin_errors_out_on_unexpected_keyword_args(self): self.assertRaises(TypeError, make_plugin, "", unexpected="spanish-inquisition") def test_make_plugin_errors_out_on_args_to_a_non_callable(self): self.assertRaises(ValueError, make_plugin, "", verifier="vep:__doc__", verifier_urlopen="urllib2:urlopen") def test_checking_for_silly_argument_errors(self): self.assertRaises(ValueError, VEPAuthPlugin, audiences="notalist") def test_remember_does_nothing(self): self.assertEquals(self.plugin.remember(make_environ(), {}), []) def test_forget_gives_a_challenge_header(self): headers = self.plugin.forget(make_environ(), {}) self.assertEquals(len(headers), 1) self.assertEquals(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1].startswith("MAC+BrowserID ")) self.assertTrue(self.plugin.token_url in headers[0][1]) def test_unauthenticated_requests_get_a_challenge(self): # Requests to most URLs generate a 401, which is passed through # with the appropriate challenge. r = self.app.get("/", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC+BrowserID")) self.assertTrue(self.plugin.token_url in challenge) # Requests to URLs with "forbidden" generate a 403 in the downstream # app, which should be converted into a 401 by the plugin. r = self.app.get("/forbidden", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC+BrowserID")) self.assertTrue(self.plugin.token_url in challenge) def test_sending_an_assertion_creates_a_token(self): authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} # This fails since we're not at the token-provisioning URL. r = self.app.get("/", headers=headers, status=401) self.assertTrue("id" not in r.body) # This works since we're at the postback url. r = self.app.get(self.plugin.token_url, headers=headers) self.assertTrue("id" in r.body) def test_that_an_empty_token_url_disables_provisioning(self): authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} self.plugin.token_url = "" r = self.app.get("/", headers=headers, status=401) self.assertTrue("id" not in r.body) r = self.app.get("/request_token", headers=headers, status=401) self.assertTrue("id" not in r.body) def test_non_get_requests_give_405(self): authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} self.app.post(self.plugin.token_url, headers=headers, status=405) def test_provisioning_with_malformed_assertion(self): authz = "Browser-ID I AINT NO ASSERTION, FOOL!" headers = {"Authorization": authz} r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("assertion" in r.body) def test_provisioning_with_no_credentials_gives_401(self): headers = {} self.app.get(self.plugin.token_url, headers=headers, status=401) def test_provisioning_with_basic_credentials_gives_400(self): headers = {"Authorization": "Basic dTpw"} self.app.get(self.plugin.token_url, headers=headers, status=400) def test_provisioning_with_untrusted_assertion(self): assertion = self._make_assertion("test@moz", assertion_sig="X") headers = {"Authorization": "Browser-ID " + assertion} r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("assertion" in r.body) def test_provisioning_with_invalid_audience(self): assertion = self._make_assertion("*****@*****.**", "http://evil.com") headers = {"Authorization": "Browser-ID " + assertion} r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("audience" in r.body) # Setting audiences to None will allow it to pass # if it matches the HTTP_HOST header. self.plugin.audiences = None r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("audience" in r.body) r = self.app.get(self.plugin.token_url, headers=headers, extra_environ={"HTTP_HOST": "evil.com"}) self.assertTrue("id" in r.body) def test_provisioning_with_unaccepted_email_address(self): assertion = self._make_assertion("*****@*****.**") headers = {"Authorization": "Browser-ID " + assertion} self.app.get(self.plugin.token_url, headers=headers, status=401) def test_authenticated_request_works(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") def test_authentication_with_non_mac_scheme_fails(self): req = Request.blank("/") req.authorization = "OpenID hello=world" self.app.request(req, status=401) def test_authentication_without_consumer_key_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("id", "idd") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_timestamp_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("ts", "typostamp") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_nonce_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("nonce", "typonce") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): session = self._start_session() req = Request.blank("/") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=200) # Now do one with a really old timestamp. ts = str(int(time.time() - 1000)) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=401) def test_authentication_with_far_future_timestamp_fails(self): session = self._start_session() req = Request.blank("/") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=200) # Now do one with a far future timestamp. ts = str(int(time.time() + 1000)) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=401) def test_authentication_with_reused_nonce_fails(self): session = self._start_session() # First request with that nonce should succeed. req = Request.blank("/") req.authorization = ("MAC", {"nonce": "PEPPER"}) sign_request(req, **session) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") # Second request with that nonce should fail. req = Request.blank("/") req.authorization = ("MAC", {"nonce": "PEPPER"}) sign_request(req, **session) self.app.request(req, status=401) def test_authentication_with_busted_token_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) token = parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(token, "XXX" + token) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_busted_signature_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) signature = parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = Request.blank("/public") resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with valid credentials is allowed access. session = self._start_session() req = Request.blank("/public") sign_request(req, **session) resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with invalid credentials gets a 401. req = Request.blank("/public") sign_request(req, **session) signature = parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req, status=401) def test_authenticate_only_accepts_mac_credentials(self): # Yes, this is a rather pointless test that boosts line coverage... self.assertEquals(self.plugin.authenticate(make_environ(), {}), None) def test_token_url_can_contain_placeholders(self): self.plugin.token_url = "/{application}/{version}/{test}/foo" authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} # this doesn't match the pattern and should return a 401 r = self.app.get("/foo/bar/bar", headers=headers, status=401) self.assertTrue("id" not in r.body) # valid pattern should return a consumer key r = self.app.get("/foo/1.0/bar/foo", headers=headers) self.assertTrue("id" in r.body) self.plugin.token_manager.applications = {"foo": ["1.0"], "bar": ["2.1"], "baz": ["1.2"]} # defining manually a set of applications an making a request for one # of them should work r = self.app.get("/foo/1.0/bar/foo", headers=headers) self.assertTrue("id" in r.body) # this doesn't match any of the defined applications and should return # a 404 self.assertRaises(HTTPNotFound, self.app.get, "/not_an_app/1.0/bar/foo", headers=headers) # bad version self.assertRaises(HTTPNotFound, self.app.get, "/foo/1.4/bar/foo", headers=headers) def test_extra_data_gets_added(self): self.plugin.token_manager = ExtraTokenManager() authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} resp = self.app.get(self.plugin.token_url, headers=headers, status=200) self.assertTrue("foo" in resp.json) self.assertEqual(resp.json["foo"], "bar")
class TestHawkAuthPlugin(unittest.TestCase): """Testcases for the main HawkAuthPlugin class.""" def setUp(self): self.plugin = HawkAuthPlugin() application = PluggableAuthenticationMiddleware(stub_application, [["hawk", self.plugin]], [["hawk", self.plugin]], [["hawk", self.plugin]], [], stub_request_classifier, stub_challenge_decider) self.app = TestApp(application) def _get_credentials(self, **data): id, key = self.plugin.encode_hawk_id(Request.blank("/"), data) return {"id": id, "key": key} def test_implements(self): verifyClass(IIdentifier, HawkAuthPlugin) verifyClass(IAuthenticator, HawkAuthPlugin) verifyClass(IChallenger, HawkAuthPlugin) def test_make_plugin_can_explicitly_set_all_properties(self): plugin = make_plugin( master_secret="elvislives", nonce_cache="hawkauthlib:NonceCache", decode_hawk_id=dotted_name("stub_decode_hawk_id"), encode_hawk_id=dotted_name("stub_encode_hawk_id")) self.assertEquals(plugin.master_secret, "elvislives") self.assertTrue(isinstance(plugin.nonce_cache, hawkauthlib.NonceCache)) self.assertEquals(plugin.decode_hawk_id, stub_decode_hawk_id) self.assertEquals(plugin.encode_hawk_id, stub_encode_hawk_id) def test_make_plugin_passes_on_args_to_nonce_cache(self): plugin = make_plugin( nonce_cache="hawkauthlib:NonceCache", nonce_cache_window=42) self.assertTrue(isinstance(plugin.nonce_cache, hawkauthlib.NonceCache)) self.assertEquals(plugin.nonce_cache.window, 42) self.assertRaises(TypeError, make_plugin, nonce_cache="hawkauthlib:NonceCache", nonce_cache_invalid_arg="WHAWHAWHAWHA") def test_make_plugin_errors_out_on_unexpected_keyword_args(self): self.assertRaises(TypeError, make_plugin, unexpected="spanish-inquisition") def test_make_plugin_errors_out_on_args_to_a_non_callable(self): self.assertRaises(ValueError, make_plugin, nonce_cache=dotted_name("unittest"), nonce_cache_arg="invalidarg") def test_make_plugin_errors_out_if_decode_hawk_id_is_not_callable(self): self.assertRaises(ValueError, make_plugin, decode_hawk_id=dotted_name("unittest")) def test_make_plugin_produces_sensible_defaults(self): plugin = make_plugin() self.assertEquals(plugin.decode_hawk_id.im_func, HawkAuthPlugin.decode_hawk_id.im_func) self.assertTrue(isinstance(plugin.nonce_cache, hawkauthlib.NonceCache)) def test_make_plugin_curries_args_to_decode_hawk_id(self): plugin = make_plugin( decode_hawk_id=dotted_name("stub_decode_hawk_id"), decode_hawk_id_hello="hi") self.assertEquals(plugin.decode_hawk_id(None, "id")[0], "id") self.assertEquals(plugin.decode_hawk_id(None, "id")[1]["hello"], "hi") def test_remember_does_nothing(self): self.assertEquals(self.plugin.remember(make_environ(), {}), []) def test_forget_gives_a_challenge_header(self): headers = self.plugin.forget(make_environ(), {}) self.assertEquals(len(headers), 1) self.assertEquals(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1] == "Hawk") def test_unauthenticated_requests_get_a_challenge(self): # Requests to most URLs generate a 401, which is passed through # with the appropriate challenge. r = self.app.get("/", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("Hawk")) # Requests to URLs with "forbidden" generate a 403 in the downstream # app, which should be converted into a 401 by the plugin. r = self.app.get("/forbidden", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("Hawk")) def test_authenticated_request_works(self): creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") def test_authentication_fails_when_hawkid_has_no_userid(self): creds = self._get_credentials(hello="world") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_non_hawk_scheme_fails(self): req = Request.blank("/") req.authorization = "OpenID hello=world" self.app.request(req, status=401) def test_authentication_without_hawkid_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("id", "idd") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_timestamp_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("ts", "typostamp") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_nonce_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("nonce", "typonce") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") ts = str(int(time.time() - 1000)) req.authorization = ("Hawk", {"ts": ts}) hawkauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_far_future_timestamp_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") ts = str(int(time.time() + 1000)) req.authorization = ("Hawk", {"ts": ts}) hawkauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_reused_nonce_fails(self): creds = self._get_credentials(username="******") # First request with that nonce should succeed. req = Request.blank("/") req.authorization = ("Hawk", {"nonce": "PEPPER"}) hawkauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") # Second request with that nonce should fail. req = Request.blank("/") req.authorization = ("Hawk", {"nonce": "PEPPER"}) hawkauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_busted_hawkid_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) id = hawkauthlib.utils.parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(id, "XXX" + id) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_busted_signature_fails(self): creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) signature = hawkauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = Request.blank("/public") resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with valid credentials is allowed access. creds = self._get_credentials(username="******") req = Request.blank("/public") hawkauthlib.sign_request(req, **creds) resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with invalid credentials gets a 401. req = Request.blank("/public") hawkauthlib.sign_request(req, **creds) signature = hawkauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req, status=401) def test_authenticate_only_accepts_hawk_credentials(self): # Yes, this is a rather pointless test that boosts line coverage... self.assertEquals(self.plugin.authenticate(make_environ(), {}), None) def test_authentication_with_custom_master_secret(self): self.plugin.master_secret = "elvislives" try: creds = self._get_credentials(username="******") req = Request.blank("/") hawkauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") finally: self.plugin.master_secret = None
class TestVEPAuthPlugin(unittest2.TestCase): """Testcases for the main VEPAuthPlugin class.""" def setUp(self): self.plugin = VEPAuthPlugin(audiences=["localhost"], verifier=vep.DummyVerifier(), token_manager=StubTokenManager()) application = PluggableAuthenticationMiddleware(stub_application, [["vep", self.plugin]], [["vep", self.plugin]], [["vep", self.plugin]], [], stub_request_classifier, stub_challenge_decider) self.app = TestApp(application) def _make_assertion(self, address, audience="http://localhost", **kwds): return vep.DummyVerifier.make_assertion(address, audience, **kwds) def _start_session(self, email="*****@*****.**", *args, **kwds): assertion = self._make_assertion(email, *args, **kwds) headers = {"Authorization": "Browser-ID " + assertion} session = self.app.get(self.plugin.token_url, headers=headers).json return { "token": session["id"], "secret": session["key"], } def test_implements(self): verifyClass(IIdentifier, VEPAuthPlugin) verifyClass(IAuthenticator, VEPAuthPlugin) verifyClass(IChallenger, VEPAuthPlugin) def test_make_plugin_can_explicitly_set_all_properties(self): plugin = make_plugin( audiences="example.com", token_url="/test_token_url", verifier="vep:DummyVerifier", token_manager="vep:LocalVerifier", nonce_timeout=42) self.assertEquals(plugin.audiences, ["example.com"]) self.assertEquals(plugin.token_url, "/test_token_url") self.assertTrue(isinstance(plugin.verifier, vep.DummyVerifier)) self.assertTrue(isinstance(plugin.token_manager, vep.LocalVerifier)) self.assertEquals(plugin.nonce_timeout, 42) def test_make_plugin_produces_sensible_defaults(self): # The "audiences" parameter must be set explicitly self.assertRaises(ValueError, make_plugin) plugin = make_plugin("one two") self.assertEquals(plugin.audiences, ["one", "two"]) self.assertEquals(plugin.token_url, "/request_token") self.assertTrue(isinstance(plugin.verifier, vep.RemoteVerifier)) self.assertTrue(isinstance(plugin.token_manager, SignedTokenManager)) self.assertEquals(plugin.nonce_timeout, 60) def test_make_plugin_loads_urlopen_from_dotted_name(self): plugin = make_plugin("one two", verifier="vep:LocalVerifier", verifier_urlopen="urllib2:urlopen") self.assertEquals(plugin.audiences, ["one", "two"]) self.assertTrue(isinstance(plugin.verifier, vep.LocalVerifier)) self.assertEquals(plugin.verifier.urlopen, urllib2.urlopen) def test_make_plugin_treats_empty_audiences_string_as_none(self): plugin = make_plugin("") self.assertEquals(plugin.audiences, None) plugin = make_plugin(" ") self.assertEquals(plugin.audiences, []) def test_make_plugin_errors_out_on_unexpected_keyword_args(self): self.assertRaises(TypeError, make_plugin, "", unexpected="spanish-inquisition") def test_make_plugin_errors_out_on_args_to_a_non_callable(self): self.assertRaises(ValueError, make_plugin, "", verifier="vep:__doc__", verifier_urlopen="urllib2:urlopen") def test_checking_for_silly_argument_errors(self): self.assertRaises(ValueError, VEPAuthPlugin, audiences="notalist") def test_remember_does_nothing(self): self.assertEquals(self.plugin.remember(make_environ(), {}), []) def test_forget_gives_a_challenge_header(self): headers = self.plugin.forget(make_environ(), {}) self.assertEquals(len(headers), 1) self.assertEquals(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1].startswith("MAC+BrowserID ")) self.assertTrue(self.plugin.token_url in headers[0][1]) def test_unauthenticated_requests_get_a_challenge(self): # Requests to most URLs generate a 401, which is passed through # with the appropriate challenge. r = self.app.get("/", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC+BrowserID")) self.assertTrue(self.plugin.token_url in challenge) # Requests to URLs with "forbidden" generate a 403 in the downstream # app, which should be converted into a 401 by the plugin. r = self.app.get("/forbidden", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC+BrowserID")) self.assertTrue(self.plugin.token_url in challenge) def test_sending_an_assertion_creates_a_token(self): authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} # This fails since we're not at the token-provisioning URL. r = self.app.get("/", headers=headers, status=401) self.assertTrue("id" not in r.body) # This works since we're at the postback url. r = self.app.get(self.plugin.token_url, headers=headers) self.assertTrue("id" in r.body) def test_that_an_empty_token_url_disables_provisioning(self): authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} self.plugin.token_url = "" r = self.app.get("/", headers=headers, status=401) self.assertTrue("id" not in r.body) r = self.app.get("/request_token", headers=headers, status=401) self.assertTrue("id" not in r.body) def test_non_get_requests_give_405(self): authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} self.app.post(self.plugin.token_url, headers=headers, status=405) def test_provisioning_with_malformed_assertion(self): authz = "Browser-ID I AINT NO ASSERTION, FOOL!" headers = {"Authorization": authz} r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("assertion" in r.body) def test_provisioning_with_no_credentials_gives_401(self): headers = {} self.app.get(self.plugin.token_url, headers=headers, status=401) def test_provisioning_with_basic_credentials_gives_400(self): headers = {"Authorization": "Basic dTpw"} self.app.get(self.plugin.token_url, headers=headers, status=400) def test_provisioning_with_untrusted_assertion(self): assertion = self._make_assertion("test@moz", assertion_sig="X") headers = {"Authorization": "Browser-ID " + assertion} r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("assertion" in r.body) def test_provisioning_with_invalid_audience(self): assertion = self._make_assertion("*****@*****.**", "http://evil.com") headers = {"Authorization": "Browser-ID " + assertion} r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("audience" in r.body) # Setting audiences to None will allow it to pass # if it matches the HTTP_HOST header. self.plugin.audiences = None r = self.app.get(self.plugin.token_url, headers=headers, status=400) self.assertTrue("audience" in r.body) r = self.app.get(self.plugin.token_url, headers=headers, extra_environ={"HTTP_HOST": "evil.com"}) self.assertTrue("id" in r.body) def test_provisioning_with_unaccepted_email_address(self): assertion = self._make_assertion("*****@*****.**") headers = {"Authorization": "Browser-ID " + assertion} self.app.get(self.plugin.token_url, headers=headers, status=401) def test_authenticated_request_works(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") def test_authentication_with_non_mac_scheme_fails(self): req = Request.blank("/") req.authorization = "OpenID hello=world" self.app.request(req, status=401) def test_authentication_without_consumer_key_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("id", "idd") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_timestamp_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("ts", "typostamp") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_nonce_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("nonce", "typonce") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): session = self._start_session() req = Request.blank("/") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=200) # Now do one with a really old timestamp. ts = str(int(time.time() - 1000)) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=401) def test_authentication_with_far_future_timestamp_fails(self): session = self._start_session() req = Request.blank("/") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=200) # Now do one with a far future timestamp. ts = str(int(time.time() + 1000)) req.authorization = ("MAC", {"ts": ts}) sign_request(req, **session) self.app.request(req, status=401) def test_authentication_with_reused_nonce_fails(self): session = self._start_session() # First request with that nonce should succeed. req = Request.blank("/") req.authorization = ("MAC", {"nonce": "PEPPER"}) sign_request(req, **session) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") # Second request with that nonce should fail. req = Request.blank("/") req.authorization = ("MAC", {"nonce": "PEPPER"}) sign_request(req, **session) self.app.request(req, status=401) def test_authentication_with_busted_token_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) token = parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(token, "XXX" + token) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_busted_signature_fails(self): session = self._start_session() req = Request.blank("/") sign_request(req, **session) signature = parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = Request.blank("/public") resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with valid credentials is allowed access. session = self._start_session() req = Request.blank("/public") sign_request(req, **session) resp = self.app.request(req) self.assertEquals(resp.body, "public") # Request with invalid credentials gets a 401. req = Request.blank("/public") sign_request(req, **session) signature = parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req, status=401) def test_authenticate_only_accepts_mac_credentials(self): # Yes, this is a rather pointless test that boosts line coverage... self.assertEquals(self.plugin.authenticate(make_environ(), {}), None) def test_token_url_can_contain_placeholders(self): self.plugin.token_url = "/{application}/{version}/{test}/foo" authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} # this doesn't match the pattern and should return a 401 r = self.app.get("/foo/bar/bar", headers=headers, status=401) self.assertTrue("id" not in r.body) # valid pattern should return a consumer key r = self.app.get("/foo/1.0/bar/foo", headers=headers) self.assertTrue("id" in r.body) self.plugin.token_manager.applications = {"foo": ["1.0"], "bar": ["2.1"], "baz": ["1.2"]} # defining manually a set of applications an making a request for one # of them should work r = self.app.get("/foo/1.0/bar/foo", headers=headers) self.assertTrue("id" in r.body) # this doesn't match any of the defined applications and should return # a 404 self.assertRaises(HTTPNotFound, self.app.get, "/not_an_app/1.0/bar/foo", headers=headers) # bad version self.assertRaises(HTTPNotFound, self.app.get, "/foo/1.4/bar/foo", headers=headers) def test_extra_data_gets_added(self): self.plugin.token_manager = ExtraTokenManager() authz = "Browser-ID " + self._make_assertion("*****@*****.**") headers = {"Authorization": authz} resp = self.app.get(self.plugin.token_url, headers=headers, status=200) self.assertTrue('foo' in resp.json) self.assertEqual(resp.json['foo'], 'bar')
class TestTASRCoreApp(TASRTestCase): '''These tests check that the TASR core app endpoints work.''' def setUp(self): self.event_type = "gold" fix_rel_path = "schemas/%s.avsc" % (self.event_type) self.avsc_file = TASRTestCase.get_fixture_file(fix_rel_path, "r") self.schema_str = self.avsc_file.read() self.tasr_app = TestApp(APP) self.url_prefix = 'http://%s:%s/tasr' % (APP.config.host, APP.config.port) self.subject_url = '%s/subject/%s' % (self.url_prefix, self.event_type) self.content_type = 'application/json; charset=utf8' # clear out all the keys before beginning -- careful! APP.ASR.redis.flushdb() def tearDown(self): # this clears out redis after each test -- careful! APP.ASR.redis.flushdb() def abort_diff_status(self, resp, code): self.assertEqual(code, resp.status_code, u'Non-%s status code: %s' % (code, resp.status_code)) def register_subject(self, subject_name): url = '%s/subject/%s' % (self.url_prefix, subject_name) return self.tasr_app.put(url, {'subject_name': subject_name}) def register_schema(self, subject_name, schema_str, expect_errors=False): reg_url = '%s/subject/%s/register' % (self.url_prefix, subject_name) return self.tasr_app.request(reg_url, method='PUT', content_type=self.content_type, expect_errors=expect_errors, body=schema_str) ########################################################################### # /id app ########################################################################### def test_lookup_by_md5_id(self): '''GET /tasr/id/<MD5 ID> - as expected''' put_resp = self.register_schema(self.event_type, self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body smeta = SchemaHeaderBot.extract_metadata(put_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') url = "%s/id/%s" % (self.url_prefix, smeta.md5_id) get_resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(get_resp, 200) self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_by_md5_id__accept_json(self): '''GET /tasr/id/<MD5 ID> - "Accept: text/json" as expected''' put_resp = self.register_schema(self.event_type, self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body smeta = SchemaHeaderBot.extract_metadata(put_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') url = "%s/id/%s" % (self.url_prefix, smeta.md5_id) get_resp = self.tasr_app.request(url, method='GET', accept='text/json') self.abort_diff_status(get_resp, 200) self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_by_sha256_id(self): '''GET /tasr/id/<SHA256 ID> - as expected''' put_resp = self.register_schema(self.event_type, self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body smeta = SchemaHeaderBot.extract_metadata(put_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') url = "%s/id/%s" % (self.url_prefix, smeta.sha256_id) get_resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(get_resp, 200) self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_by_sha256_id__accept_json(self): '''GET /tasr/id/<SHA256 ID> - "Accept: text/json" as expected''' put_resp = self.register_schema(self.event_type, self.schema_str) # the canonicalized form returned has normalized whitespace canonicalized_schema_str = put_resp.body smeta = SchemaHeaderBot.extract_metadata(put_resp) self.assertEqual(1, smeta.group_version(self.event_type), 'bad ver') url = "%s/id/%s" % (self.url_prefix, smeta.sha256_id) get_resp = self.tasr_app.request(url, method='GET', accept='text/json') self.abort_diff_status(get_resp, 200) self.assertEqual(canonicalized_schema_str, get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_by_sha256_id_str__bad_id(self): '''GET /tasr/id/<id str> - fail on bad ID''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) ver_meta = SchemaHeaderBot.extract_metadata(resp) sha256_id = ver_meta.sha256_id # get a "bad" ID from a different schema string rs = tasr.registered_schema.RegisteredSchema() rs.schema_str = self.schema_str.replace('tagged.events', 'bob') bad_sha256_id = rs.sha256_id self.assertNotEqual(sha256_id, bad_sha256_id, 'IDs should differ') # try getting the schema for the "bad" ID get_url = '%s/id/%s' % (self.url_prefix, bad_sha256_id) get_resp = self.tasr_app.request(get_url, method='GET', expect_errors=True) self.abort_diff_status(get_resp, 404) def test_lookup_by_sha256_id_str__accept_json__bad_id(self): '''GET /tasr/id/<id str> - "Accept: text/json" fail on bad ID''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) ver_meta = SchemaHeaderBot.extract_metadata(resp) sha256_id = ver_meta.sha256_id # get a "bad" ID from a different schema string rs = tasr.registered_schema.RegisteredSchema() rs.schema_str = self.schema_str.replace('tagged.events', 'bob') bad_sha256_id = rs.sha256_id self.assertNotEqual(sha256_id, bad_sha256_id, 'IDs should differ') # try getting the schema for the "bad" ID get_url = '%s/id/%s' % (self.url_prefix, bad_sha256_id) get_resp = self.tasr_app.request(get_url, method='GET', accept='text/json', expect_errors=True) self.abort_diff_status(get_resp, 404) # we expect a JSON error back, so check that we got it json_error = json.loads(get_resp.body) # body is parseable JSON self.assertEqual(404, json_error["status_code"], "expected a 404") def test_lookup_by_sha256_id_str(self): '''GET /tasr/id/<id_str> - as expected''' sha256_ids = [] schemas = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) ver_meta = SchemaHeaderBot.extract_metadata(resp) sha256_ids.append(ver_meta.sha256_id) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # step through and request each version by version number for v in range(1, 50): get_url = '%s/id/%s' % (self.url_prefix, sha256_ids[v - 1]) get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) meta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(sha256_ids[v - 1], meta.sha256_id, 'bad ID') self.assertEqual(schemas[v - 1], get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_by_md5_id_str(self): '''GET /tasr/id/<id_str> - as expected''' md5_ids = [] schemas = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) ver_meta = SchemaHeaderBot.extract_metadata(resp) md5_ids.append(ver_meta.md5_id) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # step through and request each version by version number for v in range(1, 50): get_url = '%s/id/%s' % (self.url_prefix, md5_ids[v - 1]) get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) meta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(md5_ids[v - 1], meta.md5_id, 'bad ID') self.assertEqual(schemas[v - 1], get_resp.body, u'Unexpected body: %s' % get_resp.body) ########################################################################### # /schema app ########################################################################### def test_lookup_by_schema_str(self): '''POST /tasr/schema - as expected''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # canonicalized schema string is passed back on registration canonicalized_schema_str = resp.body meta_1 = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta_1.group_version(self.event_type), 'bad ver') schema_str_2 = self.get_schema_permutation(self.schema_str) resp = self.register_schema(self.event_type, schema_str_2) self.abort_diff_status(resp, 201) # get by POSTed schema post_url = "%s/schema" % self.url_prefix post_resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, body=self.schema_str) meta_2 = SchemaHeaderBot.extract_metadata(post_resp) self.assertEqual(1, meta_2.group_version(self.event_type), 'bad ver') self.assertEqual(meta_1.sha256_id, meta_2.sha256_id, 'SHA mismatch') self.assertEqual(meta_1.md5_id, meta_2.md5_id, 'MD5 mismatch') self.assertEqual(canonicalized_schema_str, post_resp.body, u'Unexpected body: %s' % post_resp.body) def test_lookup_by_schema_str__accept_json(self): '''POST /tasr/schema - "Accept: text/json" as expected''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # canonicalized schema string is passed back on registration canonicalized_schema_str = resp.body meta_1 = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta_1.group_version(self.event_type), 'bad ver') schema_str_2 = self.get_schema_permutation(self.schema_str) resp = self.register_schema(self.event_type, schema_str_2) self.abort_diff_status(resp, 201) # get by POSTed schema post_url = "%s/schema" % self.url_prefix post_resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, accept='text/json', body=self.schema_str) meta_2 = SchemaHeaderBot.extract_metadata(post_resp) self.assertEqual(1, meta_2.group_version(self.event_type), 'bad ver') self.assertEqual(meta_1.sha256_id, meta_2.sha256_id, 'SHA mismatch') self.assertEqual(meta_1.md5_id, meta_2.md5_id, 'MD5 mismatch') self.assertEqual(canonicalized_schema_str, post_resp.body, u'Unexpected body: %s' % post_resp.body) def test_fail_lookup_by_schema_str_on_empty_schema_str(self): '''POST /tasr/schema - fail on empty schema string''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) post_url = "%s/schema" % self.url_prefix resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, expect_errors=True, body=None) self.abort_diff_status(resp, 400) def test_fail_lookup_by_schema_str_on_empty_schema_str__accept_json(self): '''POST /tasr/schema - "Accept: text/json" fail on empty schema str''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) post_url = "%s/schema" % self.url_prefix resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, accept='text/json', expect_errors=True, body=None) self.abort_diff_status(resp, 400) # we expect a JSON error back, so check that we got it json_error = json.loads(resp.body) # body is parseable JSON self.assertEqual(400, json_error["status_code"], "expected a 404") def test_fail_lookup_by_schema_str_on_invalid_schema_str(self): '''POST /tasr/schema - fail on bad schema string''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) post_url = "%s/schema" % self.url_prefix resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, expect_errors=True, body="%s }" % self.schema_str) self.abort_diff_status(resp, 400) def test_fail_lookup_by_schema_str_on_invalid_schema_str__accept_json(self): '''POST /tasr/schema - "Accept: text/json" fail on bad schema string''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) post_url = "%s/schema" % self.url_prefix resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, accept='text/json', expect_errors=True, body="%s }" % self.schema_str) self.abort_diff_status(resp, 400) # we expect a JSON error back, so check that we got it json_error = json.loads(resp.body) # body is parseable JSON self.assertEqual(400, json_error["status_code"], "expected a 404") def test_fail_lookup_by_schema_str_on_unreg_schema_str(self): '''POST /tasr/schema - fail on new schema string''' post_url = "%s/schema" % self.url_prefix resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, expect_errors=True, body=self.schema_str) self.assertEqual(404, resp.status_int, u'Unexpected status: %s' % resp.status_int) meta = SchemaHeaderBot.extract_metadata(resp) self.assertTrue(meta.sha256_id, 'SHA missing') self.assertTrue(meta.md5_id, 'MD5 missing') def test_fail_lookup_by_schema_str_on_unreg_schema_str__accept_json(self): '''POST /tasr/schema - fail on new schema string''' post_url = "%s/schema" % self.url_prefix resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, accept='text/json', expect_errors=True, body=self.schema_str) self.assertEqual(404, resp.status_int, u'Unexpected status: %s' % resp.status_int) meta = SchemaHeaderBot.extract_metadata(resp) self.assertTrue(meta.sha256_id, 'SHA missing') self.assertTrue(meta.md5_id, 'MD5 missing') # we expect a JSON error back, so check that we got it json_error = json.loads(resp.body) # body is parseable JSON self.assertEqual(404, json_error["status_code"], "expected a 404") ########################################################################### # /collection app ########################################################################### def test_all_subject_names(self): '''GET /tasr/collection/subjects/all - get _all_ registered subjects''' # reg two vers for target subject and one for an alt subject self.register_subject(self.event_type) alt_subject_name = 'bob' self.register_subject(alt_subject_name) # now get all and check the headers get_url = '%s/collection/subjects/all' % self.url_prefix resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) self.assertIn(self.event_type, meta_dict.keys(), 'missing subject') subj = meta_dict[self.event_type] self.assertEqual(self.event_type, subj.name, 'bad subject name') self.assertIn(alt_subject_name, meta_dict.keys(), 'missing subject') alt_subj = meta_dict[alt_subject_name] self.assertEqual(alt_subject_name, alt_subj.name, 'bad subject name') # lastly check the body buff = StringIO.StringIO(resp.body) group_names = [] for topic_line in buff: group_names.append(topic_line.strip()) buff.close() self.assertListEqual(sorted(group_names), sorted(meta_dict.keys()), 'Expected group_names in body to match headers.') def test_all_subject_names__accept_json(self): '''GET /tasr/collection/subjects/all - get _all_ registered subjects''' # reg two vers for target subject and one for an alt subject self.register_subject(self.event_type) alt_subject_name = 'bob' self.register_subject(alt_subject_name) # now get all and check the headers get_url = '%s/collection/subjects/all' % self.url_prefix resp = self.tasr_app.request(get_url, method='GET', accept='text/json') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) self.assertIn(self.event_type, meta_dict.keys(), 'missing subject') subj = meta_dict[self.event_type] self.assertEqual(self.event_type, subj.name, 'bad subject name') self.assertIn(alt_subject_name, meta_dict.keys(), 'missing subject') alt_subj = meta_dict[alt_subject_name] self.assertEqual(alt_subject_name, alt_subj.name, 'bad subject name') # the body should be a JSON dict of subject objects keyed by name sub_dict = json.loads(resp.body) self.assertListEqual(sorted(sub_dict.keys()), sorted(meta_dict.keys()), 'Expected group_names in body to match headers.') def test_active_subjects(self): '''GET /tasr/collection/subjects/active - gets _active_ subjects (that is, ones with at least one schema), as expected''' # reg two vers for target subject and one for an alt subject self.register_subject(self.event_type) alt_subject_name = 'bob' self.register_subject(alt_subject_name) # now get all and check the headers all_url = "%s/collection/subjects/all" % self.url_prefix resp = self.tasr_app.request(all_url, method='GET') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) # we should have a GroupMetadata object for each group in the headers for sub_name in [self.event_type, alt_subject_name]: self.assertIn(sub_name, meta_dict.keys(), 'missing subject') subj = meta_dict[sub_name] self.assertEqual(sub_name, subj.name, 'bad subject name') # now get the ACTIVE subjects, which should be empty so far active_url = "%s/collection/subjects/active" % self.url_prefix resp = self.tasr_app.request(active_url, method='GET') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) # we should have no GroupMetadata objects for sub_name in [self.event_type, alt_subject_name]: self.assertNotIn(sub_name, meta_dict.keys(), 'unexpected subject') # now register a schema for the base subject and recheck resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # the get_all should be unchanged, the get_active should have one resp = self.tasr_app.request(all_url, method='GET') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) # we should have a GroupMetadata object for each group in the headers for sub_name in [self.event_type, alt_subject_name]: self.assertIn(sub_name, meta_dict.keys(), 'missing subject') subj = meta_dict[sub_name] self.assertEqual(sub_name, subj.name, 'bad subject name') # now get the ACTIVE subjects, which should be empty so far resp = self.tasr_app.request(active_url, method='GET') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) # we should have a GroupMetadata object for one group in the headers self.assertNotIn(alt_subject_name, meta_dict.keys(), 'unexpected obj') # the event_type should be there self.assertIn(self.event_type, meta_dict.keys(), 'missing subject') subj = meta_dict[self.event_type] self.assertEqual(self.event_type, subj.name, 'bad subject name') # lastly check the body buff = StringIO.StringIO(resp.body) group_names = [] for topic_line in buff: group_names.append(topic_line.strip()) buff.close() self.assertListEqual(sorted(group_names), sorted(meta_dict.keys()), 'Expected group_names in body to match headers.') def test_active_subjects__accept_json(self): '''GET /tasr/collection/subjects/active - gets _active_ subjects (that is, ones with at least one schema), as expected''' # reg two vers for target subject and one for an alt subject self.register_subject(self.event_type) alt_subject_name = 'bob' self.register_subject(alt_subject_name) # now get the ACTIVE subjects, which should be empty so far active_url = "%s/collection/subjects/active" % self.url_prefix resp = self.tasr_app.request(active_url, method='GET', accept='text/json') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) # we should have no GroupMetadata objects for sub_name in [self.event_type, alt_subject_name]: self.assertNotIn(sub_name, meta_dict.keys(), 'unexpected subject') # we should have received an empty dict as the content body active_dict = json.loads(resp.body) self.assertDictEqual({}, active_dict, 'expected empty dict') # now register a schema for the base subject and recheck resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # now get the ACTIVE subjects, which should be empty so far resp = self.tasr_app.request(active_url, method='GET', accept='text/json') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) # we should have a GroupMetadata object for one group in the headers self.assertNotIn(alt_subject_name, meta_dict.keys(), 'unexpected obj') # the event_type should be there self.assertIn(self.event_type, meta_dict.keys(), 'missing subject') subj = meta_dict[self.event_type] self.assertEqual(self.event_type, subj.name, 'bad subject name') # and check the expected content body JSON active_dict = json.loads(resp.body) self.assertListEqual(sorted(active_dict.keys()), sorted(meta_dict.keys()), 'Expected group_names in body to match headers.')
class TestMACAuthenticationPolicy(unittest.TestCase): """Testcases for the MACAuthenticationPolicy class.""" def setUp(self): self.config = Configurator(settings={ "macauth.find_groups": "pyramid_macauth.tests:stub_find_groups", }) self.config.include("pyramid_macauth") self.config.add_route("public", "/public") self.config.add_view(stub_view_public, route_name="public") self.config.add_route("auth", "/auth") self.config.add_view(stub_view_auth, route_name="auth") self.config.add_route("groups", "/groups") self.config.add_view(stub_view_groups, route_name="groups") self.app = TestApp(self.config.make_wsgi_app()) self.policy = self.config.registry.queryUtility(IAuthenticationPolicy) def _make_request(self, *args, **kwds): return make_request(self.config, *args, **kwds) def _make_signed_request(self, userid, *args, **kwds): req = self._make_request(*args, **kwds) creds = self._get_credentials(req, userid=userid) macauthlib.sign_request(req, **creds) return req def _get_credentials(self, req, **data): id, key = self.policy.encode_mac_id(req, **data) return {"id": id, "key": key} def test_the_class_implements_auth_policy_interface(self): verifyClass(IAuthenticationPolicy, MACAuthenticationPolicy) def test_from_settings_can_explicitly_set_all_properties(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.find_groups": "pyramid_macauth.tests:stub_find_groups", "macauth.master_secret": "V8 JUICE IS 1/8TH GASOLINE", "macauth.nonce_cache": "macauthlib:NonceCache", "macauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", "macauth.encode_mac_id": "pyramid_macauth.tests:stub_encode_mac_id", }) self.assertEquals(policy.find_groups, stub_find_groups) self.assertEquals(policy.master_secret, "V8 JUICE IS 1/8TH GASOLINE") self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) self.assertEquals(policy.decode_mac_id, stub_decode_mac_id) self.assertEquals(policy.encode_mac_id, stub_encode_mac_id) def test_from_settings_passes_on_args_to_nonce_cache(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.nonce_cache": "macauthlib:NonceCache", "macauth.nonce_cache_nonce_ttl": 42, }) self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) self.assertEquals(policy.nonce_cache.nonce_ttl, 42) self.assertRaises( TypeError, MACAuthenticationPolicy.from_settings, { "macauth.nonce_cache": "macauthlib:NonceCache", "macauth.nonce_cache_invalid_arg": "WHAWHAWHAWHA", }) def test_from_settings_errors_out_on_unexpected_keyword_args(self): self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { "macauth.unexpected": "spanish-inquisition", }) def test_from_settings_errors_out_on_args_to_a_non_callable(self): self.assertRaises( ValueError, MACAuthenticationPolicy.from_settings, { "macauth.nonce_cache": "pyramid_macauth.tests:stub_non_callable", "macauth.nonce_cache_arg": "invalidarg", }) def test_from_settings_errors_out_if_decode_mac_id_is_not_callable(self): self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { "macauth.decode_mac_id": "pyramid_macauth.tests:stub_non_callable", }) def test_from_settings_errors_out_if_encode_mac_id_is_not_callable(self): self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { "macauth.encode_mac_id": "pyramid_macauth.tests:stub_non_callable", }) def test_from_settings_produces_sensible_defaults(self): policy = MACAuthenticationPolicy.from_settings({}) # Using __code__ here is a Py2/Py3 compatible way of checking # that a bound and unbound method point to the same function object. self.assertEquals(policy.find_groups.__code__, MACAuthenticationPolicy.find_groups.__code__) self.assertEquals(policy.decode_mac_id.__code__, MACAuthenticationPolicy.decode_mac_id.__code__) self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) def test_from_settings_curries_args_to_decode_mac_id(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", "macauth.decode_mac_id_suffix": "-TEST", }) self.assertEquals(policy.decode_mac_id(None, "id"), ("id", "id-TEST")) def test_from_settings_curries_args_to_encode_mac_id(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.encode_mac_id": "pyramid_macauth.tests:stub_encode_mac_id", "macauth.encode_mac_id_suffix": "-TEST", }) self.assertEquals(policy.encode_mac_id(None, "id"), ("id", "id-TEST")) def test_remember_does_nothing(self): policy = MACAuthenticationPolicy() req = self._make_signed_request("*****@*****.**", "/") self.assertEquals(policy.remember(req, "*****@*****.**"), []) def test_forget_gives_a_challenge_header(self): policy = MACAuthenticationPolicy() req = self._make_signed_request("*****@*****.**", "/") headers = policy.forget(req) self.assertEquals(len(headers), 1) self.assertEquals(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1] == "MAC") def test_unauthenticated_requests_get_a_challenge(self): r = self.app.get("/auth", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC")) def test_authenticated_request_works(self): req = self._make_signed_request("*****@*****.**", "/auth") r = self.app.request(req) self.assertEquals(r.body, b"*****@*****.**") def test_authentication_fails_when_macid_has_no_userid(self): req = self._make_request("/auth") creds = self._get_credentials(req, hello="world") macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_non_mac_scheme_fails(self): req = self._make_request("/auth") req.authorization = "OpenID hello=world" self.app.request(req, status=401) req = self._make_request("/public") req.authorization = "OpenID hello=world" self.app.request(req, status=200) def test_authentication_without_macid_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("id", "idd") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_timestamp_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("ts", "typostamp") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_nonce_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("nonce", "typonce") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): req = self._make_request("/auth") creds = self._get_credentials(req, username="******") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=200) # Now do one with a really old timestamp. ts = str(int(time.time() - 1000)) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_far_future_timestamp_fails(self): req = self._make_request("/auth") creds = self._get_credentials(req, username="******") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=200) # Now do one with a far future timestamp. ts = str(int(time.time() + 1000)) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_reused_nonce_fails(self): req = self._make_request("/auth") creds = self._get_credentials(req, username="******") # First request with that nonce should succeed. req.authorization = ("MAC", {"nonce": "PEPPER"}) macauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, b"*****@*****.**") # Second request with that nonce should fail. req = self._make_request("/auth") req.authorization = ("MAC", {"nonce": "PEPPER"}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_busted_macid_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") id = macauthlib.utils.parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(id, "XXX" + id) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_busted_signature_fails(self): req = self._make_request("/auth") creds = self._get_credentials(req, username="******") macauthlib.sign_request(req, **creds) signature = macauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_groupfinder_can_block_authentication(self): req = self._make_signed_request("baduser", "/auth") r = self.app.request(req, status=401) req = self._make_signed_request("baduser", "/public") r = self.app.request(req, status=200) self.assertEquals(r.body, b"baduser") def test_groupfinder_gruops_are_correctly_reported(self): req = self._make_request("/groups") r = self.app.request(req) self.assertEquals(r.json, [str(Everyone)]) req = self._make_signed_request("gooduser", "/groups") r = self.app.request(req) self.assertEquals( r.json, ["gooduser", str(Everyone), str(Authenticated)]) req = self._make_signed_request("test", "/groups") r = self.app.request(req) self.assertEquals( r.json, ["test", str(Everyone), str(Authenticated), "group"]) req = self._make_signed_request("baduser", "/groups") r = self.app.request(req) self.assertEquals(r.json, [str(Everyone)]) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = self._make_request("/public") resp = self.app.request(req) self.assertEquals(resp.body, b"None") # Request with valid credentials is allowed access. req = self._make_signed_request("*****@*****.**", "/public") resp = self.app.request(req) self.assertEquals(resp.body, b"*****@*****.**") # Request with invalid credentials still reports a userid. req = self._make_signed_request("*****@*****.**", "/public") signature = macauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req) self.assertEquals(resp.body, b"*****@*****.**") # Request with malformed credentials gets a 401 req = self._make_signed_request("*****@*****.**", "/public") tokenid = macauthlib.utils.parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(tokenid, "XXX" + tokenid) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req, status=401) def test_check_signature_fails_if_no_params_present(self): req = self._make_request("/auth") self.assertRaises(HTTPUnauthorized, self.policy._check_signature, req, "XXX") def test_default_groupfinder_returns_empty_list(self): policy = MACAuthenticationPolicy() req = self._make_request("/auth") self.assertEquals(policy.find_groups("test", req), []) def test_auth_can_be_checked_several_times_on_same_request(self): req = self._make_signed_request("*****@*****.**", "/public") self.assertEquals(authenticated_userid(req), "*****@*****.**") self.assertEquals(authenticated_userid(req), "*****@*****.**")
def request_response(request, testapp: TestApp) -> RequestResponse: req = request.param # type: Request test_request = TestRequest.blank(req.url, **req.kwargs) test_response = testapp.request(test_request, expect_errors=True) return RequestResponse(test_request, test_response, req.expected_status, None)
class TestJWTAuthenticationPolicy(unittest.TestCase): """Testcases for the JWTAuthenticationPolicy class.""" def setUp(self): self.config = Configurator( settings={ "jwtauth.find_groups": "pyramid_jwtauth.tests.test_jwtauth:stub_find_groups", "jwtauth.master_secret": MASTER_SECRET, }) self.config.include("pyramid_jwtauth") self.config.add_route("public", "/public") self.config.add_view(stub_view_public, route_name="public") self.config.add_route("auth", "/auth") self.config.add_view(stub_view_auth, route_name="auth") self.config.add_route("groups", "/groups") self.config.add_view(stub_view_groups, route_name="groups") self.app = TestApp(self.config.make_wsgi_app()) self.policy = self.config.registry.queryUtility(IAuthenticationPolicy) def _make_request(self, *args, **kwds): return make_request(self.config, *args, **kwds) # create an authenticated request that has a JWT with the userid set # in our case, this is the 'sub' request. # # we need to have the following claims as a minimum: # 'sub': the userid that we want to authenticate - it can be anything. # 'iat': the issued at time stamp # 'nbf': the not before time stamp # 'exp': the expiry time for the JWT def _make_authenticated_request(self, userid, *args, **kwds): claims = None if 'claims' in kwds: claims = kwds['claims'] del kwds['claims'] req = self._make_request(*args, **kwds) # creds = self._get_credentials(req, userid=userid) claims = make_claims(userid=userid, claims=claims) # jwt_authenticate_request(req, **creds) # note jwt_authenticate_request() returns headers if wanted jwt_authenticate_request(req, claims, MASTER_SECRET) return req def test_the_class_implements_auth_policy_interface(self): verifyClass(IAuthenticationPolicy, JWTAuthenticationPolicy) def test_from_settings_can_explicitly_set_all_properties(self): policy = JWTAuthenticationPolicy.from_settings({ "jwtauth.find_groups": "pyramid_jwtauth.tests.test_jwtauth:stub_find_groups", "jwtauth.master_secret": MASTER_SECRET, # "jwtauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", # "jwtauth.encode_mac_id": "pyramid_macauth.tests:stub_encode_mac_id", }) self.assertEqual(policy.find_groups, stub_find_groups) self.assertEqual(policy.master_secret, MASTER_SECRET) # self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) # self.assertEqual(policy.decode_mac_id, stub_decode_mac_id) # self.assertEqual(policy.encode_mac_id, stub_encode_mac_id) # def test_from_settings_passes_on_args_to_nonce_cache(self): # policy = MACAuthenticationPolicy.from_settings({ # "macauth.nonce_cache": "macauthlib:NonceCache", # "macauth.nonce_cache_nonce_ttl": 42, # }) # self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) # self.assertEqual(policy.nonce_cache.nonce_ttl, 42) # self.assertRaises(TypeError, MACAuthenticationPolicy.from_settings, { # "macauth.nonce_cache": "macauthlib:NonceCache", # "macauth.nonce_cache_invalid_arg": "WHAWHAWHAWHA", # }) def test_from_settings_errors_out_on_unexpected_keyword_args(self): self.assertRaises(ValueError, JWTAuthenticationPolicy.from_settings, { "jwtauth.unexpected": "spanish-inquisition", }) # def test_from_settings_errors_out_on_args_to_a_non_callable(self): # self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { # "macauth.nonce_cache": "pyramid_macauth.tests:stub_non_callable", # "macauth.nonce_cache_arg": "invalidarg", # }) # def test_from_settings_errors_out_if_decode_mac_id_is_not_callable(self): # self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { # "macauth.decode_mac_id": "pyramid_macauth.tests:stub_non_callable", # }) # def test_from_settings_errors_out_if_encode_mac_id_is_not_callable(self): # self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { # "macauth.encode_mac_id": "pyramid_macauth.tests:stub_non_callable", # }) def test_from_settings_produces_sensible_defaults(self): policy = JWTAuthenticationPolicy.from_settings({}) # Using __code__ here is a Py2/Py3 compatible way of checking # that a bound and unbound method point to the same function object. self.assertEqual(policy.find_groups.__code__, JWTAuthenticationPolicy.find_groups.__code__) # def test_from_settings_curries_args_to_decode_mac_id(self): # policy = MACAuthenticationPolicy.from_settings({ # "macauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", # "macauth.decode_mac_id_suffix": "-TEST", # }) # self.assertEqual(policy.decode_mac_id(None, "id"), ("id", "id-TEST")) # def test_from_settings_curries_args_to_encode_mac_id(self): # policy = MACAuthenticationPolicy.from_settings({ # "macauth.encode_mac_id": "pyramid_macauth.tests:stub_encode_mac_id", # "macauth.encode_mac_id_suffix": "-TEST", # }) # self.assertEqual(policy.encode_mac_id(None, "id"), ("id", "id-TEST")) # not sure if this test is particularly useful as JWTAuthenticationPolicy # doesn't work on 'remembering' requests. def test_remember_does_nothing(self): policy = JWTAuthenticationPolicy() req = self._make_authenticated_request("*****@*****.**", "/") self.assertEqual(policy.remember(req, "*****@*****.**"), []) def test_forget_gives_a_challenge_header(self): policy = JWTAuthenticationPolicy() req = self._make_authenticated_request("*****@*****.**", "/") headers = policy.forget(req) self.assertEqual(len(headers), 1) self.assertEqual(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1] == "JWT") def test_forget_gives_a_challenge_header_with_custom_scheme(self): policy = JWTAuthenticationPolicy(scheme='Bearer') req = self._make_authenticated_request("*****@*****.**", "/") headers = policy.forget(req) self.assertTrue(headers[0][1] == "Bearer") def test_unauthenticated_requests_get_a_challenge(self): r = self.app.get("/auth", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("JWT")) def test_unauthenticated_requests_get_a_challenge_custom_scheme(self): self.policy.scheme = 'Bearer' r = self.app.get("/auth", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith('Bearer')) def test_authenticated_request_works(self): req = self._make_authenticated_request("*****@*****.**", "/auth") r = self.app.request(req) self.assertEqual(r.body, b"*****@*****.**") # def test_authentication_fails_when_macid_has_no_userid(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, hello="world") # macauthlib.sign_request(req, **creds) # self.app.request(req, status=401) def test_authentication_with_non_jwt_scheme_fails(self): req = self._make_request("/auth") req.authorization = "OpenID hello=world" self.app.request(req, status=401) req = self._make_request("/public") req.authorization = "OpenID hello=world" self.app.request(req, status=200) # def test_authentication_without_macid_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace("id", "idd") # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) # def test_authentication_without_timestamp_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace("ts", "typostamp") # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) # def test_authentication_without_nonce_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace("nonce", "typonce") # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): req = self._make_authenticated_request("*****@*****.**", "/auth") self.app.request(req, status=200) # now do an out of date one. ts = datetime.datetime.utcnow() - datetime.timedelta(days=1) claims = {'exp': ts} req = self._make_authenticated_request("*****@*****.**", "/auth", claims=claims) self.app.request(req, status=401) def test_can_get_claims_from_token(self): claims = {'urn:websandhq.co.uk/auth:jti': 'hello'} req = self._make_authenticated_request("*****@*****.**", "/auth", claims=claims) policy = JWTAuthenticationPolicy( master_secret="V8 JUICE IS 1/8TH GASOLINE") encoded_claims = policy.get_claims(req) self.assertTrue('urn:websandhq.co.uk/auth:jti' in encoded_claims) self.assertEqual(encoded_claims['urn:websandhq.co.uk/auth:jti'], 'hello') # def test_authentication_with_far_future_timestamp_fails(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, username="******") # # Do an initial request so that the server can # # calculate and cache our clock skew. # ts = str(int(time.time())) # req.authorization = ("MAC", {"ts": ts}) # macauthlib.sign_request(req, **creds) # self.app.request(req, status=200) # # Now do one with a far future timestamp. # ts = str(int(time.time() + 1000)) # req.authorization = ("MAC", {"ts": ts}) # macauthlib.sign_request(req, **creds) # self.app.request(req, status=401) # def test_authentication_with_reused_nonce_fails(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, username="******") # # First request with that nonce should succeed. # req.authorization = ("MAC", {"nonce": "PEPPER"}) # macauthlib.sign_request(req, **creds) # r = self.app.request(req) # self.assertEqual(r.body, b"*****@*****.**") # # Second request with that nonce should fail. # req = self._make_request("/auth") # req.authorization = ("MAC", {"nonce": "PEPPER"}) # macauthlib.sign_request(req, **creds) # self.app.request(req, status=401) # def test_authentication_with_busted_macid_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # id = macauthlib.utils.parse_authz_header(req)["id"] # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace(id, "XXX" + id) # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) # def test_authentication_with_busted_signature_fails(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, username="******") # macauthlib.sign_request(req, **creds) # signature = macauthlib.utils.parse_authz_header(req)["mac"] # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace(signature, "XXX" + signature) # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) def test_groupfinder_can_block_authentication(self): req = self._make_authenticated_request("baduser", "/auth") r = self.app.request(req, status=403) req = self._make_authenticated_request("baduser", "/public") r = self.app.request(req, status=200) self.assertEqual(r.body, b"baduser") def test_groupfinder_groups_are_correctly_reported(self): req = self._make_request("/groups") r = self.app.request(req) self.assertEqual(r.json, [str(Everyone)]) req = self._make_authenticated_request("gooduser", "/groups") r = self.app.request(req) self.assertEqual( r.json, ["gooduser", str(Everyone), str(Authenticated)]) req = self._make_authenticated_request("test", "/groups") r = self.app.request(req) self.assertEqual( r.json, ["test", str(Everyone), str(Authenticated), "group"]) req = self._make_authenticated_request("baduser", "/groups") r = self.app.request(req) self.assertEqual(r.json, [str(Everyone)]) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = self._make_request("/public") resp = self.app.request(req) self.assertEqual(resp.body, b"None") # Request with valid credentials is allowed access. req = self._make_authenticated_request("*****@*****.**", "/public") resp = self.app.request(req) self.assertEqual(resp.body, b"*****@*****.**") # Request with invalid credentials still reports a userid. req = self._make_authenticated_request("*****@*****.**", "/public") token = pyramid_jwtauth.utils.parse_authz_header(req)["token"] bits = token.split('.') bits[2] = 'XXX' + bits[2] broken_token = '.'.join(bits) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(token, broken_token) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req) self.assertEqual(resp.body, b"*****@*****.**") # Request with malformed credentials gets a 401 # req = self._make_signed_request("*****@*****.**", "/public") # tokenid = macauthlib.utils.parse_authz_header(req)["id"] # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace(tokenid, "XXX" + tokenid) # req.environ["HTTP_AUTHORIZATION"] = authz # resp = self.app.request(req, status=401) # def test_check_signature_fails_if_no_params_present(self): # req = self._make_request("/auth") # self.assertRaises(HTTPUnauthorized, # self.policy._check_signature, req, "XXX") def test_default_groupfinder_returns_empty_list(self): policy = JWTAuthenticationPolicy() req = self._make_request("/auth") self.assertEqual(policy.find_groups("test", req), []) def test_auth_can_be_checked_several_times_on_same_request(self): req = self._make_authenticated_request("*****@*****.**", "/public") self.assertEqual(authenticated_userid(req), "*****@*****.**") self.assertEqual(authenticated_userid(req), "*****@*****.**")
class TestController(unittest.TestCase): def setUp(self): self.app = TestApp(server(get_config())) def tearDown(self): pass # location str parser def test_01_LOCATION_load_location(self): """ location str parse and construct server info from server.txt""" loc_str = ':test/server0.txt, local:test/server1.txt, both:(hoge)test/server2.txt (gere)test/server3.txt, remote:test/server4.txt' loc = Location(loc_str) self.assertTrue(loc.has_location('')) self.assertTrue(loc.has_location('local')) self.assertTrue(loc.has_location('remote')) self.assertTrue(loc.has_location('both')) self.assertFalse(loc.has_location('nothing')) self.assertEqual( { 'webcache': { 'http://127.0.0.1:8080': 'http://127.0.0.1:8888' }, 'container_prefix': { 'http://127.0.0.1:8080': None }, 'swift': [['http://127.0.0.1:8080']] }, loc.servers_of('')) self.assertEqual( { 'webcache': { 'http://127.0.0.1:8080': None }, 'container_prefix': { 'http://127.0.0.1:8080': None }, 'swift': [['http://127.0.0.1:8080']] }, loc.servers_of('local')) self.assertEqual( { 'webcache': { 'http://127.0.0.1:18080': None, 'http://127.0.0.1:8080': None }, 'container_prefix': { 'http://127.0.0.1:18080': 'gere', 'http://127.0.0.1:8080': 'hoge' }, 'swift': [['http://127.0.0.1:8080'], ['http://127.0.0.1:18080']] }, loc.servers_of('both')) self.assertEqual( { 'webcache': { 'http://127.0.0.1:18080': None }, 'container_prefix': { 'http://127.0.0.1:18080': None }, 'swift': [['http://127.0.0.1:18080']] }, loc.servers_of('remote')) self.assertEqual([['http://127.0.0.1:8080']], loc.swift_of('')) self.assertEqual([['http://127.0.0.1:8080']], loc.swift_of('local')) self.assertEqual( [['http://127.0.0.1:8080'], ['http://127.0.0.1:18080']], loc.swift_of('both')) self.assertEqual([['http://127.0.0.1:18080']], loc.swift_of('remote')) self.assertFalse(loc.is_merged('')) self.assertFalse(loc.is_merged('local')) self.assertTrue(loc.is_merged('both')) self.assertFalse(loc.is_merged('remote')) self.assertEqual(loc.is_merged('nothing'), None) self.assertEqual(None, loc.container_prefix_of('', 'http://127.0.0.1:8080')) self.assertEqual( 'hoge', loc.container_prefix_of('both', 'http://127.0.0.1:8080')) self.assertEqual( 'gere', loc.container_prefix_of('both', 'http://127.0.0.1:18080')) self.assertEqual({'http://127.0.0.1:8080': 'http://127.0.0.1:8888'}, loc.webcache_of('')) self.assertEqual({'http://127.0.0.1:8080': None}, loc.webcache_of('local')) self.assertEqual( { 'http://127.0.0.1:18080': None, 'http://127.0.0.1:8080': None }, loc.webcache_of('both')) self.assertEqual({'http://127.0.0.1:18080': None}, loc.webcache_of('remote')) self.assertEqual({'http://127.0.0.1:8080': None}, loc.container_prefixes_of('')) self.assertEqual({'http://127.0.0.1:8080': None}, loc.container_prefixes_of('local')) self.assertEqual( { 'http://127.0.0.1:18080': 'gere', 'http://127.0.0.1:8080': 'hoge' }, loc.container_prefixes_of('both')) self.assertEqual({'http://127.0.0.1:18080': None}, loc.container_prefixes_of('remote')) self.assertEqual(['http://127.0.0.1:8080'], loc.servers_by_container_prefix_of('both', 'hoge')) self.assertEqual(['http://127.0.0.1:18080'], loc.servers_by_container_prefix_of('both', 'gere')) self.assertEqual( 'http://127.0.0.1:9999', loc._sock_connect_faster([ 'http://127.0.0.1:8080', 'http://127.0.0.1:18080', 'http://127.0.0.1:9999' ])[2]) loc_str = ':test/server0.txt test/server1.txt' loc = Location(loc_str) self.assertEqual(True, loc.is_merged('')) def test_02_LOCATION_update_location(self): """ server.txt reload if update.""" loc_str = ':test/server0.txt, local:test/server1.txt, both:(hoge)test/server2.txt (gere)test/server3.txt, remote:test/server4.txt' loc = Location(loc_str) old_server2_swifts = loc.swift_of('remote') with open('test/server4.txt', 'r') as f: olddata = f.read() with open('test/server4.txt', 'w') as f: f.write('http://192.168.2.1:8080') loc.reload() with open('test/server4.txt', 'w') as f: f.write(olddata) self.assertEqual([['http://192.168.2.1:8080']], loc.swift_of('remote')) def test_LOCATION_invalid_location_file(self): loc_str = ':test/server00.txt' self.assertRaises(ValueError, Location, loc_str) def test_LOCATION_invalid_location_str(self): loc_str = 'test/server0.txt' self.assertRaises(ValueError, Location, loc_str) loc_str = None self.assertRaises(ValueError, Location, loc_str) # rewrite url def test_03_REWRITE_PATH_blank(self): """ rewrite path when location prefix is blank.""" res = self.app.get('/v1.0/AUTH_test', headers=dict(X_Auth_Token='t'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy0_srv.env['PATH_INFO']) def test_04_REWRITE_PATH_local(self): """ rewrite path when location prefix is 'local'.""" res = self.app.get('/local/v1.0/AUTH_test', headers=dict(X_Auth_Token='t'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy0_srv.env['PATH_INFO']) def test_05_REWRITE_PATH_both(self): """ rewrite path when location prefix is 'both' (merge mode).""" res = self.app.get('/both/v1.0/AUTH_test', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy0_srv.env['PATH_INFO']) self.assertEqual('/v1.0/AUTH_test', proxy1_srv.env['PATH_INFO']) def test_06_REWRITE_PATH_remote(self): """ rewrite path when location prefix is 'remote'.""" res = self.app.get('/remote/v1.0/AUTH_test', headers=dict(X_Auth_Token='t'), expect_errors=True) self.assertEqual('/v1.0/AUTH_test', proxy1_srv.env['PATH_INFO']) # auth request in normal def test_07_REQUEST_normal_GET_auth(self): """ rewrite auth info from swift in normal mode. """ res = self.app.get('/local/auth/v1.0', headers={ 'X-Auth-User': '******', 'X-Auth-Key': 'testing' }) print res.body print res.headers body = { 'storage': { 'default': 'locals', 'locals': 'http://127.0.0.1:10000/local/v1.0/AUTH_test' } } self.assertEqual(res.headers['x-storage-url'], 'http://127.0.0.1:10000/local/v1.0/AUTH_test') self.assertEqual(res.headers['x-auth-token'], 'dummy') self.assertEqual(res.headers['x-storage-token'], 'dummy') self.assertEqual(body, json.loads(res.body)) # request relay def test_08_REQUEST_normal_GET_account(self): """ relay to get account (container listing) in normal mode. """ res = self.app.get('/local//v1.0/AUTH_test', headers=dict(X_Auth_Token='t')) body = 'TEST0\nTEST1\nTEST2\nTEST3\nTEST4' self.assertEqual(body, res.body) def test_09_REQUEST_normal_GET_container(self): """ relay to get container (object listing) in normal mode. """ res = self.app.get('/local/v1.0/AUTH_test/TEST0', headers=dict(X_Auth_Token='t')) body = 'test0.txt\ntest1.txt\ntest2.txt\ntest2.txt\ntest4.txt' print proxy0_srv.env self.assertEqual(body, res.body) def test_10_REQUEST_normal_GET_object(self): """ relay to get object in normal mode. """ res = self.app.get('/local/v1.0/AUTH_test/TEST0/test0.txt', headers=dict(X_Auth_Token='t')) body = 'This is a test0.\nOK?' self.assertEqual(body, res.body) # request via webcache def test_11_REQUEST_normal_GET_object_via_webcache(self): """ relay to get object in normal mode via WebCache. """ res = self.app.get('/v1.0/AUTH_test/TEST0/test0.txt', headers=dict(X_Auth_Token='t')) self.assertEqual( 'http://127.0.0.1:8080/v1.0/AUTH_test/TEST0/test0.txt', webcache0_srv.env['PATH_INFO']) # auth request in merge #@unittest.skip def test_12_REQUEST_merge_GET_auth(self): """ rewrite auth info from swift in merge mode. """ res = self.app.get('/both/auth/v1.0', headers={ 'X-Auth-User': '******', 'X-Auth-Key': 'testing' }) print res.body print res.headers body = { 'storage': { 'default': 'locals', 'locals': 'http://127.0.0.1:10000/both/v1.0/AUTH_test' } } self.assertEqual(res.headers['x-storage-url'], 'http://127.0.0.1:10000/both/v1.0/AUTH_test') self.assertEqual(res.headers['x-auth-token'], 'dummy__@@__dummy') self.assertEqual(res.headers['x-storage-token'], 'dummy__@@__dummy') self.assertEqual(body, json.loads(res.body)) res = self.app.get('/both/auth/v1.0', headers={ 'X-Auth-User': '******', 'X-Auth-Key': 'dummy' }, expect_errors=True) self.assertEqual(res.status, '401 Unauthorized') # request relay in merge mode #@unittest.skip def test_13_REQUEST_merge_GET_account(self): """ relay to get account (container listing) in merge mode. """ res = self.app.get('/both/v1.0/AUTH_test', headers=dict(X_Auth_Token='t__@@__v')) body = 'gere:TEST0\ngere:TEST1\ngere:TEST2\ngere:TEST3\ngere:TEST4\n' + \ 'hoge:TEST0\nhoge:TEST1\nhoge:TEST2\nhoge:TEST3\nhoge:TEST4' print res.body print res.headers self.assertEqual(res.headers['x-account-bytes-used'], '40') self.assertEqual(res.headers['x-account-container-count'], '10') self.assertEqual(res.headers['x-account-object-count'], '2') self.assertEqual(body, res.body) def test_14_REQUEST_merge_GET_account_with_marker(self): """ relay to get account (container listing) in merge mode with marker param. """ res = self.app.get('/both/v1.0/AUTH_test?marker=hoge:TEST2', headers=dict(X_Auth_Token='t__@@__v')) body = 'hoge:TEST3\nhoge:TEST4' print res.body print res.headers self.assertEqual(body, res.body) def test_15_REQUEST_merge_GET_container(self): """ relay to get container (object listing) in merge mode. """ res = self.app.get('/both/v1.0/AUTH_test/hoge:TEST0', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'test0.txt\ntest1.txt\ntest2.txt\ntest2.txt\ntest4.txt' #print self.app.app.debug print res.status print res.body print res.headers print proxy0_srv.env print proxy1_srv.env self.assertEqual(body, res.body) def test_16_REQUEST_merge_GET_object(self): """ relay to get object in merge mode. """ res = self.app.get('/both/v1.0/AUTH_test/hoge:TEST0/test0.txt', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'This is a test0.\nOK?' self.assertEqual(body, res.body) def test_17_REQUEST_merge_COPY_object_in_same_account(self): """ relay to copy object in the same account. """ res = self.app.request( '/both/v1.0/AUTH_test/hoge:TEST1/copied_test0.txt', method='PUT', body='', headers={ 'X_Auth_Token': 't__@@__v', 'X_Copy_From': '/hoge:TEST0/test0.txt' }, expect_errors=True) print res.status print res.body self.assertEqual(proxy0_srv.env['CONTENT_LENGTH'], '0') self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST1/copied_test0.txt') self.assertEqual(proxy0_srv.env['HTTP_X_COPY_FROM'], '/TEST0/test0.txt') def test_18_REQUEST_merge_COPY_object_across_accounts(self): """ relay to copy object across accounts. """ res = self.app.request( '/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', method='PUT', body='', headers={ 'X_Auth_Token': 't__@@__v', 'X_Copy_From': '/hoge:TEST0/test0.txt' }, expect_errors=True) print proxy0_srv.env print proxy0_srv.env['REQUEST_METHOD'] print proxy0_srv.env['PATH_INFO'] print proxy1_srv.env print proxy1_srv.env['REQUEST_METHOD'] print proxy1_srv.env['PATH_INFO'] self.assertEqual(proxy0_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy0_srv.env['SERVER_PORT'], '8080') self.assertEqual(proxy0_srv.env['REQUEST_METHOD'], 'GET') self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST0/test0.txt') self.assertEqual(proxy1_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy1_srv.env['SERVER_PORT'], '18080') self.assertEqual(proxy1_srv.env['REQUEST_METHOD'], 'PUT') self.assertEqual(proxy1_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST1/copied_test0.txt') res = self.app.get('/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'This is a test0.\nOK?' print res.body self.assertEqual(body, res.body) #@unittest.skip def test_19_REQUEST_merge_COPY_object_across_accounts_with_split_upload( self): """ relay to copy object across accounts with split uploading. """ swift_store_large_chunk_size = self.app.app.swift_store_large_chunk_size self.app.app.no_split_copy_max_size = 15 res = self.app.request( '/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', method='PUT', body='', headers={ 'X_Auth_Token': 't__@@__v', 'X_Copy_From': '/hoge:TEST0/test0.txt' }, expect_errors=True) self.app.app.swift_store_large_chunk_size = swift_store_large_chunk_size print proxy0_srv.env print proxy0_srv.env['REQUEST_METHOD'] print proxy0_srv.env['PATH_INFO'] print proxy1_srv.env print proxy1_srv.env['REQUEST_METHOD'] print proxy1_srv.env['PATH_INFO'] self.assertEqual(proxy0_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy0_srv.env['SERVER_PORT'], '8080') self.assertEqual(proxy0_srv.env['REQUEST_METHOD'], 'GET') self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST0/test0.txt') self.assertEqual(proxy1_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy1_srv.env['SERVER_PORT'], '18080') self.assertEqual(proxy1_srv.env['REQUEST_METHOD'], 'PUT') self.assertEqual(proxy1_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST1/copied_test0.txt') res = self.app.get('/both/v1.0/AUTH_test/gere:TEST1/copied_test0.txt', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) body = 'This is a test0.\nOK?' print res.body self.assertEqual(body, res.body) def test_get_merged_auth_resp(self): req = Request.blank('/auth/v1.0') req.headers['x-auth-user'] = '******' req.headers['x-auth-key'] = 'testing' location = 'both' self.assertEqual( self.app.app.get_merged_auth_resp(req, location).status, '200 OK') req = Request.blank('/auth/v1.0') req.headers['x-auth-user'] = '******' req.headers['x-auth-key'] = 'dummy' location = 'both' self.assertEqual( self.app.app.get_merged_auth_resp(req, location).status, '401 Unauthorized') def test_no_exist_location(self): res = self.app.get('/nothing/v1.0/auth', headers={ 'X-Auth-User': '******', 'X-Auth-Key': 'testing' }, expect_errors=True) self.assertEqual(res.status, '404 Not Found') res = self.app.get('/nothing/v1.0/AUTH_test', headers=dict(X_Auth_Token='t__@@__v'), expect_errors=True) self.assertEqual(res.status, '404 Not Found') def test_put_container(self): req = Request.blank('/') location = 'both' cont_prefix = 'hoge' each_tokens = ['t', 'v'] account = 'AUTH_test' container = 'TEST0' res = self.app.app._create_container(req, location, cont_prefix, each_tokens, account, container) self.assertEqual(proxy0_srv.env['PATH_INFO'], '/v1.0/AUTH_test/TEST0') self.assertEqual(proxy0_srv.env['SERVER_NAME'], '127.0.0.1') self.assertEqual(proxy0_srv.env['SERVER_PORT'], '8080') self.assertEqual(proxy0_srv.env['REQUEST_METHOD'], 'PUT')
class TestMACAuthenticationPolicy(unittest.TestCase): """Testcases for the MACAuthenticationPolicy class.""" def setUp(self): self.config = Configurator(settings={ "macauth.find_groups": "pyramid_macauth.tests:stub_find_groups", }) self.config.include("pyramid_macauth") self.config.add_route("public", "/public") self.config.add_view(stub_view_public, route_name="public") self.config.add_route("auth", "/auth") self.config.add_view(stub_view_auth, route_name="auth") self.config.add_route("groups", "/groups") self.config.add_view(stub_view_groups, route_name="groups") self.app = TestApp(self.config.make_wsgi_app()) self.policy = self.config.registry.queryUtility(IAuthenticationPolicy) def _make_request(self, *args, **kwds): return make_request(self.config, *args, **kwds) def _make_signed_request(self, userid, *args, **kwds): creds = self._get_credentials(userid=userid) req = self._make_request(*args, **kwds) macauthlib.sign_request(req, **creds) return req def _get_credentials(self, **data): id = tokenlib.make_token(data) key = tokenlib.get_token_secret(id) return {"id": id, "key": key} def test_the_class_implements_auth_policy_interface(self): verifyClass(IAuthenticationPolicy, MACAuthenticationPolicy) def test_from_settings_can_explicitly_set_all_properties(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.find_groups": "pyramid_macauth.tests:stub_find_groups", "macauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", "macauth.nonce_cache": "macauthlib:NonceCache", }) self.assertEquals(policy.find_groups, stub_find_groups) self.assertEquals(policy.decode_mac_id, stub_decode_mac_id) self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) def test_from_settings_passes_on_args_to_nonce_cache(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.nonce_cache": "macauthlib:NonceCache", "macauth.nonce_cache_nonce_ttl": 42, }) self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) self.assertEquals(policy.nonce_cache.nonce_ttl, 42) self.assertRaises(TypeError, MACAuthenticationPolicy.from_settings, { "macauth.nonce_cache": "macauthlib:NonceCache", "macauth.nonce_cache_invalid_arg": "WHAWHAWHAWHA", }) def test_from_settings_errors_out_on_unexpected_keyword_args(self): self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { "macauth.unexpected": "spanish-inquisition", }) def test_from_settings_errors_out_on_args_to_a_non_callable(self): self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { "macauth.nonce_cache": "pyramid_macauth.tests:stub_non_callable", "macauth.nonce_cache_arg": "invalidarg", }) def test_from_settings_errors_out_if_decode_mac_id_is_not_callable(self): self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { "macauth.decode_mac_id": "pyramid_macauth.tests:stub_non_callable", }) def test_from_settings_produces_sensible_defaults(self): policy = MACAuthenticationPolicy.from_settings({}) self.assertEquals(policy.find_groups.im_func, MACAuthenticationPolicy.find_groups.im_func) self.assertEquals(policy.decode_mac_id.im_func, MACAuthenticationPolicy.decode_mac_id.im_func) self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) def test_from_settings_curries_args_to_decode_mac_id(self): policy = MACAuthenticationPolicy.from_settings({ "macauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", "macauth.decode_mac_id_suffix": "-TEST", }) self.assertEquals(policy.decode_mac_id(None, "id"), ("id", "id-TEST")) def test_remember_does_nothing(self): policy = MACAuthenticationPolicy() req = self._make_signed_request("*****@*****.**", "/") self.assertEquals(policy.remember(req, "*****@*****.**"), []) def test_forget_gives_a_challenge_header(self): policy = MACAuthenticationPolicy() req = self._make_signed_request("*****@*****.**", "/") headers = policy.forget(req) self.assertEquals(len(headers), 1) self.assertEquals(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1] == "MAC") def test_unauthenticated_requests_get_a_challenge(self): r = self.app.get("/auth", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("MAC")) def test_authenticated_request_works(self): req = self._make_signed_request("*****@*****.**", "/auth") r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") def test_authentication_fails_when_macid_has_no_userid(self): creds = self._get_credentials(hello="world") req = self._make_request("/auth") macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_non_mac_scheme_fails(self): req = self._make_request("/auth") req.authorization = "OpenID hello=world" self.app.request(req, status=401) req = self._make_request("/public") req.authorization = "OpenID hello=world" self.app.request(req, status=200) def test_authentication_without_macid_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("id", "idd") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_timestamp_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("ts", "typostamp") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_without_nonce_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace("nonce", "typonce") req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): creds = self._get_credentials(username="******") req = self._make_request("/auth") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=200) # Now do one with a really old timestamp. ts = str(int(time.time() - 1000)) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_far_future_timestamp_fails(self): creds = self._get_credentials(username="******") req = self._make_request("/auth") # Do an initial request so that the server can # calculate and cache our clock skew. ts = str(int(time.time())) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=200) # Now do one with a far future timestamp. ts = str(int(time.time() + 1000)) req.authorization = ("MAC", {"ts": ts}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_reused_nonce_fails(self): creds = self._get_credentials(username="******") # First request with that nonce should succeed. req = self._make_request("/auth") req.authorization = ("MAC", {"nonce": "PEPPER"}) macauthlib.sign_request(req, **creds) r = self.app.request(req) self.assertEquals(r.body, "*****@*****.**") # Second request with that nonce should fail. req = self._make_request("/auth") req.authorization = ("MAC", {"nonce": "PEPPER"}) macauthlib.sign_request(req, **creds) self.app.request(req, status=401) def test_authentication_with_busted_macid_fails(self): req = self._make_signed_request("*****@*****.**", "/auth") id = macauthlib.utils.parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(id, "XXX" + id) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_authentication_with_busted_signature_fails(self): creds = self._get_credentials(username="******") req = self._make_request("/auth") macauthlib.sign_request(req, **creds) signature = macauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz self.app.request(req, status=401) def test_groupfinder_can_block_authentication(self): req = self._make_signed_request("baduser", "/auth") r = self.app.request(req, status=401) req = self._make_signed_request("baduser", "/public") r = self.app.request(req, status=200) self.assertEquals(r.body, "baduser") def test_groupfinder_gruops_are_correctly_reported(self): req = self._make_request("/groups") r = self.app.request(req) self.assertEquals(r.json, [str(Everyone)]) req = self._make_signed_request("gooduser", "/groups") r = self.app.request(req) self.assertEquals(r.json, ["gooduser", str(Everyone), str(Authenticated)]) req = self._make_signed_request("test", "/groups") r = self.app.request(req) self.assertEquals(r.json, ["test", str(Everyone), str(Authenticated), "group"]) req = self._make_signed_request("baduser", "/groups") r = self.app.request(req) self.assertEquals(r.json, [str(Everyone)]) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = self._make_request("/public") resp = self.app.request(req) self.assertEquals(resp.body, "None") # Request with valid credentials is allowed access. req = self._make_signed_request("*****@*****.**", "/public") resp = self.app.request(req) self.assertEquals(resp.body, "*****@*****.**") # Request with invalid credentials still reports a userid. req = self._make_signed_request("*****@*****.**", "/public") signature = macauthlib.utils.parse_authz_header(req)["mac"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(signature, "XXX" + signature) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req) self.assertEquals(resp.body, "*****@*****.**") # Request with malformed credentials gets a 401 req = self._make_signed_request("*****@*****.**", "/public") tokenid = macauthlib.utils.parse_authz_header(req)["id"] authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(tokenid, "XXX" + tokenid) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req, status=401) def test_check_signature_fails_if_no_params_present(self): req = self._make_request("/auth") self.assertRaises(HTTPUnauthorized, self.policy._check_signature, req, "XXX") def test_default_groupfinder_returns_empty_list(self): policy = MACAuthenticationPolicy() req = self._make_request("/auth") self.assertEquals(policy.find_groups("test", req), []) def test_auth_can_be_checked_several_times_on_same_request(self): req = self._make_signed_request("*****@*****.**", "/public") self.assertEquals(authenticated_userid(req), "*****@*****.**") self.assertEquals(authenticated_userid(req), "*****@*****.**")
class TestJWTAuthenticationPolicy(unittest.TestCase): """Testcases for the JWTAuthenticationPolicy class.""" def setUp(self): self.config = Configurator(settings={ "jwtauth.find_groups": "pyramid_jwtauth.tests.test_jwtauth:stub_find_groups", "jwtauth.master_secret": MASTER_SECRET, }) self.config.include("pyramid_jwtauth") self.config.add_route("public", "/public") self.config.add_view(stub_view_public, route_name="public") self.config.add_route("auth", "/auth") self.config.add_view(stub_view_auth, route_name="auth") self.config.add_route("groups", "/groups") self.config.add_view(stub_view_groups, route_name="groups") self.app = TestApp(self.config.make_wsgi_app()) self.policy = self.config.registry.queryUtility(IAuthenticationPolicy) def _make_request(self, *args, **kwds): return make_request(self.config, *args, **kwds) # create an authenticated request that has a JWT with the userid set # in our case, this is the 'sub' request. # # we need to have the following claims as a minimum: # 'sub': the userid that we want to authenticate - it can be anything. # 'iat': the issued at time stamp # 'nbf': the not before time stamp # 'exp': the expiry time for the JWT def _make_authenticated_request(self, userid, *args, **kwds): claims = None if 'claims' in kwds: claims = kwds['claims'] del kwds['claims'] req = self._make_request(*args, **kwds) # creds = self._get_credentials(req, userid=userid) claims = make_claims(userid=userid, claims=claims) # jwt_authenticate_request(req, **creds) # note jwt_authenticate_request() returns headers if wanted jwt_authenticate_request(req, claims, MASTER_SECRET) return req def test_the_class_implements_auth_policy_interface(self): verifyClass(IAuthenticationPolicy, JWTAuthenticationPolicy) def test_from_settings_can_explicitly_set_all_properties(self): policy = JWTAuthenticationPolicy.from_settings({ "jwtauth.find_groups": "pyramid_jwtauth.tests.test_jwtauth:stub_find_groups", "jwtauth.master_secret": MASTER_SECRET, # "jwtauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", # "jwtauth.encode_mac_id": "pyramid_macauth.tests:stub_encode_mac_id", }) self.assertEqual(policy.find_groups, stub_find_groups) self.assertEqual(policy.master_secret, MASTER_SECRET) # self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) # self.assertEqual(policy.decode_mac_id, stub_decode_mac_id) # self.assertEqual(policy.encode_mac_id, stub_encode_mac_id) # def test_from_settings_passes_on_args_to_nonce_cache(self): # policy = MACAuthenticationPolicy.from_settings({ # "macauth.nonce_cache": "macauthlib:NonceCache", # "macauth.nonce_cache_nonce_ttl": 42, # }) # self.assertTrue(isinstance(policy.nonce_cache, macauthlib.NonceCache)) # self.assertEqual(policy.nonce_cache.nonce_ttl, 42) # self.assertRaises(TypeError, MACAuthenticationPolicy.from_settings, { # "macauth.nonce_cache": "macauthlib:NonceCache", # "macauth.nonce_cache_invalid_arg": "WHAWHAWHAWHA", # }) def test_from_settings_errors_out_on_unexpected_keyword_args(self): self.assertRaises(ValueError, JWTAuthenticationPolicy.from_settings, { "jwtauth.unexpected": "spanish-inquisition", }) # def test_from_settings_errors_out_on_args_to_a_non_callable(self): # self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { # "macauth.nonce_cache": "pyramid_macauth.tests:stub_non_callable", # "macauth.nonce_cache_arg": "invalidarg", # }) # def test_from_settings_errors_out_if_decode_mac_id_is_not_callable(self): # self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { # "macauth.decode_mac_id": "pyramid_macauth.tests:stub_non_callable", # }) # def test_from_settings_errors_out_if_encode_mac_id_is_not_callable(self): # self.assertRaises(ValueError, MACAuthenticationPolicy.from_settings, { # "macauth.encode_mac_id": "pyramid_macauth.tests:stub_non_callable", # }) def test_from_settings_produces_sensible_defaults(self): policy = JWTAuthenticationPolicy.from_settings({}) # Using __code__ here is a Py2/Py3 compatible way of checking # that a bound and unbound method point to the same function object. self.assertEqual(policy.find_groups.__code__, JWTAuthenticationPolicy.find_groups.__code__) # def test_from_settings_curries_args_to_decode_mac_id(self): # policy = MACAuthenticationPolicy.from_settings({ # "macauth.decode_mac_id": "pyramid_macauth.tests:stub_decode_mac_id", # "macauth.decode_mac_id_suffix": "-TEST", # }) # self.assertEqual(policy.decode_mac_id(None, "id"), ("id", "id-TEST")) # def test_from_settings_curries_args_to_encode_mac_id(self): # policy = MACAuthenticationPolicy.from_settings({ # "macauth.encode_mac_id": "pyramid_macauth.tests:stub_encode_mac_id", # "macauth.encode_mac_id_suffix": "-TEST", # }) # self.assertEqual(policy.encode_mac_id(None, "id"), ("id", "id-TEST")) # not sure if this test is particularly useful as JWTAuthenticationPolicy # doesn't work on 'remembering' requests. def test_remember_does_nothing(self): policy = JWTAuthenticationPolicy() req = self._make_authenticated_request("*****@*****.**", "/") self.assertEqual(policy.remember(req, "*****@*****.**"), []) def test_forget_gives_a_challenge_header(self): policy = JWTAuthenticationPolicy() req = self._make_authenticated_request("*****@*****.**", "/") headers = policy.forget(req) self.assertEqual(len(headers), 1) self.assertEqual(headers[0][0], "WWW-Authenticate") self.assertTrue(headers[0][1] == "Bearer") def test_forget_gives_a_challenge_header_with_custom_scheme(self): policy = JWTAuthenticationPolicy(scheme='Bearer') req = self._make_authenticated_request("*****@*****.**", "/") headers = policy.forget(req) self.assertTrue(headers[0][1] == "Bearer") def test_unauthenticated_requests_get_a_challenge(self): r = self.app.get("/auth", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith("Bearer")) def test_unauthenticated_requests_get_a_challenge_custom_scheme(self): self.policy.scheme = 'Lolwut' r = self.app.get("/auth", status=401) challenge = r.headers["WWW-Authenticate"] self.assertTrue(challenge.startswith('Lolwut')) def test_authenticated_request_works(self): req = self._make_authenticated_request("*****@*****.**", "/auth") r = self.app.request(req) self.assertEqual(r.body, b"*****@*****.**") # def test_authentication_fails_when_macid_has_no_userid(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, hello="world") # macauthlib.sign_request(req, **creds) # self.app.request(req, status=401) def test_authentication_with_non_jwt_scheme_fails(self): req = self._make_request("/auth") req.authorization = "OpenID hello=world" self.app.request(req, status=401) req = self._make_request("/public") req.authorization = "OpenID hello=world" self.app.request(req, status=200) # def test_authentication_without_macid_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace("id", "idd") # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) # def test_authentication_without_timestamp_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace("ts", "typostamp") # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) # def test_authentication_without_nonce_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace("nonce", "typonce") # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) def test_authentication_with_expired_timestamp_fails(self): req = self._make_authenticated_request("*****@*****.**", "/auth") self.app.request(req, status=200) # now do an out of date one. ts = datetime.datetime.utcnow() - datetime.timedelta(days=1) claims = {'exp': ts} req = self._make_authenticated_request("*****@*****.**", "/auth", claims=claims) self.app.request(req, status=401) def test_can_get_claims_from_token(self): claims = { 'urn:websandhq.co.uk/auth:jti': 'hello' } req = self._make_authenticated_request("*****@*****.**", "/auth", claims=claims) policy = JWTAuthenticationPolicy( master_secret="V8 JUICE IS 1/8TH GASOLINE") encoded_claims = policy.get_claims(req) self.assertTrue('urn:websandhq.co.uk/auth:jti' in encoded_claims) self.assertEqual(encoded_claims['urn:websandhq.co.uk/auth:jti'], 'hello') # def test_authentication_with_far_future_timestamp_fails(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, username="******") # # Do an initial request so that the server can # # calculate and cache our clock skew. # ts = str(int(time.time())) # req.authorization = ("MAC", {"ts": ts}) # macauthlib.sign_request(req, **creds) # self.app.request(req, status=200) # # Now do one with a far future timestamp. # ts = str(int(time.time() + 1000)) # req.authorization = ("MAC", {"ts": ts}) # macauthlib.sign_request(req, **creds) # self.app.request(req, status=401) # def test_authentication_with_reused_nonce_fails(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, username="******") # # First request with that nonce should succeed. # req.authorization = ("MAC", {"nonce": "PEPPER"}) # macauthlib.sign_request(req, **creds) # r = self.app.request(req) # self.assertEqual(r.body, b"*****@*****.**") # # Second request with that nonce should fail. # req = self._make_request("/auth") # req.authorization = ("MAC", {"nonce": "PEPPER"}) # macauthlib.sign_request(req, **creds) # self.app.request(req, status=401) # def test_authentication_with_busted_macid_fails(self): # req = self._make_signed_request("*****@*****.**", "/auth") # id = macauthlib.utils.parse_authz_header(req)["id"] # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace(id, "XXX" + id) # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) # def test_authentication_with_busted_signature_fails(self): # req = self._make_request("/auth") # creds = self._get_credentials(req, username="******") # macauthlib.sign_request(req, **creds) # signature = macauthlib.utils.parse_authz_header(req)["mac"] # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace(signature, "XXX" + signature) # req.environ["HTTP_AUTHORIZATION"] = authz # self.app.request(req, status=401) def test_groupfinder_can_block_authentication(self): req = self._make_authenticated_request("baduser", "/auth") r = self.app.request(req, status=403) req = self._make_authenticated_request("baduser", "/public") r = self.app.request(req, status=200) self.assertEqual(r.body, b"baduser") def test_groupfinder_groups_are_correctly_reported(self): req = self._make_request("/groups") r = self.app.request(req) self.assertEqual(r.json, [str(Everyone)]) req = self._make_authenticated_request("gooduser", "/groups") r = self.app.request(req) self.assertEqual(r.json, ["gooduser", str(Everyone), str(Authenticated)]) req = self._make_authenticated_request("test", "/groups") r = self.app.request(req) self.assertEqual(r.json, ["test", str(Everyone), "group", str(Authenticated)]) req = self._make_authenticated_request("baduser", "/groups") r = self.app.request(req) self.assertEqual(r.json, [str(Everyone)]) def test_access_to_public_urls(self): # Request with no credentials is allowed access. req = self._make_request("/public") resp = self.app.request(req) self.assertEqual(resp.body, b"None") # Request with valid credentials is allowed access. req = self._make_authenticated_request("*****@*****.**", "/public") resp = self.app.request(req) self.assertEqual(resp.body, b"*****@*****.**") # Request with invalid credentials still reports a userid. req = self._make_authenticated_request("*****@*****.**", "/public") token = pyramid_jwtauth.utils.parse_authz_header(req)["token"] bits = token.split('.') bits[2] = 'XXX' + bits[2] broken_token = '.'.join(bits) authz = req.environ["HTTP_AUTHORIZATION"] authz = authz.replace(token, broken_token) req.environ["HTTP_AUTHORIZATION"] = authz resp = self.app.request(req) self.assertEqual(resp.body, b"*****@*****.**") # Request with malformed credentials gets a 401 # req = self._make_signed_request("*****@*****.**", "/public") # tokenid = macauthlib.utils.parse_authz_header(req)["id"] # authz = req.environ["HTTP_AUTHORIZATION"] # authz = authz.replace(tokenid, "XXX" + tokenid) # req.environ["HTTP_AUTHORIZATION"] = authz # resp = self.app.request(req, status=401) # def test_check_signature_fails_if_no_params_present(self): # req = self._make_request("/auth") # self.assertRaises(HTTPUnauthorized, # self.policy._check_signature, req, "XXX") def test_default_groupfinder_returns_empty_list(self): policy = JWTAuthenticationPolicy() req = self._make_request("/auth") self.assertEqual(policy.find_groups("test", req), []) def test_auth_can_be_checked_several_times_on_same_request(self): req = self._make_authenticated_request("*****@*****.**", "/public") self.assertEqual(authenticated_userid(req), "*****@*****.**") self.assertEqual(authenticated_userid(req), "*****@*****.**")
def test_basic_rest(self): class OthersController(object): @expose() def index(self): return 'OTHERS' @expose() def echo(self, value): return str(value) class ThingsController(RestController): data = ['zero', 'one', 'two', 'three'] _custom_actions = {'count': ['GET'], 'length': ['GET', 'POST']} others = OthersController() @expose() def get_one(self, id): return self.data[int(id)] @expose('json') def get_all(self): return dict(items=self.data) @expose() def length(self, id, value=None): length = len(self.data[int(id)]) if value: length += len(value) return str(length) @expose() def get_count(self): return str(len(self.data)) @expose() def new(self): return 'NEW' @expose() def post(self, value): self.data.append(value) response.status = 302 return 'CREATED' @expose() def edit(self, id): return 'EDIT %s' % self.data[int(id)] @expose() def put(self, id, value): self.data[int(id)] = value return 'UPDATED' @expose() def get_delete(self, id): return 'DELETE %s' % self.data[int(id)] @expose() def delete(self, id): del self.data[int(id)] return 'DELETED' @expose() def reset(self): return 'RESET' @expose() def post_options(self): return 'OPTIONS' @expose() def options(self): abort(500) @expose() def other(self): abort(500) class RootController(object): things = ThingsController() # create the app app = TestApp(make_app(RootController())) # test get_all r = app.get('/things') assert r.status_int == 200 assert r.body == b_(dumps(dict(items=ThingsController.data))) # test get_one for i, value in enumerate(ThingsController.data): r = app.get('/things/%d' % i) assert r.status_int == 200 assert r.body == b_(value) # test post r = app.post('/things', {'value': 'four'}) assert r.status_int == 302 assert r.body == b_('CREATED') # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('four') # test edit r = app.get('/things/3/edit') assert r.status_int == 200 assert r.body == b_('EDIT three') # test put r = app.put('/things/4', {'value': 'FOUR'}) assert r.status_int == 200 assert r.body == b_('UPDATED') # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('FOUR') # test put with _method parameter and GET r = app.get('/things/4?_method=put', {'value': 'FOUR!'}, status=405) assert r.status_int == 405 # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('FOUR') # test put with _method parameter and POST r = app.post('/things/4?_method=put', {'value': 'FOUR!'}) assert r.status_int == 200 assert r.body == b_('UPDATED') # make sure it works r = app.get('/things/4') assert r.status_int == 200 assert r.body == b_('FOUR!') # test get delete r = app.get('/things/4/delete') assert r.status_int == 200 assert r.body == b_('DELETE FOUR!') # test delete r = app.delete('/things/4') assert r.status_int == 200 assert r.body == b_('DELETED') # make sure it works r = app.get('/things') assert r.status_int == 200 assert len(loads(r.body.decode())['items']) == 4 # test delete with _method parameter and GET r = app.get('/things/3?_method=DELETE', status=405) assert r.status_int == 405 # make sure it works r = app.get('/things') assert r.status_int == 200 assert len(loads(r.body.decode())['items']) == 4 # test delete with _method parameter and POST r = app.post('/things/3?_method=DELETE') assert r.status_int == 200 assert r.body == b_('DELETED') # make sure it works r = app.get('/things') assert r.status_int == 200 assert len(loads(r.body.decode())['items']) == 3 # test "RESET" custom action r = app.request('/things', method='RESET') assert r.status_int == 200 assert r.body == b_('RESET') # test "RESET" custom action with _method parameter r = app.get('/things?_method=RESET') assert r.status_int == 200 assert r.body == b_('RESET') # test the "OPTIONS" custom action r = app.request('/things', method='OPTIONS') assert r.status_int == 200 assert r.body == b_('OPTIONS') # test the "OPTIONS" custom action with the _method parameter r = app.post('/things', {'_method': 'OPTIONS'}) assert r.status_int == 200 assert r.body == b_('OPTIONS') # test the "other" custom action with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things/other', method='MISC', status=405) assert r.status_int == 405 # test the "other" custom action with the _method parameter r = app.post('/things/other', {'_method': 'MISC'}, status=405) assert r.status_int == 405 # test the "others" custom action with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things/others/', method='MISC') assert r.status_int == 200 assert r.body == b_('OTHERS') # test the "others" custom action missing trailing slash with warnings.catch_warnings(): warnings.simplefilter("ignore") r = app.request('/things/others', method='MISC', status=302) assert r.status_int == 302 # test the "others" custom action with the _method parameter r = app.get('/things/others/?_method=MISC') assert r.status_int == 200 assert r.body == b_('OTHERS') # test an invalid custom action r = app.get('/things?_method=BAD', status=404) assert r.status_int == 404 # test custom "GET" request "count" r = app.get('/things/count') assert r.status_int == 200 assert r.body == b_('3') # test custom "GET" request "length" r = app.get('/things/1/length') assert r.status_int == 200 assert r.body == b_(str(len('one'))) # test custom "GET" request through subcontroller r = app.get('/things/others/echo?value=test') assert r.status_int == 200 assert r.body == b_('test') # test custom "POST" request "length" r = app.post('/things/1/length', {'value': 'test'}) assert r.status_int == 200 assert r.body == b_(str(len('onetest'))) # test custom "POST" request through subcontroller r = app.post('/things/others/echo', {'value': 'test'}) assert r.status_int == 200 assert r.body == b_('test')
class TestTASRSubjectApp(TASRTestCase): '''These tests check that the TASR S+V REST API, expected by the Avro-1124 repo code. This does not check the TASR native API calls. ''' def setUp(self): self.event_type = "gold" fix_rel_path = "schemas/%s.avsc" % (self.event_type) self.avsc_file = TASRTestCase.get_fixture_file(fix_rel_path, "r") self.schema_str = self.avsc_file.read() self.tasr_app = TestApp(APP) self.url_prefix = 'http://%s:%s/tasr' % (APP.config.host, APP.config.port) self.subject_url = '%s/subject/%s' % (self.url_prefix, self.event_type) self.content_type = 'application/json; charset=utf8' # clear out all the keys before beginning -- careful! APP.ASR.redis.flushdb() def tearDown(self): # this clears out redis after each test -- careful! APP.ASR.redis.flushdb() def abort_diff_status(self, resp, code): self.assertEqual(code, resp.status_code, u'Non-%s status code: %s' % (code, resp.status_code)) def register_subject(self, subject_name): url = '%s/subject/%s' % (self.url_prefix, subject_name) return self.tasr_app.put(url, {'subject_name': subject_name}) def register_schema(self, subject_name, schema_str, expect_errors=False): reg_url = '%s/subject/%s/register' % (self.url_prefix, subject_name) return self.tasr_app.request(reg_url, method='PUT', content_type=self.content_type, expect_errors=expect_errors, body=schema_str) ########################################################################### # subject tests ########################################################################### def test_all_subject_names(self): '''GET /tasr/subject - gets _all_ current subjects, as expected''' # reg two vers for target subject and one for an alt subject self.register_subject(self.event_type) alt_subject_name = 'bob' self.register_subject(alt_subject_name) # now get all and check the headers resp = self.tasr_app.request('%s/subject' % self.url_prefix, method='GET') self.abort_diff_status(resp, 200) meta_dict = SubjectHeaderBot.extract_metadata(resp) self.assertIn(self.event_type, meta_dict.keys(), 'missing subject') subj = meta_dict[self.event_type] self.assertEqual(self.event_type, subj.name, 'bad subject name') self.assertIn(alt_subject_name, meta_dict.keys(), 'missing subject') alt_subj = meta_dict[alt_subject_name] self.assertEqual(alt_subject_name, alt_subj.name, 'bad subject name') # lastly check the body buff = StringIO.StringIO(resp.body) group_names = [] for topic_line in buff: group_names.append(topic_line.strip()) buff.close() self.assertListEqual(sorted(group_names), sorted(meta_dict.keys()), 'Expected group_names in body to match headers.') def test_lookup_subject(self): '''GET /tasr/subject/<subject> - lookup the subject by name''' self.register_subject(self.event_type) resp = self.tasr_app.request(self.subject_url, method='GET') self.abort_diff_status(resp, 200) metas = SubjectHeaderBot.extract_metadata(resp) self.assertEqual(self.event_type, metas[self.event_type].name, 'unexpected subject name') def test_lookup_subject__accept_json(self): '''GET /tasr/subject/<subject> - lookup the subject by name''' self.register_subject(self.event_type) resp = self.tasr_app.request(self.subject_url, method='GET', accept='text/json') self.abort_diff_status(resp, 200) metas = SubjectHeaderBot.extract_metadata(resp) self.assertEqual(self.event_type, metas[self.event_type].name, 'unexpected subject name') def test_lookup_missing_subject(self): '''GET /tasr/subject/<subject> - lookup the subject by name''' missing_subject_name = 'bob' url = '%s/%s' % (self.url_prefix, missing_subject_name) resp = self.tasr_app.request(url, method='GET', expect_errors=True) self.abort_diff_status(resp, 404) def test_lookup_missing_subject__accept_json(self): '''GET /tasr/subject/<subject> - lookup the subject by name''' missing_subject_name = 'bob' url = '%s/%s' % (self.url_prefix, missing_subject_name) resp = self.tasr_app.request(url, method='GET', accept='text/json', expect_errors=True) self.abort_diff_status(resp, 404) # we expect a JSON error back, so check that we got it json_error = json.loads(resp.body) # body is parseable JSON self.assertEqual(404, json_error["status_code"], "expected a 404") def test_register_subject(self): '''PUT /tasr/subject - registers the subject (not the schema)''' resp = self.register_subject(self.event_type) self.abort_diff_status(resp, 201) metas = SubjectHeaderBot.extract_metadata(resp) self.assertEqual(self.event_type, metas[self.event_type].name, 'unexpected subject name') def test_delete_subject(self): '''DELETE /tasr/subject/<subject> - delete the subject''' # ensure expose_delete is True mode = APP.config.mode orig_val = APP.config.config.get(mode, 'expose_delete') APP.config.config.set(mode, 'expose_delete', 'True') try: self.register_subject(self.event_type) resp = self.tasr_app.request(self.subject_url, method='GET') self.abort_diff_status(resp, 200) resp = self.tasr_app.request(self.subject_url, method='DELETE', expect_errors=False) self.abort_diff_status(resp, 200) finally: # reset expose_delete to its original value APP.config.config.set(mode, 'expose_delete', orig_val) def test_delete_missing_subject(self): '''DELETE /tasr/subject/<subject> - delete a missing subject''' mode = APP.config.mode orig_val = APP.config.config.get(mode, 'expose_delete') APP.config.config.set(mode, 'expose_delete', 'True') try: resp = self.tasr_app.request(self.subject_url, method='DELETE', expect_errors=True) self.abort_diff_status(resp, 404) finally: # reset expose_delete to its original value APP.config.config.set(mode, 'expose_delete', orig_val) def test_unexposed_delete_subject(self): '''DELETE /tasr/subject/<subject> - delete when not allowed''' mode = APP.config.mode orig_val = APP.config.config.get(mode, 'expose_delete') APP.config.config.set(mode, 'expose_delete', 'False') try: resp = self.tasr_app.request(self.subject_url, method='DELETE', expect_errors=True) self.abort_diff_status(resp, 403) finally: # reset expose_delete to its original value APP.config.config.set(mode, 'expose_delete', orig_val) def test_register_subject__accept_json(self): '''PUT /tasr/subject - registers the subject (not the schema)''' url = '%s/subject/%s' % (self.url_prefix, self.event_type) dummy_config = {'dummy_config_key': 'dummy_config_val'} resp = self.tasr_app.put(url, dummy_config, {'Accept': 'text/json'}) self.abort_diff_status(resp, 201) metas = SubjectHeaderBot.extract_metadata(resp) self.assertEqual(self.event_type, metas[self.event_type].name, 'unexpected subject name') # check the returned JSON to ensure it worked json_sub = json.loads(resp.body) self.assertEqual(self.event_type, json_sub["subject_name"], "bad subject name") self.assertEqual(dummy_config, json_sub["config"], "bad config") def test_register_subject_with_no_config(self): '''PUT /tasr/subject/<subject> - missing body should be OK''' resp = self.tasr_app.request(self.subject_url, method='PUT', body=None, expect_errors=False) self.abort_diff_status(resp, 201) def test_register_subject_with_config_with_empty_field_val(self): '''PUT /tasr/subject - empty subject name should be OK''' resp = self.tasr_app.put(self.subject_url, {'subject_name': ''}, expect_errors=False) self.abort_diff_status(resp, 201) def test_register_subject_with_config_with_colliding_fields(self): '''PUT /tasr/subject - empty subject name should return a 400''' resp = self.tasr_app.put(self.subject_url, {'subject_name': ['alice', 'bob']}, expect_errors=True) self.abort_diff_status(resp, 400) def test_rereg_subject_with_non_conflicting_config(self): '''PUT /tasr/subject - configs match, so no problem''' resp = self.tasr_app.put(self.subject_url, {'subject_name': 'bob'}, expect_errors=False) self.abort_diff_status(resp, 201) resp = self.tasr_app.put(self.subject_url, {'subject_name': 'bob'}, expect_errors=False) self.abort_diff_status(resp, 200) def test_rereg_subject_with_conflicting_config(self): '''PUT /tasr/subject - conflict with preexisting config should 409''' resp = self.tasr_app.put(self.subject_url, {'subject_name': 'bob'}, expect_errors=False) self.abort_diff_status(resp, 201) resp = self.tasr_app.put(self.subject_url, {'subject_name': 'alice'}, expect_errors=True) self.abort_diff_status(resp, 409) def test_reg_and_rereg_subject(self): '''PUT /tasr/subject - registers the subject (not the schema), then re-registers the same subject. The second reg should return a 200.''' resp = self.register_subject(self.event_type) self.abort_diff_status(resp, 201) resp = self.register_subject(self.event_type) self.abort_diff_status(resp, 200) metas = SubjectHeaderBot.extract_metadata(resp) self.assertEqual(self.event_type, metas[self.event_type].name, 'unexpected subject name') def test_get_subject_config(self): '''GET /tasr/subject/<subject>/config - get the config map''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}, expect_errors=False) self.abort_diff_status(resp, 201) url = '%s/config' % self.subject_url resp = self.tasr_app.request(url, method='GET') self.assertEqual('subject_name=%s' % self.event_type, resp.body.strip(), 'Bad response body.') def test_update_subject_config(self): '''GET /tasr/subject/<subject>/config - get the config map''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}) self.abort_diff_status(resp, 201) url = '%s/config' % self.subject_url resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual('subject_name=%s' % self.event_type, resp.body.strip(), 'Bad response body.') resp = self.tasr_app.post(url, {'subject_name': 'alice'}) self.abort_diff_status(resp, 200) resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual('subject_name=alice', resp.body.strip(), 'Bad response body.') def test_get_subject_config_entry(self): '''GET /tasr/subject/<subject>/config/<key> - get a config value''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}, expect_errors=False) self.abort_diff_status(resp, 201) url = '%s/config/%s' % (self.subject_url, 'subject_name') resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(resp.body.strip(), self.event_type, 'value mismatch') def test_get_subject_config_entry_as_json(self): '''GET /tasr/subject/<subject>/config/<key> - get as JSON''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}, expect_errors=False) self.abort_diff_status(resp, 201) url = '%s/config/%s' % (self.subject_url, 'subject_name') resp = self.tasr_app.request(url, headers={'Accept': 'text/json'}, method='GET') self.abort_diff_status(resp, 200) expected_dict = {'subject_name': self.event_type} json_dict = json.loads(resp.body.strip()) self.assertDictEqual(json_dict, expected_dict, 'mismatch') def test_set_subject_config_entry_overwrite(self): '''POST /tasr/subject/<subject>/config/<key> - get a config value''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}, expect_errors=False) self.abort_diff_status(resp, 201) # check that the original value is right url = '%s/config/%s' % (self.subject_url, 'subject_name') resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(resp.body.strip(), self.event_type, 'value mismatch') # set a new entry -- key is part of the URL, the POST body is the value val = 'ALICE_VAL' resp = self.tasr_app.post(url, val) self.abort_diff_status(resp, 200) # now grab the value for the new entry and check it is what we sent resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) rval = resp.body.strip() self.assertEqual(rval, val, 'value mismatch (%s != %s)' % (rval, val)) def test_set_subject_config_entry_new(self): '''POST /tasr/subject/<subject>/config/<key> - get a config value''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}, expect_errors=False) self.abort_diff_status(resp, 201) # check that the original value is right url = '%s/config/%s' % (self.subject_url, 'subject_name') resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(resp.body.strip(), self.event_type, 'value mismatch') # set a new entry -- key is part of the URL, the POST body is the value key = 'alice_key' val = 'ALICE_VAL' url = '%s/config/%s' % (self.subject_url, key) resp = self.tasr_app.post(url, val) self.abort_diff_status(resp, 200) # now grab the value for the new entry and check it is what we sent resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) rval = resp.body.strip() self.assertEqual(rval, val, 'value mismatch (%s != %s)' % (rval, val)) def test_delete_subject_config_entry(self): '''POST /tasr/subject/<subject>/config/<key> - get a config value''' resp = self.tasr_app.put(self.subject_url, {'subject_name': self.event_type}, expect_errors=False) self.abort_diff_status(resp, 201) # add a new entry # set a new entry -- key is part of the URL, the POST body is the value key = 'alice_key' val = 'ALICE_VAL' url = '%s/config/%s' % (self.subject_url, key) resp = self.tasr_app.post(url, val) self.abort_diff_status(resp, 200) # check that both entries are present and correct url = '%s/config/%s' % (self.subject_url, 'subject_name') resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(resp.body.strip(), self.event_type, 'value mismatch') url = '%s/config/%s' % (self.subject_url, key) resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(resp.body.strip(), val, 'value mismatch') # delete the new entry resp = self.tasr_app.delete(url) self.abort_diff_status(resp, 200) # now check that the new entry is gone... resp = self.tasr_app.request(url, method='GET', expect_errors=True) self.abort_diff_status(resp, 404) # ...and that the original entry is unaffected url = '%s/config/%s' % (self.subject_url, 'subject_name') resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(resp.body.strip(), self.event_type, 'value mismatch') def test_subject_integral(self): '''GET /tasr/subject/<subject_name>/integral - should always return False as our IDs are not integers (though our version numbers are). ''' self.register_subject(self.event_type) url = '%s/integral' % self.subject_url resp = self.tasr_app.request(url, method='GET') self.abort_diff_status(resp, 200) self.assertEqual(u'False', resp.body.strip(), 'Bad response body.') def test_missing_subject_integral(self): '''GET /tasr/subject/<subject_name>/integral - for a bad subject''' url = '%s/integral' % self.subject_url resp = self.tasr_app.request(url, method='GET', expect_errors=True) self.abort_diff_status(resp, 404) def test_all_subject_ids(self): '''GET /tasr/subject/<subject>/all_ids - gets schema IDs for all versions of the subject, in order, one per line in the response body. ''' sha256_ids = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) sha256_ids.append(meta.sha256_id) url = '%s/all_ids' % self.subject_url resp = self.tasr_app.get(url) buff = StringIO.StringIO(resp.body) all_ids = [] for topic_line in buff: all_ids.append(topic_line.strip()) buff.close() self.assertListEqual(sha256_ids, all_ids, 'Bad ID list.') def test_all_subject_schemas(self): '''GET /tasr/subject/<subject>/all_schemas - gets schemas for all versions of the subject, in order, one per line in the response body. ''' versions = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) versions.append(resp.body.strip()) url = '%s/all_schemas' % self.subject_url resp = self.tasr_app.get(url) buff = StringIO.StringIO(resp.body) all_vers = [] for topic_line in buff: all_vers.append(topic_line.strip()) buff.close() self.assertListEqual(versions, all_vers, 'Bad versions list.') ########################################################################### # schema tests ########################################################################### def test_register_schema(self): '''PUT /tasr/subject/<subject>/register - as expected''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) def test_reg_fail_on_empty_schema(self): '''PUT /tasr/subject/<subject>/register - empty schema''' resp = self.register_schema(self.event_type, None, True) self.abort_diff_status(resp, 400) def test_reg_fail_on_invalid_schema(self): '''PUT /tasr/subject/<subject>/register - bad schema''' bad_schema_str = "%s }" % self.schema_str resp = self.register_schema(self.event_type, bad_schema_str, True) self.abort_diff_status(resp, 400) def test_reg_fail_on_bad_content_type(self): '''PUT /tasr/subject/<subject>/register - bad content type''' reg_url = '%s/register' % self.subject_url resp = self.tasr_app.request(reg_url, method='PUT', content_type='text/plain; charset=utf8', expect_errors=True, body=self.schema_str) self.abort_diff_status(resp, 406) def test_reg_and_rereg(self): '''PUT /tasr/subject/<subject>/register - multiple calls, one schema''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta.group_version(self.event_type), 'bad ver') resp1 = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp1, 200) meta1 = SchemaHeaderBot.extract_metadata(resp1) self.assertEqual(1, meta1.group_version(self.event_type), 'bad ver') def test_fail_rereg_with_incompatible_schema(self): '''PUT /tasr/subject/<subject>/register - incompatible schemas''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta.group_version(self.event_type), 'bad ver') # swap long for int, an incompatible change targ = '{"name": "source__timestamp", "type": "long"}' replacement = '{"name": "source__timestamp", "type": "int"}' incompat_schema_str = self.schema_str.replace(targ, replacement, 1) # now registering the schema should return a 409 reg_url = '%s/register' % self.subject_url resp1 = self.tasr_app.request(reg_url, method='PUT', content_type=self.content_type, expect_errors=True, body=incompat_schema_str) self.abort_diff_status(resp1, 409) def test_force_rereg_with_incompatible_schema(self): '''PUT /tasr/subject/<subject>/force_register - incompatible schemas''' mode = APP.config.mode orig_val = APP.config.config.get(mode, 'expose_force_register') APP.config.config.set(mode, 'expose_force_register', 'True') try: resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta.group_version(self.event_type), 'bad ver') # swap long for int, an incompatible change targ = '{"name": "source__timestamp", "type": "long"}' replacement = '{"name": "source__timestamp", "type": "int"}' incompat_schema_str = self.schema_str.replace(targ, replacement, 1) # now forcibly registering the schema should return a 201 reg_url = '%s/force_register' % self.subject_url resp1 = self.tasr_app.request(reg_url, method='PUT', content_type=self.content_type, expect_errors=False, body=incompat_schema_str) self.abort_diff_status(resp1, 201) meta = SchemaHeaderBot.extract_metadata(resp1) self.assertEqual(2, meta.group_version(self.event_type), 'bad ver') finally: # reset expose_force_register to its original value APP.config.config.set(mode, 'expose_force_register', orig_val) def test_unexposed_force_rereg_with_incompatible_schema(self): '''PUT /tasr/subject/<subject>/force_register - incompatible schemas''' mode = APP.config.mode orig_val = APP.config.config.get(mode, 'expose_force_register') APP.config.config.set(mode, 'expose_force_register', 'False') try: resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta.group_version(self.event_type), 'bad ver') # swap long for int, an incompatible change targ = '{"name": "source__timestamp", "type": "long"}' replacement = '{"name": "source__timestamp", "type": "int"}' incompat_schema_str = self.schema_str.replace(targ, replacement, 1) # now forcibly registering the schema should return a 201 reg_url = '%s/force_register' % self.subject_url resp1 = self.tasr_app.request(reg_url, method='PUT', content_type=self.content_type, expect_errors=True, body=incompat_schema_str) self.abort_diff_status(resp1, 403) finally: # reset expose_force_register to its original value APP.config.config.set(mode, 'expose_force_register', orig_val) def test_multi_subject_reg(self): '''PUT /tasr/subject/<subject>/register - multi subjects, one schema''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta.group_version(self.event_type), 'bad ver') alt_subject = 'bob' resp2 = self.register_schema(alt_subject, self.schema_str) self.abort_diff_status(resp2, 201) meta2 = SchemaHeaderBot.extract_metadata(resp2) self.assertEqual(1, meta2.group_version(alt_subject), 'bad ver') # check that first association still holds resp3 = self.tasr_app.get('%s/latest' % self.subject_url) meta3 = SchemaHeaderBot.extract_metadata(resp3) self.assertEqual(1, meta3.group_version(self.event_type), 'lost reg') def test_reg_if_latest(self): '''PUT /tasr/subject/<subject name>/register_if_latest/<version> As expected, we reference the version number of the latest version. ''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) cur_ver = meta.group_version(self.event_type) schema_str_2 = self.get_schema_permutation(self.schema_str) url = '%s/register_if_latest/%s' % (self.subject_url, cur_ver) resp = self.tasr_app.request(url, method='PUT', content_type=self.content_type, body=schema_str_2) self.abort_diff_status(resp, 201) def test_fail_reg_if_latest_bad_ver(self): '''PUT /tasr/subject/<subject name>/register_if_latest/<version> Should fail as version number is non-existent. ''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) bad_ver = meta.group_version(self.event_type) + 1 schema_str_2 = self.get_schema_permutation(self.schema_str) url = '%s/register_if_latest/%s' % (self.subject_url, bad_ver) resp = self.tasr_app.request(url, method='PUT', content_type=self.content_type, expect_errors=True, body=schema_str_2) self.abort_diff_status(resp, 409) def test_fail_reg_if_latest_old_ver(self): '''PUT /tasr/subject/<subject name>/register_if_latest/<version> Should fail as version number exists but is not the latest. ''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) schema_str_2 = self.get_schema_permutation(self.schema_str) resp = self.register_schema(self.event_type, schema_str_2) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) old_ver = meta.group_version(self.event_type) - 1 url = '%s/register_if_latest/%s' % (self.subject_url, old_ver) resp = self.tasr_app.request(url, method='PUT', content_type=self.content_type, expect_errors=True, body=self.schema_str) self.abort_diff_status(resp, 409) # retrieval def test_lookup_by_schema_str(self): '''POST /tasr/subject/<subject>/schema - as expected''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # canonicalized schema string is passed back on registration canonicalized_schema_str = resp.body meta_1 = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(1, meta_1.group_version(self.event_type), 'bad ver') schema_str_2 = self.get_schema_permutation(self.schema_str) resp = self.register_schema(self.event_type, schema_str_2) self.abort_diff_status(resp, 201) # get by POSTed schema post_url = "%s/schema" % self.subject_url post_resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, body=self.schema_str) meta_2 = SchemaHeaderBot.extract_metadata(post_resp) self.assertEqual(1, meta_2.group_version(self.event_type), 'bad ver') self.assertEqual(meta_1.sha256_id, meta_2.sha256_id, 'SHA mismatch') self.assertEqual(meta_1.md5_id, meta_2.md5_id, 'MD5 mismatch') self.assertEqual(canonicalized_schema_str, post_resp.body, u'Unexpected body: %s' % post_resp.body) def test_fail_lookup_by_schema_str_on_empty_schema_str(self): '''POST /tasr/subject/<subject>/schema - fail on empty schema string''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) post_url = "%s/schema" % self.subject_url resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, expect_errors=True, body=None) self.abort_diff_status(resp, 400) def test_fail_lookup_by_schema_str_on_invalid_schema_str(self): '''POST /tasr/subject/<subject>/schema - fail on bad schema string''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) post_url = "%s/schema" % self.subject_url resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, expect_errors=True, body="%s }" % self.schema_str) self.abort_diff_status(resp, 400) def test_fail_lookup_by_schema_str_on_unregistered_schema_str(self): '''POST /tasr/subject/<subject>/schema - fail on new schema string''' post_url = "%s/schema" % self.subject_url resp = self.tasr_app.request(post_url, method='POST', content_type=self.content_type, expect_errors=True, body=self.schema_str) self.assertEqual(404, resp.status_int, u'Unexpected status: %s' % resp.status_int) meta = SchemaHeaderBot.extract_metadata(resp) self.assertTrue(meta.sha256_id, 'SHA missing') self.assertTrue(meta.md5_id, 'MD5 missing') def test_lookup_by_subject_and_version(self): '''GET /tasr/subject/<subject>/version/<version> - as expected''' schemas = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # step through and request each version by version number for v in range(1, 50): get_url = '%s/version/%s' % (self.subject_url, v) get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) meta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(v, meta.group_version(self.event_type), 'bad ver') self.assertEqual(schemas[v - 1], get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_fail_lookup_for_subject_and_version_on_bad_version(self): '''GET /tasr/subject/<subject>/version/<version> - fail on bad ver''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) meta = SchemaHeaderBot.extract_metadata(resp) bad_version = meta.group_version(self.event_type) + 1 get_url = '%s/version/%s' % (self.subject_url, bad_version) get_resp = self.tasr_app.request(get_url, method='GET', expect_errors=True) self.abort_diff_status(get_resp, 404) def test_lookup_for_subject_and_version_on_stale_version(self): '''GET /tasr/subject/<subject>/version/<version> - 1 schema, 2 vers''' resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) schema_str_2 = self.get_schema_permutation(self.schema_str) resp = self.register_schema(self.event_type, schema_str_2) self.abort_diff_status(resp, 201) resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # get the latest version, which should be 3 resp = self.tasr_app.get('%s/latest' % self.subject_url) self.abort_diff_status(resp, 200) meta_v3 = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(3, meta_v3.group_version(self.event_type), 'bad ver') # now get ver 1, which should have the same body as ver 3 get_url = '%s/version/%s' % (self.subject_url, 1) get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) meta_v1 = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(1, meta_v1.group_version(self.event_type), 'bad ver') self.assertEqual(resp.body, get_resp.body, 'schema body mismatch') def test_lookup_by_subject_and_sha256_id_str(self): '''GET /tasr/subject/<subject>/id/<id_str> - as expected''' sha256_ids = [] schemas = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) ver_meta = SchemaHeaderBot.extract_metadata(resp) sha256_ids.append(ver_meta.sha256_id) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # step through and request each version by version number for v in range(1, 50): get_url = '%s/id/%s' % (self.subject_url, sha256_ids[v - 1]) get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) meta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(sha256_ids[v - 1], meta.sha256_id, 'bad ID') self.assertEqual(schemas[v - 1], get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_by_subject_and_md5_id_str(self): '''GET /tasr/subject/<subject>/id/<id_str> - as expected''' md5_ids = [] schemas = [] # add a bunch of versions for our subject for v in range(1, 50): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) ver_meta = SchemaHeaderBot.extract_metadata(resp) md5_ids.append(ver_meta.md5_id) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # step through and request each version by version number for v in range(1, 50): get_url = '%s/id/%s' % (self.subject_url, md5_ids[v - 1]) get_resp = self.tasr_app.request(get_url, method='GET') self.abort_diff_status(get_resp, 200) meta = SchemaHeaderBot.extract_metadata(get_resp) self.assertEqual(md5_ids[v - 1], meta.md5_id, 'bad ID') self.assertEqual(schemas[v - 1], get_resp.body, u'Unexpected body: %s' % get_resp.body) def test_lookup_latest(self): '''GET /tasr/subject/<subject name>/latest''' # should be nothing there to start with resp = self.tasr_app.request('%s/latest' % self.subject_url, method='GET', expect_errors=True) self.abort_diff_status(resp, 404) # reg a schema so we'll have something to lookup resp = self.register_schema(self.event_type, self.schema_str) self.abort_diff_status(resp, 201) # reg a second schema so we could get a stale version schema_str_2 = self.get_schema_permutation(self.schema_str) resp = self.register_schema(self.event_type, schema_str_2) self.abort_diff_status(resp, 201) # check that lookup gets the _latest_ schema resp = self.tasr_app.get('%s/latest' % self.subject_url) self.abort_diff_status(resp, 200) meta = SchemaHeaderBot.extract_metadata(resp) self.assertEqual(2, meta.group_version(self.event_type), 'bad ver') def test_master_schema_for_subject(self): '''GET /tasr/subject/<subject>/master - as expected''' schemas = [] # add a bunch of versions for our subject for v in range(1, 4): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # grab the master and check that all the expected fields are there resp = self.tasr_app.get('%s/master' % self.subject_url) self.abort_diff_status(resp, 200) master_fnames = [] for mfield in json.loads(resp.body)['fields']: master_fnames.append(mfield['name']) # check the original fields for ofield in json.loads(self.schema_str)['fields']: if not ofield['name'] in master_fnames: self.fail('missing original field %s' % ofield['name']) # now check all of the extra fields from the version permutations for v in range(1, 4): fname = "fn_%s" % v if not fname in master_fnames: self.fail('missing field %s' % fname) def test_incompat_master_schema_for_subject(self): '''GET /tasr/subject/<subject>/master - as expected''' mode = APP.config.mode orig_val = APP.config.config.get(mode, 'expose_force_register') APP.config.config.set(mode, 'expose_force_register', 'True') try: # first add a version that will not be compatible targ = '{"name": "source__timestamp", "type": "long"}' replacement = '{"name": "source__timestamp", "type": "int"}' incompat_schema_str = self.schema_str.replace(targ, replacement, 1) resp = self.register_schema(self.event_type, incompat_schema_str) self.abort_diff_status(resp, 201) # now force register a set of compatible schemas schemas = [] for v in range(1, 4): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) reg_url = '%s/force_register' % self.subject_url resp1 = self.tasr_app.request(reg_url, method='PUT', content_type=self.content_type, expect_errors=False, body=ver_schema_str) self.abort_diff_status(resp1, 201) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp1.body schemas.append(canonicalized_schema_str) # grab the master and check that all the expected fields are there reg_url = '%s/master' % self.subject_url resp2 = self.tasr_app.request(reg_url, method='GET', content_type=self.content_type, expect_errors=True, body=None) self.abort_diff_status(resp2, 409) master_fnames = [] for mfield in json.loads(resp2.body)['fields']: master_fnames.append(mfield['name']) # check the original fields for ofield in json.loads(self.schema_str)['fields']: if not ofield['name'] in master_fnames: self.fail('missing original field %s' % ofield['name']) # now check all of the extra fields from the version permutations for v in range(1, 4): fname = "fn_%s" % v if not fname in master_fnames: self.fail('missing field %s' % fname) finally: # reset expose_force_register to its original value APP.config.config.set(mode, 'expose_force_register', orig_val) def test_hdfs_master_schema_for_subject(self): '''GET /tasr/subject/<subject>/master - as expected, check hdfs''' mode = APP.config.mode orig_val = APP.config.config.get(mode, 'push_masters_to_hdfs') APP.config.config.set(mode, 'push_masters_to_hdfs', 'True') try: resp = None schemas = [] # add a bunch of versions for our subject for v in range(1, 4): ver_schema_str = self.get_schema_permutation(self.schema_str, "fn_%s" % v) resp = self.register_schema(self.event_type, ver_schema_str) self.abort_diff_status(resp, 201) # schema str with canonicalized whitespace returned canonicalized_schema_str = resp.body schemas.append(canonicalized_schema_str) # grab the master FROM HDFS, check that all the expected fields hdfs_path = resp.headers['X-Tasr-Hdfs-Master-Path'] hdfs_user = APP.config.config.get(mode, 'webhdfs_user') # first get the current master from HDFS resp = requests.get('%s?user.name=%s&op=OPEN' % (hdfs_path, hdfs_user)) self.abort_diff_status(resp, 200) master_fnames = [] for mfield in json.loads(resp.content)['fields']: master_fnames.append(mfield['name']) # check the original fields for ofield in json.loads(self.schema_str)['fields']: if not ofield['name'] in master_fnames: self.fail('missing original field %s' % ofield['name']) # now check all of the extra fields from the version permutations for v in range(1, 4): fname = "fn_%s" % v if not fname in master_fnames: self.fail('missing field %s' % fname) finally: # reset expose_force_register to its original value APP.config.config.set(mode, 'push_masters_to_hdfs', orig_val)