def testMaybeSetVarsFail(self):
self.mox.StubOutWithMock(time, 'time')
time.time().MultipleTimes().AndReturn(1001)
self.mox.StubOutWithMock(users_id_token, '_get_id_token_user')
users_id_token._get_id_token_user(
self._SAMPLE_TOKEN,
self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS,
1001, memcache).MultipleTimes().AndReturn(users.User('*****@*****.**'))
self.mox.ReplayAll()
# This token should correctly result in _get_id_token_user being called
os.environ['HTTP_AUTHORIZATION'] = ('Bearer ' + self._SAMPLE_TOKEN)
api_instance = self.TestApiAnnotatedAtApi()
# No im_self is present and no api_info can be used, so the method itself
# has no access to scopes, hence scopes will be null and neither of the
# token checks will occur
users_id_token._maybe_set_current_user_vars(api_instance.method.im_func)
self.assertNotIn('ENDPOINTS_USE_OAUTH_SCOPE', os.environ)
self.assertEqual(os.getenv('ENDPOINTS_AUTH_EMAIL'), '')
self.assertEqual(os.getenv('ENDPOINTS_AUTH_DOMAIN'), '')
# Test the same works when using the method and not im_func
os.environ.pop('ENDPOINTS_AUTH_EMAIL')
os.environ.pop('ENDPOINTS_AUTH_DOMAIN')
users_id_token._maybe_set_current_user_vars(api_instance.method)
self.assertEqual(os.getenv('ENDPOINTS_AUTH_EMAIL'), '*****@*****.**')
# Test that it works using the api info from the API
os.environ.pop('ENDPOINTS_AUTH_EMAIL')
os.environ.pop('ENDPOINTS_AUTH_DOMAIN')
users_id_token._maybe_set_current_user_vars(api_instance.method.im_func,
api_info=api_instance.api_info)
self.assertEqual(os.getenv('ENDPOINTS_AUTH_EMAIL'), '*****@*****.**')
self.mox.VerifyAll()
def testMaybeSetVarsFail(self):
self.mox.StubOutWithMock(time, 'time')
time.time().MultipleTimes().AndReturn(1001)
self.mox.StubOutWithMock(users_id_token, '_get_id_token_user')
users_id_token._get_id_token_user(
self._SAMPLE_TOKEN, self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS, 1001,
memcache).MultipleTimes().AndReturn(users.User('*****@*****.**'))
self.mox.ReplayAll()
# This token should correctly result in _get_id_token_user being called
os.environ['HTTP_AUTHORIZATION'] = ('Bearer ' + self._SAMPLE_TOKEN)
api_instance = self.TestApiAnnotatedAtApi()
# No im_self is present and no api_info can be used, so the method itself
# has no access to scopes, hence scopes will be null and neither of the
# token checks will occur
users_id_token._maybe_set_current_user_vars(
api_instance.method.im_func)
self.assertNotIn('ENDPOINTS_USE_OAUTH_SCOPE', os.environ)
self.assertEqual(os.getenv('ENDPOINTS_AUTH_EMAIL'), '')
self.assertEqual(os.getenv('ENDPOINTS_AUTH_DOMAIN'), '')
# Test the same works when using the method and not im_func
os.environ.pop('ENDPOINTS_AUTH_EMAIL')
os.environ.pop('ENDPOINTS_AUTH_DOMAIN')
users_id_token._maybe_set_current_user_vars(api_instance.method)
self.assertEqual(os.getenv('ENDPOINTS_AUTH_EMAIL'), '*****@*****.**')
# Test that it works using the api info from the API
os.environ.pop('ENDPOINTS_AUTH_EMAIL')
os.environ.pop('ENDPOINTS_AUTH_DOMAIN')
users_id_token._maybe_set_current_user_vars(
api_instance.method.im_func, api_info=api_instance.api_info)
self.assertEqual(os.getenv('ENDPOINTS_AUTH_EMAIL'), '*****@*****.**')
self.mox.VerifyAll()
def testSampleIdToken(self):
user = users_id_token._get_id_token_user(
self._SAMPLE_TOKEN, self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS, self._SAMPLE_TIME_NOW, self.cache)
self.assertEqual(user.email(), '*****@*****.**')
# User ID shouldn't be filled in. See notes in users_id_token.py.
self.assertIsNone(user.user_id())
self.assertTrue(self.cache.used_cached_value)
def VerifyIdToken(self, cls, *args):
self.mox.StubOutWithMock(time, 'time')
self.mox.StubOutWithMock(users_id_token, '_get_id_token_user')
time.time().AndReturn(1001)
users_id_token._get_id_token_user(
self._SAMPLE_TOKEN,
self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS,
1001, memcache).AndReturn(users.User('*****@*****.**'))
self.mox.ReplayAll()
os.environ['HTTP_AUTHORIZATION'] = ('Bearer ' + self._SAMPLE_TOKEN)
if args:
cls.method(*args)
else:
users_id_token._maybe_set_current_user_vars(cls.method)
self.assertEqual(os.environ.get('ENDPOINTS_AUTH_EMAIL'), '*****@*****.**')
self.mox.VerifyAll()
def testSampleIdToken(self):
user = users_id_token._get_id_token_user(self._SAMPLE_TOKEN,
self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS,
self._SAMPLE_TIME_NOW, self.cache)
self.assertEqual(user.email(), '*****@*****.**')
# User ID shouldn't be filled in. See notes in users_id_token.py.
self.assertIsNone(user.user_id())
self.assertTrue(self.cache.used_cached_value)
def VerifyIdToken(self, cls, *args):
self.mox.StubOutWithMock(time, 'time')
self.mox.StubOutWithMock(users_id_token, '_get_id_token_user')
time.time().AndReturn(1001)
users_id_token._get_id_token_user(
self._SAMPLE_TOKEN,
users_id_token._ISSUERS,
self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS,
1001, memcache).AndReturn(users.User('*****@*****.**'))
self.mox.ReplayAll()
os.environ['HTTP_AUTHORIZATION'] = ('Bearer ' + self._SAMPLE_TOKEN)
if args:
cls.method(*args)
else:
users_id_token._maybe_set_current_user_vars(cls.method)
self.assertEqual(os.environ.get('ENDPOINTS_AUTH_EMAIL'), '*****@*****.**')
self.mox.VerifyAll()
def testExpiredToken(self):
"""Verify that expired tokens will fail."""
expired_time_now = (self._SAMPLE_TIME_NOW +
users_id_token._MAX_TOKEN_LIFETIME_SECS + 1)
self.assertRaises(users_id_token._AppIdentityError,
users_id_token._verify_signed_jwt_with_certs,
self._SAMPLE_TOKEN, expired_time_now, self.cache)
# Also verify that this doesn't return a user when called from
# users_id_token.
user = users_id_token._get_id_token_user(
self._SAMPLE_TOKEN, self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS, expired_time_now, self.cache)
self.assertIsNone(user)
def testExpiredToken(self):
"""Verify that expired tokens will fail."""
expired_time_now = (self._SAMPLE_TIME_NOW +
users_id_token._MAX_TOKEN_LIFETIME_SECS + 1)
self.assertRaises(users_id_token._AppIdentityError,
users_id_token._verify_signed_jwt_with_certs,
self._SAMPLE_TOKEN, expired_time_now,
self.cache)
# Also verify that this doesn't return a user when called from
# users_id_token.
user = users_id_token._get_id_token_user(self._SAMPLE_TOKEN,
self._SAMPLE_AUDIENCES,
self._SAMPLE_ALLOWED_CLIENT_IDS,
expired_time_now, self.cache)
self.assertIsNone(user)
def test_get_id_token_user(valid_issuers, valid_audiences, valid_client_ids,
token_sig_cert_uri, token_issuer, token_audience,
token_client_id, token_email_address):
cache = TestCache()
parsed_token = {
'iss': token_issuer,
'aud': token_audience,
'azp': token_client_id,
'email': token_email_address,
}
with mock.patch.object(users_id_token,
'_verify_signed_jwt_with_certs') as mocked_verify:
mocked_verify.side_effect = _make_mocked_verify_signed_jwt_with_certs(
token_sig_cert_uri)
user = users_id_token._get_id_token_user(parsed_token, valid_issuers,
valid_audiences,
valid_client_ids, 0, cache)
assert user is not None
assert user.email() == token_email_address