casino 1.3.2 → 2.0.0

data/spec/processor/session_overview_spec.rb

@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+describe CASino::SessionOverviewProcessor do
+  describe '#process' do
+    let(:listener) { Object.new }
+    let(:processor) { described_class.new(listener) }
+    let(:other_ticket_granting_ticket) { FactoryGirl.create :ticket_granting_ticket }
+    let(:user) { other_ticket_granting_ticket.user }
+    let(:user_agent) { other_ticket_granting_ticket.user_agent }
+    let(:cookies) { { tgt: tgt } }
+
+    before(:each) do
+      listener.stub(:user_not_logged_in)
+      listener.stub(:ticket_granting_tickets_found)
+      other_ticket_granting_ticket
+    end
+
+    context 'with an existing ticket-granting ticket' do
+      let(:ticket_granting_ticket) { FactoryGirl.create :ticket_granting_ticket, user: user }
+      let(:tgt) { ticket_granting_ticket.ticket }
+      it 'calls the #ticket_granting_tickets_found method on the listener' do
+        listener.should_receive(:ticket_granting_tickets_found) do |tickets|
+          tickets.length.should == 2
+        end
+        processor.process(cookies, user_agent)
+      end
+    end
+
+    context 'with a ticket-granting ticket with same username but different authenticator' do
+      let(:ticket_granting_ticket) { FactoryGirl.create :ticket_granting_ticket }
+      let(:tgt) { ticket_granting_ticket.ticket }
+
+      it 'calls the #ticket_granting_tickets_found method on the listener' do
+        listener.should_receive(:ticket_granting_tickets_found) do |tickets|
+          tickets.length.should == 1
+        end
+        processor.process(cookies, user_agent)
+      end
+    end
+
+    context 'with an invalid ticket-granting ticket' do
+      let(:tgt) { 'TGT-lalala' }
+      it 'calls the #user_not_logged_in method on the listener' do
+        listener.should_receive(:user_not_logged_in).with(no_args)
+        processor.process(cookies, user_agent)
+      end
+    end
+  end
+end

data/spec/processor/ticket_validator_spec.rb

@@ -0,0 +1,199 @@
+require 'spec_helper'
+
+[CASino::ServiceTicketValidatorProcessor, CASino::ProxyTicketValidatorProcessor].each do |class_under_test|
+  describe class_under_test do
+    describe '#process' do
+      let(:listener) { Object.new }
+      let(:processor) { described_class.new(listener) }
+      let(:service_ticket) { FactoryGirl.create :service_ticket }
+      let(:parameters) { { service: service_ticket.service, ticket: service_ticket.ticket }}
+      let(:regex_failure) { /\A\<cas\:serviceResponse.*\n.*authenticationFailure/ }
+      let(:regex_success) { /\A\<cas\:serviceResponse.*\n.*authenticationSuccess/ }
+
+      before(:each) do
+        listener.stub(:validation_failed)
+        listener.stub(:validation_succeeded)
+      end
+
+      context 'without all required parameters' do
+        [:ticket, :service].each do |missing_parameter|
+          let(:invalid_parameters) { parameters.except(missing_parameter) }
+
+          context "without '#{missing_parameter}'" do
+            it 'calls the #validation_failed method on the listener' do
+              listener.should_receive(:validation_failed).with(regex_failure)
+              processor.process(invalid_parameters)
+            end
+          end
+        end
+      end
+
+      context 'with an unconsumed service ticket' do
+        context 'issued from a long_term ticket-granting ticket' do
+          before(:each) do
+            tgt = service_ticket.ticket_granting_ticket
+            tgt.long_term = true
+            tgt.save!
+          end
+
+          it 'calls the #validation_succeeded method on the listener' do
+            listener.should_receive(:validation_succeeded).with(
+              /<cas\:longTermAuthenticationRequestTokenUsed>true<\/cas\:longTermAuthenticationRequestTokenUsed>/
+            )
+            processor.process(parameters)
+          end
+        end
+
+        context 'without renew flag' do
+          it 'consumes the service ticket' do
+            processor.process(parameters)
+            service_ticket.reload
+            service_ticket.consumed.should == true
+          end
+
+          it 'calls the #validation_succeeded method on the listener' do
+            listener.should_receive(:validation_succeeded).with(regex_success)
+            processor.process(parameters)
+          end
+        end
+
+        context 'with empty query values' do
+          it 'calls the #validation_succeeded method on the listener' do
+            listener.should_receive(:validation_succeeded).with(regex_success)
+            processor.process(parameters.merge(service: "#{service_ticket.service}/?"))
+          end
+        end
+
+        context 'with renew flag' do
+          let(:parameters_with_renew) { parameters.merge renew: 'true' }
+
+          context 'with a service ticket without issued_from_credentials flag' do
+            it 'consumes the service ticket' do
+              processor.process(parameters_with_renew)
+              service_ticket.reload
+              service_ticket.consumed.should == true
+            end
+
+            it 'calls the #validation_failed method on the listener' do
+              listener.should_receive(:validation_failed).with(regex_failure)
+              processor.process(parameters_with_renew)
+            end
+          end
+
+          context 'with a service ticket with issued_from_credentials flag' do
+            before(:each) do
+              service_ticket.issued_from_credentials = true
+              service_ticket.save!
+            end
+
+            it 'consumes the service ticket' do
+              processor.process(parameters_with_renew)
+              service_ticket.reload
+              service_ticket.consumed.should == true
+            end
+
+            it 'calls the #validation_succeeded method on the listener' do
+              listener.should_receive(:validation_succeeded).with(regex_success)
+              processor.process(parameters_with_renew)
+            end
+          end
+        end
+
+        context 'with proxy-granting ticket callback server' do
+          let(:pgt_url) { 'https://www.example.org' }
+          let(:parameters_with_pgt_url) { parameters.merge pgtUrl: pgt_url }
+
+          before(:each) do
+            stub_request(:get, /#{pgt_url}\/\?pgtId=[^&]+&pgtIou=[^&]+/)
+          end
+
+          context 'not using https' do
+            let(:pgt_url) { 'http://www.example.org' }
+
+            it 'calls the #validation_succeeded method on the listener' do
+              listener.should_receive(:validation_succeeded).with(regex_success)
+              processor.process(parameters_with_pgt_url)
+            end
+
+            it 'does not create a proxy-granting ticket' do
+              lambda do
+                processor.process(parameters_with_pgt_url)
+              end.should_not change(service_ticket.proxy_granting_tickets, :count)
+            end
+          end
+
+          it 'calls the #validation_succeeded method on the listener' do
+            listener.should_receive(:validation_succeeded).with(regex_success)
+            processor.process(parameters_with_pgt_url)
+          end
+
+          it 'includes the PGTIOU in the response' do
+            listener.should_receive(:validation_succeeded).with(/\<cas\:proxyGrantingTicket\>\n?\s*PGTIOU-.+/)
+            processor.process(parameters_with_pgt_url)
+          end
+
+          it 'creates a proxy-granting ticket' do
+            lambda do
+              processor.process(parameters_with_pgt_url)
+            end.should change(service_ticket.proxy_granting_tickets, :count).by(1)
+          end
+
+          it 'contacts the callback server' do
+            processor.process(parameters_with_pgt_url)
+            proxy_granting_ticket = CASino::ProxyGrantingTicket.last
+            WebMock.should have_requested(:get, 'https://www.example.org').with(query: {
+              pgtId: proxy_granting_ticket.ticket,
+              pgtIou: proxy_granting_ticket.iou
+            })
+          end
+
+          context 'when callback server gives an error' do
+            before(:each) do
+              stub_request(:get, /#{pgt_url}.*/).to_return status: 404
+            end
+
+            it 'calls the #validation_succeeded method on the listener' do
+              listener.should_receive(:validation_succeeded).with(regex_success)
+              processor.process(parameters_with_pgt_url)
+            end
+
+            it 'does not create a proxy-granting ticket' do
+              lambda do
+                processor.process(parameters_with_pgt_url)
+              end.should_not change(service_ticket.proxy_granting_tickets, :count)
+            end
+          end
+
+          context 'when callback server is unreachable' do
+            before(:each) do
+              stub_request(:get, /#{pgt_url}.*/).to_raise(Timeout::Error)
+            end
+
+            it 'calls the #validation_succeeded method on the listener' do
+              listener.should_receive(:validation_succeeded).with(regex_success)
+              processor.process(parameters_with_pgt_url)
+            end
+
+            it 'does not create a proxy-granting ticket' do
+              lambda do
+                processor.process(parameters_with_pgt_url)
+              end.should_not change(service_ticket.proxy_granting_tickets, :count)
+            end
+          end
+        end
+      end
+
+      context 'with a consumed service ticket' do
+        before(:each) do
+          service_ticket.consumed = true
+          service_ticket.save!
+        end
+
+        it 'calls the #validation_failed method on the listener' do
+          listener.should_receive(:validation_failed).with(regex_failure)
+          processor.process(parameters)
+        end
+      end
+    end
+  end
+end

data/spec/processor/two_factor_authenticator_activator_spec.rb

@@ -0,0 +1,122 @@
+require 'spec_helper'
+
+describe CASino::TwoFactorAuthenticatorActivatorProcessor do
+  describe '#process' do
+    let(:listener) { Object.new }
+    let(:processor) { described_class.new(listener) }
+    let(:cookies) { { tgt: tgt } }
+
+    before(:each) do
+      listener.stub(:user_not_logged_in)
+      listener.stub(:two_factor_authenticator_activated)
+      listener.stub(:invalid_two_factor_authenticator)
+      listener.stub(:invalid_one_time_password)
+      listener.stub(:two_factor_authenticator_activated)
+    end
+
+    context 'with an existing ticket-granting ticket' do
+      let(:ticket_granting_ticket) { FactoryGirl.create :ticket_granting_ticket }
+      let(:user) { ticket_granting_ticket.user }
+      let(:tgt) { ticket_granting_ticket.ticket }
+      let(:user_agent) { ticket_granting_ticket.user_agent }
+      let(:id) { two_factor_authenticator.id }
+      let(:otp) { '123456' }
+      let(:params) { { otp: otp, id: id } }
+
+      context 'with an invalid authenticator' do
+        context 'with an expired authenticator' do
+          let(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, :inactive, user: user }
+
+          before(:each) do
+            two_factor_authenticator.created_at = 10.hours.ago
+            two_factor_authenticator.save!
+          end
+
+          it 'calls the `#invalid_two_factor_authenticator` method an the listener' do
+            listener.should_receive(:invalid_two_factor_authenticator).with(no_args)
+            processor.process(params, cookies, user_agent)
+          end
+        end
+
+        context 'with a authenticator of another user' do
+          let(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, :inactive }
+
+          before(:each) do
+            two_factor_authenticator.created_at = 10.hours.ago
+            two_factor_authenticator.save!
+          end
+
+          it 'calls the `#invalid_two_factor_authenticator` method an the listener' do
+            listener.should_receive(:invalid_two_factor_authenticator).with(no_args)
+            processor.process(params, cookies, user_agent)
+          end
+        end
+      end
+
+      context 'with a valid authenticator' do
+        let(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, :inactive, user: user }
+
+        context 'with a valid OTP' do
+          before(:each) do
+            ROTP::TOTP.any_instance.should_receive(:verify_with_drift).with(otp, 30).and_return(true)
+          end
+
+          it 'calls the `#two_factor_authenticator_activated` method an the listener' do
+            listener.should_receive(:two_factor_authenticator_activated).with(no_args)
+            processor.process(params, cookies, user_agent)
+          end
+
+          it 'does activate the authenticator' do
+            processor.process(params, cookies, user_agent)
+            two_factor_authenticator.reload
+            two_factor_authenticator.should be_active
+          end
+
+          context 'when another two-factor authenticator was active' do
+            let!(:other_two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, user: user }
+
+            it 'does activate the authenticator' do
+              processor.process(params, cookies, user_agent)
+              two_factor_authenticator.reload
+              two_factor_authenticator.should be_active
+            end
+
+            it 'does delete the other authenticator' do
+              processor.process(params, cookies, user_agent)
+              lambda do
+                other_two_factor_authenticator.reload
+              end.should raise_error(ActiveRecord::RecordNotFound)
+            end
+          end
+
+        end
+
+        context 'with an invalid OTP' do
+          before(:each) do
+            ROTP::TOTP.any_instance.should_receive(:verify_with_drift).with(otp, 30).and_return(false)
+          end
+
+          it 'calls the `#invalid_one_time_password` method an the listener' do
+            listener.should_receive(:invalid_one_time_password).with(two_factor_authenticator)
+            processor.process(params, cookies, user_agent)
+          end
+
+          it 'does not activate the authenticator' do
+            processor.process(params, cookies, user_agent)
+            two_factor_authenticator.reload
+            two_factor_authenticator.should_not be_active
+          end
+        end
+      end
+    end
+
+    context 'with an invalid ticket-granting ticket' do
+      let(:tgt) { 'TGT-lalala' }
+      let(:user_agent) { 'TestBrowser 1.0' }
+      it 'calls the #user_not_logged_in method on the listener' do
+        listener.should_receive(:user_not_logged_in).with(no_args)
+        processor.process(nil, cookies, user_agent)
+      end
+    end
+  end
+end

data/spec/processor/two_factor_authenticator_destroyer_spec.rb

@@ -0,0 +1,71 @@
+require 'spec_helper'
+
+describe CASino::TwoFactorAuthenticatorDestroyerProcessor do
+  describe '#process' do
+    let(:listener) { Object.new }
+    let(:processor) { described_class.new(listener) }
+    let(:cookies) { { tgt: tgt } }
+
+    before(:each) do
+      listener.stub(:user_not_logged_in)
+      listener.stub(:two_factor_authenticator_destroyed)
+      listener.stub(:invalid_two_factor_authenticator)
+    end
+
+    context 'with an existing ticket-granting ticket' do
+      let(:ticket_granting_ticket) { FactoryGirl.create :ticket_granting_ticket }
+      let(:user) { ticket_granting_ticket.user }
+      let(:tgt) { ticket_granting_ticket.ticket }
+      let(:user_agent) { ticket_granting_ticket.user_agent }
+      let(:params) { { id: two_factor_authenticator.id } }
+
+      context 'with a valid two-factor authenticator' do
+        let!(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, user: user }
+
+        it 'calls the #two_factor_authenticator_destroyed method on the listener' do
+          listener.should_receive(:two_factor_authenticator_destroyed).with(no_args)
+          processor.process(params, cookies, user_agent)
+        end
+
+        it 'deletes the two-factor authenticator' do
+          processor.process(params, cookies, user_agent)
+          lambda do
+            two_factor_authenticator.reload
+          end.should raise_error(ActiveRecord::RecordNotFound)
+        end
+
+        it 'does not delete other two-factor authenticators' do
+          other = FactoryGirl.create :two_factor_authenticator
+          lambda do
+            processor.process(params, cookies, user_agent)
+          end.should change(CASino::TwoFactorAuthenticator, :count).by(-1)
+        end
+      end
+
+      context 'with a two-factor authenticator of another user' do
+        let!(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator }
+
+        it 'calls the #invalid_two_factor_authenticator method on the listener' do
+          listener.should_receive(:invalid_two_factor_authenticator).with(no_args)
+          processor.process(params, cookies, user_agent)
+        end
+
+        it 'does not delete two-factor authenticators' do
+          lambda do
+            processor.process(params, cookies, user_agent)
+          end.should_not change(CASino::TwoFactorAuthenticator, :count)
+        end
+      end
+    end
+
+    context 'with an invalid ticket-granting ticket' do
+      let(:params) { {} }
+      let(:tgt) { 'TGT-lalala' }
+      let(:user_agent) { 'TestBrowser 1.0' }
+      it 'calls the #user_not_logged_in method on the listener' do
+        listener.should_receive(:user_not_logged_in).with(no_args)
+        processor.process(params, cookies, user_agent)
+      end
+    end
+  end
+end

data/spec/processor/two_factor_authenticator_overview_spec.rb

@@ -0,0 +1,56 @@
+require 'spec_helper'
+
+describe CASino::TwoFactorAuthenticatorOverviewProcessor do
+  describe '#process' do
+    let(:listener) { Object.new }
+    let(:processor) { described_class.new(listener) }
+    let(:cookies) { { tgt: tgt } }
+
+    before(:each) do
+      listener.stub(:user_not_logged_in)
+      listener.stub(:two_factor_authenticators_found)
+    end
+
+    context 'with an existing ticket-granting ticket' do
+      let(:ticket_granting_ticket) { FactoryGirl.create :ticket_granting_ticket }
+      let(:user) { ticket_granting_ticket.user }
+      let(:tgt) { ticket_granting_ticket.ticket }
+      let(:user_agent) { ticket_granting_ticket.user_agent }
+
+      context 'without a two-factor authenticator registered' do
+        it 'calls the #two_factor_authenticators_found method on the listener' do
+          listener.should_receive(:two_factor_authenticators_found).with([])
+          processor.process(cookies, user_agent)
+        end
+      end
+
+      context 'with an inactive two-factor authenticator' do
+        let!(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, :inactive, user: user }
+
+        it 'does not include the inactive authenticator' do
+          listener.should_receive(:two_factor_authenticators_found).with([])
+          processor.process(cookies, user_agent)
+        end
+      end
+
+      context 'with a two-factor authenticator registered' do
+        let(:two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator, user: user }
+        let!(:other_two_factor_authenticator) { FactoryGirl.create :two_factor_authenticator }
+
+        it 'calls the #two_factor_authenticators_found method on the listener' do
+          listener.should_receive(:two_factor_authenticators_found).with([two_factor_authenticator])
+          processor.process(cookies, user_agent)
+        end
+      end
+    end
+
+    context 'with an invalid ticket-granting ticket' do
+      let(:tgt) { 'TGT-lalala' }
+      let(:user_agent) { 'TestBrowser 1.0' }
+      it 'calls the #user_not_logged_in method on the listener' do
+        listener.should_receive(:user_not_logged_in).with(no_args)
+        processor.process(cookies, user_agent)
+      end
+    end
+  end
+end