casino 3.0.4 → 4.0.0.pre.1

data/config/routes.rb

@@ -1,4 +1,6 @@
 CASino::Engine.routes.draw do
+  mount CASino::API => '/api'
+
   resources :sessions, only: [:index, :destroy]
   resources :two_factor_authenticators, only: [:new, :create, :destroy]
 
@@ -15,16 +17,7 @@ CASino::Engine.routes.draw do
   get 'proxyValidate' => 'proxy_tickets#proxy_validate'
   get 'proxy' => 'proxy_tickets#create'
 
-  # api
-  scope '/cas' do
-    scope module: :api, as: :api do
-      namespace :v1 do
-        resources :tickets, only: [:create, :destroy] do
-          post :update, on: :member
-        end
-      end
-    end
-  end
+  get 'authTokenLogin' => 'auth_tokens#login'
 
   root to: redirect('login')
 

data/db/migrate/20140831205255_create_auth_token_tickets.rb

@@ -0,0 +1,10 @@
+class CreateAuthTokenTickets < ActiveRecord::Migration
+  def change
+    create_table :casino_auth_token_tickets do |t|
+      t.string :ticket, :null => false
+
+      t.timestamps
+    end
+    add_index :casino_auth_token_tickets, :ticket, :unique => true
+  end
+end

data/lib/casino.rb

@@ -21,6 +21,9 @@ module CASino
       two_factor_authenticator: nil,
       user: nil
     ),
+    auth_token_ticket: {
+      lifetime: 60
+    },
     login_ticket: {
       lifetime: 600
     },
@@ -47,4 +50,4 @@ module CASino
   }
 
   self.config.merge! defaults.deep_dup
-end
+end

data/lib/casino/tasks/cleanup.rake

@@ -31,6 +31,12 @@ namespace :casino do
       puts "Deleted #{rows_affected} login tickets."
     end
 
+    desc 'Remove expired auth token tickets.'
+    task auth_token_tickets: :environment do
+      rows_affected = CASino::AuthTokenTicket.cleanup
+      puts "Deleted #{rows_affected} auth token tickets."
+    end
+
     desc 'Remove expired inactive two-factor authenticators.'
     task two_factor_authenticators: :environment do
       rows_affected = CASino::TwoFactorAuthenticator.cleanup
@@ -53,7 +59,13 @@ namespace :casino do
     end
 
     desc 'Perform all cleanup tasks.'
-    task all: [:acquire_lock, :ticket_granting_tickets, :service_tickets, :proxy_tickets, :login_tickets, :two_factor_authenticators] do
+    task all: [:acquire_lock,
+               :ticket_granting_tickets,
+               :service_tickets,
+               :proxy_tickets,
+               :auth_token_tickets,
+               :login_tickets,
+               :two_factor_authenticators] do
     end
   end
 end

data/lib/casino/version.rb

@@ -1,3 +1,3 @@
 module CASino
-  VERSION = '3.0.4'
+  VERSION = '4.0.0.pre.1'
 end

data/spec/controllers/auth_tokens_controller_spec.rb

@@ -0,0 +1,75 @@
+require 'spec_helper'
+
+describe CASino::AuthTokensController do
+  include CASino::Engine.routes.url_helpers
+
+  let(:params) { { } }
+  let(:request_options) { params.merge(use_route: :casino) }
+
+  before(:each) do
+    CASino::AuthTokenValidationService.any_instance.stub(:validation_result).and_return(validation_result)
+  end
+
+  describe 'GET "authTokenLogin"' do
+    context 'with invalid data' do
+      let(:validation_result) { false }
+      let(:service) { 'http://www.example.org/' }
+      let(:params) { { service: service } }
+
+      it 'redirects to the login' do
+        get :login, request_options
+        response.should redirect_to(login_path(service: service))
+      end
+    end
+
+    context 'with valid data' do
+      let(:validation_result) { { authenticator: 'icanhaz', user_data: { username: 'cheezeburger' } } }
+
+      context 'with a not allowed service' do
+        before(:each) do
+          FactoryGirl.create :service_rule, :regex, url: '^https://.*'
+        end
+
+        let(:service) { 'http://www.example.org/' }
+        let(:params) { { service: service } }
+
+        it 'renders the service_not_allowed template' do
+          get :login, request_options
+          response.should render_template(:service_not_allowed)
+        end
+      end
+
+      context 'with a service' do
+        let(:service) { 'http://www.example.org/' }
+        let(:params) { { service: service } }
+
+        it 'redirects to the service' do
+          get :login, request_options
+          response.location.should =~ /^#{Regexp.escape service}\?ticket=ST-/
+        end
+
+        it 'generates a service ticket' do
+          lambda do
+            get :login, request_options
+          end.should change(CASino::ServiceTicket, :count).by(1)
+        end
+      end
+
+      it 'creates a cookie' do
+        get :login, request_options
+        response.cookies['tgt'].should_not be_nil
+      end
+
+      it 'generates a ticket-granting ticket' do
+        lambda do
+          get :login, request_options
+        end.should change(CASino::TicketGrantingTicket, :count).by(1)
+      end
+
+      it 'redirects to the session overview' do
+        get :login, request_options
+        response.should redirect_to(sessions_path)
+      end
+    end
+  end
+end

data/spec/controllers/proxy_tickets_controller_spec.rb

@@ -1,25 +1,131 @@
 require 'spec_helper'
 
 describe CASino::ProxyTicketsController do
-  describe 'GET "serviceValidate"' do
-    let(:params) { { service: 'https://www.example.com/', use_route: :casino } }
-    it 'calls the process method of the ProxyTicketValidator' do
-      CASino::ProxyTicketValidatorProcessor.any_instance.should_receive(:process).with(kind_of(Hash)) do |params|
-        params.should == controller.params
-        controller.render nothing: true
-      end
-      get :proxy_validate, params
+  let(:request_options) { params.merge(use_route: :casino) }
+
+  describe 'GET "proxyValidate"' do
+    let(:proxy_ticket) { FactoryGirl.create :proxy_ticket }
+    let(:service) { proxy_ticket.service }
+    let(:parameters) { { service: service, ticket: proxy_ticket.ticket }}
+    let(:params) { parameters }
+    let(:regex_success) { /\A<cas:serviceResponse.*\n.*authenticationSuccess/ }
+    let(:regex_failure) { /\A\<cas\:serviceResponse.*\n.*authenticationFailure/ }
+
+    render_views
+
+    context 'with an unconsumed proxy ticket' do
+      let(:regex_proxy) { /<cas:proxies>\s*<cas:proxy>#{proxy_ticket.proxy_granting_ticket.pgt_url}<\/cas:proxy>\s*<\/cas:proxies>/ }
+
+      it 'answers with the success text' do
+        get :proxy_validate, request_options
+        response.body.should =~ regex_success
+      end
+
+      it 'includes the proxy in the response' do
+        get :proxy_validate, request_options
+        response.body.should =~ regex_proxy
+      end
+
+      context 'with an expired proxy ticket' do
+        before(:each) do
+          CASino::ProxyTicket.any_instance.stub(:expired?).and_return(true)
+        end
+
+        it 'answers with the failure text' do
+          get :proxy_validate, request_options
+          response.body.should =~ regex_failure
+        end
+      end
+
+      context 'with an other service' do
+        let(:params) { parameters.merge(service: 'this_is_another_service') }
+
+        it 'answers with the failure text' do
+          get :proxy_validate, request_options
+          response.body.should =~ regex_failure
+        end
+      end
+
+      context 'without an existing ticket' do
+        let(:params) { { ticket: 'PT-1234', service: 'https://www.example.com/' } }
+
+        it 'answers with the failure text' do
+          get :proxy_validate, request_options
+          response.body.should =~ regex_failure
+        end
+      end
     end
   end
 
   describe 'GET "proxy"' do
-    let(:params) { { service: 'https://www.example.com/', use_route: :casino } }
-    it 'calls the process method of the ProxyTicketProvider' do
-      CASino::ProxyTicketProviderProcessor.any_instance.should_receive(:process).with(kind_of(Hash)) do |params|
-        params.should == controller.params
-        controller.render nothing: true
+    let(:parameters) { { targetService: 'this_does_not_have_to_be_a_url' } }
+    let(:params) { parameters }
+    let(:regex_success) { /\A<cas:serviceResponse.*\n.*proxySuccess/ }
+    let(:regex_failure) { /\A\<cas\:serviceResponse.*\n.*proxyFailure/ }
+
+    context 'without proxy-granting ticket' do
+      it 'answers with the failure text' do
+        get :create, request_options
+        response.body.should =~ regex_failure
+      end
+
+      it 'does not create a proxy ticket' do
+        lambda do
+          get :create, request_options
+        end.should_not change(CASino::ProxyTicket, :count)
+      end
+    end
+
+    context 'with a not-existing proxy-granting ticket' do
+      let(:params) { parameters.merge(pgt: 'PGT-123453789') }
+
+      it 'answers with the failure text' do
+        get :create, request_options
+        response.body.should =~ regex_failure
+      end
+
+      it 'does not create a proxy ticket' do
+        lambda do
+          get :create, request_options
+        end.should_not change(CASino::ProxyTicket, :count)
+      end
+    end
+
+    context 'with a proxy-granting ticket' do
+      let(:proxy_granting_ticket) { FactoryGirl.create :proxy_granting_ticket }
+      let(:params) { parameters.merge(pgt: proxy_granting_ticket.ticket) }
+
+      it 'answers with the success text' do
+        get :create, request_options
+        response.body.should =~ regex_success
+      end
+
+      it 'does create a proxy ticket' do
+        lambda do
+          get :create, request_options
+        end.should change(proxy_granting_ticket.proxy_tickets, :count).by(1)
+      end
+
+      it 'includes the proxy ticket in the response' do
+        get :create, request_options
+        proxy_ticket = CASino::ProxyTicket.last
+        response.body.should =~ /<cas:proxyTicket>#{proxy_ticket.ticket}<\/cas:proxyTicket>/
+      end
+
+      context 'without a targetService' do
+        let(:params) { parameters.merge(pgt: proxy_granting_ticket.ticket, targetService: nil) }
+
+        it 'answers with the failure text' do
+          get :create, request_options
+          response.body.should =~ regex_failure
+        end
+
+        it 'does not create a proxy ticket' do
+          lambda do
+            get :create, request_options
+          end.should_not change(CASino::ProxyTicket, :count)
+        end
       end
-      get :create, params
     end
   end
 end

data/spec/controllers/service_and_proxy_tickets_controller_spec.rb

@@ -0,0 +1,224 @@
+require 'spec_helper'
+
+shared_examples_for 'a service ticket validator' do
+  include CASino::Engine.routes.url_helpers
+  let(:request_options) { params.merge(use_route: :casino) }
+  let(:service_ticket) { FactoryGirl.create :service_ticket }
+  let(:service) { service_ticket.service }
+  let(:parameters) { { service: service, ticket: service_ticket.ticket }}
+  let(:params) { parameters }
+
+  render_views
+
+  describe 'GET "serviceValidate"' do
+    let(:regex_failure) { /\A\<cas\:serviceResponse.*\n.*authenticationFailure/ }
+    let(:regex_success) { /\A\<cas\:serviceResponse.*\n.*authenticationSuccess/ }
+
+    context 'without all required parameters' do
+      [:ticket, :service].each do |missing_parameter|
+        let(:params) { parameters.except(missing_parameter) }
+
+        context "without '#{missing_parameter}'" do
+          it 'answers with the failure text' do
+            get validation_action, request_options
+            response.body.should =~ regex_failure
+          end
+        end
+      end
+    end
+
+    context 'with an unconsumed service ticket' do
+      context 'with extra attributes using strings as keys' do
+        before(:each) do
+          CASino::User.any_instance.stub(:extra_attributes).and_return({ "id" => 1234 })
+        end
+
+        it 'includes the extra attributes' do
+          get validation_action, request_options
+          response.body.should =~ /<cas\:id>1234<\/cas\:id\>/
+        end
+      end
+
+      context 'with extra attributes using array as value' do
+        before(:each) do
+          CASino::User.any_instance.stub(:extra_attributes).and_return({ "memberOf" => [ "test", "yolo" ] })
+        end
+
+        it 'includes all values' do
+          get validation_action, request_options
+          response.body.should =~ /<cas\:memberOf>test<\/cas\:memberOf\>/
+          response.body.should =~ /<cas\:memberOf>yolo<\/cas\:memberOf\>/
+        end
+      end
+
+      context 'issued from a long_term ticket-granting ticket' do
+        before(:each) do
+          service_ticket.ticket_granting_ticket.update_attribute(:long_term, true)
+        end
+
+        it 'includes the long-term flag in the answer' do
+          get validation_action, request_options
+          response.body.should =~ /<cas\:longTermAuthenticationRequestTokenUsed>true<\/cas\:longTermAuthenticationRequestTokenUsed>/
+        end
+      end
+
+      context 'without renew flag' do
+        it 'consumes the service ticket' do
+          get validation_action, request_options
+          service_ticket.reload.consumed.should == true
+        end
+
+        it 'answers with the success text' do
+          get validation_action, request_options
+          response.body.should =~ regex_success
+        end
+      end
+
+      context 'with empty query values' do
+        let(:service) { "#{service_ticket.service}?" }
+
+        it 'answers with the success text' do
+          get validation_action, request_options
+          response.body.should =~ regex_success
+        end
+      end
+
+      context 'with renew flag' do
+        let(:params) { parameters.merge renew: 'true' }
+
+        context 'with a service ticket without issued_from_credentials flag' do
+          it 'consumes the service ticket' do
+            get validation_action, request_options
+            service_ticket.reload.consumed.should == true
+          end
+
+          it 'answers with the failure text' do
+            get validation_action, request_options
+            response.body.should =~ regex_failure
+          end
+        end
+
+        context 'with a service ticket with issued_from_credentials flag' do
+          before(:each) do
+            service_ticket.issued_from_credentials = true
+            service_ticket.save!
+          end
+
+          it 'consumes the service ticket' do
+            get validation_action, request_options
+            service_ticket.reload.consumed.should == true
+          end
+
+          it 'answers with the success text' do
+            get validation_action, request_options
+            response.body.should =~ regex_success
+          end
+        end
+      end
+
+      context 'with proxy-granting ticket callback server' do
+        let(:pgt_url) { 'https://www.example.org' }
+        let(:params) { parameters.merge pgtUrl: pgt_url }
+
+        before(:each) do
+          stub_request(:get, /#{pgt_url}\/\?pgtId=[^&]+&pgtIou=[^&]+/)
+        end
+
+        context 'not using https' do
+          let(:pgt_url) { 'http://www.example.org' }
+
+          it 'answers with the success text' do
+            get validation_action, request_options
+            response.body.should =~ regex_success
+          end
+
+          it 'does not create a proxy-granting ticket' do
+            lambda do
+              get validation_action, request_options
+            end.should_not change(service_ticket.proxy_granting_tickets, :count)
+          end
+        end
+
+        it 'answers with the success text' do
+          get validation_action, request_options
+          response.body.should =~ regex_success
+        end
+
+        it 'includes the PGTIOU in the response' do
+          get validation_action, request_options
+          response.body.should =~ /\<cas\:proxyGrantingTicket\>\n?\s*PGTIOU-.+/
+        end
+
+        it 'creates a proxy-granting ticket' do
+          lambda do
+            get validation_action, request_options
+          end.should change(service_ticket.proxy_granting_tickets, :count).by(1)
+        end
+
+        it 'contacts the callback server' do
+          get validation_action, request_options
+          proxy_granting_ticket = CASino::ProxyGrantingTicket.last
+          WebMock.should have_requested(:get, 'https://www.example.org').with(query: {
+            pgtId: proxy_granting_ticket.ticket,
+            pgtIou: proxy_granting_ticket.iou
+          })
+        end
+
+        context 'when callback server gives an error' do
+          before(:each) do
+            stub_request(:get, /#{pgt_url}.*/).to_return status: 404
+          end
+
+          it 'answers with the success text' do
+            get validation_action, request_options
+            response.body.should =~ regex_success
+          end
+
+          it 'does not create a proxy-granting ticket' do
+            lambda do
+              get validation_action, request_options
+            end.should_not change(service_ticket.proxy_granting_tickets, :count)
+          end
+        end
+
+        context 'when callback server is unreachable' do
+          before(:each) do
+            stub_request(:get, /#{pgt_url}.*/).to_raise(Timeout::Error)
+          end
+
+          it 'answers with the success text' do
+            get validation_action, request_options
+            response.body.should =~ regex_success
+          end
+
+          it 'does not create a proxy-granting ticket' do
+            lambda do
+              get validation_action, request_options
+            end.should_not change(service_ticket.proxy_granting_tickets, :count)
+          end
+        end
+      end
+    end
+
+    context 'with a consumed service ticket' do
+      before(:each) do
+        service_ticket.update_attribute(:consumed, true)
+      end
+
+      it 'answers with the failure text' do
+        get validation_action, request_options
+        response.body.should =~ regex_failure
+      end
+    end
+  end
+end
+
+describe CASino::ServiceTicketsController do
+  let(:validation_action) { :service_validate }
+  it_behaves_like 'a service ticket validator'
+end
+
+describe CASino::ProxyTicketsController do
+  let(:validation_action) { :proxy_validate }
+  it_behaves_like 'a service ticket validator'
+end