casino_core 0.0.6 → 1.0.0

data/lib/casino_core/model.rb

@@ -5,6 +5,7 @@ module CASinoCore
     autoload :LoginTicket, 'casino_core/model/login_ticket.rb'
     autoload :ServiceTicket, 'casino_core/model/service_ticket.rb'
     autoload :ProxyGrantingTicket, 'casino_core/model/proxy_granting_ticket.rb'
+    autoload :ProxyTicket, 'casino_core/model/proxy_ticket.rb'
     autoload :TicketGrantingTicket, 'casino_core/model/ticket_granting_ticket.rb'
   end
 end

data/lib/casino_core/model/proxy_granting_ticket.rb

@@ -1,8 +1,9 @@
 require 'casino_core/model'
 
 class CASinoCore::Model::ProxyGrantingTicket < ActiveRecord::Base
-  attr_accessible :iou, :ticket, :service_ticket_id
+  attr_accessible :iou, :ticket, :pgt_url
   validates :ticket, uniqueness: true
   validates :iou, uniqueness: true
-  belongs_to :service_ticket
+  belongs_to :granter, polymorphic: true
+  has_many :proxy_tickets, dependent: :destroy
 end

data/lib/casino_core/model/proxy_ticket.rb

@@ -0,0 +1,27 @@
+require 'casino_core/model'
+require 'casino_core/settings'
+require 'addressable/uri'
+
+class CASinoCore::Model::ProxyTicket < ActiveRecord::Base
+  attr_accessible :ticket, :service
+  validates :ticket, uniqueness: true
+  belongs_to :proxy_granting_ticket
+  has_many :proxy_granting_tickets, as: :granter, dependent: :destroy
+
+  def self.cleanup_unconsumed
+    self.destroy_all(['created_at < ? AND consumed = ?', CASinoCore::Settings.proxy_ticket[:lifetime_unconsumed].seconds.ago, false])
+  end
+
+  def self.cleanup_consumed
+    self.destroy_all(['created_at < ? AND consumed = ?', CASinoCore::Settings.proxy_ticket[:lifetime_consumed].seconds.ago, true])
+  end
+
+  def expired?
+    lifetime = if consumed?
+      CASinoCore::Settings.proxy_ticket[:lifetime_consumed]
+    else
+      CASinoCore::Settings.proxy_ticket[:lifetime_unconsumed]
+    end
+    Time.now - self.created_at > lifetime
+  end
+end

data/lib/casino_core/model/service_ticket.rb

@@ -8,15 +8,19 @@ class CASinoCore::Model::ServiceTicket < ActiveRecord::Base
   attr_accessible :ticket, :service
   validates :ticket, uniqueness: true
   belongs_to :ticket_granting_ticket
-  before_destroy :send_single_sing_out_notification
-  has_many :proxy_granting_tickets
+  before_destroy :send_single_sing_out_notification, if: :consumed?
+  has_many :proxy_granting_tickets, as: :granter, dependent: :destroy
 
   def self.cleanup_unconsumed
-    self.delete_all(['created_at < ? AND consumed = ?', CASinoCore::Settings.service_ticket[:lifetime_unconsumed].seconds.ago, false])
+    self.destroy_all(['created_at < ? AND consumed = ?', CASinoCore::Settings.service_ticket[:lifetime_unconsumed].seconds.ago, false])
   end
 
   def self.cleanup_consumed
-    self.destroy_all(['created_at < ? AND consumed = ?', CASinoCore::Settings.service_ticket[:lifetime_consumed].seconds.ago, true]).length
+    self.destroy_all(['created_at < ? AND consumed = ?', CASinoCore::Settings.service_ticket[:lifetime_consumed].seconds.ago, true])
+  end
+
+  def self.cleanup_consumed_hard
+    self.delete_all(['created_at < ? AND consumed = ?', (CASinoCore::Settings.service_ticket[:lifetime_consumed].seconds * 2).ago, true])
   end
 
   def service_with_ticket_url
@@ -25,6 +29,15 @@ class CASinoCore::Model::ServiceTicket < ActiveRecord::Base
     service_uri.to_s
   end
 
+  def expired?
+    lifetime = if consumed?
+      CASinoCore::Settings.service_ticket[:lifetime_consumed]
+    else
+      CASinoCore::Settings.service_ticket[:lifetime_unconsumed]
+    end
+    Time.now - self.created_at > lifetime
+  end
+
   private
   def send_single_sing_out_notification
     notifier = SingleSignOutNotifier.new(self)

data/lib/casino_core/model/service_ticket/single_sign_out_notifier.rb

@@ -1,15 +1,18 @@
 require 'builder'
 require 'net/https'
 require 'casino_core/model/service_ticket'
+require 'addressable/uri'
 
 class CASinoCore::Model::ServiceTicket::SingleSignOutNotifier
+  include CASinoCore::Helper::Logger
+
   def initialize(service_ticket)
     @service_ticket = service_ticket
   end
 
   def notify
     xml = build_xml
-    uri = URI.parse(@service_ticket.service)
+    uri = Addressable::URI.parse(@service_ticket.service)
     request = build_request(uri, xml)
     send_notification(uri, request)
   end
@@ -25,12 +28,13 @@ class CASinoCore::Model::ServiceTicket::SingleSignOutNotifier
   end
 
   def build_request(uri, xml)
-    request = Net::HTTP::Post.new(uri.path || '/')
+    request = Net::HTTP::Post.new(uri.request_uri)
     request.set_form_data(logoutRequest: xml)
     return request
   end
 
   def send_notification(uri, request)
+    logger.info "Sending Single Sign Out notification for ticket '#{@service_ticket.ticket}'"
     begin
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = true if uri.scheme =='https'

data/lib/casino_core/model/ticket_granting_ticket.rb

@@ -6,6 +6,9 @@ class CASinoCore::Model::TicketGrantingTicket < ActiveRecord::Base
   validates :ticket, uniqueness: true
   has_many :service_tickets
 
+  before_destroy :destroy_service_tickets
+  after_destroy :destroy_proxy_granting_tickets
+
   def browser_info
     user_agent = UserAgent.parse(self.user_agent)
     "#{user_agent.browser} (#{user_agent.platform})"
@@ -18,4 +21,22 @@ class CASinoCore::Model::TicketGrantingTicket < ActiveRecord::Base
       other_ticket.username == self.username
     end
   end
+
+  private
+  def destroy_service_tickets
+    self.service_tickets.each do |service_ticket|
+      unless service_ticket.destroy
+        service_ticket.ticket_granting_ticket_id = nil
+        service_ticket.save
+      end
+    end
+  end
+
+  # Deletes proxy-granting tickets of service tickets that
+  # could not be deleted (see #destroy_service_tickets)
+  def destroy_proxy_granting_tickets
+    self.service_tickets.each do |service_ticket|
+      service_ticket.proxy_granting_tickets.destroy_all
+    end
+  end
 end

data/lib/casino_core/processor.rb

@@ -6,6 +6,8 @@ module CASinoCore
     autoload :LoginCredentialAcceptor, 'casino_core/processor/login_credential_acceptor.rb'
     autoload :LoginCredentialRequestor, 'casino_core/processor/login_credential_requestor.rb'
     autoload :Logout, 'casino_core/processor/logout.rb'
+    autoload :ProxyTicketProvider, 'casino_core/processor/proxy_ticket_provider.rb'
+    autoload :ProxyTicketValidator, 'casino_core/processor/proxy_ticket_validator.rb'
     autoload :ServiceTicketValidator, 'casino_core/processor/service_ticket_validator.rb'
     autoload :SessionDestroyer, 'casino_core/processor/session_destroyer.rb'
     autoload :SessionOverview, 'casino_core/processor/session_overview.rb'

data/lib/casino_core/processor/legacy_validator.rb

@@ -15,7 +15,7 @@ class CASinoCore::Processor::LegacyValidator < CASinoCore::Processor
   def process(params = nil)
     params ||= {}
     ticket = CASinoCore::Model::ServiceTicket.where(ticket: params[:ticket]).first
-    if service_ticket_valid_for_service?(ticket, params[:service], !!params[:renew])
+    if !params[:service].nil? && ticket_valid_for_service?(ticket, params[:service], !!params[:renew])
       @listener.validation_succeeded("yes\n#{ticket.ticket_granting_ticket.username}\n")
     else
       @listener.validation_failed("no\n\n")

data/lib/casino_core/processor/proxy_ticket_provider.rb

@@ -0,0 +1,44 @@
+require 'builder'
+require 'casino_core/processor'
+require 'casino_core/helper'
+require 'casino_core/model'
+
+# The ProxyTicketProvider processor should be used to handle GET requests to /proxy
+class CASinoCore::Processor::ProxyTicketProvider < CASinoCore::Processor
+  include CASinoCore::Helper::ProxyGrantingTickets
+  include CASinoCore::Helper::ProxyTickets
+
+  # This method will call `#request_succeeded` or `#request_failed`. In both cases, it supplies
+  # a string as argument. The web application should present that string (and nothing else) to the
+  # requestor. The Content-Type should be set to 'text/xml; charset=utf-8'
+  #
+  # @param [Hash] params parameters delivered by the client
+  def process(params = nil)
+    if params[:pgt].nil? || params[:targetService].nil?
+      @listener.request_failed build_xml false, error_code: 'INVALID_REQUEST', error_message: '"pgt" and "targetService" parameters are both required'
+    else
+      proxy_granting_ticket = CASinoCore::Model::ProxyGrantingTicket.where(ticket: params[:pgt]).first
+      if proxy_granting_ticket.nil?
+        @listener.request_failed build_xml false, error_code: 'BAD_PGT', error_message: 'PGT not found'
+      else
+        proxy_ticket = acquire_proxy_ticket(proxy_granting_ticket, params[:targetService])
+        @listener.request_succeeded build_xml true, proxy_ticket: proxy_ticket
+      end
+    end
+  end
+
+  private
+  def build_xml(success, options = {})
+    xml = Builder::XmlMarkup.new(indent: 2)
+    xml.cas :serviceResponse, 'xmlns:cas' => 'http://www.yale.edu/tp/cas' do |service_response|
+      if success
+        service_response.cas :proxySuccess do |proxy_success|
+          proxy_success.cas :proxyTicket, options[:proxy_ticket].ticket
+        end
+      else
+        service_response.cas :proxyFailure, options[:error_message], code: options[:error_code]
+      end
+    end
+    xml.target!
+  end
+end

data/lib/casino_core/processor/proxy_ticket_validator.rb

@@ -0,0 +1,27 @@
+require 'builder'
+require 'casino_core/processor'
+require 'casino_core/helper'
+require 'casino_core/model'
+
+# The ProxyTicketValidator processor should be used to handle GET requests to /proxyValidate
+class CASinoCore::Processor::ProxyTicketValidator < CASinoCore::Processor::ServiceTicketValidator
+
+  # This method will call `#validation_succeeded` or `#validation_failed`. In both cases, it supplies
+  # a string as argument. The web application should present that string (and nothing else) to the
+  # requestor. The Content-Type should be set to 'text/xml; charset=utf-8'
+  #
+  # @param [Hash] params parameters delivered by the client
+  def process(params = nil)
+    params ||= {}
+    if request_valid?(params)
+      ticket = if params[:ticket].start_with?('PT-')
+        CASinoCore::Model::ProxyTicket.where(ticket: params[:ticket]).first
+      elsif params[:ticket].start_with?('ST-')
+        CASinoCore::Model::ServiceTicket.where(ticket: params[:ticket]).first
+      else
+        nil
+      end
+      validate_ticket!(ticket, params)
+    end
+  end
+end

data/lib/casino_core/processor/service_ticket_validator.rb

@@ -1,7 +1,7 @@
-require 'builder'
 require 'casino_core/processor'
 require 'casino_core/helper'
 require 'casino_core/model'
+require 'casino_core/builder'
 
 # The ServiceTicketValidator processor should be used to handle GET requests to /serviceValidate
 class CASinoCore::Processor::ServiceTicketValidator < CASinoCore::Processor
@@ -15,55 +15,37 @@ class CASinoCore::Processor::ServiceTicketValidator < CASinoCore::Processor
   # @param [Hash] params parameters delivered by the client
   def process(params = nil)
     params ||= {}
-    ticket = CASinoCore::Model::ServiceTicket.where(ticket: params[:ticket]).first
-    validation_result = validate_service_ticket_for_service(ticket, params[:service], !!params[:renew])
-    if validation_result == true
-      options = { service_ticket: ticket }
-      unless params[:pgtUrl].nil?
-        options[:proxy_granting_ticket] = acquire_proxy_granting_ticket(params[:pgtUrl], ticket)
-      end
-      @listener.validation_succeeded(build_xml(true, options))
-    else
-      @listener.validation_failed(build_xml(false, error_code: validation_result, error_message: 'Validation failed'))
+    if request_valid?(params)
+      ticket = CASinoCore::Model::ServiceTicket.where(ticket: params[:ticket]).first
+      validate_ticket!(ticket, params)
     end
   end
 
-  private
-  def build_xml(success, options = {})
-    xml = Builder::XmlMarkup.new(indent: 2)
-    xml.cas :serviceResponse, 'xmlns:cas' => 'http://www.yale.edu/tp/cas' do |service_response|
-      if success
-        ticket_granting_ticket = options[:service_ticket].ticket_granting_ticket
-        service_response.cas :authenticationSuccess do |authentication_success|
-          authentication_success.cas :user, ticket_granting_ticket.username
-          unless ticket_granting_ticket.extra_attributes.blank?
-            authentication_success.cas :attributes do |attributes|
-              ticket_granting_ticket.extra_attributes.each do |key, value|
-                serialize_extra_attribute(attributes, key, value)
-              end
-            end
-          end
-          if options[:proxy_granting_ticket]
-            proxy_granting_ticket = options[:proxy_granting_ticket]
-            authentication_success.cas :proxyGrantingTicket, proxy_granting_ticket.iou
-          end
-        end
-      else
-        service_response.cas :authenticationFailure, options[:error_message], code: options[:error_code]
-      end
-    end
-    xml.target!
+  protected
+  def build_service_response(success, options = {})
+    builder = CASinoCore::Builder::TicketValidationResponse.new(success, options)
+    builder.build
   end
 
-  def serialize_extra_attribute(builder, key, value)
-    if value.kind_of?(String) || value.kind_of?(Numeric) || value.kind_of?(Symbol)
-      builder.cas key, "#{value}"
-    elsif value.kind_of?(Numeric)
-      builder.cas key, value.to_s
+  def request_valid?(params)
+    if params[:ticket].nil? || params[:service].nil?
+      @listener.validation_failed build_service_response(false, error_code: 'INVALID_REQUEST', error_message: '"ticket" and "service" parameters are both required')
+      false
     else
-      builder.cas key do
-        builder.cdata! value.to_yaml
+      true
+    end
+  end
+
+  def validate_ticket!(ticket, params)
+    validation_result = validate_ticket_for_service(ticket, params[:service], !!params[:renew])
+    if validation_result.success?
+      options = { ticket: ticket }
+      unless params[:pgtUrl].nil?
+        options[:proxy_granting_ticket] = acquire_proxy_granting_ticket(params[:pgtUrl], ticket)
       end
+      @listener.validation_succeeded(build_service_response(true, options))
+    else
+      @listener.validation_failed(build_service_response(false, error_code: validation_result.error_code, error_message: validation_result.error_message))
     end
   end
 end

data/lib/casino_core/processor/session_destroyer.rb

@@ -9,6 +9,8 @@ require 'casino_core/model'
 # combination with the {CASinoCore::Processor::SessionOverview} processor.
 class CASinoCore::Processor::SessionDestroyer < CASinoCore::Processor
 
+  include CASinoCore::Helper::Logger
+
   # This method will call `#ticket_not_found` or `#ticket_deleted` on the listener.
   # @param [Hash] params parameters supplied by user (ID of ticket-granting ticket to delete should by in params[:id])
   # @param [Hash] cookies cookies supplied by user
@@ -21,6 +23,7 @@ class CASinoCore::Processor::SessionDestroyer < CASinoCore::Processor
     if ticket.nil? || !ticket.same_user?(owner_ticket)
       @listener.ticket_not_found
     else
+      logger.info "Destroying ticket-granting ticket '#{ticket.ticket}'"
       ticket.destroy
       @listener.ticket_deleted
     end

data/lib/casino_core/settings.rb

@@ -3,7 +3,7 @@ require 'casino_core/authenticator'
 module CASinoCore
   class Settings
     class << self
-      attr_accessor :login_ticket, :service_ticket, :authenticators, :logger
+      attr_accessor :login_ticket, :service_ticket, :proxy_ticket, :authenticators, :logger
       def init(config = {})
         config.each do |key,value|
           if respond_to?("#{key}=")

data/lib/casino_core/tasks/cleanup.rake

@@ -8,9 +8,19 @@ namespace :casino_core do
     desc 'Remove expired service tickets.'
     task service_tickets: 'casino_core:db:configure_connection' do
       [:consumed, :unconsumed].each do |type|
-        rows_affected = CASinoCore::Model::ServiceTicket.send("cleanup_#{type}")
+        rows_affected = CASinoCore::Model::ServiceTicket.send("cleanup_#{type}").length
         puts "Deleted #{rows_affected} #{type} service tickets."
       end
+      rows_affected = CASinoCore::Model::ServiceTicket.cleanup_consumed_hard
+      puts "Force deleted #{rows_affected} consumed service tickets."
+    end
+
+    desc 'Remove expired proxy tickets.'
+    task proxy_tickets: 'casino_core:db:configure_connection' do
+      [:consumed, :unconsumed].each do |type|
+        rows_affected = CASinoCore::Model::ProxyTicket.send("cleanup_#{type}").length
+        puts "Deleted #{rows_affected} #{type} proxy tickets."
+      end
     end
 
     desc 'Remove expired login tickets.'
@@ -20,7 +30,7 @@ namespace :casino_core do
     end
 
     desc 'Perform all cleanup tasks.'
-    task all: [:service_tickets, :login_tickets] do
+    task all: [:service_tickets, :proxy_tickets, :login_tickets] do
     end
   end
 end

data/lib/casino_core/tasks/database.rake

@@ -11,12 +11,13 @@ namespace :casino_core do
           Gem.loaded_specs['casino_core'].full_gem_path
         end
       DATABASE_ENV = ENV['DATABASE_ENV'] || ENV['RAILS_ENV'] || 'development'
-      MIGRATIONS_DIR = File.join(BASE_DIR, 'db', 'migrate')
+      ActiveRecord::Migrator.migrations_paths = File.join(BASE_DIR, 'db', 'migrate')
       SCHEMA_PATH = ENV['SCHEMA'] || File.join(BASE_DIR, 'db', 'schema.rb')
     end
 
     task :configuration => :environment do
       @config = YAML.load_file('config/database.yml')[DATABASE_ENV]
+      CASinoCore.setup DATABASE_ENV
     end
 
     task :configure_connection => :configuration do
@@ -33,7 +34,7 @@ namespace :casino_core do
     end
 
     desc 'Rolls the schema back to the previous version (specify steps w/ STEP=n).'
-    task :rollback => [:environment, :load_config] do
+    task :rollback => :configure_connection do
       step = ENV['STEP'] ? ENV['STEP'].to_i : 1
       ActiveRecord::Migrator.rollback(ActiveRecord::Migrator.migrations_paths, step)
     end

data/spec/authenticator/base_spec.rb

@@ -0,0 +1,13 @@
+require 'spec_helper'
+
+describe CASinoCore::Authenticator do
+  subject {
+    CASinoCore::Authenticator.new
+  }
+
+  context '#validate' do
+    it 'raises an error' do
+      expect { subject.validate(nil, nil) }.to raise_error(NotImplementedError)
+    end
+  end
+end

data/spec/model/proxy_ticket_spec.rb

@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+describe CASinoCore::Model::ProxyTicket do
+  let(:ticket) {
+    ticket = described_class.new ticket: 'PT-12345', service: 'any string is valid'
+    ticket.proxy_granting_ticket_id = 1
+    ticket
+  }
+
+  describe '.cleanup_unconsumed' do
+    it 'deletes expired unconsumed service tickets' do
+      ticket.created_at = 10.hours.ago
+      ticket.save!
+      lambda do
+        described_class.cleanup_unconsumed
+      end.should change(described_class, :count).by(-1)
+      described_class.find_by_ticket('ST-12345').should be_false
+    end
+  end
+
+  describe '.cleanup_consumed' do
+    it 'deletes expired consumed service tickets' do
+      ticket.consumed = true
+      ticket.created_at = 10.days.ago
+      ticket.save!
+      lambda do
+        described_class.cleanup_consumed
+      end.should change(described_class, :count).by(-1)
+      described_class.find_by_ticket('ST-12345').should be_false
+    end
+  end
+end