googleauth 0.1.0 → 0.16.1

data/spec/googleauth/user_refresh_spec.rb

@@ -0,0 +1,359 @@
+# Copyright 2015, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+spec_dir = File.expand_path File.join(File.dirname(__FILE__))
+$LOAD_PATH.unshift spec_dir
+$LOAD_PATH.uniq!
+
+require "apply_auth_examples"
+require "fakefs/safe"
+require "fileutils"
+require "googleauth/user_refresh"
+require "jwt"
+require "multi_json"
+require "openssl"
+require "spec_helper"
+require "tmpdir"
+require "os"
+
+include Google::Auth::CredentialsLoader
+
+describe Google::Auth::UserRefreshCredentials do
+  UserRefreshCredentials = Google::Auth::UserRefreshCredentials
+
+  let :cred_json do
+    {
+      client_secret: "privatekey",
+      client_id:     "client123",
+      refresh_token: "refreshtoken",
+      type:          "authorized_user"
+    }
+  end
+
+  before :example do
+    @key = OpenSSL::PKey::RSA.new 2048
+    @client = UserRefreshCredentials.make_creds(
+      json_key_io: StringIO.new(cred_json_text),
+      scope:       "https://www.googleapis.com/auth/userinfo.profile"
+    )
+  end
+
+  def make_auth_stubs opts
+    access_token = opts[:access_token] || ""
+    body = MultiJson.dump("access_token" => access_token,
+                          "token_type"   => "Bearer",
+                          "expires_in"   => 3600)
+    stub_request(:post, "https://oauth2.googleapis.com/token")
+      .with(body: hash_including("grant_type" => "refresh_token"))
+      .to_return(body:    body,
+                 status:  200,
+                 headers: { "Content-Type" => "application/json" })
+  end
+
+  def cred_json_text missing = nil
+    cred_json.delete missing.to_sym unless missing.nil?
+    MultiJson.dump cred_json
+  end
+
+  it_behaves_like "apply/apply! are OK"
+
+  describe "#from_env" do
+    before :example do
+      @var_name = ENV_VAR
+      @credential_vars = [
+        ENV_VAR, CLIENT_ID_VAR, CLIENT_SECRET_VAR, REFRESH_TOKEN_VAR,
+        ACCOUNT_TYPE_VAR
+      ]
+      @original_env_vals = {}
+      @credential_vars.each { |var| @original_env_vals[var] = ENV[var] }
+      @scope = "https://www.googleapis.com/auth/userinfo.profile"
+      @clz = UserRefreshCredentials
+      @project_id = "a_project_id"
+    end
+
+    after :example do
+      @credential_vars.each { |var| ENV[var] = @original_env_vals[var] }
+    end
+
+    it "returns nil if the GOOGLE_APPLICATION_CREDENTIALS is unset" do
+      ENV.delete @var_name unless ENV[@var_name].nil?
+      expect(UserRefreshCredentials.from_env(@scope)).to be_nil
+    end
+
+    it "returns nil if the GOOGLE_APPLICATION_CREDENTIALS is empty" do
+      ENV[@var_name] = ""
+      expect(UserRefreshCredentials.from_env(@scope)).to be_nil
+    end
+
+    it "fails if the GOOGLE_APPLICATION_CREDENTIALS path does not exist" do
+      ENV.delete @var_name unless ENV[@var_name].nil?
+      expect(UserRefreshCredentials.from_env(@scope)).to be_nil
+      Dir.mktmpdir do |dir|
+        key_path = File.join dir, "does-not-exist"
+        ENV[@var_name] = key_path
+        expect { @clz.from_env @scope }.to raise_error RuntimeError
+      end
+    end
+
+    it "fails if the GOOGLE_APPLICATION_CREDENTIALS path file is invalid" do
+      needed = %w[client_id client_secret refresh_token]
+      needed.each do |missing|
+        Dir.mktmpdir do |dir|
+          key_path = File.join dir, "my_cert_file"
+          FileUtils.mkdir_p File.dirname(key_path)
+          File.write key_path, cred_json_text(missing)
+          ENV[@var_name] = key_path
+          expect { @clz.from_env @scope }.to raise_error RuntimeError
+        end
+      end
+    end
+
+    it "succeeds when the GOOGLE_APPLICATION_CREDENTIALS file is valid" do
+      Dir.mktmpdir do |dir|
+        key_path = File.join dir, "my_cert_file"
+        FileUtils.mkdir_p File.dirname(key_path)
+        File.write key_path, cred_json_text
+        ENV[@var_name] = key_path
+        expect(@clz.from_env(@scope)).to_not be_nil
+      end
+    end
+
+    it "succeeds when GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and "\
+      "GOOGLE_REFRESH_TOKEN env vars are valid" do
+      ENV[ENV_VAR] = nil
+      ENV[CLIENT_ID_VAR] = cred_json[:client_id]
+      ENV[CLIENT_SECRET_VAR] = cred_json[:client_secret]
+      ENV[REFRESH_TOKEN_VAR] = cred_json[:refresh_token]
+      ENV[ACCOUNT_TYPE_VAR] = cred_json[:type]
+      creds = @clz.from_env @scope
+      expect(creds).to_not be_nil
+      expect(creds.client_id).to eq(cred_json[:client_id])
+      expect(creds.client_secret).to eq(cred_json[:client_secret])
+      expect(creds.refresh_token).to eq(cred_json[:refresh_token])
+    end
+
+    it "sets project_id when the PROJECT_ID_VAR env var is set" do
+      ENV[ENV_VAR] = nil
+      ENV[CLIENT_ID_VAR] = cred_json[:client_id]
+      ENV[CLIENT_SECRET_VAR] = cred_json[:client_secret]
+      ENV[REFRESH_TOKEN_VAR] = cred_json[:refresh_token]
+      ENV[ACCOUNT_TYPE_VAR] = cred_json[:type]
+      ENV[PROJECT_ID_VAR] = @project_id
+      creds = @clz.from_env @scope
+      expect(creds.project_id).to eq(@project_id)
+    end
+  end
+
+  describe "#from_well_known_path" do
+    before :example do
+      @home = ENV["HOME"]
+      @app_data = ENV["APPDATA"]
+      @scope = "https://www.googleapis.com/auth/userinfo.profile"
+      @known_path = WELL_KNOWN_PATH
+      @clz = UserRefreshCredentials
+    end
+
+    after :example do
+      ENV["HOME"] = @home unless @home == ENV["HOME"]
+      ENV["APPDATA"] = @app_data unless @app_data == ENV["APPDATA"]
+    end
+
+    it "is nil if no file exists" do
+      ENV["HOME"] = File.dirname __FILE__
+      expect(UserRefreshCredentials.from_well_known_path(@scope)).to be_nil
+    end
+
+    it "fails if the file is invalid" do
+      needed = %w[client_id client_secret refresh_token]
+      needed.each do |missing|
+        Dir.mktmpdir do |dir|
+          key_path = File.join dir, ".config", @known_path
+          key_path = File.join dir, @known_path if OS.windows?
+          FileUtils.mkdir_p File.dirname(key_path)
+          File.write key_path, cred_json_text(missing)
+          ENV["HOME"] = dir
+          ENV["APPDATA"] = dir
+          expect { @clz.from_well_known_path @scope }
+            .to raise_error RuntimeError
+        end
+      end
+    end
+
+    it "successfully loads the file when it is present" do
+      Dir.mktmpdir do |dir|
+        key_path = File.join dir, ".config", @known_path
+        key_path = File.join dir, @known_path if OS.windows?
+        FileUtils.mkdir_p File.dirname(key_path)
+        File.write key_path, cred_json_text
+        ENV["HOME"] = dir
+        ENV["APPDATA"] = dir
+        expect(@clz.from_well_known_path(@scope)).to_not be_nil
+      end
+    end
+
+    it "checks gcloud config for project_id if none was provided" do
+      Dir.mktmpdir do |dir|
+        key_path = File.join dir, ".config", @known_path
+        key_path = File.join dir, @known_path if OS.windows?
+        FileUtils.mkdir_p File.dirname(key_path)
+        File.write key_path, cred_json_text
+        ENV["HOME"] = dir
+        ENV["APPDATA"] = dir
+        ENV[PROJECT_ID_VAR] = nil
+        expect(Google::Auth::CredentialsLoader).to receive(:load_gcloud_project_id).with(no_args)
+        @clz.from_well_known_path @scope
+      end
+    end
+  end
+
+  describe "#from_system_default_path" do
+    before :example do
+      @scope = "https://www.googleapis.com/auth/userinfo.profile"
+      @prefix = OS.windows? ? "/etc/Google/Auth/" : "/etc/google/auth/"
+      @path = File.join @prefix, CREDENTIALS_FILE_NAME
+      @program_data = ENV["ProgramData"]
+      @clz = UserRefreshCredentials
+    end
+
+    after :example do
+      ENV["ProgramData"] = @program_data
+    end
+
+    it "is nil if no file exists" do
+      FakeFS do
+        expect(UserRefreshCredentials.from_system_default_path(@scope))
+          .to be_nil
+      end
+    end
+
+    it "fails if the file is invalid" do
+      needed = %w[client_id client_secret refresh_token]
+      needed.each do |missing|
+        FakeFS do
+          ENV["ProgramData"] = "/etc"
+          FileUtils.mkdir_p File.dirname(@path)
+          File.write @path, cred_json_text(missing)
+          expect { @clz.from_system_default_path @scope }
+            .to raise_error RuntimeError
+          File.delete @path
+        end
+      end
+    end
+
+    it "successfully loads the file when it is present" do
+      FakeFS do
+        ENV["ProgramData"] = "/etc"
+        FileUtils.mkdir_p File.dirname(@path)
+        File.write @path, cred_json_text
+        expect(@clz.from_system_default_path(@scope)).to_not be_nil
+        File.delete @path
+      end
+    end
+  end
+
+  shared_examples "revoked token" do
+    it "should nil the refresh token" do
+      expect(@client.refresh_token).to be_nil
+    end
+
+    it "should nil the access token" do
+      expect(@client.access_token).to be_nil
+    end
+
+    it "should mark the token as expired" do
+      expect(@client.expired?).to be_truthy
+    end
+  end
+
+  describe "when revoking a refresh token" do
+    let :stub do
+      stub_request(:post, "https://oauth2.googleapis.com/revoke")
+        .with(body: hash_including("token" => "refreshtoken"))
+        .to_return(status:  200,
+                   headers: { "Content-Type" => "application/json" })
+    end
+
+    before :example do
+      stub
+      @client.revoke!
+    end
+
+    it_behaves_like "revoked token"
+  end
+
+  describe "when revoking an access token" do
+    let :stub do
+      stub_request(:post, "https://oauth2.googleapis.com/revoke")
+        .with(body: hash_including("token" => "accesstoken"))
+        .to_return(status:  200,
+                   headers: { "Content-Type" => "application/json" })
+    end
+
+    before :example do
+      stub
+      @client.refresh_token = nil
+      @client.access_token = "accesstoken"
+      @client.revoke!
+    end
+
+    it_behaves_like "revoked token"
+  end
+
+  describe "when revoking an invalid token" do
+    let :stub do
+      stub_request(:post, "https://oauth2.googleapis.com/revoke")
+        .with(body: hash_including("token" => "refreshtoken"))
+        .to_return(status:  400,
+                   headers: { "Content-Type" => "application/json" })
+    end
+
+    it "raises an authorization error" do
+      stub
+      expect { @client.revoke! }.to raise_error(
+        Signet::AuthorizationError
+      )
+    end
+  end
+
+  describe "when errors occurred with request" do
+    it "should fail with Signet::AuthorizationError if request times out" do
+      allow_any_instance_of(Faraday::Connection).to receive(:post)
+        .and_raise(Faraday::TimeoutError)
+      expect { @client.revoke! }
+        .to raise_error Signet::AuthorizationError
+    end
+
+    it "should fail with Signet::AuthorizationError if request fails" do
+      allow_any_instance_of(Faraday::Connection).to receive(:post)
+        .and_raise(Faraday::ConnectionFailed, nil)
+      expect { @client.revoke! }
+        .to raise_error Signet::AuthorizationError
+    end
+  end
+end

data/spec/googleauth/web_user_authorizer_spec.rb

@@ -0,0 +1,172 @@
+# Copyright 2015, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+spec_dir = File.expand_path File.join(File.dirname(__FILE__))
+$LOAD_PATH.unshift spec_dir
+$LOAD_PATH.uniq!
+
+require "googleauth"
+require "googleauth/web_user_authorizer"
+require "uri"
+require "multi_json"
+require "spec_helper"
+require "rack"
+
+describe Google::Auth::WebUserAuthorizer do
+  include TestHelpers
+
+  let(:client_id) { Google::Auth::ClientId.new "testclient", "notasecret" }
+  let(:scope) { %w[email profile] }
+  let(:token_store) { DummyTokenStore.new }
+  let :authorizer do
+    Google::Auth::WebUserAuthorizer.new client_id, scope, token_store
+  end
+
+  describe "#get_authorization_url" do
+    let :env do
+      Rack::MockRequest.env_for(
+        "http://example.com:8080/test",
+        "REMOTE_ADDR" => "10.10.10.10"
+      )
+    end
+    let(:request) { Rack::Request.new env }
+    it "should include current url in state" do
+      url = authorizer.get_authorization_url request: request
+      expect(url).to match(
+        %r{%22current_uri%22:%22http://example.com:8080/test%22}
+      )
+    end
+
+    it "should allow adding custom state key-value pairs" do
+      url = authorizer.get_authorization_url request: request, state: { james: "bond", kind: 1 }
+      expect(url).to match(%r{%22james%22:%22bond%22})
+      expect(url).to match(%r{%22kind%22:1})
+    end
+
+    it "should include request forgery token in state" do
+      expect(SecureRandom).to receive(:base64).and_return("aGVsbG8=")
+      url = authorizer.get_authorization_url request: request
+      expect(url).to match(/%22session_id%22:%22aGVsbG8=%22/)
+    end
+
+    it "should include request forgery token in session" do
+      expect(SecureRandom).to receive(:base64).and_return("aGVsbG8=")
+      authorizer.get_authorization_url request: request
+      expect(request.session["g-xsrf-token"]).to eq "aGVsbG8="
+    end
+
+    it "should resolve callback against base URL" do
+      url = authorizer.get_authorization_url request: request
+      expect(url).to match(
+        %r{redirect_uri=http://example.com:8080/oauth2callback}
+      )
+    end
+
+    it "should allow overriding the current URL" do
+      url = authorizer.get_authorization_url(
+        request:     request,
+        redirect_to: "/foo"
+      )
+      expect(url).to match %r{%22current_uri%22:%22/foo%22}
+    end
+
+    it "should pass through login hint" do
+      url = authorizer.get_authorization_url(
+        request:    request,
+        login_hint: "user@example.com"
+      )
+      expect(url).to match(/login_hint=user@example.com/)
+    end
+  end
+
+  shared_examples "handles callback" do
+    let :token_json do
+      MultiJson.dump("access_token" => "1/abc123",
+                     "token_type"   => "Bearer",
+                     "expires_in"   => 3600)
+    end
+
+    before :example do
+      stub_request(:post, "https://oauth2.googleapis.com/token")
+        .to_return(body:    token_json,
+                   status:  200,
+                   headers: { "Content-Type" => "application/json" })
+    end
+
+    let :env do
+      Rack::MockRequest.env_for(
+        "http://example.com:8080/oauth2callback?code=authcode&"\
+        "state=%7B%22current_uri%22%3A%22%2Ffoo%22%2C%22"\
+        "session_id%22%3A%22abc%22%7D",
+        "REMOTE_ADDR" => "10.10.10.10"
+      )
+    end
+    let(:request) { Rack::Request.new env }
+
+    before :example do
+      request.session["g-xsrf-token"] = "abc"
+    end
+
+    it "should return credentials when valid code present" do
+      expect(credentials).to be_instance_of(
+        Google::Auth::UserRefreshCredentials
+      )
+    end
+
+    it "should return next URL to redirect to" do
+      expect(next_url).to eq "/foo"
+    end
+
+    it "should fail if xrsf token in session and does not match request" do
+      request.session["g-xsrf-token"] = "123"
+      expect { credentials }.to raise_error(Signet::AuthorizationError)
+    end
+  end
+
+  describe "#handle_auth_callback" do
+    let(:result) { authorizer.handle_auth_callback "user1", request }
+    let(:credentials) { result[0] }
+    let(:next_url) { result[1] }
+
+    it_behaves_like "handles callback"
+  end
+
+  describe "#handle_auth_callback_deferred and #get_credentials" do
+    let :next_url do
+      Google::Auth::WebUserAuthorizer.handle_auth_callback_deferred request
+    end
+
+    let :credentials do
+      next_url
+      authorizer.get_credentials "user1", request
+    end
+
+    it_behaves_like "handles callback"
+  end
+end