googleauth 0.17.0 → 0.17.1

data/spec/googleauth/user_refresh_spec.rb

@@ -1,359 +0,0 @@
-# Copyright 2015, Google Inc.
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-spec_dir = File.expand_path File.join(File.dirname(__FILE__))
-$LOAD_PATH.unshift spec_dir
-$LOAD_PATH.uniq!
-
-require "apply_auth_examples"
-require "fakefs/safe"
-require "fileutils"
-require "googleauth/user_refresh"
-require "jwt"
-require "multi_json"
-require "openssl"
-require "spec_helper"
-require "tmpdir"
-require "os"
-
-include Google::Auth::CredentialsLoader
-
-describe Google::Auth::UserRefreshCredentials do
-  UserRefreshCredentials = Google::Auth::UserRefreshCredentials
-
-  let :cred_json do
-    {
-      client_secret: "privatekey",
-      client_id:     "client123",
-      refresh_token: "refreshtoken",
-      type:          "authorized_user"
-    }
-  end
-
-  before :example do
-    @key = OpenSSL::PKey::RSA.new 2048
-    @client = UserRefreshCredentials.make_creds(
-      json_key_io: StringIO.new(cred_json_text),
-      scope:       "https://www.googleapis.com/auth/userinfo.profile"
-    )
-  end
-
-  def make_auth_stubs opts
-    access_token = opts[:access_token] || ""
-    body = MultiJson.dump("access_token" => access_token,
-                          "token_type"   => "Bearer",
-                          "expires_in"   => 3600)
-    stub_request(:post, "https://oauth2.googleapis.com/token")
-      .with(body: hash_including("grant_type" => "refresh_token"))
-      .to_return(body:    body,
-                 status:  200,
-                 headers: { "Content-Type" => "application/json" })
-  end
-
-  def cred_json_text missing = nil
-    cred_json.delete missing.to_sym unless missing.nil?
-    MultiJson.dump cred_json
-  end
-
-  it_behaves_like "apply/apply! are OK"
-
-  describe "#from_env" do
-    before :example do
-      @var_name = ENV_VAR
-      @credential_vars = [
-        ENV_VAR, CLIENT_ID_VAR, CLIENT_SECRET_VAR, REFRESH_TOKEN_VAR,
-        ACCOUNT_TYPE_VAR
-      ]
-      @original_env_vals = {}
-      @credential_vars.each { |var| @original_env_vals[var] = ENV[var] }
-      @scope = "https://www.googleapis.com/auth/userinfo.profile"
-      @clz = UserRefreshCredentials
-      @project_id = "a_project_id"
-    end
-
-    after :example do
-      @credential_vars.each { |var| ENV[var] = @original_env_vals[var] }
-    end
-
-    it "returns nil if the GOOGLE_APPLICATION_CREDENTIALS is unset" do
-      ENV.delete @var_name unless ENV[@var_name].nil?
-      expect(UserRefreshCredentials.from_env(@scope)).to be_nil
-    end
-
-    it "returns nil if the GOOGLE_APPLICATION_CREDENTIALS is empty" do
-      ENV[@var_name] = ""
-      expect(UserRefreshCredentials.from_env(@scope)).to be_nil
-    end
-
-    it "fails if the GOOGLE_APPLICATION_CREDENTIALS path does not exist" do
-      ENV.delete @var_name unless ENV[@var_name].nil?
-      expect(UserRefreshCredentials.from_env(@scope)).to be_nil
-      Dir.mktmpdir do |dir|
-        key_path = File.join dir, "does-not-exist"
-        ENV[@var_name] = key_path
-        expect { @clz.from_env @scope }.to raise_error RuntimeError
-      end
-    end
-
-    it "fails if the GOOGLE_APPLICATION_CREDENTIALS path file is invalid" do
-      needed = %w[client_id client_secret refresh_token]
-      needed.each do |missing|
-        Dir.mktmpdir do |dir|
-          key_path = File.join dir, "my_cert_file"
-          FileUtils.mkdir_p File.dirname(key_path)
-          File.write key_path, cred_json_text(missing)
-          ENV[@var_name] = key_path
-          expect { @clz.from_env @scope }.to raise_error RuntimeError
-        end
-      end
-    end
-
-    it "succeeds when the GOOGLE_APPLICATION_CREDENTIALS file is valid" do
-      Dir.mktmpdir do |dir|
-        key_path = File.join dir, "my_cert_file"
-        FileUtils.mkdir_p File.dirname(key_path)
-        File.write key_path, cred_json_text
-        ENV[@var_name] = key_path
-        expect(@clz.from_env(@scope)).to_not be_nil
-      end
-    end
-
-    it "succeeds when GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and "\
-      "GOOGLE_REFRESH_TOKEN env vars are valid" do
-      ENV[ENV_VAR] = nil
-      ENV[CLIENT_ID_VAR] = cred_json[:client_id]
-      ENV[CLIENT_SECRET_VAR] = cred_json[:client_secret]
-      ENV[REFRESH_TOKEN_VAR] = cred_json[:refresh_token]
-      ENV[ACCOUNT_TYPE_VAR] = cred_json[:type]
-      creds = @clz.from_env @scope
-      expect(creds).to_not be_nil
-      expect(creds.client_id).to eq(cred_json[:client_id])
-      expect(creds.client_secret).to eq(cred_json[:client_secret])
-      expect(creds.refresh_token).to eq(cred_json[:refresh_token])
-    end
-
-    it "sets project_id when the PROJECT_ID_VAR env var is set" do
-      ENV[ENV_VAR] = nil
-      ENV[CLIENT_ID_VAR] = cred_json[:client_id]
-      ENV[CLIENT_SECRET_VAR] = cred_json[:client_secret]
-      ENV[REFRESH_TOKEN_VAR] = cred_json[:refresh_token]
-      ENV[ACCOUNT_TYPE_VAR] = cred_json[:type]
-      ENV[PROJECT_ID_VAR] = @project_id
-      creds = @clz.from_env @scope
-      expect(creds.project_id).to eq(@project_id)
-    end
-  end
-
-  describe "#from_well_known_path" do
-    before :example do
-      @home = ENV["HOME"]
-      @app_data = ENV["APPDATA"]
-      @scope = "https://www.googleapis.com/auth/userinfo.profile"
-      @known_path = WELL_KNOWN_PATH
-      @clz = UserRefreshCredentials
-    end
-
-    after :example do
-      ENV["HOME"] = @home unless @home == ENV["HOME"]
-      ENV["APPDATA"] = @app_data unless @app_data == ENV["APPDATA"]
-    end
-
-    it "is nil if no file exists" do
-      ENV["HOME"] = File.dirname __FILE__
-      expect(UserRefreshCredentials.from_well_known_path(@scope)).to be_nil
-    end
-
-    it "fails if the file is invalid" do
-      needed = %w[client_id client_secret refresh_token]
-      needed.each do |missing|
-        Dir.mktmpdir do |dir|
-          key_path = File.join dir, ".config", @known_path
-          key_path = File.join dir, @known_path if OS.windows?
-          FileUtils.mkdir_p File.dirname(key_path)
-          File.write key_path, cred_json_text(missing)
-          ENV["HOME"] = dir
-          ENV["APPDATA"] = dir
-          expect { @clz.from_well_known_path @scope }
-            .to raise_error RuntimeError
-        end
-      end
-    end
-
-    it "successfully loads the file when it is present" do
-      Dir.mktmpdir do |dir|
-        key_path = File.join dir, ".config", @known_path
-        key_path = File.join dir, @known_path if OS.windows?
-        FileUtils.mkdir_p File.dirname(key_path)
-        File.write key_path, cred_json_text
-        ENV["HOME"] = dir
-        ENV["APPDATA"] = dir
-        expect(@clz.from_well_known_path(@scope)).to_not be_nil
-      end
-    end
-
-    it "checks gcloud config for project_id if none was provided" do
-      Dir.mktmpdir do |dir|
-        key_path = File.join dir, ".config", @known_path
-        key_path = File.join dir, @known_path if OS.windows?
-        FileUtils.mkdir_p File.dirname(key_path)
-        File.write key_path, cred_json_text
-        ENV["HOME"] = dir
-        ENV["APPDATA"] = dir
-        ENV[PROJECT_ID_VAR] = nil
-        expect(Google::Auth::CredentialsLoader).to receive(:load_gcloud_project_id).with(no_args)
-        @clz.from_well_known_path @scope
-      end
-    end
-  end
-
-  describe "#from_system_default_path" do
-    before :example do
-      @scope = "https://www.googleapis.com/auth/userinfo.profile"
-      @prefix = OS.windows? ? "/etc/Google/Auth/" : "/etc/google/auth/"
-      @path = File.join @prefix, CREDENTIALS_FILE_NAME
-      @program_data = ENV["ProgramData"]
-      @clz = UserRefreshCredentials
-    end
-
-    after :example do
-      ENV["ProgramData"] = @program_data
-    end
-
-    it "is nil if no file exists" do
-      FakeFS do
-        expect(UserRefreshCredentials.from_system_default_path(@scope))
-          .to be_nil
-      end
-    end
-
-    it "fails if the file is invalid" do
-      needed = %w[client_id client_secret refresh_token]
-      needed.each do |missing|
-        FakeFS do
-          ENV["ProgramData"] = "/etc"
-          FileUtils.mkdir_p File.dirname(@path)
-          File.write @path, cred_json_text(missing)
-          expect { @clz.from_system_default_path @scope }
-            .to raise_error RuntimeError
-          File.delete @path
-        end
-      end
-    end
-
-    it "successfully loads the file when it is present" do
-      FakeFS do
-        ENV["ProgramData"] = "/etc"
-        FileUtils.mkdir_p File.dirname(@path)
-        File.write @path, cred_json_text
-        expect(@clz.from_system_default_path(@scope)).to_not be_nil
-        File.delete @path
-      end
-    end
-  end
-
-  shared_examples "revoked token" do
-    it "should nil the refresh token" do
-      expect(@client.refresh_token).to be_nil
-    end
-
-    it "should nil the access token" do
-      expect(@client.access_token).to be_nil
-    end
-
-    it "should mark the token as expired" do
-      expect(@client.expired?).to be_truthy
-    end
-  end
-
-  describe "when revoking a refresh token" do
-    let :stub do
-      stub_request(:post, "https://oauth2.googleapis.com/revoke")
-        .with(body: hash_including("token" => "refreshtoken"))
-        .to_return(status:  200,
-                   headers: { "Content-Type" => "application/json" })
-    end
-
-    before :example do
-      stub
-      @client.revoke!
-    end
-
-    it_behaves_like "revoked token"
-  end
-
-  describe "when revoking an access token" do
-    let :stub do
-      stub_request(:post, "https://oauth2.googleapis.com/revoke")
-        .with(body: hash_including("token" => "accesstoken"))
-        .to_return(status:  200,
-                   headers: { "Content-Type" => "application/json" })
-    end
-
-    before :example do
-      stub
-      @client.refresh_token = nil
-      @client.access_token = "accesstoken"
-      @client.revoke!
-    end
-
-    it_behaves_like "revoked token"
-  end
-
-  describe "when revoking an invalid token" do
-    let :stub do
-      stub_request(:post, "https://oauth2.googleapis.com/revoke")
-        .with(body: hash_including("token" => "refreshtoken"))
-        .to_return(status:  400,
-                   headers: { "Content-Type" => "application/json" })
-    end
-
-    it "raises an authorization error" do
-      stub
-      expect { @client.revoke! }.to raise_error(
-        Signet::AuthorizationError
-      )
-    end
-  end
-
-  describe "when errors occurred with request" do
-    it "should fail with Signet::AuthorizationError if request times out" do
-      allow_any_instance_of(Faraday::Connection).to receive(:post)
-        .and_raise(Faraday::TimeoutError)
-      expect { @client.revoke! }
-        .to raise_error Signet::AuthorizationError
-    end
-
-    it "should fail with Signet::AuthorizationError if request fails" do
-      allow_any_instance_of(Faraday::Connection).to receive(:post)
-        .and_raise(Faraday::ConnectionFailed, nil)
-      expect { @client.revoke! }
-        .to raise_error Signet::AuthorizationError
-    end
-  end
-end

data/spec/googleauth/web_user_authorizer_spec.rb

@@ -1,172 +0,0 @@
-# Copyright 2015, Google Inc.
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-spec_dir = File.expand_path File.join(File.dirname(__FILE__))
-$LOAD_PATH.unshift spec_dir
-$LOAD_PATH.uniq!
-
-require "googleauth"
-require "googleauth/web_user_authorizer"
-require "uri"
-require "multi_json"
-require "spec_helper"
-require "rack"
-
-describe Google::Auth::WebUserAuthorizer do
-  include TestHelpers
-
-  let(:client_id) { Google::Auth::ClientId.new "testclient", "notasecret" }
-  let(:scope) { %w[email profile] }
-  let(:token_store) { DummyTokenStore.new }
-  let :authorizer do
-    Google::Auth::WebUserAuthorizer.new client_id, scope, token_store
-  end
-
-  describe "#get_authorization_url" do
-    let :env do
-      Rack::MockRequest.env_for(
-        "http://example.com:8080/test",
-        "REMOTE_ADDR" => "10.10.10.10"
-      )
-    end
-    let(:request) { Rack::Request.new env }
-    it "should include current url in state" do
-      url = authorizer.get_authorization_url request: request
-      expect(url).to match(
-        %r{%22current_uri%22:%22http://example.com:8080/test%22}
-      )
-    end
-
-    it "should allow adding custom state key-value pairs" do
-      url = authorizer.get_authorization_url request: request, state: { james: "bond", kind: 1 }
-      expect(url).to match(%r{%22james%22:%22bond%22})
-      expect(url).to match(%r{%22kind%22:1})
-    end
-
-    it "should include request forgery token in state" do
-      expect(SecureRandom).to receive(:base64).and_return("aGVsbG8=")
-      url = authorizer.get_authorization_url request: request
-      expect(url).to match(/%22session_id%22:%22aGVsbG8=%22/)
-    end
-
-    it "should include request forgery token in session" do
-      expect(SecureRandom).to receive(:base64).and_return("aGVsbG8=")
-      authorizer.get_authorization_url request: request
-      expect(request.session["g-xsrf-token"]).to eq "aGVsbG8="
-    end
-
-    it "should resolve callback against base URL" do
-      url = authorizer.get_authorization_url request: request
-      expect(url).to match(
-        %r{redirect_uri=http://example.com:8080/oauth2callback}
-      )
-    end
-
-    it "should allow overriding the current URL" do
-      url = authorizer.get_authorization_url(
-        request:     request,
-        redirect_to: "/foo"
-      )
-      expect(url).to match %r{%22current_uri%22:%22/foo%22}
-    end
-
-    it "should pass through login hint" do
-      url = authorizer.get_authorization_url(
-        request:    request,
-        login_hint: "user@example.com"
-      )
-      expect(url).to match(/login_hint=user@example.com/)
-    end
-  end
-
-  shared_examples "handles callback" do
-    let :token_json do
-      MultiJson.dump("access_token" => "1/abc123",
-                     "token_type"   => "Bearer",
-                     "expires_in"   => 3600)
-    end
-
-    before :example do
-      stub_request(:post, "https://oauth2.googleapis.com/token")
-        .to_return(body:    token_json,
-                   status:  200,
-                   headers: { "Content-Type" => "application/json" })
-    end
-
-    let :env do
-      Rack::MockRequest.env_for(
-        "http://example.com:8080/oauth2callback?code=authcode&"\
-        "state=%7B%22current_uri%22%3A%22%2Ffoo%22%2C%22"\
-        "session_id%22%3A%22abc%22%7D",
-        "REMOTE_ADDR" => "10.10.10.10"
-      )
-    end
-    let(:request) { Rack::Request.new env }
-
-    before :example do
-      request.session["g-xsrf-token"] = "abc"
-    end
-
-    it "should return credentials when valid code present" do
-      expect(credentials).to be_instance_of(
-        Google::Auth::UserRefreshCredentials
-      )
-    end
-
-    it "should return next URL to redirect to" do
-      expect(next_url).to eq "/foo"
-    end
-
-    it "should fail if xrsf token in session and does not match request" do
-      request.session["g-xsrf-token"] = "123"
-      expect { credentials }.to raise_error(Signet::AuthorizationError)
-    end
-  end
-
-  describe "#handle_auth_callback" do
-    let(:result) { authorizer.handle_auth_callback "user1", request }
-    let(:credentials) { result[0] }
-    let(:next_url) { result[1] }
-
-    it_behaves_like "handles callback"
-  end
-
-  describe "#handle_auth_callback_deferred and #get_credentials" do
-    let :next_url do
-      Google::Auth::WebUserAuthorizer.handle_auth_callback_deferred request
-    end
-
-    let :credentials do
-      next_url
-      authorizer.get_credentials "user1", request
-    end
-
-    it_behaves_like "handles callback"
-  end
-end