RubyGems - leap_web_users - Versions diffs - 0.0.1 - Mend

leap_web_users 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (62) hide show

data/MIT-LICENSE +20 -0
data/README.rdoc +3 -0
data/Rakefile +38 -0
data/app/controllers/sessions_controller.rb +27 -0
data/app/controllers/users_controller.rb +17 -0
data/app/helpers/sessions_helper.rb +2 -0
data/app/helpers/users_helper.rb +2 -0
data/app/models/unauthenticated_user.rb +4 -0
data/app/models/user.rb +49 -0
data/app/views/sessions/new.html.haml +7 -0
data/app/views/users/new.html.haml +10 -0
data/config/initializers/error_constants.rb +1 -0
data/config/routes.rb +10 -0
data/lib/leap_web_users.rb +4 -0
data/lib/leap_web_users/engine.rb +11 -0
data/lib/leap_web_users/version.rb +3 -0
data/lib/tasks/leap_web_users_tasks.rake +4 -0
data/test/dummy/README.rdoc +261 -0
data/test/dummy/Rakefile +7 -0
data/test/dummy/app/assets/javascripts/application.js +15 -0
data/test/dummy/app/assets/stylesheets/application.css +13 -0
data/test/dummy/app/controllers/application_controller.rb +3 -0
data/test/dummy/app/helpers/application_helper.rb +2 -0
data/test/dummy/app/views/layouts/application.html.erb +14 -0
data/test/dummy/config.ru +4 -0
data/test/dummy/config/application.rb +65 -0
data/test/dummy/config/boot.rb +10 -0
data/test/dummy/config/environment.rb +5 -0
data/test/dummy/config/environments/development.rb +31 -0
data/test/dummy/config/environments/production.rb +64 -0
data/test/dummy/config/environments/test.rb +35 -0
data/test/dummy/config/initializers/backtrace_silencers.rb +7 -0
data/test/dummy/config/initializers/inflections.rb +15 -0
data/test/dummy/config/initializers/mime_types.rb +5 -0
data/test/dummy/config/initializers/secret_token.rb +7 -0
data/test/dummy/config/initializers/session_store.rb +8 -0
data/test/dummy/config/initializers/wrap_parameters.rb +10 -0
data/test/dummy/config/locales/en.yml +5 -0
data/test/dummy/config/routes.rb +58 -0
data/test/dummy/log/development.log +0 -0
data/test/dummy/log/test.log +1145 -0
data/test/dummy/public/404.html +26 -0
data/test/dummy/public/422.html +26 -0
data/test/dummy/public/500.html +25 -0
data/test/dummy/public/favicon.ico +0 -0
data/test/dummy/script/rails +6 -0
data/test/functional/sessions_controller_test.rb +73 -0
data/test/functional/users_controller_test.rb +33 -0
data/test/integration/api/Readme.md +23 -0
data/test/integration/api/account_flow_test.rb +69 -0
data/test/integration/api/python/login_wrong_username.py +19 -0
data/test/integration/api/python/signup.py +20 -0
data/test/integration/api/python/signup_and_login.py +48 -0
data/test/integration/api/python/signup_and_login_wrong_password.py +43 -0
data/test/integration/navigation_test.rb +9 -0
data/test/leap_web_users_test.rb +7 -0
data/test/test_helper.rb +10 -0
data/test/unit/helpers/session_helper_test.rb +4 -0
data/test/unit/helpers/users_helper_test.rb +4 -0
data/test/unit/unauthorized_user_test.rb +7 -0
data/test/unit/user_test.rb +40 -0
metadata +352 -0

data/test/dummy/public/404.html ADDED

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>The page you were looking for doesn't exist (404)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/404.html -->
+  <div class="dialog">
+    <h1>The page you were looking for doesn't exist.</h1>
+    <p>You may have mistyped the address or the page may have moved.</p>
+  </div>
+</body>
+</html>

data/test/dummy/public/422.html ADDED

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>The change you wanted was rejected (422)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/422.html -->
+  <div class="dialog">
+    <h1>The change you wanted was rejected.</h1>
+    <p>Maybe you tried to change something you didn't have access to.</p>
+  </div>
+</body>
+</html>

data/test/dummy/public/500.html ADDED

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>We're sorry, but something went wrong (500)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/500.html -->
+  <div class="dialog">
+    <h1>We're sorry, but something went wrong.</h1>
+  </div>
+</body>
+</html>

data/test/dummy/public/favicon.ico ADDED

File without changes

data/test/dummy/script/rails ADDED

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby1.8
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+APP_PATH = File.expand_path('../../config/application',  __FILE__)
+require File.expand_path('../../config/boot',  __FILE__)
+require 'rails/commands'

data/test/functional/sessions_controller_test.rb ADDED

@@ -0,0 +1,73 @@
+require 'test_helper'
+class SessionsControllerTest < ActionController::TestCase
+  def setup
+    @client_hex = 'a123'
+    @client_rnd = @client_hex.hex
+    @server_hex = 'b123'
+    @server_rnd = @server_hex.hex
+    @server_rnd_exp = 'e123'.hex
+    @server_handshake = stub :aa => @client_rnd, :bb => @server_rnd, :b => @server_rnd_exp
+  end
+  test "should get login screen" do
+    get :new
+    assert_response :success
+  end
+  test "should perform handshake" do
+    user = stub :login => "me", :id => 123
+    user.expects(:initialize_auth).
+      with(@client_rnd).
+      returns(@server_handshake)
+    User.expects(:find_by_param).with(user.login).returns(user)
+    post :create, :login => user.login, 'A' => @client_hex
+    assert_equal @server_handshake, session[:handshake]
+    assert_response :success
+    assert_json_response :B => @server_hex
+  end
+  test "should report user not found" do
+    unknown = "login_that_does_not_exist"
+    User.expects(:find_by_param).with(unknown).raises(RECORD_NOT_FOUND)
+    post :create, :login => unknown
+    assert_response :success
+    assert_json_response :errors => {"login" => ["unknown user"]}
+  end
+  test "should authorize" do
+    session[:handshake] = @server_handshake
+    user = stub :login => "me", :id => 123
+    user.expects(:authenticate!).
+      with(@client_rnd, @server_handshake).
+      returns(@server_auth)
+    User.expects(:find_by_param).with(user.login).returns(user)
+    post :update, :id => user.login, :client_auth => @client_hex
+    assert_nil session[:handshake]
+    assert_json_response :M2 => @server_auth
+    assert_equal user.id, session[:user_id]
+  end
+  test "should report wrong password" do
+    session[:handshake] = @server_handshake
+    user = stub :login => "me", :id => 123
+    user.expects(:authenticate!).
+      with(@client_rnd, @server_handshake).
+      raises(WRONG_PASSWORD)
+    User.expects(:find_by_param).with(user.login).returns(user)
+    post :update, :id => user.login, :client_auth => @client_hex
+    assert_nil session[:handshake]
+    assert_nil session[:user_id]
+    assert_json_response :errors => {"password" => ["wrong password"]}
+  end
+  test "logout should reset sessions user_id" do
+    session[:user_id] = "set"
+    delete :destroy
+    assert_nil session[:user_id]
+    assert_response :redirect
+    assert_redirected_to root_url
+  end
+end

data/test/functional/users_controller_test.rb ADDED

@@ -0,0 +1,33 @@
+require 'test_helper'
+class UsersControllerTest < ActionController::TestCase
+  test "should get new" do
+    get :new
+    assert_equal User, assigns(:user).class
+    assert_response :success
+  end
+  test "should create new user" do
+    params = User.valid_attributes_hash
+    user = stub params.merge(:id => 123)
+    params.stringify_keys!
+    User.expects(:create!).with(params).returns(user)
+    post :create, :user => params
+    assert_nil session[:user_id]
+    assert_response :redirect
+    assert_redirected_to root_url
+  end
+  test "should redirect to signup form on failed attempt" do
+    params = User.valid_attributes_hash.slice(:login)
+    user = User.new(params)
+    params.stringify_keys!
+    User.expects(:create!).with(params).raises(VALIDATION_FAILED.new(user))
+    post :create, :user => params
+    assert_nil session[:user_id]
+    assert_equal user, assigns[:user]
+    assert_response :redirect
+    assert_redirected_to new_user_path
+  end
+end

data/test/integration/api/Readme.md ADDED

@@ -0,0 +1,23 @@
+API tests
+==========
+Testing the restful api from a simple python client as that's what we'll be using.
+This test so far mostly demoes the API. We have no SRP calc in there.
+TODO: keep track of the cookies during login. The server uses the session to keep track of the random numbers A and B.
+The output of signup_and_login_wrong_password pretty well describes the SRP API:
+```
+POST: http://localhost:9292/users.json
+    {"user[password_salt]": "54321", "user[password_verifier]": "12345", "user[login]": "SWQ055"}
+ -> {"password_salt":"54321","login":"SWQ055"}
+POST: http://localhost:9292/sessions
+    {"A": "12345", "login": "SWQ055"}
+ -> {"B":"1778367531e93a4c7713c76f67649f35a4211ebc520926ae8c3848cd66171651"}
+PUT: http://localhost:9292/sessions/SWQ055
+    {"M": "123ABC"}
+ -> {"field":"password","error":"wrong password"}
+```

data/test/integration/api/account_flow_test.rb ADDED

@@ -0,0 +1,69 @@
+require 'test_helper'
+class AccountFlowTest < ActionDispatch::IntegrationTest
+  # this test wraps the api and implements the interface the ruby-srp client.
+  def handshake(login, aa)
+    post "sessions", :login => login, 'A' => aa.to_s(16)
+    assert_response :success
+    response = JSON.parse(@response.body)
+    if response['errors']
+      raise RECORD_NOT_FOUND.new(response['errors'])
+    else
+      return response['B'].hex
+    end
+  end
+  def validate(m)
+    put "sessions/" + @login, :client_auth => m.to_s(16)
+    assert_response :success
+    return JSON.parse(@response.body)
+  end
+  def setup
+    @login = "integration_test_user"
+    User.find_by_login(@login).tap{|u| u.destroy if u}
+    @password = "srp, verify me!"
+    @srp = SRP::Client.new(@login, @password)
+    @user_params = {
+      :login => @login,
+      :password_verifier => @srp.verifier.to_s(16),
+      :password_salt => @srp.salt.to_s(16)
+    }
+  end
+  def teardown
+    @user.destroy if @user # make sure we can run this test again
+  end
+  test "signup and login with srp via api" do
+    post '/users.json', :user => @user_params
+    @user = User.find_by_param(@login)
+    assert_json_response @user_params.slice(:login, :password_salt)
+    assert_response :success
+    server_auth = @srp.authenticate(self, @login, @password)
+    assert_nil server_auth["errors"]
+    assert server_auth["M2"]
+  end
+  test "signup and wrong password login attempt" do
+    post '/users.json', :user => @user_params
+    @user = User.find_by_param(@login)
+    assert_json_response @user_params.slice(:login, :password_salt)
+    assert_response :success
+    server_auth = @srp.authenticate(self, @login, "wrong password")
+    assert_equal ["wrong password"], server_auth["errors"]['password']
+    assert_nil server_auth["M2"]
+  end
+  test "signup and wrong username login attempt" do
+    post '/users.json', :user => @user_params
+    @user = User.find_by_param(@login)
+    assert_json_response @user_params.slice(:login, :password_salt)
+    assert_response :success
+    assert_raises RECORD_NOT_FOUND do
+      server_auth = @srp.authenticate(self, "wronglogin", @password)
+    end
+  end
+end

data/test/integration/api/python/login_wrong_username.py ADDED

@@ -0,0 +1,19 @@
+#!/usr/bin/env python
+server = 'http://localhost:9292'
+import requests
+import json
+import string
+import random
+def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
+  return ''.join(random.choice(chars) for x in range(size))
+params = {
+    'login': 'python_test_user_'+id_generator(),
+    'A': '12345',
+    }
+r = requests.post(server + '/sessions', data = params)
+print r.url
+print r.text

data/test/integration/api/python/signup.py ADDED

@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+server = 'http://localhost:9292'
+import requests
+import json
+import string
+import random
+def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
+  return ''.join(random.choice(chars) for x in range(size))
+user_params = {
+    'user[login]': 'python_test_user_'+id_generator(),
+    'user[password_verifier]': '12345',
+    'user[password_salt]': '54321'
+    }
+r = requests.post(server + '/users.json', data = user_params)
+print r.url
+print r.text

data/test/integration/api/python/signup_and_login.py ADDED

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+# FAILS
+#
+# This test is currently failing for me because the session is not kept.
+# Played with it a bunch - is probably messed up right now as well.
+server = 'http://localhost:3000'
+import requests
+import json
+import string
+import random
+def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
+  return ''.join(random.choice(chars) for x in range(size))
+def print_and_parse(response):
+  print response.request.method + ': ' + response.url
+  print "    " + json.dumps(response.request.data)
+  print " -> " + response.text
+  print " () " + json.dumps(requests.utils.dict_from_cookiejar(response.cookies))
+  return json.loads(response.text)
+def signup(session):
+  user_params = {
+      'user[login]': id_generator(),
+      'user[password_verifier]': '12345',
+      'user[password_salt]': '54321'
+      }
+  return session.post(server + '/users.json', data = user_params)
+def authenticate(session, login):
+  params = {
+      'login': login,
+      'A': '12345',
+      }
+  init = session.post(server + '/sessions', data = params)
+  cookies = requests.utils.dict_from_cookiejar(init.cookies)
+  init = session.post(server + '/sessions', data = params, cookies = cookies)
+  print "(%) " + json.dumps(cookies)
+  return session.put(server + '/sessions/' + login, data = {'M': '123'}, cookies = cookies)
+session = requests.session()
+user = print_and_parse(signup(session))
+# SRP signup would happen here and calculate M hex
+auth = print_and_parse(authenticate(session, user['login']))

data/test/integration/api/python/signup_and_login_wrong_password.py ADDED

@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+server = 'http://localhost:9292'
+import requests
+import json
+import string
+import random
+def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
+  return ''.join(random.choice(chars) for x in range(size))
+def print_and_parse(response):
+  print response.request.method + ': ' + response.url
+  print "    " + json.dumps(response.request.data)
+  print " -> " + response.text
+#  print " () " + json.dumps(requests.utils.dict_from_cookiejar(response.cookies))
+  return json.loads(response.text)
+def signup():
+  user_params = {
+      'user[login]': id_generator(),
+      'user[password_verifier]': '12345',
+      'user[password_salt]': '54321'
+      }
+  return requests.post(server + '/users.json', data = user_params)
+def handshake(login):
+  params = {
+      'login': login,
+      'A': '12345',
+      }
+  return requests.post(server + '/sessions', data = params)
+def authenticate(login, M):
+  return requests.put(server + '/sessions/' + login, data = {'M': M})
+user = print_and_parse(signup())
+handshake = print_and_parse(handshake(user['login']))
+# SRP signup would happen here and calculate M hex
+M = '123ABC'
+auth = print_and_parse(authenticate(user['login'], M))

data/test/integration/navigation_test.rb ADDED

@@ -0,0 +1,9 @@
+require 'test_helper'
+class NavigationTest < ActionDispatch::IntegrationTest
+  # test "the truth" do
+  #   assert true
+  # end
+end

data/test/leap_web_users_test.rb ADDED

@@ -0,0 +1,7 @@
+require 'test_helper'
+class LeapWebUsersTest < ActiveSupport::TestCase
+  test "module exists" do
+    assert_kind_of Module, LeapWebUsers
+  end
+end