lockbox_middleware 1.2.0 → 1.2.1

data/script/about

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+$LOAD_PATH.unshift "#{RAILTIES_PATH}/builtin/rails_info"
+require 'commands/about'

data/script/autospec

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+gem 'test-unit', '1.2.3' if RUBY_VERSION.to_f >= 1.9
+ENV['RSPEC'] = 'true'     # allows autotest to discover rspec
+ENV['AUTOTEST'] = 'true'  # allows autotest to run w/ color on linux
+system((RUBY_PLATFORM =~ /mswin|mingw/ ? 'autotest.bat' : 'autotest'), *ARGV) ||
+  $stderr.puts("Unable to find autotest.  Please install ZenTest or fix your PATH")

data/script/console

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/console'

data/script/cucumber

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+
+vendored_cucumber_binary = Dir[File.join(File.dirname(__FILE__),
+                                         '..',
+                                         'vendor',
+                                         '{gems,plugins}',
+                                         'cucumber*',
+                                         'bin',
+                                         'cucumber')].first
+
+if vendored_cucumber_binary
+  load File.expand_path(vendored_cucumber_binary)
+else
+  require 'rubygems' unless ENV['NO_RUBYGEMS']
+  require 'cucumber'
+  load Cucumber::BINARY
+end

data/script/dbconsole

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/dbconsole'

data/script/destroy

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/destroy'

data/script/generate

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/generate'

data/script/performance/benchmarker

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../../config/boot',  __FILE__)
+require 'commands/performance/benchmarker'

data/script/performance/profiler

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../../config/boot',  __FILE__)
+require 'commands/performance/profiler'

data/script/plugin

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/plugin'

data/script/runner

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/runner'

data/script/server

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require File.expand_path('../../config/boot',  __FILE__)
+require 'commands/server'

data/script/spec

@@ -0,0 +1,10 @@
+#!/usr/bin/env ruby
+if ARGV.any? {|arg| %w[--drb -X --generate-options -G --help -h --version -v].include?(arg)}
+  require 'rubygems' unless ENV['NO_RUBYGEMS']
+else
+  gem 'test-unit', '1.2.3' if RUBY_VERSION.to_f >= 1.9
+  ENV["RAILS_ENV"] ||= 'test'
+  require File.expand_path(File.dirname(__FILE__) + "/../config/environment") unless defined?(RAILS_ROOT)
+end
+require 'spec/autorun'
+exit ::Spec::Runner::CommandLine.run

data/spec/controllers/admin/partners_controller_spec.rb

@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe Admin::PartnersController do
+  # include Rack::Test::Methods
+  include HelperMethods
+  
+  context "an admin" do
+    before do
+      @partner = Factory(:partner)
+      admin_login
+    end
+    
+    it "should be able to get index" do
+      get :index
+      assert_response :success
+    end
+
+    it "should be able to show a partner" do
+      get :show, :id => @partner.id
+      assert_response :success
+    end
+
+    it "should be able to get edit page for partner" do
+      get :edit, :id => @partner.id
+      assert_response :success
+    end
+
+    it "should be able to destroy a partner" do
+      assert Partner.find(@partner.id)
+      delete :destroy, :id => @partner.id
+      assert_redirected_to admin_partners_path
+      assert_raise(ActiveRecord::RecordNotFound) {  Partner.find(@partner.id) }
+    end
+
+    it "should be able to update a partner" do
+      put :update, :id => @partner.id, :record => Factory.attributes_for(:partner, :name => 'crazyname', :max_requests => 1234, 
+        :password => nil, :password_confirmation => nil)
+      assert_equal("crazyname", @partner.reload.name)
+      assert_equal(1234, @partner.max_requests)
+    end
+    
+    it "should be able to get new page" do
+      get :new
+      assert_response :success
+    end
+    
+    it "should be able to create a new partner" do
+      count = Partner.count
+      post :create, :record => {:name => "crazyname", :organization => @partner.organization, :phone_number => @partner.phone_number, :email => "something@somewhere.com", :max_requests => "1234", :password => 'potato', :password_confirmation => 'potato'}
+      assert_equal(count + 1, Partner.count)
+      assert Partner.find_by_name("crazyname")
+      assert Partner.find_by_email("something@somewhere.com")
+    end
+  end
+end

data/spec/controllers/admin_controller_spec.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+
+describe AdminController do
+  include HelperMethods
+
+  context "a logged in admin" do
+    before do
+      admin_login
+    end
+
+    it "should be able to get admin page" do
+      get :show
+      response.should be_success
+    end
+
+  end
+  
+  context "joe schmoe" do
+    
+    it "should not be able to get admin page" do
+      get :show
+      response.should_not be_success
+      response.status.should =~ /401/
+      response.body.should =~ /HTTP Basic: Access denied/
+    end
+    
+  end
+
+end

data/spec/controllers/application_controller_spec.rb

@@ -0,0 +1,36 @@
+require 'spec_helper'
+
+describe ApplicationController do
+
+  context "an instantiated controller" do
+
+    context "rendering jsonp" do
+      it "should pass the json straight through with no options" do
+        subject.stubs(:params).returns({})
+        subject.expects(:render).with({:text => 'foo'}).returns(true)
+        subject.render_jsonp('foo')
+      end
+
+      it "should return jsonp with variable assignment" do
+        subject.stubs(:params).returns({:variable => 'var'})
+        subject.expects(:render).with({:text => 'var var = foo;'}).returns(true)
+        subject.render_jsonp('foo')
+      end
+
+      it "should return jsonp with callback" do
+        subject.stubs(:params).returns({ :callback => 'callback'})
+        subject.expects(:render).with({:text => 'callback(foo);'}).returns(true)
+        subject.render_jsonp('foo')
+      end
+
+      it "should return jsonp with variable assignment and callback" do
+        subject.stubs(:params).returns({:variable => 'var', :callback => 'callback'})
+        subject.expects(:render).with({:text => "var var = foo;\ncallback(var);"}).returns(true)
+        subject.render_jsonp('foo')
+      end
+    end
+  end
+
+
+  
+end

data/spec/controllers/authentication_controller_spec.rb

@@ -0,0 +1,120 @@
+require 'spec_helper'
+
+describe AuthenticationController do
+  integrate_views
+  
+  context "with an existing partner" do
+    subject { Factory(:partner) }
+    
+    it "should return 200 for successful authentication" do
+      get :show, :id => subject.api_key
+      response.should be_success
+    end
+    
+    it "should return the API key in a header" do
+      get :show, :id => subject.api_key
+      response.headers['X-LockBox-API-Key'].should == subject.api_key
+    end
+    
+    it "should return 401 for unsuccessful authentication" do
+      get :show, :id => 'potato'
+      response.should_not be_success
+      response.status.should =~ /401/
+    end
+    
+    context "using HMAC authentication" do
+      subject { Factory(:partner) }
+      
+      before do
+        subject.stubs(:api_key).returns('daad465deb7718a5d0db99345be41e3a1ea0de6d')
+         Partner.stubs(:find_by_slug).returns(subject)
+         Partner.stubs(:find_by_api_key).returns(subject)
+         Time.stubs(:now).returns(Time.parse("2010-05-10 16:30:00 EDT"))
+         {'X-Referer-Method' => 'GET', 'X-Referer-Date' => [Time.now.httpdate], 'X-Referer-Authorization' => ['AuthHMAC cherry tree cutters:GurpT6GfwItXF3Co4Ut1a3I+3iI='], 'Referer' => 'http://example.org/api/some_controller/some_action'}.each_pair do |e,value|
+           request.env[e] = value
+        end
+      end
+      
+      it "should return 200 with valid HMAC credentials" do
+        get :show, :id => 'hmac'
+        response.should be_success
+      end
+    
+      it "should return 401 with invalid HMAC credentials" do
+        request.env['X-Referer-Authorization'] = ['AuthHMAC foo:bar']
+        get :show, :id => 'hmac'
+        response.should_not be_success
+        response.status.should =~ /401/
+      end
+    end
+    
+    it "should increment current_request_count for this partner after successful auth" do
+      count = subject.current_request_count
+      get :show, :id => subject.api_key
+      subject.current_request_count.should == count+1
+    end
+    
+    it "should return 420 once max_requests has been reached" do
+      # 420 is the code the Twitter rate limiting API uses
+      subject.requests_remaining.times do
+        subject.increment_request_count
+      end
+      get :show, :id => subject.api_key
+      response.should_not be_success
+      response.status.should =~ /420/
+    end
+    
+    it "should include an error message in the body when rate limited" do
+      subject.requests_remaining.times do
+        subject.increment_request_count
+      end
+      get :show, :id => subject.api_key
+      response.body.should =~ /Too many requests/
+    end
+    
+    it "should return Cache-Control header after successful auth" do
+      get :show, :id => subject.api_key
+      expected_cc_header = ['public', 'no-cache']
+      response.headers['Cache-Control'].split(/,\s*/).sort.should eql(expected_cc_header.sort)
+    end
+    
+    it "should return Twitter-style rate limit headers after successful auth" do
+      # these headers are documented here: http://apiwiki.twitter.com/Rate-limiting
+      get :show, :id => subject.api_key
+      expected_rl_headers = {
+        'X-RateLimit-Limit' => subject.max_requests,
+        'X-RateLimit-Remaining' => subject.requests_remaining,
+        'X-RateLimit-Reset' => subject.max_requests_reset_time,
+      }
+      rl_headers_received = Hash.new
+      expected_rl_headers.keys.map { |header|
+        rl_headers_received[header] = @response.headers[header].to_i
+      }
+      rl_headers_received.should eql(expected_rl_headers)
+    end
+
+  end
+
+  context "with a partner that has no max requests" do
+    subject { Factory(:partner, :max_requests => nil) }
+
+    it "should allow access" do
+      get :show, :id => subject.api_key
+      response.should be_success
+    end
+    
+    it "should not return rate limit headers after successful auth" do
+      get :show, :id => subject.api_key
+      response.headers.each_key do |header|
+        header.should_not =~ /^X-RateLimit-/
+      end
+    end
+    
+    it "should return Cache-Control header after successful auth" do
+      get :show, :id => subject.api_key
+      expected_cc_header = ['public', "max-age=#{subject.max_response_cache_time}", 'must-revalidate']
+      response.headers['Cache-Control'].split(/,\s*/).sort.should eql(expected_cc_header.sort)
+    end
+    
+  end
+end

data/spec/controllers/confirmation_controller_spec.rb

@@ -0,0 +1,36 @@
+require 'spec_helper'
+
+describe ConfirmationController do
+
+  context "Update" do
+    let(:partner) { Factory.build(:partner, :confirmed => false) }
+    let(:perishable_token) { "1234" }
+    
+    before do
+      partner.stubs(:save).returns(true)
+      Partner.stubs(:find_by_perishable_token!).returns(partner)
+      PartnerSession.stubs(:create)
+    end
+    
+    it "should redirect to /" do
+      get :update, :perishable_token => perishable_token
+      response.should redirect_to(root_path)
+    end
+    
+    it "should confirm the partner" do
+      partner.expects :save
+      get :update, :perishable_token => perishable_token
+      partner.should be_confirmed
+    end
+    
+    it "should find by the perishable token" do
+      Partner.expects(:find_by_perishable_token!).with(perishable_token).returns(partner)
+      get :update, :perishable_token => perishable_token
+    end
+    
+    it "should log the partner in" do
+      PartnerSession.expects(:create).with(partner)
+      get :update, :perishable_token => perishable_token
+    end
+  end
+end

data/spec/controllers/fetch_password_controller_spec.rb

@@ -0,0 +1,155 @@
+require 'spec_helper'
+
+describe FetchPasswordController do
+  include HelperMethods
+  
+  context "Index" do
+    let(:partner) { Partner.new }
+    
+    before do
+      Partner.stubs(:new).returns(partner)
+    end
+    
+    it "should respond with successful status" do
+      get :index
+      should respond_with :success
+    end
+    
+    it "should create a new instance of Partner" do
+      Partner.expects(:new)
+      get :index
+    end
+  end
+  
+  context "Show" do
+    let(:partner) { Factory.build(:partner) }
+    let(:partner_session) { PartnerSession.new }
+    let(:perishable_token) { "1234" }
+    
+    before do
+      Partner.stubs(:find_by_perishable_token!).returns(partner)
+    end
+    
+    context "Authenticates" do
+      before do
+        partner_session.stubs(:save).returns(true)
+        PartnerSession.stubs(:new).returns(partner_session)
+        get :show, :id => perishable_token
+      end
+      
+      it { should respond_with :success }
+    end
+    
+    context "Does not authenticate" do
+      before do
+        partner_session.stubs(:save).returns(false)
+        PartnerSession.stubs(:new).returns(partner_session)
+        get :show, :id => perishable_token
+      end
+      
+      its(:response) { should redirect_to fetch_password_index_path }
+    end
+  end
+  
+  context "Create" do
+    context "Valid" do
+      let(:partner) { Factory.build(:partner) }
+      
+      before do
+        Partner.stubs(:find_by_email).returns(partner)
+        PartnerMailer.stubs(:deliver_fetch_password)
+      end
+      
+      it "should redirect to /" do
+        post :create, :partner => { :email => partner.email }
+        response.should redirect_to root_path
+      end
+      
+      it "should find a partner by the email" do
+        Partner.expects(:find_by_email).with(partner.email)
+        post :create, :partner => { :email => partner.email }
+      end
+      
+      it "should deliver an email to the partner" do
+        PartnerMailer.expects(:deliver_fetch_password).with(partner)
+        post :create, :partner => { :email => partner.email }
+      end
+    end
+  
+    context "Invalid" do
+      let(:partner) { Partner.new(:email => "bademail@test.com") }
+      
+      before do
+        Partner.stubs(:find_by_email)
+        PartnerMailer.stubs(:deliver_fetch_password)
+      end
+      
+      it "should render in the index template" do
+        post :create, :partner => { :email => partner.email }
+        response.should render_template(:index)
+      end
+      
+      it "should assign a new instance of Partner to partner" do
+        post :create, :partner => { :email => partner.email }
+        assigns(:partner).should be_new_record
+      end
+      
+      it "should try to find a partner by the email" do
+        Partner.expects(:find_by_email).with(partner.email)
+        post :create, :partner => { :email => partner.email }
+      end
+      
+      it "should not deliver an email" do
+        PartnerMailer.expects(:deliver_fetch_password).never
+        post :create, :partner => { :email => partner.email }
+      end
+    end
+  end
+
+  context "Update" do
+    before do
+      stubbed_session_for(:partner)
+    end
+    
+    context "Valid" do
+      let(:password) { "goodpassword" }
+      let(:partner) { @partner }
+      
+      before do
+        partner.stubs(:save).returns(true)
+        FetchPasswordController.any_instance.stubs(:current_partner).returns(partner)
+      end
+      
+      it "should redirect to /" do
+        put :update, :partner => { :password => password, :password_confirmation => password }
+        response.should redirect_to root_path
+      end
+      
+      it "should attempt to save the record " do
+        partner.expects(:save)
+        put :update, :partner => { :password => password, :password_confirmation => password }
+      end
+    end
+    
+    context "Invalid" do
+      let(:password) { "badpassword" }
+      let(:partner) { @partner }
+      
+      before do
+        partner.stubs(:save).returns(false)
+        FetchPasswordController.any_instance.stubs(:current_partner).returns(partner)
+      end
+      
+      it "should render the show template" do
+        put :update, :partner => { :password => password }
+        response.should render_template :show
+      end
+      
+      it "should attempt to save the record " do
+        partner.expects(:save)
+        put :update, :partner => { :password => password }
+      end
+    end
+  end
+
+end