rubygems-update 3.3.18 → 3.4.19

data/test/rubygems/test_gem_gemcutter_utilities.rb

@@ -1,29 +1,32 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems'
-require 'rubygems/command'
-require 'rubygems/gemcutter_utilities'
+
+require_relative "helper"
+require_relative "multifactor_auth_utilities"
+require "rubygems"
+require "rubygems/command"
+require "rubygems/gemcutter_utilities"
 
 class TestGemGemcutterUtilities < Gem::TestCase
   def setup
     super
 
     credential_setup
+    @fetcher = SignInFetcher.new
 
     # below needed for random testing, class property
     Gem.configuration.disable_default_gem_server = nil
 
-    ENV['RUBYGEMS_HOST'] = nil
-    ENV['GEM_HOST_OTP_CODE'] = nil
+    ENV["RUBYGEMS_HOST"] = nil
+    ENV["GEM_HOST_OTP_CODE"] = nil
     Gem.configuration.rubygems_api_key = nil
 
-    @cmd = Gem::Command.new '', 'summary'
+    @cmd = Gem::Command.new "", "summary"
     @cmd.extend Gem::GemcutterUtilities
   end
 
   def teardown
-    ENV['RUBYGEMS_HOST'] = nil
-    ENV['GEM_HOST_OTP_CODE'] = nil
+    ENV["RUBYGEMS_HOST"] = nil
+    ENV["GEM_HOST_OTP_CODE"] = nil
     Gem.configuration.rubygems_api_key = nil
 
     credential_teardown
@@ -33,11 +36,11 @@ class TestGemGemcutterUtilities < Gem::TestCase
 
   def test_alternate_key_alternate_host
     keys = {
-      :rubygems_api_key => 'KEY',
+      :rubygems_api_key => "KEY",
       "http://rubygems.engineyard.com" => "EYKEY",
     }
 
-    File.open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, "w" do |f|
       f.write keys.to_yaml
     end
 
@@ -45,25 +48,25 @@ class TestGemGemcutterUtilities < Gem::TestCase
 
     Gem.configuration.load_api_keys
 
-    assert_equal 'EYKEY', @cmd.api_key
+    assert_equal "EYKEY", @cmd.api_key
   end
 
   def test_api_key
-    keys = { :rubygems_api_key => 'KEY' }
+    keys = { :rubygems_api_key => "KEY" }
 
-    File.open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, "w" do |f|
       f.write keys.to_yaml
     end
 
     Gem.configuration.load_api_keys
 
-    assert_equal 'KEY', @cmd.api_key
+    assert_equal "KEY", @cmd.api_key
   end
 
   def test_api_key_override
-    keys = { :rubygems_api_key => 'KEY', :other => 'OTHER' }
+    keys = { :rubygems_api_key => "KEY", :other => "OTHER" }
 
-    File.open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, "w" do |f|
       f.write keys.to_yaml
     end
 
@@ -72,41 +75,39 @@ class TestGemGemcutterUtilities < Gem::TestCase
     @cmd.add_key_option
     @cmd.handle_options %w[--key other]
 
-    assert_equal 'OTHER', @cmd.api_key
+    assert_equal "OTHER", @cmd.api_key
   end
 
   def test_host
-    assert_equal 'https://rubygems.org', @cmd.host
+    assert_equal "https://rubygems.org", @cmd.host
   end
 
   def test_host_RUBYGEMS_HOST
-    ENV['RUBYGEMS_HOST'] = 'https://other.example'
+    ENV["RUBYGEMS_HOST"] = "https://other.example"
 
-    assert_equal 'https://other.example', @cmd.host
+    assert_equal "https://other.example", @cmd.host
   end
 
   def test_host_RUBYGEMS_HOST_empty
-    ENV['RUBYGEMS_HOST'] = ''
+    ENV["RUBYGEMS_HOST"] = ""
 
-    assert_equal 'https://rubygems.org', @cmd.host
+    assert_equal "https://rubygems.org", @cmd.host
   end
 
   def test_sign_in
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    util_sign_in [api_key, 200, 'OK']
+    util_sign_in
 
     assert_match %r{Enter your RubyGems.org credentials.}, @sign_in_ui.output
     assert @fetcher.last_request["authorization"]
     assert_match %r{Signed in.}, @sign_in_ui.output
 
     credentials = load_yaml_file Gem.configuration.credentials_path
-    assert_equal api_key, credentials[:rubygems_api_key]
+    assert_equal @fetcher.api_key, credentials[:rubygems_api_key]
   end
 
   def test_sign_in_with_host
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-
-    util_sign_in [api_key, 200, 'OK'], 'http://example.com', ['http://example.com']
+    @fetcher = SignInFetcher.new(host: "http://example.com")
+    util_sign_in
 
     assert_match "Enter your http://example.com credentials.",
                  @sign_in_ui.output
@@ -114,13 +115,12 @@ class TestGemGemcutterUtilities < Gem::TestCase
     assert_match %r{Signed in.}, @sign_in_ui.output
 
     credentials = load_yaml_file Gem.configuration.credentials_path
-    assert_equal api_key, credentials['http://example.com']
+    assert_equal @fetcher.api_key, credentials["http://example.com"]
   end
 
   def test_sign_in_with_host_nil
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-
-    util_sign_in [api_key, 200, 'OK'], nil, [nil]
+    @fetcher = SignInFetcher.new(host: nil)
+    util_sign_in(args: [nil])
 
     assert_match "Enter your RubyGems.org credentials.",
                  @sign_in_ui.output
@@ -128,12 +128,12 @@ class TestGemGemcutterUtilities < Gem::TestCase
     assert_match %r{Signed in.}, @sign_in_ui.output
 
     credentials = load_yaml_file Gem.configuration.credentials_path
-    assert_equal api_key, credentials[:rubygems_api_key]
+    assert_equal @fetcher.api_key, credentials[:rubygems_api_key]
   end
 
   def test_sign_in_with_host_ENV
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    util_sign_in [api_key, 200, 'OK'], 'http://example.com'
+    @fetcher = SignInFetcher.new(host: "http://example.com")
+    util_sign_in
 
     assert_match "Enter your http://example.com credentials.",
                  @sign_in_ui.output
@@ -141,47 +141,45 @@ class TestGemGemcutterUtilities < Gem::TestCase
     assert_match %r{Signed in.}, @sign_in_ui.output
 
     credentials = load_yaml_file Gem.configuration.credentials_path
-    assert_equal api_key, credentials['http://example.com']
+    assert_equal @fetcher.api_key, credentials["http://example.com"]
   end
 
   def test_sign_in_skips_with_existing_credentials
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    Gem.configuration.rubygems_api_key = api_key
+    Gem.configuration.rubygems_api_key = @fetcher.api_key
 
-    util_sign_in [api_key, 200, 'OK']
+    util_sign_in
 
     assert_equal "", @sign_in_ui.output
   end
 
   def test_sign_in_skips_with_key_override
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    Gem.configuration.api_keys[:KEY] = 'other'
+    Gem.configuration.api_keys[:KEY] = "other"
     @cmd.options[:key] = :KEY
-    util_sign_in [api_key, 200, 'OK']
+    util_sign_in
 
     assert_equal "", @sign_in_ui.output
   end
 
   def test_sign_in_with_other_credentials_doesnt_overwrite_other_keys
-    api_key       = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    other_api_key = 'f46dbb18bb6a9c97cdc61b5b85c186a17403cdcbf'
+    other_api_key = "f46dbb18bb6a9c97cdc61b5b85c186a17403cdcbf"
 
-    File.open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, "w" do |f|
       f.write Hash[:other_api_key, other_api_key].to_yaml
     end
-    util_sign_in [api_key, 200, 'OK']
+    util_sign_in
 
     assert_match %r{Enter your RubyGems.org credentials.}, @sign_in_ui.output
     assert_match %r{Signed in.}, @sign_in_ui.output
 
     credentials = load_yaml_file Gem.configuration.credentials_path
-    assert_equal api_key, credentials[:rubygems_api_key]
+    assert_equal @fetcher.api_key, credentials[:rubygems_api_key]
     assert_equal other_api_key, credentials[:other_api_key]
   end
 
   def test_sign_in_with_bad_credentials
+    @fetcher.respond_with_forbidden_api_key_response
     assert_raise Gem::MockGemUi::TermError do
-      util_sign_in ['Access Denied.', 403, 'Forbidden']
+      util_sign_in
     end
 
     assert_match %r{Enter your RubyGems.org credentials.}, @sign_in_ui.output
@@ -189,57 +187,120 @@ class TestGemGemcutterUtilities < Gem::TestCase
   end
 
   def test_signin_with_env_otp_code
-    ENV['GEM_HOST_OTP_CODE'] = '111111'
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
+    ENV["GEM_HOST_OTP_CODE"] = "111111"
 
-    util_sign_in [api_key, 200, 'OK']
+    util_sign_in
 
-    assert_match 'Signed in with API key:', @sign_in_ui.output
-    assert_equal '111111', @fetcher.last_request['OTP']
+    assert_match "Signed in with API key:", @sign_in_ui.output
+    assert_equal "111111", @fetcher.last_request["OTP"]
   end
 
   def test_sign_in_with_correct_otp_code
-    api_key       = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
-
-    util_sign_in(proc do
-      @call_count ||= 0
-      (@call_count += 1).odd? ? [response_fail, 401, 'Unauthorized'] : [api_key, 200, 'OK']
-    end, nil, [], "111111\n")
-
-    assert_match 'You have enabled multi-factor authentication. Please enter OTP code.', @sign_in_ui.output
-    assert_match 'Code: ', @sign_in_ui.output
-    assert_match 'Signed in with API key:', @sign_in_ui.output
-    assert_equal '111111', @fetcher.last_request['OTP']
+    @fetcher.respond_with_require_otp
+    util_sign_in(extra_input: "111111\n")
+
+    assert_match "You have enabled multi-factor authentication. Please enter OTP code.", @sign_in_ui.output
+    assert_match "Code: ", @sign_in_ui.output
+    assert_match "Signed in with API key:", @sign_in_ui.output
+    assert_equal "111111", @fetcher.last_request["OTP"]
   end
 
   def test_sign_in_with_incorrect_otp_code
     response = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
 
+    @fetcher.respond_with_unauthorized_api_key_response
     assert_raise Gem::MockGemUi::TermError do
-      util_sign_in [response, 401, 'Unauthorized'], nil, [], "111111\n"
+      util_sign_in(extra_input: "111111\n")
     end
 
-    assert_match 'You have enabled multi-factor authentication. Please enter OTP code.', @sign_in_ui.output
-    assert_match 'Code: ', @sign_in_ui.output
+    assert_match "You have enabled multi-factor authentication. Please enter OTP code.", @sign_in_ui.output
+    assert_match "Code: ", @sign_in_ui.output
     assert_match response, @sign_in_ui.output
-    assert_equal '111111', @fetcher.last_request['OTP']
+    assert_equal "111111", @fetcher.last_request["OTP"]
+  end
+
+  def test_sign_in_with_webauthn_enabled
+    server = Gem::MockTCPServer.new
+
+    @fetcher.respond_with_require_otp
+    @fetcher.respond_with_webauthn_url
+    TCPServer.stub(:new, server) do
+      Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:otp] = "Uvh6T57tkWuUnWYo" }) do
+        util_sign_in
+      end
+    end
+
+    assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output
+    assert_match "You are verified with a security device. You may close the browser window.", @sign_in_ui.output
+    assert_equal "Uvh6T57tkWuUnWYo", @fetcher.last_request["OTP"]
+  end
+
+  def test_sign_in_with_webauthn_enabled_with_error
+    server = Gem::MockTCPServer.new
+    error = Gem::WebauthnVerificationError.new("Something went wrong")
+
+    @fetcher.respond_with_require_otp
+    @fetcher.respond_with_webauthn_url
+    error = assert_raise Gem::MockGemUi::TermError do
+      TCPServer.stub(:new, server) do
+        Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:error] = error }) do
+          util_sign_in
+        end
+      end
+    end
+    assert_equal 1, error.exit_code
+
+    assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output
+    assert_match "ERROR:  Security device verification failed: Something went wrong", @sign_in_ui.error
+    refute_match "You are verified with a security device. You may close the browser window.", @sign_in_ui.output
+    refute_match "Signed in with API key:", @sign_in_ui.output
   end
 
-  def util_sign_in(response, host = nil, args = [], extra_input = '')
-    email            = 'you@example.com'
-    password         = 'secret'
-    profile_response = [ "mfa: disabled\n" , 200, 'OK']
+  def test_sign_in_with_webauthn_enabled_with_polling
+    server = Gem::MockTCPServer.new
+    @fetcher.respond_with_require_otp
+    @fetcher.respond_with_webauthn_url
+    @fetcher.respond_with_webauthn_polling("Uvh6T57tkWuUnWYo")
 
-    if host
-      ENV['RUBYGEMS_HOST'] = host
-    else
-      host = Gem.host
+    TCPServer.stub(:new, server) do
+      util_sign_in
     end
 
-    @fetcher = Gem::FakeFetcher.new
-    @fetcher.data["#{host}/api/v1/api_key"] = response
-    @fetcher.data["#{host}/api/v1/profile/me.yaml"] = profile_response
+    assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output
+    assert_match "You are verified with a security device. You may close the browser window.", @sign_in_ui.output
+    assert_equal "Uvh6T57tkWuUnWYo", @fetcher.last_request["OTP"]
+  end
+
+  def test_sign_in_with_webauthn_enabled_with_polling_failure
+    server = Gem::MockTCPServer.new
+    @fetcher.respond_with_require_otp
+    @fetcher.respond_with_webauthn_url
+    @fetcher.respond_with_webauthn_polling_failure
+
+    assert_raise Gem::MockGemUi::TermError do
+      TCPServer.stub(:new, server) do
+        util_sign_in
+      end
+    end
+
+    assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output
+    assert_match "ERROR:  Security device verification failed: " \
+      "The token in the link you used has either expired or been used already.", @sign_in_ui.error
+  end
+
+  def util_sign_in(args: [], extra_input: "")
+    email             = "you@example.com"
+    password          = "secret"
+
+    ENV["RUBYGEMS_HOST"] = @fetcher.host
     Gem::RemoteFetcher.fetcher = @fetcher
 
     @sign_in_ui = Gem::MockGemUi.new("#{email}\n#{password}\n\n\n\n\n\n\n\n\n" + extra_input)
@@ -254,13 +315,13 @@ class TestGemGemcutterUtilities < Gem::TestCase
   end
 
   def test_verify_api_key
-    keys = { :other => 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903' }
-    File.open Gem.configuration.credentials_path, 'w' do |f|
+    keys = { :other => "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" }
+    File.open Gem.configuration.credentials_path, "w" do |f|
       f.write keys.to_yaml
     end
     Gem.configuration.load_api_keys
 
-    assert_equal 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903',
+    assert_equal "a5fdbb6ba150cbb83aad2bb2fede64cf040453903",
                  @cmd.verify_api_key(:other)
   end
 
@@ -269,4 +330,29 @@ class TestGemGemcutterUtilities < Gem::TestCase
       @cmd.verify_api_key :missing
     end
   end
+
+  class SignInFetcher < Gem::MultifactorAuthFetcher
+    attr_reader :api_key
+
+    def initialize(host: nil)
+      super(host: host)
+      @api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903"
+      @data["#{@host}/api/v1/api_key"] = Gem::HTTPResponseFactory.create(body: @api_key, code: 200, msg: "OK")
+      @data["#{@host}/api/v1/profile/me.yaml"] = Gem::HTTPResponseFactory.create(body: "mfa: disabled\n", code: 200, msg: "OK")
+    end
+
+    def respond_with_require_otp
+      super("#{host}/api/v1/api_key", @api_key)
+    end
+
+    def respond_with_forbidden_api_key_response
+      @data["#{host}/api/v1/api_key"] = Gem::HTTPResponseFactory.create(body: "Access Denied.", code: 403, msg: "Forbidden")
+    end
+
+    def respond_with_unauthorized_api_key_response
+      response = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
+
+      @data["#{host}/api/v1/api_key"] = Gem::HTTPResponseFactory.create(body: response, code: 401, msg: "Unauthorized")
+    end
+  end
 end

data/test/rubygems/test_gem_impossible_dependencies_error.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
-require_relative 'helper'
+
+require_relative "helper"
 
 class TestGemImpossibleDependenciesError < Gem::TestCase
   def test_message_conflict
-    request = dependency_request dep('net-ssh', '>= 2.0.13'), 'rye', '0.9.8'
+    request = dependency_request dep("net-ssh", ">= 2.0.13"), "rye", "0.9.8"
 
     conflicts = []
 
@@ -11,9 +12,9 @@ class TestGemImpossibleDependenciesError < Gem::TestCase
     # requested-by entries, but they are suitable for testing the message.
     # See #485 to construct a correct conflict.
     net_ssh_2_2_2 =
-      dependency_request dep('net-ssh', '>= 2.6.5'), 'net-ssh', '2.2.2', request
+      dependency_request dep("net-ssh", ">= 2.6.5"), "net-ssh", "2.2.2", request
     net_ssh_2_6_5 =
-      dependency_request dep('net-ssh', '~> 2.2.2'), 'net-ssh', '2.6.5', request
+      dependency_request dep("net-ssh", "~> 2.2.2"), "net-ssh", "2.6.5", request
 
     conflict1 = Gem::Resolver::Conflict.new \
       net_ssh_2_6_5, net_ssh_2_6_5.requester