rubygems-update 3.4.17 → 3.4.18

data/test/rubygems/multifactor_auth_utilities.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+##
+# A MultifactorAuthFetcher is a FakeFetcher that adds paths to data for requests related to
+# multi-factor authentication.
+#
+
+require_relative "utilities"
+require "json"
+
+class Gem::MultifactorAuthFetcher < Gem::FakeFetcher
+  attr_reader :host, :webauthn_url
+
+  # GET /api/v1/webauthn_verification defaults to user does not have any security devices
+  def initialize(host: nil)
+    super()
+    @host = host || Gem.host
+    @path_token = "odow34b93t6aPCdY"
+    @webauthn_url = "#{@host}/webauthn_verification/#{@path_token}"
+    @data["#{@host}/api/v1/webauthn_verification"] = Gem::HTTPResponseFactory.create(
+      body: "You don't have any security devices",
+      code: 422,
+      msg: "Unprocessable Entity"
+    )
+  end
+
+  # given a url, return a response that requires multifactor authentication
+  def respond_with_require_otp(url, success_body)
+    response_fail = "You have enabled multifactor authentication"
+
+    @data[url] = proc do
+      @call_count ||= 0
+      if (@call_count += 1).odd?
+        Gem::HTTPResponseFactory.create(body: response_fail, code: 401, msg: "Unauthorized")
+      else
+        Gem::HTTPResponseFactory.create(body: success_body, code: 200, msg: "OK")
+      end
+    end
+  end
+
+  # GET /api/v1/webauthn_verification returns a webauthn url
+  # GET /api/v1/webauthn_verification/:token/status.json (polling url) returns pending status
+  def respond_with_webauthn_url
+    @data["#{@host}/api/v1/webauthn_verification"] = Gem::HTTPResponseFactory.create(body: @webauthn_url, code: 200, msg: "OK")
+    @data["#{@host}/api/v1/webauthn_verification/#{@path_token}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: { status: "pending", message: "Security device authentication is still pending." }.to_json,
+      code: 200,
+      msg: "OK"
+    )
+  end
+
+  # GET /api/v1/webauthn_verification/:token/status.json returns success status with OTP code
+  def respond_with_webauthn_polling(code)
+    @data["#{@host}/api/v1/webauthn_verification/#{@path_token}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: { status: "success", code: code }.to_json,
+      code: 200,
+      msg: "OK"
+    )
+  end
+
+  # GET /api/v1/webauthn_verification/:token/status.json returns expired status
+  def respond_with_webauthn_polling_failure
+    @data["#{@host}/api/v1/webauthn_verification/#{@path_token}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: {
+        status: "expired",
+        message: "The token in the link you used has either expired or been used already.",
+      }.to_json,
+      code: 200,
+      msg: "OK"
+    )
+  end
+
+  def webauthn_url_with_port(port)
+    "#{@webauthn_url}?port=#{port}"
+  end
+end
+
+##
+# The MockTCPServer for use in tests or to avoid real TCPServer instances to be created
+# when testing code related to the WebAuthn listener.
+#
+# Example:
+#
+#   server = Gem::MockTCPServer
+#   port = server.addr[1].to_s
+#
+#   # this mocks waiting for a request by calling sleep
+#   server.accept
+#
+#   # this mocks the server closing
+#   server.close
+
+class Gem::MockTCPServer
+  attr_reader :port
+
+  def initialize(port = 5678)
+    @port = port
+  end
+
+  def close
+    true
+  end
+
+  def addr
+    ["AF_INET6", @port, "::", "::"]
+  end
+
+  def accept
+    sleep
+  end
+end

data/test/rubygems/package/tar_test_case.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../helper"
 require "rubygems/package"
 

data/test/rubygems/plugin/exception/rubygems_plugin.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
+
 TestGem::TEST_PLUGIN_EXCEPTION = :loaded
 raise Exception.new("boom")

data/test/rubygems/plugin/load/rubygems_plugin.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class TestGem
   TEST_PLUGIN_LOAD = :loaded
 end

data/test/rubygems/plugin/standarderror/rubygems_plugin.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
+
 TestGem::TEST_PLUGIN_STANDARDERROR = :loaded
 raise StandardError.new("boom")

data/test/rubygems/rubygems/commands/crash_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class Gem::Commands::CrashCommand < Gem::Command
   raise "crash"
 end

data/test/rubygems/rubygems_plugin.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "rubygems/command_manager"
 
 ##

data/test/rubygems/simple_gem.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 SIMPLE_GEM = <<-GEMDATA
         MD5SUM = "989bf34a1cbecd52e0ea66b662b3a405"
         if $0 == __FILE__

data/test/rubygems/specifications/bar-0.0.2.gemspec

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Gem::Specification.new do |s|
   s.name          = "bar"
   s.version       = "0.0.2"

data/test/rubygems/specifications/rubyforge-0.0.1.gemspec

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Gem::Specification.new do |s|
   s.name              = "rubyforge"
   s.version           = "0.0.1"

data/test/rubygems/test_bundled_ca.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "net/http"
 require "rubygems/openssl"

data/test/rubygems/test_config.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems"
 require "shellwords"

data/test/rubygems/test_deprecate.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/deprecate"
 

data/test/rubygems/test_gem.rb

@@ -1,4 +1,5 @@
 # coding: US-ASCII
+
 require_relative "helper"
 require "rubygems"
 require "rubygems/command"

data/test/rubygems/test_gem_available_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/available_set"
 require "rubygems/security"

data/test/rubygems/test_gem_bundler_version_finder.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/bundler_version_finder"
 

data/test/rubygems/test_gem_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/command"
 

data/test/rubygems/test_gem_command_manager.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/command_manager"
 

data/test/rubygems/test_gem_commands_build_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/build_command"
 require "rubygems/package"

data/test/rubygems/test_gem_commands_cert_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/cert_command"
 

data/test/rubygems/test_gem_commands_check_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/check_command"
 

data/test/rubygems/test_gem_commands_cleanup_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/cleanup_command"
 require "rubygems/installer"

data/test/rubygems/test_gem_commands_contents_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/contents_command"
 

data/test/rubygems/test_gem_commands_dependency_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/dependency_command"
 

data/test/rubygems/test_gem_commands_environment_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/environment_command"
 

data/test/rubygems/test_gem_commands_exec_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/exec_command"
 
@@ -215,6 +216,7 @@ class TestGemCommandsExecCommand < Gem::TestCase
 
   def test_gem_with_platform_and_platform_dependencies
     pend "extensions don't quite work on jruby" if Gem.java_platform?
+    pend "terminates on mswin" if vc_windows? && ruby_repo?
 
     spec_fetcher do |fetcher|
       fetcher.download "a", 2 do |s|

data/test/rubygems/test_gem_commands_fetch_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/package"
 require "rubygems/security"

data/test/rubygems/test_gem_commands_generate_index_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/indexer"
 require "rubygems/commands/generate_index_command"

data/test/rubygems/test_gem_commands_help_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "rubygems"
 require_relative "helper"
 require "rubygems/commands/help_command"

data/test/rubygems/test_gem_commands_info_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/info_command"
 

data/test/rubygems/test_gem_commands_install_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require_relative "test_gem_update_suggestion"
 require "rubygems/commands/install_command"

data/test/rubygems/test_gem_commands_list_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/list_command"
 

data/test/rubygems/test_gem_commands_lock_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/lock_command"
 

data/test/rubygems/test_gem_commands_mirror.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/mirror_command"
 

data/test/rubygems/test_gem_commands_open_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/open_command"
 

data/test/rubygems/test_gem_commands_outdated_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/outdated_command"
 

data/test/rubygems/test_gem_commands_owner_command.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
+
 require_relative "helper"
+require_relative "multifactor_auth_utilities"
 require "rubygems/commands/owner_command"
 
 class TestGemCommandsOwnerCommand < Gem::TestCase
@@ -10,7 +12,7 @@ class TestGemCommandsOwnerCommand < Gem::TestCase
 
     ENV["RUBYGEMS_HOST"] = nil
     @stub_ui = Gem::MockGemUi.new
-    @stub_fetcher = Gem::FakeFetcher.new
+    @stub_fetcher = Gem::MultifactorAuthFetcher.new
     Gem::RemoteFetcher.fetcher = @stub_fetcher
     Gem.configuration = nil
     Gem.configuration.rubygems_api_key = "ed244fbf2b1a52e012da8616c512fa47f9aa5250"
@@ -323,15 +325,8 @@ EOF
   end
 
   def test_otp_verified_success
-    response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
     response_success = "Owner added successfully."
-
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
-      HTTPResponseFactory.create(body: response_fail, code: 401, msg: "Unauthorized"),
-      HTTPResponseFactory.create(body: response_success, code: 200, msg: "OK"),
-    ]
-    @stub_fetcher.data["#{Gem.host}/api/v1/webauthn_verification"] =
-      HTTPResponseFactory.create(body: "You don't have any security devices", code: 422, msg: "Unprocessable Entity")
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
 
     @otp_ui = Gem::MockGemUi.new "111111\n"
     use_ui @otp_ui do
@@ -362,68 +357,102 @@ EOF
   end
 
   def test_with_webauthn_enabled_success
-    webauthn_verification_url = "rubygems.org/api/v1/webauthn_verification/odow34b93t6aPCdY"
-    response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
     response_success = "Owner added successfully."
-    port = 5678
-    server = TCPServer.new(port)
+    server = Gem::MockTCPServer.new
 
-    @stub_fetcher.data["#{Gem.host}/api/v1/webauthn_verification"] = HTTPResponseFactory.create(body: webauthn_verification_url, code: 200, msg: "OK")
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
-      HTTPResponseFactory.create(body: response_fail, code: 401, msg: "Unauthorized"),
-      HTTPResponseFactory.create(body: response_success, code: 200, msg: "OK"),
-    ]
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
+    @stub_fetcher.respond_with_webauthn_url
 
     TCPServer.stub(:new, server) do
-      Gem::WebauthnListener.stub(:wait_for_otp_code, "Uvh6T57tkWuUnWYo") do
+      Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:otp] = "Uvh6T57tkWuUnWYo" }) do
         use_ui @stub_ui do
           @cmd.add_owners("freewill", ["user-new1@example.com"])
         end
       end
-    ensure
-      server.close
     end
 
-    url_with_port = "#{webauthn_verification_url}?port=#{port}"
-    assert_match "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output
     assert_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
     assert_equal "Uvh6T57tkWuUnWYo", @stub_fetcher.last_request["OTP"]
     assert_match response_success, @stub_ui.output
   end
 
   def test_with_webauthn_enabled_failure
-    webauthn_verification_url = "rubygems.org/api/v1/webauthn_verification/odow34b93t6aPCdY"
-    response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
     response_success = "Owner added successfully."
-    port = 5678
-    server = TCPServer.new(port)
-    raise_error = ->(*_args) { raise Gem::WebauthnVerificationError, "Something went wrong" }
+    server = Gem::MockTCPServer.new
+    error = Gem::WebauthnVerificationError.new("Something went wrong")
 
-    @stub_fetcher.data["#{Gem.host}/api/v1/webauthn_verification"] = HTTPResponseFactory.create(body: webauthn_verification_url, code: 200, msg: "OK")
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
-      HTTPResponseFactory.create(body: response_fail, code: 401, msg: "Unauthorized"),
-      HTTPResponseFactory.create(body: response_success, code: 200, msg: "OK"),
-    ]
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
+    @stub_fetcher.respond_with_webauthn_url
 
     TCPServer.stub(:new, server) do
-      Gem::WebauthnListener.stub(:wait_for_otp_code, raise_error) do
+      Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:error] = error }) do
         use_ui @stub_ui do
           @cmd.add_owners("freewill", ["user-new1@example.com"])
         end
       end
-    ensure
-      server.close
     end
 
-    url_with_port = "#{webauthn_verification_url}?port=#{port}"
-
     assert_match @stub_fetcher.last_request["Authorization"], Gem.configuration.rubygems_api_key
-    assert_match "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output
     assert_match "ERROR:  Security device verification failed: Something went wrong", @stub_ui.error
     refute_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
     refute_match response_success, @stub_ui.output
   end
 
+  def test_with_webauthn_enabled_success_with_polling
+    response_success = "Owner added successfully."
+    server = Gem::MockTCPServer.new
+
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
+    @stub_fetcher.respond_with_webauthn_url
+    @stub_fetcher.respond_with_webauthn_polling("Uvh6T57tkWuUnWYo")
+
+    TCPServer.stub(:new, server) do
+      use_ui @stub_ui do
+        @cmd.add_owners("freewill", ["user-new1@example.com"])
+      end
+    end
+
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin " \
+      "command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
+    assert_equal "Uvh6T57tkWuUnWYo", @stub_fetcher.last_request["OTP"]
+    assert_match response_success, @stub_ui.output
+  end
+
+  def test_with_webauthn_enabled_failure_with_polling
+    response_success = "Owner added successfully."
+    server = Gem::MockTCPServer.new
+
+    @stub_fetcher.respond_with_require_otp(
+      "#{Gem.host}/api/v1/gems/freewill/owners",
+      response_success
+    )
+    @stub_fetcher.respond_with_webauthn_url
+    @stub_fetcher.respond_with_webauthn_polling_failure
+
+    TCPServer.stub(:new, server) do
+      use_ui @stub_ui do
+        @cmd.add_owners("freewill", ["user-new1@example.com"])
+      end
+    end
+
+    assert_match @stub_fetcher.last_request["Authorization"], Gem.configuration.rubygems_api_key
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin " \
+      "command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "ERROR:  Security device verification failed: The token in the link you used has either expired " \
+      "or been used already.", @stub_ui.error
+    refute_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
+    refute_match response_success, @stub_ui.output
+  end
+
   def test_remove_owners_unathorized_api_key
     response_forbidden = "The API key doesn't have access"
     response_success   = "Owner removed successfully."

data/test/rubygems/test_gem_commands_pristine_command.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/commands/pristine_command"