vines 0.1.1 → 0.2.0

data/lib/vines/stream/client.rb

@@ -24,20 +24,18 @@ module Vines
         end
       end
 
+      %w[max_stanza_size max_resources_per_account private_storage?].each do |name|
+        define_method name do |*args|
+          @config[:client].send(name, *args)
+        end
+      end
+
       def ssl_handshake_completed
         if get_peer_cert
           close_connection unless cert_domain_matches?(@session.domain)
         end
       end
 
-      def max_stanza_size
-        @config[:client].max_stanza_size
-      end
-
-      def max_resources_per_account
-        @config[:client].max_resources_per_account
-      end
-
       def unbind
         @session.unbind!(self)
         super

data/lib/vines/stream/http.rb

@@ -17,38 +17,40 @@ module Vines
           body = ''
           p.on_body = proc {|data| body << data }
           p.on_message_complete = proc {
-            process_request(body)
+            process_request(Request.new(self, @parser, body))
             body = ''
           }
         end
       end
 
-      # Return true if this session ID matches the stream's session ID. Clients
-      # are only allowed one session per stream so they must send the same
-      # session ID on each request.
+      # If the session ID is valid, switch this stream's session to the new
+      # ID and return true. Some clients, like Google Chrome, reuse one stream
+      # for multiple sessions.
       def valid_session?(sid)
-        @session.id == sid
-      end
-
-      def max_stanza_size
-        @config[:http].max_stanza_size
+        if session = Sessions[sid]
+          @session = session
+        end
+        !!session
       end
 
-      def max_resources_per_account
-        @config[:http].max_resources_per_account
+      %w[max_stanza_size max_resources_per_account private_storage? bind root].each do |name|
+        define_method name do |*args|
+          @config[:http].send(name, *args)
+        end
       end
 
-      def process_request(body)
-        # proxy server ping
-        if body.empty?
-          req = Request.new(self, nil, 'text/plain')
-          req.reply('online')
-          close_connection_after_writing
-        else
-          body = Nokogiri::XML(body).root
-          req = Request.new(self, body['rid'], @session.content_type)
-          @session.request(req)
+      def process_request(request)
+        if request.path == self.bind
+          body = Nokogiri::XML(request.body).root
+          if session = Sessions[body['sid']]
+            session.request(request)
+          else
+            @session = Http::Session.new(self)
+            @session.request(request)
+          end
           @nodes.push(body)
+        else
+          request.reply_with_file(self.root)
         end
       end
 

data/lib/vines/stream/http/auth.rb

@@ -9,7 +9,7 @@ module Vines
         end
 
         def node(node)
-          unless body?(node) && node['rid'] && stream.valid_session?(node['sid'])
+          unless stream.valid_session?(node['sid']) && body?(node) && node['rid']
             raise StreamErrors::NotAuthorized
           end
           nodes = stream.parse_body(node)

data/lib/vines/stream/http/bind.rb

@@ -11,7 +11,7 @@ module Vines
         end
 
         def node(node)
-          unless body?(node) && node['rid'] && stream.valid_session?(node['sid'])
+          unless stream.valid_session?(node['sid']) && body?(node) && node['rid']
             raise StreamErrors::NotAuthorized
           end
           nodes = stream.parse_body(node)

data/lib/vines/stream/http/bind_restart.rb

@@ -9,7 +9,7 @@ module Vines
         end
 
         def node(node)
-          raise StreamErrors::NotAuthorized unless body?(node) && restart?(node)
+          raise StreamErrors::NotAuthorized unless restart?(node)
 
           doc = Document.new
           body = doc.create_element('body') do |el|
@@ -26,9 +26,10 @@ module Vines
         private
 
         def restart?(node)
+          session = stream.valid_session?(node['sid'])
           restart = node.attribute_with_ns('restart', NAMESPACES[:bosh]).value rescue nil
-          domain = node['to'] == stream.domain
-          domain && restart == 'true' && node['rid'] && stream.valid_session?(node['sid'])
+          domain  = node['to'] == stream.domain
+          session && body?(node) && domain && restart == 'true' && node['rid']
         end
       end
     end

data/lib/vines/stream/http/ready.rb

@@ -7,7 +7,7 @@ module Vines
         RID, SID, TYPE, TERMINATE = %w[rid sid type terminate].map {|s| s.freeze }
 
         def node(node)
-          unless body?(node) && node[RID] && stream.valid_session?(node[SID])
+          unless stream.valid_session?(node[SID]) && body?(node) && node[RID]
             raise StreamErrors::NotAuthorized
           end
           stream.parse_body(node).each do |child|

data/lib/vines/stream/http/request.rb

@@ -4,10 +4,32 @@ module Vines
   class Stream
     class Http
       class Request
-        attr_reader :rid, :stream
+        BUF_SIZE      = 1024
+        MODIFIED      = '%a, %d %b %Y %H:%M:%S GMT'.freeze
+        NOT_FOUND     = 'Not Found'.freeze
+        NOT_MODIFIED  = 'Not Modified'.freeze
+        IF_MODIFIED   = 'If-Modified-Since'.freeze
+        TEXT_PLAIN    = 'text/plain'.freeze
+        CONTENT_TYPES = {
+          'html'     => 'text/html; charset="utf-8"',
+          'js'       => 'application/javascript; charset="utf-8"',
+          'css'      => 'text/css',
+          'png'      => 'image/png',
+          'jpg'      => 'image/jpeg',
+          'jpeg'     => 'image/jpeg',
+          'gif'      => 'image/gif',
+          'manifest' => 'text/cache-manifest'
+        }.freeze
 
-        def initialize(stream, rid, content_type)
-          @stream, @rid, @content = stream, rid, content_type
+        attr_reader :stream, :body, :headers, :method, :path, :url, :query
+
+        def initialize(stream, parser, body)
+          @stream, @body = stream, body
+          @headers  = parser.headers
+          @method   = parser.http_method
+          @path     = parser.request_path
+          @url      = parser.request_url
+          @query    = parser.query_string
           @received = Time.now
         end
 
@@ -16,17 +38,84 @@ module Vines
           Time.now - @received
         end
 
+        # Write the requested file to the client out of the given document root
+        # directory. Take care to prevent directory traversal attacks with paths
+        # like ../../../etc/passwd. Use the If-Modified-Since request header
+        # to implement caching.
+        def reply_with_file(dir)
+          path = File.expand_path(File.join(dir, @path))
+          path = File.join(path, 'index.html') if File.directory?(path)
+
+          if path.start_with?(dir) && File.exist?(path)
+            modified?(path) ? send_file(path) : send_status(304, NOT_MODIFIED)
+          else
+            missing = File.join(dir, '404.html')
+            if File.exist?(missing)
+              send_file(missing, 404, NOT_FOUND)
+            else
+              send_status(404, NOT_FOUND)
+            end
+          end
+        end
+
         # Send an HTTP 200 OK response wrapping the XMPP node content back
         # to the client.
-        def reply(node)
+        def reply(node, content_type)
           body = node.to_s
           header = [
             "HTTP/1.1 200 OK",
-            "Content-Type: #{@content}",
+            "Content-Type: #{content_type}",
             "Content-Length: #{body.bytesize}"
           ].join("\r\n")
           @stream.stream_write([header, body].join("\r\n\r\n"))
         end
+
+        private
+
+        # Return true if the file has been modified since the client last
+        # requested it with the If-Modified-Since header.
+        def modified?(path)
+          @headers[IF_MODIFIED] != mtime(path)
+        end
+
+        def mtime(path)
+          File.mtime(path).utc.strftime(MODIFIED)
+        end
+
+        def send_status(status, message)
+          header = [
+            "HTTP/1.1 #{status} #{message}",
+            "Connection: close"
+          ].join("\r\n")
+          @stream.stream_write("#{header}\r\n\r\n")
+          @stream.close_connection_after_writing
+        end
+
+        # Stream the contents of the file to the client in a 200 OK response.
+        # Send a Last-Modified response header so clients can send us an
+        # If-Modified-Since request header for caching.
+        def send_file(path, status=200, message='OK')
+          header = [
+            "HTTP/1.1 #{status} #{message}",
+            "Connection: close",
+            "Content-Type: #{content_type(path)}",
+            "Content-Length: #{File.size(path)}",
+            "Last-Modified: #{mtime(path)}"
+          ].join("\r\n")
+          @stream.stream_write("#{header}\r\n\r\n")
+
+          File.open(path) do |file|
+            while (buf = file.read(BUF_SIZE)) != nil
+              @stream.stream_write(buf)
+            end
+          end
+          @stream.close_connection_after_writing
+        end
+
+        def content_type(path)
+          ext = File.extname(path).sub('.', '')
+          CONTENT_TYPES[ext] || TEXT_PLAIN
+        end
       end
     end
   end

data/lib/vines/stream/http/session.rb

@@ -57,12 +57,12 @@ module Vines
 
         def request(request)
           if @responses.any?
-            request.reply(wrap_body(@responses.join))
+            request.reply(wrap_body(@responses.join), @content_type)
             @replied = Time.now
             @responses.clear
           else
             while @requests.size >= @hold
-              @requests.shift.reply(wrap_body(''))
+              @requests.shift.reply(wrap_body(''), @content_type)
               @replied = Time.now
             end
             @requests << request
@@ -72,8 +72,10 @@ module Vines
         # Send an HTTP 200 OK response wrapping the XMPP node content back
         # to the client.
         def reply(node)
-          @requests.shift.reply(node)
-          @replied = Time.now
+          if request = @requests.shift
+            request.reply(node, @content_type)
+            @replied = Time.now
+          end
         end
 
         # Write the XMPP node to the client stream after wrapping it in a BOSH
@@ -81,7 +83,7 @@ module Vines
         # immediately. If not, it's queued until the next request arrives.
         def write(node)
           if request = @requests.shift
-            request.reply(wrap_body(node))
+            request.reply(wrap_body(node), @content_type)
             @replied = Time.now
           else
             @responses << node.to_s
@@ -97,7 +99,7 @@ module Vines
         def respond_to_expired_requests
           expired = @requests.select {|req| req.age > @wait }
           expired.each do |request|
-            request.reply(wrap_body(''))
+            request.reply(wrap_body(''), @content_type)
             @requests.delete(request)
             @replied = Time.now
           end

data/lib/vines/version.rb

@@ -1,5 +1,5 @@
 # encoding: UTF-8
 
 module Vines
-  VERSION = '0.1.1'
+  VERSION = '0.2.0'
 end

data/test/config_test.rb

@@ -205,6 +205,7 @@ class ConfigTest < MiniTest::Unit::TestCase
     assert_equal 5222, port.port
     assert_equal 131_072, port.max_stanza_size
     assert_equal 5, port.max_resources_per_account
+    refute port.private_storage?
     assert_equal Vines::Stream::Client, port.stream
     assert_same config, port.config 
     assert_equal 1, config.ports.size
@@ -216,6 +217,7 @@ class ConfigTest < MiniTest::Unit::TestCase
         storage(:fs) { dir '.' }
       end
       client '0.0.0.1', 42 do
+        private_storage true
         max_stanza_size 60_000
         max_resources_per_account 1
       end
@@ -227,6 +229,7 @@ class ConfigTest < MiniTest::Unit::TestCase
     assert_equal 42, port.port
     assert_equal 60_000, port.max_stanza_size
     assert_equal 1, port.max_resources_per_account
+    assert port.private_storage?
     assert_equal Vines::Stream::Client, port.stream
     assert_same config, port.config 
     assert_equal 1, config.ports.size
@@ -301,6 +304,9 @@ class ConfigTest < MiniTest::Unit::TestCase
     assert_equal 5280, port.port
     assert_equal 131_072, port.max_stanza_size
     assert_equal 5, port.max_resources_per_account
+    assert_equal File.join(Dir.pwd, 'web'), port.root
+    assert_equal '/xmpp', port.bind
+    refute port.private_storage?
     assert_equal Vines::Stream::Http, port.stream
     assert_same config, port.config 
     assert_equal 1, config.ports.size
@@ -312,8 +318,11 @@ class ConfigTest < MiniTest::Unit::TestCase
         storage(:fs) { dir '.' }
       end
       http '0.0.0.1', 42 do
+        bind '/custom'
+        private_storage true
         max_stanza_size 60_000
         max_resources_per_account 1
+        root '/var/www/html'
       end
     end
     port = config.ports.first
@@ -323,6 +332,9 @@ class ConfigTest < MiniTest::Unit::TestCase
     assert_equal 42, port.port
     assert_equal 60_000, port.max_stanza_size
     assert_equal 1, port.max_resources_per_account
+    assert_equal '/var/www/html', port.root
+    assert_equal '/custom', port.bind
+    assert port.private_storage?
     assert_equal Vines::Stream::Http, port.stream
     assert_same config, port.config 
     assert_equal 1, config.ports.size

data/test/contact_test.rb

@@ -1,6 +1,7 @@
 # encoding: UTF-8
 
 require 'vines'
+require 'ext/nokogiri'
 require 'minitest/autorun'
 
 class ContactTest < MiniTest::Unit::TestCase
@@ -39,4 +40,43 @@ class ContactTest < MiniTest::Unit::TestCase
 
     assert_equal expected, contact.to_roster_xml.to_xml(:indent => 0).gsub(/\n/, '')
   end
+
+  def test_send_roster_push
+    contact = Vines::Contact.new(
+      :jid => 'alice@wonderland.lit',
+      :name => "Alice",
+      :groups => %w[Friends Buddies],
+      :subscription => 'from')
+
+    recipient = MiniTest::Mock.new
+    recipient.expect(:user, Vines::User.new(:jid => 'hatter@wonderland.lit'))
+    def recipient.nodes; @nodes; end
+    def recipient.write(node)
+      @nodes ||= []
+      @nodes << node
+    end
+
+    contact.send_roster_push(recipient)
+    assert recipient.verify
+    assert_equal 1, recipient.nodes.size
+
+    expected = node(%q{
+      <iq to="hatter@wonderland.lit" type="set">
+        <query xmlns="jabber:iq:roster">
+        <item jid="alice@wonderland.lit" name="Alice" subscription="from">
+          <group>Buddies</group>
+          <group>Friends</group>
+        </item>
+        </query>
+      </iq>
+    }.strip.gsub(/\n/, '').gsub(/\s{2,}/, ''))
+    recipient.nodes[0].remove_attribute('id') # id is random
+    assert_equal expected, recipient.nodes[0]
+  end
+
+  private
+
+  def node(xml)
+    Nokogiri::XML(xml).root
+  end
 end

data/test/rake_test_loader.rb

@@ -1,9 +1,17 @@
-#!/usr/bin/env ruby
+require 'rake'
 
 # Use the latest MiniTest gem instead of the buggy
 # version included with Ruby 1.9.2.
-gem 'minitest'
+gem 'minitest', '2.2.2'
 
 # Load the test files from the command line.
 
-ARGV.each { |f| load f unless f =~ /^-/  }
+ARGV.each do |f|
+  next if f =~ /^-/
+
+  if f =~ /\*/
+    FileList[f].to_a.each { |fn| require File.expand_path(fn) }
+  else
+    require File.expand_path(f)
+  end
+end

data/test/stanza/iq/private_storage_test.rb

@@ -0,0 +1,177 @@
+# encoding: UTF-8
+
+require 'vines'
+require 'ext/nokogiri'
+require 'minitest/autorun'
+
+class PrivateStorageTest < MiniTest::Unit::TestCase
+  def setup
+    @stream = MiniTest::Mock.new
+  end
+
+  def test_feature_disabled_raises_error
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/></query>}
+    node = node(%Q{<iq id="42" type="get">#{query}</iq>})
+
+    @stream.expect(:private_storage?, false)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::ServiceUnavailable) { stanza.process }
+    assert @stream.verify
+  end
+
+  def test_get_another_user_fragment_raises_error
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/></query>}
+    node = node(%Q{<iq id="42" to="hatter@wonderland.lit" type="get">#{query}</iq>})
+
+    @stream.expect(:private_storage?, true)
+    @stream.expect(:user, alice)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::Forbidden) { stanza.process }
+    assert @stream.verify
+  end
+
+  def test_get_with_zero_children_raises_error
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"></query>}
+    node = node(%Q{<iq id="42" type="get">#{query}</iq>})
+
+    @stream.expect(:private_storage?, true)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::NotAcceptable) { stanza.process }
+    assert @stream.verify
+  end
+
+  def test_get_with_two_children_raises_error
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/><two xmlns="b"/></query>}
+    node = node(%Q{<iq id="42" type="get">#{query}</iq>})
+
+    @stream.expect(:private_storage?, true)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::NotAcceptable) { stanza.process }
+    assert @stream.verify
+  end
+
+  def test_set_with_zero_children_raises_error
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"></query>}
+    node = node(%Q{<iq id="42" type="set">#{query}</iq>})
+
+    @stream.expect(:private_storage?, true)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::NotAcceptable) { stanza.process }
+    assert @stream.verify
+  end
+
+  def test_get_without_namespace_raises_error
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one/></query>}
+    node = node(%Q{<iq id="42" type="get">#{query}</iq>})
+
+    @stream.expect(:private_storage?, true)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::NotAcceptable) { stanza.process }
+    assert @stream.verify
+  end
+
+  def test_get_missing_fragment_raises_error
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/></query>}
+    node = node(%Q{<iq id="42" type="get">#{query}</iq>})
+
+    storage = MiniTest::Mock.new
+    storage.expect(:find_fragment, nil, [alice.jid, node.elements[0].elements[0]])
+
+    @stream.expect(:private_storage?, true)
+    @stream.expect(:domain, 'wonderland.lit')
+    @stream.expect(:storage, storage, ['wonderland.lit'])
+    @stream.expect(:user, alice)
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    assert_raises(Vines::StanzaErrors::ItemNotFound) { stanza.process }
+    assert @stream.verify
+    assert storage.verify
+  end
+
+  def test_get_finds_fragment_writes_to_stream
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/></query>}
+    node = node(%Q{<iq id="42" type="get">#{query}</iq>})
+
+    data = %q{<one xmlns="a"><child>data</child></one>}
+    query = %Q{<query xmlns="jabber:iq:private">#{data}</query>}
+    expected = node(%Q{<iq from="#{alice.jid}" id="42" to="#{alice.jid}" type="result">#{query}</iq>})
+
+    storage = MiniTest::Mock.new
+    storage.expect(:find_fragment, node(data), [alice.jid, node.elements[0].elements[0]])
+
+    @stream.expect(:private_storage?, true)
+    @stream.expect(:domain, 'wonderland.lit')
+    @stream.expect(:storage, storage, ['wonderland.lit'])
+    @stream.expect(:user, alice)
+    @stream.expect(:write, nil, [expected])
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    stanza.process
+    assert @stream.verify
+    assert storage.verify
+  end
+
+  def test_set_one_fragment_writes_result_to_stream
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/></query>}
+    node = node(%Q{<iq id="42" type="set">#{query}</iq>})
+
+    storage = MiniTest::Mock.new
+    storage.expect(:save_fragment, nil, [alice.jid, node.elements[0].elements[0]])
+
+    expected = node(%Q{<iq from="#{alice.jid}" id="42" to="#{alice.jid}" type="result"/>})
+
+    @stream.expect(:private_storage?, true)
+    @stream.expect(:domain, 'wonderland.lit')
+    @stream.expect(:storage, storage, ['wonderland.lit'])
+    @stream.expect(:user, alice)
+    @stream.expect(:write, nil, [expected])
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    stanza.process
+    assert @stream.verify
+    assert storage.verify
+  end
+
+  def test_set_two_fragments_writes_result_to_stream
+    alice = Vines::User.new(:jid => 'alice@wonderland.lit/tea')
+    query = %q{<query xmlns="jabber:iq:private"><one xmlns="a"/><two xmlns="a"/></query>}
+    node = node(%Q{<iq id="42" type="set">#{query}</iq>})
+
+    storage = MiniTest::Mock.new
+    storage.expect(:save_fragment, nil, [alice.jid, node.elements[0].elements[0]])
+    storage.expect(:save_fragment, nil, [alice.jid, node.elements[0].elements[1]])
+
+    expected = node(%Q{<iq from="#{alice.jid}" id="42" to="#{alice.jid}" type="result"/>})
+
+    @stream.expect(:private_storage?, true)
+    @stream.expect(:domain, 'wonderland.lit')
+    @stream.expect(:storage, storage, ['wonderland.lit'])
+    @stream.expect(:user, alice)
+    @stream.expect(:write, nil, [expected])
+
+    stanza = Vines::Stanza::Iq::PrivateStorage.new(node, @stream)
+    stanza.process
+    assert @stream.verify
+    assert storage.verify
+  end
+
+  private
+
+  def node(xml)
+    Nokogiri::XML(xml).root
+  end
+end