Merge lp:~alecu/ubuntu-sso-client/timestamp-autofix-1-0 into lp:ubuntu-sso-client/stable-1-0

[Alejandro J. Cura]

Do a HEAD request on the server to get accurate timestamp (LP: #692597 & LP: #891644)

Do a HEAD request on the server to get accurate timestamp (LP: #692597 & LP: #891644)

[Diego Sarmentero (diegosarmentero)]

Text conflict in bin/ubuntu-sso-login
Text conflict in data/gtk/ui.glade
Text conflict in run-tests
Text conflict in setup.py
Text conflict in ubuntu_sso/gtk/gui.py
Text conflict in ubuntu_sso/gtk/tests/test_gui.py
Text conflict in ubuntu_sso/keyring/linux.py
Text conflict in ubuntu_sso/keyring/tests/test_linux.py
Text conflict in ubuntu_sso/main/linux.py
Text conflict in ubuntu_sso/main/tests/test_linux.py
Conflict adding file ubuntu_sso/utils. Moved existing file to ubuntu_sso/utils.moved.
11 conflicts encountered.

review: Needs Fixing

[Diego Sarmentero (diegosarmentero)]

review: Abstain

[lp:~alecu/ubuntu-sso-client/timestamp-autofix-1-0]

649. By Alejandro J. Cura on 2011-11-23

fix year in file headers

[Diego Sarmentero (diegosarmentero)]

+1 looks great!

review: Approve

[Natalia Bidart (nataliabidart)]

Tested locally and IRL. It works great, and all tests are green.

review: Approve

=== modified file 'ubuntu_sso/main.py'
--- ubuntu_sso/main.py	2011-03-29 17:26:26 +0000
+++ ubuntu_sso/main.py	2011-11-23 19:50:27 +0000
@@ -3,7 +3,7 @@
 # Author: Natalia Bidart <[e-mail]>
 # Author: Alejandro J. Cura <[e-mail]>
 #
-# Copyright 2009 Canonical Ltd.
+# Copyright 2009, 2011 Canonical Ltd.
 #
 # This program is free software: you can redistribute it and/or modify it
 # under the terms of the GNU General Public License version 3, as published
@@ -46,6 +46,7 @@
 from ubuntu_sso import DBUS_IFACE_USER_NAME, DBUS_IFACE_CRED_NAME
 from ubuntu_sso.keyring import Keyring, get_token_name, U1_APP_NAME
 from ubuntu_sso.logger import setup_logging
+from ubuntu_sso.utils import timestamp_checker
 
 
 # Disable the invalid name warning, as we have a lot of DBus style names
@@ -117,6 +118,27 @@
     return creds
 
 
+class TimestampedAuthorizer(OAuthAuthorizer):
+    """Includes a custom timestamp on OAuth signatures."""
+
+    def __init__(self, get_timestamp, *args, **kwargs):
+        """Store the get_timestamp method, and move on."""
+        OAuthAuthorizer.__init__(self, *args, **kwargs)
+        self.get_timestamp = get_timestamp
+
+    # pylint: disable=C0103,E1101
+    def authorizeRequest(self, absolute_uri, method, body, headers):
+        """Override authorizeRequest including the timestamp."""
+        parameters = {"oauth_timestamp": self.get_timestamp()}
+        oauth_request = oauth.OAuthRequest.from_consumer_and_token(
+        self.consumer, self.access_token, http_url=absolute_uri,
+        parameters=parameters)
+        oauth_request.sign_request(
+        oauth.OAuthSignatureMethod_PLAINTEXT(),
+        self.consumer, self.access_token)
+        headers.update(oauth_request.to_header(self.oauth_realm))
+
+
 class SSOLoginProcessor(object):
     """Login and register users using the Ubuntu Single Sign On service."""
 
@@ -236,7 +258,9 @@
         if sso_service is None:
             oauth_token = oauth.OAuthToken(token['token'],
                                            token['token_secret'])
-            authorizer = OAuthAuthorizer(token['consumer_key'],
+            authorizer = TimestampedAuthorizer(
+                                         timestamp_checker.get_faithful_time,
+                                         token['consumer_key'],
                                          token['consumer_secret'],
                                          oauth_token)
             sso_service = self.sso_service_class(authorizer, self.service_url)
@@ -258,7 +282,8 @@
                            token_name=token_name)
 
         oauth_token = oauth.OAuthToken(token['token'], token['token_secret'])
-        authorizer = OAuthAuthorizer(token['consumer_key'],
+        authorizer = TimestampedAuthorizer(
+                                     timestamp_checker.get_faithful_time,
                                      token['consumer_secret'],
                                      oauth_token)
         sso_service = self.sso_service_class(authorizer, self.service_url)
@@ -607,9 +632,12 @@
                                            credentials['consumer_secret'])
             token = oauth.OAuthToken(credentials['token'],
                                      credentials['token_secret'])
+            timestamp = timestamp_checker.get_faithful_time()
+            parameters = {"oauth_timestamp": timestamp}
             get_request = oauth.OAuthRequest.from_consumer_and_token
             oauth_req = get_request(oauth_consumer=consumer, token=token,
-                                    http_method="GET", http_url=url)
+                                    http_method="GET", http_url=url,
+                                    parameters=parameters)
             oauth_req.sign_request(oauth.OAuthSignatureMethod_HMAC_SHA1(),
                                    consumer, token)
             request = urllib2.Request(url, headers=oauth_req.to_header())
 
=== modified file 'ubuntu_sso/tests/test_main.py'
--- ubuntu_sso/tests/test_main.py	2011-03-29 17:26:26 +0000
+++ ubuntu_sso/tests/test_main.py	2011-11-23 19:50:27 +0000
@@ -5,7 +5,7 @@
 # Author: Natalia Bidart <[e-mail]>
 # Author: Alejandro J. Cura <[e-mail]>
 #
-# Copyright 2009-2010 Canonical Ltd.
+# Copyright 2009-2011 Canonical Ltd.
 #
 # This program is free software: you can redistribute it and/or modify it
 # under the terms of the GNU General Public License version 3, as published
@@ -22,6 +22,7 @@
 
 import logging
 import os
+import time
 import urllib2
 
 import gobject
@@ -31,6 +32,7 @@
 from lazr.restfulclient.errors import HTTPError
 # pylint: enable=F0401
 from mocker import Mocker, MockerTestCase, ARGS, KWARGS, ANY
+from oauth import oauth
 from twisted.internet.defer import Deferred
 from twisted.trial.unittest import TestCase
 
@@ -46,7 +48,7 @@
     keyring_get_credentials, keyring_store_credentials, logger,
     NewPasswordError, PING_URL, SERVICE_URL,
     RegistrationError, ResetPasswordTokenError,
-    SSOCredentials, SSOLogin, SSOLoginProcessor)
+    SSOCredentials, SSOLogin, SSOLoginProcessor, TimestampedAuthorizer)
 
 
 # Access to a protected member 'yyy' of a client class
@@ -193,6 +195,38 @@
         self.accounts = FakedAccounts()
 
 
+class TimestampedAuthorizerTestCase(TestCase):
+    """Test suite for the TimestampedAuthorizer."""
+
+    def test_authorize_request_includes_timestamp(self):
+        """The authorizeRequest method includes the timestamp."""
+        fromcandt_call = []
+        fake_uri = "http://protocultura.net"
+        fake_timestamp = 1234
+        get_fake_timestamp = lambda: fake_timestamp
+        original_oauthrequest = oauth.OAuthRequest
+
+        class FakeOAuthRequest(oauth.OAuthRequest):
+            """A Fake OAuthRequest class."""
+
+            # pylint: disable=W0221
+            @staticmethod
+            def from_consumer_and_token(*args, **kwargs):
+                """A fake from_consumer_and_token."""
+                fromcandt_call.append((args, kwargs))
+                builder = original_oauthrequest.from_consumer_and_token
+                return builder(*args, **kwargs)
+            # pylint: enable=W0221
+
+        self.patch(oauth, "OAuthRequest", FakeOAuthRequest)
+
+        authorizer = TimestampedAuthorizer(get_fake_timestamp, "ubuntuone")
+        authorizer.authorizeRequest(fake_uri, "POST", None, {})
+        call_kwargs = fromcandt_call[0][1]
+        parameters = call_kwargs["parameters"]
+        self.assertEqual(parameters["oauth_timestamp"], fake_timestamp)
+
+
 class SSOLoginProcessorTestCase(TestCase, MockerTestCase):
     """Test suite for the SSO login processor."""
 
@@ -1426,6 +1460,8 @@
             return FakedResponse(code=200)
 
         self.patch(urllib2, 'urlopen', fake_it)
+        self.patch(ubuntu_sso.main.timestamp_checker, "get_faithful_time",
+                   time.time)
 
         self.client = SSOCredentials(None)
 
 
=== added directory 'ubuntu_sso/utils'
=== added file 'ubuntu_sso/utils/__init__.py'
--- ubuntu_sso/utils/__init__.py	1970-01-01 00:00:00 +0000
+++ ubuntu_sso/utils/__init__.py	2011-11-23 19:50:27 +0000
@@ -0,0 +1,81 @@
+# -*- coding: utf-8 -*-
+
+# Author: Alejandro J. Cura <[e-mail]>
+#
+# Copyright 2010, 2011 Canonical Ltd.
+#
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 3, as published
+# by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""Utility modules that may find use outside ubuntu_sso."""
+import time
+import urllib2
+from twisted.web import http
+
+from ubuntu_sso.logger import setup_logging
+logger = setup_logging("ubuntu_sso.utils")
+
+
+class RequestHead(urllib2.Request):
+    """A request with the method set to HEAD."""
+
+    _request_method = "HEAD"
+
+    def get_method(self):
+        """Return the desired method."""
+        return self._request_method
+
+
+class SyncTimestampChecker(object):
+    """A timestamp that's regularly checked with a server."""
+
+    CHECKING_INTERVAL = 60 * 60  # in seconds
+    ERROR_INTERVAL = 30  # in seconds
+    SERVER_URL = "http://one.ubuntu.com/api/time"
+
+    def __init__(self):
+        """Initialize this instance."""
+        self.next_check = time.time()
+        self.skew = 0
+
+    def get_server_time(self):
+        """Get the time at the server."""
+        headers = {"Cache-Control": "no-cache"}
+        request = RequestHead(self.SERVER_URL, headers=headers)
+        response = urllib2.urlopen(request)
+        date_string = response.info()["Date"]
+        timestamp = http.stringToDatetime(date_string)
+        return timestamp
+
+    def get_faithful_time(self):
+        """Get an accurate timestamp."""
+        local_time = time.time()
+        if local_time >= self.next_check:
+            try:
+                server_time = self.get_server_time()
+                self.next_check = local_time + self.CHECKING_INTERVAL
+                self.skew = server_time - local_time
+                logger.debug("Calculated server-local time skew: %r",
+                             self.skew)
+            #pylint: disable=W0703
+            except Exception, server_error:
+                logger.debug("Error while verifying the server time skew: %r",
+                             server_error)
+                self.next_check = local_time + self.ERROR_INTERVAL
+        logger.debug("Using corrected timestamp: %r",
+                     http.datetimeToString(local_time + self.skew))
+        return int(local_time + self.skew)
+
+
+# pylint: disable=C0103
+timestamp_checker = SyncTimestampChecker()
+# pylint: enable=C0103
 
=== added directory 'ubuntu_sso/utils/tests'
=== added file 'ubuntu_sso/utils/tests/__init__.py'
--- ubuntu_sso/utils/tests/__init__.py	1970-01-01 00:00:00 +0000
+++ ubuntu_sso/utils/tests/__init__.py	2011-11-23 19:50:27 +0000
@@ -0,0 +1,16 @@
+# ubuntu_sso - Ubuntu Single Sign On client support for desktop apps
+#
+# Copyright 2011 Canonical Ltd.
+#
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 3, as published
+# by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program.  If not, see <http://www.gnu.org/licenses/>.
+"""Ubuntu Single Sign On utils tests."""
 
=== added file 'ubuntu_sso/utils/tests/test_oauth_headers.py'
--- ubuntu_sso/utils/tests/test_oauth_headers.py	1970-01-01 00:00:00 +0000
+++ ubuntu_sso/utils/tests/test_oauth_headers.py	2011-11-23 19:50:27 +0000
@@ -0,0 +1,148 @@
+# -*- coding: utf-8 -*-
+
+# Author: Alejandro J. Cura <[e-mail]>
+#
+# Copyright 2011 Canonical Ltd.
+#
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 3, as published
+# by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""Tests for the oauth_headers helper function."""
+
+import time
+
+from twisted.application import internet, service
+from twisted.internet import defer
+from twisted.internet.threads import deferToThread
+from twisted.trial.unittest import TestCase
+from twisted.web import server, resource
+
+from ubuntu_sso.utils import SyncTimestampChecker
+
+
+class RootResource(resource.Resource):
+    """A root resource that logs the number of calls."""
+
+    isLeaf = True
+
+    def __init__(self, *args, **kwargs):
+        """Initialize this fake instance."""
+        resource.Resource.__init__(self, *args, **kwargs)
+        self.count = 0
+        self.request_headers = []
+
+    # pylint: disable=C0103
+    def render_HEAD(self, request):
+        """Increase the counter on each render."""
+        self.count += 1
+        self.request_headers.append(request.requestHeaders)
+        return ""
+
+
+class MockWebServer(object):
+    """A mock webserver for testing."""
+
+    def __init__(self):
+        """Start up this instance."""
+        # pylint: disable=E1101
+        self.root = RootResource()
+        site = server.Site(self.root)
+        application = service.Application('web')
+        self.service_collection = service.IServiceCollection(application)
+        self.tcpserver = internet.TCPServer(0, site)
+        self.tcpserver.setServiceParent(self.service_collection)
+        self.service_collection.startService()
+
+    def get_url(self):
+        """Build the url for this mock server."""
+        # pylint: disable=W0212
+        port_num = self.tcpserver._port.getHost().port
+        return "http://localhost:%d/" % port_num
+
+    def stop(self):
+        """Shut it down."""
+        # pylint: disable=E1101
+        self.service_collection.stopService()
+
+
+class FakedError(Exception):
+    """A mock, test, sample, and fake exception."""
+
+
+class TimestampCheckerTestCase(TestCase):
+    """Tests for the timestamp checker."""
+
+    def setUp(self):
+        """Initialize a fake webserver."""
+        self.ws = MockWebServer()
+        self.addCleanup(self.ws.stop)
+        self.patch(SyncTimestampChecker, "SERVER_URL", self.ws.get_url())
+
+    @defer.inlineCallbacks
+    def test_returned_value_is_int(self):
+        """The returned value is an integer."""
+        checker = SyncTimestampChecker()
+        timestamp = yield deferToThread(checker.get_faithful_time)
+        self.assertEqual(type(timestamp), int)
+
+    @defer.inlineCallbacks
+    def test_first_call_does_head(self):
+        """The first call gets the clock from our web."""
+        checker = SyncTimestampChecker()
+        yield deferToThread(checker.get_faithful_time)
+        self.assertEqual(self.ws.root.count, 1)
+
+    @defer.inlineCallbacks
+    def test_second_call_is_cached(self):
+        """For the second call, the time is cached."""
+        checker = SyncTimestampChecker()
+        yield deferToThread(checker.get_faithful_time)
+        yield deferToThread(checker.get_faithful_time)
+        self.assertEqual(self.ws.root.count, 1)
+
+    @defer.inlineCallbacks
+    def test_after_timeout_cache_expires(self):
+        """After some time, the cache expires."""
+        fake_timestamp = 1
+        self.patch(time, "time", lambda: fake_timestamp)
+        checker = SyncTimestampChecker()
+        yield deferToThread(checker.get_faithful_time)
+        fake_timestamp += SyncTimestampChecker.CHECKING_INTERVAL
+        yield deferToThread(checker.get_faithful_time)
+        self.assertEqual(self.ws.root.count, 2)
+
+    @defer.inlineCallbacks
+    def test_server_date_sends_nocache_headers(self):
+        """Getting the server date sends the no-cache headers."""
+        checker = SyncTimestampChecker()
+        yield deferToThread(checker.get_server_time)
+        assert len(self.ws.root.request_headers) == 1
+        headers = self.ws.root.request_headers[0]
+        result = headers.getRawHeaders("Cache-Control")
+        self.assertEqual(result, ["no-cache"])
+
+    @defer.inlineCallbacks
+    def test_server_error_means_skew_not_updated(self):
+        """When server can't be reached, the skew is not updated."""
+        fake_timestamp = 1
+        self.patch(time, "time", lambda: fake_timestamp)
+        checker = SyncTimestampChecker()
+
+        def failing_get_server_time():
+            """Let's fail while retrieving the server time."""
+            raise FakedError()
+
+        self.patch(checker, "get_server_time", failing_get_server_time)
+        yield deferToThread(checker.get_faithful_time)
+        self.assertEqual(checker.skew, 0)
+        self.assertEqual(checker.next_check,
+                         fake_timestamp + SyncTimestampChecker.ERROR_INTERVAL)