Merge lp:~gary/launchpad/loggerheadlogout into lp:launchpad

[Gary Poster]

log out from bzr and openid after logging out from Launchpad.

This is a merge of changes from a branch that's been applied to production. Please see the previous MP for details:

https://code.edge.launchpad.net/~bac/launchpad/bug-574493/+merge/24853

Thank you

Gary

[Paul Hummer (rockstar)]

review: Approve

=== modified file 'buildout-templates/bin/test.in'
--- buildout-templates/bin/test.in	2010-04-26 16:00:31 +0000
+++ buildout-templates/bin/test.in	2010-05-11 22:19:24 +0000
@@ -162,7 +162,7 @@
     # Find tests in the tests and ftests directories
     'tests_pattern': '^f?tests$',
     'test_path': [${buildout:directory/lib|path-repr}],
-    'package': ['canonical', 'lp', 'devscripts'],
+    'package': ['canonical', 'lp', 'devscripts', 'launchpad_loggerhead'],
     'layer': ['!(MailmanLayer)'],
     }
 
 
=== modified file 'lib/canonical/launchpad/tests/test_login.py'
--- lib/canonical/launchpad/tests/test_login.py	2010-03-30 20:02:53 +0000
+++ lib/canonical/launchpad/tests/test_login.py	2010-05-11 22:19:24 +0000
@@ -1,9 +1,11 @@
-# Copyright 2009 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2010 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
+import cgi
 from datetime import datetime
 import unittest
 
+import lazr.uri
 from zope.component import getUtility
 from zope.event import notify
 from zope.session.interfaces import ISession
@@ -17,7 +19,8 @@
 from canonical.launchpad.webapp.authentication import LaunchpadPrincipal
 from canonical.launchpad.webapp.interfaces import (
     CookieAuthLoggedInEvent, ILaunchpadPrincipal, IPlacelessAuthUtility)
-from canonical.launchpad.webapp.login import logInPrincipal, logoutPerson
+from canonical.launchpad.webapp.login import (
+    CookieLogoutPage, logInPrincipal, logoutPerson)
 from canonical.launchpad.webapp.servers import LaunchpadTestRequest
 from canonical.testing import DatabaseFunctionalLayer
 
@@ -71,6 +74,61 @@
             self.request)
         self.failUnless(principal is None)
 
+    def test_CookieLogoutPage(self):
+        # This test shows that the CookieLogoutPage redirects as we expect:
+        # first to loggerhead for it to log out (see bug 574493) and then
+        # to our OpenId provider for it to log out (see bug 568106).  This
+        # will need to be readdressed when we want to accept other OpenId
+        # providers, unfortunately.
+
+        # This is to setup an interaction so that we can call logInPrincipal
+        # below.
+        login('[e-mail]')
+
+        logInPrincipal(self.request, self.principal, '[e-mail]')
+
+        # Normally CookieLogoutPage is magically mixed in with a base class
+        # that accepts context and request and sets up other things.  We're
+        # just going to put the request on the base class ourselves for this
+        # test.
+
+        view = CookieLogoutPage()
+        view.request = self.request
+
+        # We need to set the session cookie so it can be expired.
+        self.request.response.setCookie(
+            config.launchpad_session.cookie, 'xxx')
+
+        # Now we logout.
+
+        result = view.logout()
+
+        # We should, in fact, be logged out (this calls logoutPerson).
+
+        principal = getUtility(IPlacelessAuthUtility).authenticate(
+            self.request)
+        self.failUnless(principal is None)
+
+        # The view should have redirected us, with no actual response body.
+
+        self.assertEquals(self.request.response.getStatus(), 302)
+        self.assertEquals(result, '')
+
+        # We are redirecting to Loggerhead, to ask it to logout.
+
+        location = lazr.uri.URI(self.request.response.getHeader('location'))
+        self.assertEquals(location.host, 'bazaar.launchpad.dev')
+        self.assertEquals(location.scheme, 'https')
+        self.assertEquals(location.path, '/+logout')
+
+        # That page should then redirect to our OpenId provider to logout,
+        # which we provide in our query string.  See
+        # launchpad_loggerhead.tests.TestLogout for the pertinent tests.
+
+        query = cgi.parse_qs(location.query)
+        self.assertEquals(
+            query['next_to'][0], 'http://testopenid.dev/+logout')
+
     def test_logging_in_and_logging_out_the_old_way(self):
         # A test showing that we can authenticate a request that had the
         # person/account ID stored in the 'personid' session variable instead
 
=== modified file 'lib/canonical/launchpad/webapp/login.py'
--- lib/canonical/launchpad/webapp/login.py	2010-04-27 18:48:31 +0000
+++ lib/canonical/launchpad/webapp/login.py	2010-05-11 22:19:24 +0000
@@ -502,10 +502,11 @@
 
     def logout(self):
         logoutPerson(self.request)
-        self.request.response.addNoticeNotification(
-            _(u'You have been logged out')
-            )
-        target = '%s/?loggingout=1' % self.request.URL[-1]
+        openid_vhost = config.launchpad.openid_provider_vhost
+        openid_root = allvhosts.configs[openid_vhost].rooturl
+        target = '%s+logout?%s' % (
+            config.codehosting.secure_codebrowse_root,
+            urllib.urlencode(dict(next_to='%s+logout' % (openid_root,))))
         self.request.response.redirect(target)
         return ''
 
 
=== modified file 'lib/canonical/launchpad/webapp/tests/no-anonymous-session-cookies.txt'
--- lib/canonical/launchpad/webapp/tests/no-anonymous-session-cookies.txt	2010-02-25 10:50:31 +0000
+++ lib/canonical/launchpad/webapp/tests/no-anonymous-session-cookies.txt	2010-05-11 22:19:24 +0000
@@ -1,5 +1,5 @@
 We will verify that we do not put session cookies in anonymous requests. This
-is important for cacheing anonymous requests in front of Zope, such as with
+is important for caching anonymous requests in front of Zope, such as with
 Squid.  Note that we are checking whether the browser has a session cookie
 set, not whether the server has sent a "set-cookie" header.
 
@@ -49,8 +49,19 @@
 minute time interval (set in canonical.launchpad.webapp.login and enforced
 with an assert in canonical.launchpad.webapp.session) is intended to be fudge
 time for browsers with bad system clocks.
-
-    >>> browser.getControl('Log Out').click()
+    >>> # XXX 2010-05-08 bac bug=577596 This work-around for the fact
+    >>> # that loggerhead is not running needs to be replaced with
+    >>> # something more robust and clear.
+    >>> from urllib2 import HTTPError, URLError
+    >>> try:
+    ...     browser.getControl('Log Out').click()
+    ... except (HTTPError, URLError):
+    ...     pass
+
+After ensuring the browser has not left the launchpad.dev domain, the
+single cookie is shown to have the ten minute expiration.
+
+    >>> browser.open('http://launchpad.dev:8085')
     >>> len(browser.cookies)
     1
     >>> expires = browser.cookies.getinfo('launchpad_tests')['expires']
 
=== modified file 'lib/launchpad_loggerhead/app.py'
--- lib/launchpad_loggerhead/app.py	2010-05-04 23:42:28 +0000
+++ lib/launchpad_loggerhead/app.py	2010-05-11 22:19:24 +0000
@@ -123,7 +123,7 @@
         elif response.status == CANCEL:
             self.log.error('open id response: CANCEL')
             exc = HTTPUnauthorized()
-            exc.explanation = "Authetication cancelled."
+            exc.explanation = "Authentication cancelled."
             raise exc
         else:
             self.log.error('open id response: UNKNOWN')
@@ -131,6 +131,18 @@
             exc.explanation = "Unknown OpenID response."
             raise exc
 
+    def _logout(self, environ, start_response):
+        """Logout of loggerhead.
+
+        Clear the cookie and redirect to `next_to`.
+        """
+        environ[self.session_var].clear()
+        query = dict(parse_querystring(environ))
+        next_url = query.get('next_to')
+        if next_url is None:
+            next_url = allvhosts.configs['mainsite'].rooturl
+        raise HTTPMovedPermanently(next_url)
+
     def __call__(self, environ, start_response):
         environ['loggerhead.static.url'] = environ['SCRIPT_NAME']
         if environ['PATH_INFO'].startswith('/static/'):
@@ -142,6 +154,8 @@
             return robots_app(environ, start_response)
         elif environ['PATH_INFO'].startswith('/+login'):
             return self._complete_login(environ, start_response)
+        elif environ['PATH_INFO'].startswith('/+logout'):
+            return self._logout(environ, start_response)
         path = environ['PATH_INFO']
         trailingSlashCount = len(path) - len(path.rstrip('/'))
         user = environ[self.session_var].get('user', LAUNCHPAD_ANONYMOUS)
 
=== modified file 'lib/launchpad_loggerhead/session.py'
--- lib/launchpad_loggerhead/session.py	2010-04-27 01:35:56 +0000
+++ lib/launchpad_loggerhead/session.py	2010-05-11 22:19:24 +0000
@@ -1,4 +1,4 @@
-# Copyright 2009 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2010 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Simple paste-y session manager tuned for the needs of launchpad-loggerhead.
@@ -64,10 +64,17 @@
             session = pickle.loads(environ[self.session_var])
         else:
             session = {}
+        existed = bool(session)
         environ[self.session_var] = session
         def response_hook(status, response_headers, exc_info=None):
             session = environ.pop(self.session_var)
-            if session:
+            # paste.auth.cookie does not delete cookies (see
+            # http://trac.pythonpaste.org/pythonpaste/ticket/139).  A
+            # reasonable workaround is to make the value empty.  Therefore,
+            # we explicitly set the value in the session (to be encrypted)
+            # if the value is non-empty *or* if it was non-empty at the start
+            # of the request.
+            if existed or session:
                 environ[self.session_var] = pickle.dumps(session)
             return start_response(status, response_headers, exc_info)
         return self.application(environ, response_hook)
 
=== added file 'lib/launchpad_loggerhead/tests.py'
--- lib/launchpad_loggerhead/tests.py	1970-01-01 00:00:00 +0000
+++ lib/launchpad_loggerhead/tests.py	2010-05-11 22:19:24 +0000
@@ -0,0 +1,146 @@
+# Copyright 2010 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+import unittest
+import urllib
+
+import lazr.uri
+import wsgi_intercept
+from wsgi_intercept.urllib2_intercept import install_opener, uninstall_opener
+import wsgi_intercept.zope_testbrowser
+from paste.httpexceptions import HTTPExceptionHandler
+
+from canonical.config import config
+from canonical.launchpad.webapp.vhosts import allvhosts
+from canonical.testing import DatabaseFunctionalLayer
+from launchpad_loggerhead.app import RootApp
+from launchpad_loggerhead.session import SessionHandler
+from lp.testing import TestCase
+
+SESSION_VAR = 'lh.session'
+
+# See sourcecode/launchpad-loggerhead/start-loggerhead.py for the production
+# mechanism for getting the secret.
+SECRET = 'secret'
+
+
+def session_scribbler(app, test):
+    """Squirrel away the session variable."""
+    def scribble(environ, start_response):
+        test.session = environ[SESSION_VAR] # Yay for mutables.
+        return app(environ, start_response)
+    return scribble
+
+
+def dummy_destination(environ, start_response):
+    """Return a fake response."""
+    start_response('200 OK', [('Content-type','text/plain')])
+    return ['This is a dummy destination.\n']
+
+
+class SimpleLogInRootApp(RootApp):
+    """A mock root app that doesn't require open id."""
+    def _complete_login(self, environ, start_response):
+        environ[SESSION_VAR]['user'] = 'bob'
+        start_response('200 OK', [('Content-type','text/plain')])
+        return ['\n']
+
+
+class TestLogout(TestCase):
+    layer = DatabaseFunctionalLayer
+
+    def intercept(self, uri, app):
+        """Install wsgi interceptors for the uri, app tuple."""
+        if isinstance(uri, basestring):
+            uri = lazr.uri.URI(uri)
+        port = uri.port
+        if port is None:
+            if uri.scheme == 'http':
+                port = 80
+            elif uri.scheme == 'https':
+                port = 443
+            else:
+                raise NotImplementedError(uri.scheme)
+        else:
+            port = int(port)
+        wsgi_intercept.add_wsgi_intercept(uri.host, port, lambda: app)
+        self.intercepted.append((uri.host, port))
+
+    def setUp(self):
+        TestCase.setUp(self)
+        self.intercepted = []
+        self.session = None
+        self.root = app = SimpleLogInRootApp(SESSION_VAR)
+        app = session_scribbler(app, self)
+        app = HTTPExceptionHandler(app)
+        app = SessionHandler(app, SESSION_VAR, SECRET)
+        self.cookie_name = app.cookie_handler.cookie_name
+        self.intercept(config.codehosting.codebrowse_root, app)
+        self.intercept(config.codehosting.secure_codebrowse_root, app)
+        self.intercept(allvhosts.configs['mainsite'].rooturl,
+                       dummy_destination)
+        install_opener()
+        self.browser = wsgi_intercept.zope_testbrowser.WSGI_Browser()
+        # We want to pretend we are not a robot, or else mechanize will honor
+        # robots.txt.
+        self.browser.mech_browser.set_handle_robots(False)
+        self.browser.open(
+            config.codehosting.secure_codebrowse_root + '+login')
+
+    def tearDown(self):
+        uninstall_opener()
+        for host, port in self.intercepted:
+            wsgi_intercept.remove_wsgi_intercept(host, port)
+        TestCase.tearDown(self)
+
+    def testLoggerheadLogout(self):
+        # We start logged in as 'bob'.
+        self.assertEqual(self.session['user'], 'bob')
+        self.browser.open(
+            config.codehosting.secure_codebrowse_root + 'favicon.ico')
+        self.assertEqual(self.session['user'], 'bob')
+        self.failUnless(self.browser.cookies.get(self.cookie_name))
+
+        # When we visit +logout, our session is gone.
+        self.browser.open(
+            config.codehosting.secure_codebrowse_root + '+logout')
+        self.assertEqual(self.session, {})
+
+        # By default, we have been redirected to the Launchpad root.
+        self.assertEqual(
+            self.browser.url, allvhosts.configs['mainsite'].rooturl)
+
+        # The session cookie still exists, because of how
+        # paste.auth.cookie works (see
+        # http://trac.pythonpaste.org/pythonpaste/ticket/139 ) but the user
+        # does in fact have an empty session now.
+        self.browser.open(
+            config.codehosting.secure_codebrowse_root + 'favicon.ico')
+        self.assertEqual(self.session, {})
+
+    def testLoggerheadLogoutRedirect(self):
+        # When we visit +logout with a 'next_to' value in the query string,
+        # the logout page will redirect to the given URI.  As of this
+        # writing, this is used by Launchpad to redirect to our OpenId
+        # provider (see canonical.launchpad.tests.test_login.
+        # TestLoginAndLogout.test_CookieLogoutPage).
+
+        # Here, we will have a more useless example of the basic machinery.
+        dummy_root = 'http://dummy.dev/'
+        self.intercept(dummy_root, dummy_destination)
+        self.browser.open(
+            config.codehosting.secure_codebrowse_root +
+            '+logout?' +
+            urllib.urlencode(dict(next_to=dummy_root + '+logout')))
+
+        # We are logged out, as before.
+        self.assertEqual(self.session, {})
+
+        # Now, though, we are redirected to the ``next_to`` destination.
+        self.assertEqual(self.browser.url, dummy_root + '+logout')
+        self.assertEqual(self.browser.contents,
+                         'This is a dummy destination.\n')
+
+
+def test_suite():
+    return unittest.TestLoader().loadTestsFromName(__name__)
 
=== modified file 'lib/lp/testopenid/browser/server.py'
--- lib/lp/testopenid/browser/server.py	2010-03-31 19:38:32 +0000
+++ lib/lp/testopenid/browser/server.py	2010-05-11 22:19:24 +0000
@@ -24,6 +24,7 @@
 from openid import oidutil
 from openid.server.server import CheckIDRequest, Server
 from openid.store.memstore import MemoryStore
+from openid.extensions.sreg import SRegRequest, SRegResponse
 
 from canonical.cachedproperty import cachedproperty
 from canonical.launchpad import _
@@ -41,6 +42,7 @@
 from lp.testopenid.interfaces.server import (
     get_server_url, ITestOpenIDApplication, ITestOpenIDLoginForm,
     ITestOpenIDPersistentIdentity)
+from lp.registry.interfaces.person import IPerson
 
 
 OPENID_REQUEST_SESSION_KEY = 'testopenid.request'
@@ -196,6 +198,12 @@
         else:
             response = self.openid_request.answer(True)
 
+        sreg_fields = dict(nickname=IPerson(self.account).name)
+        sreg_request = SRegRequest.fromOpenIDRequest(self.openid_request)
+        sreg_response = SRegResponse.extractResponse(
+            sreg_request, sreg_fields)
+        response.addExtension(sreg_response)
+
         return response
 
     def createFailedResponse(self):