Merge lp:~canonical-isd-hackers/canonical-identity-provider/compatible-piston into lp:canonical-identity-provider/release

[Anthony Lenton]

Implement a lazr.restfulclient-compatible piston api.

Overview
========
This branch implements a backwards-compatible Piston api, replacing our current lazr.restful one.

Details
=======
The lazr.restful dependency is removed, and zope.interface is now only needed for running the tests, as zope.testbrowser is still used.

SSO's test suite was changed as little as possible for this branch, to ensure backwards-compatibility. A few tests were changed though, as they were quite lazr-specific or imported the webservice module that was removed completely.

This branch has been tested interactively using lazr.restfulclient. Ideally we should also test our main higher-level clients (like the desktop ussoc, or mumble's sso client) during qa.

[Anthony Lenton (elachuni)]

Youch, apologies for the huge diff. Fwiw, the wadl template was taken verbatim from what lazr.restful generated previous to being removed, so that's ~1.5k lines that shouldn't need much review

[Łukasz Czyżykowski (lukasz-czyzykowski)]

How do you imagine fixing API in the future taking into the account that from now on the WADL file will have to be modified by hand? Or is this API set in stone and no signature will ever change (of course, besides moving to new version)?

review: Needs Information

[Anthony Lenton (elachuni)]

> How do you imagine fixing API in the future taking into the account that from
> now on the WADL file will have to be modified by hand? Or is this API set in
> stone and no signature will ever change (of course, besides moving to new
> version)?

Yup, next branch should add a 2.0 api (in real Piston style) that can be more easily extended in the future.

[Anthony Lenton (elachuni)]

Merged in latest changes for trunk. Requesting a new review.

[ISD Branch Mangler (isd-branches-mangler)]

There are additional revisions which have not been approved in review. Please seek review and approval of these new revisions.

=== modified file 'debian/control'
--- debian/control	2011-03-07 22:20:21 +0000
+++ debian/control	2011-05-24 16:31:52 +0000
@@ -20,15 +20,6 @@
  python-django-oauth-backend (= 0.1.dev1),
  python-django-preflight (>= 0.1),
  python-django-preflight (<< 0.2),
- python-django-settings (>= 0.2),
  python-memcache,
- python-lazr.restful (>= 0.9.18),
- python-lazr.authentication,
- python-docutils,
- python-epydoc,
- python-restrictedpython,
- python-schemaconfig (>= 0.1.3.dev1),
- python-simplejson,
- python-lazr.uri
-Conflicts: python-lazr.restful (>= 0.9.22)
+ python-simplejson
 Description: Canonical OpenID provider

=== modified file 'django_project/config.example/settings.py'
--- django_project/config.example/settings.py	2010-08-04 22:13:07 +0000
+++ django_project/config.example/settings.py	2011-05-24 16:31:52 +0000
@@ -41,17 +41,11 @@
 # api settings
 API_ENABLED = False
 API_HOST = 'openid.localdomain'
+OAUTH_DATA_STORE = 'identityprovider.store.SSODataStore'
 APP_SERVERS = [{'SERVER_ID': 'localhost',
                 'HOST': 'localhost',
                 'PORT': 8000,
                }]
-LAZR_RESTFUL_CODE_REVISION = '1'
-LAZR_RESTFUL_HOSTNAME = 'sso'
-LAZR_RESTFUL_PATH_OVERRIDE = None
-LAZR_RESTFUL_SERVICE_ROOT_URI_PREFIX = 'api/'
-LAZR_RESTFUL_SERVICE_VERSION_URI_PREFIX = '1.0'
-LAZR_RESTFUL_USE_HTTPS = False
-LAZR_RESTFUL_VIEW_PERMISSION = 'zope.Public'
 
 # branding settings
 BRANDED_TEMPLATE_DIR = 'ubuntu'

=== modified file 'doctests/stories/api-authentications.txt'
--- doctests/stories/api-authentications.txt	2011-01-24 18:28:24 +0000
+++ doctests/stories/api-authentications.txt	2011-05-24 16:31:52 +0000
@@ -120,19 +120,19 @@
     >>> api.authentications.list_tokens(consumer_key='myopenid')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...
     >>> api.authentications.invalidate_token(consumer_key='myopenid',
     ...     token='mytoken')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...
     >>> api.authentications.validate_token(consumer_key='myopenid',
     ...     token='mytoken')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...
 
 Test When OAuth Auth Credentials For Normal Users Are Supplied
@@ -218,5 +218,5 @@
     >>> api.authentications.authenticate(token_name='this-machine')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...

=== modified file 'doctests/stories/api-workflows.txt'
--- doctests/stories/api-workflows.txt	2011-03-14 15:56:30 +0000
+++ doctests/stories/api-workflows.txt	2011-05-24 16:31:52 +0000
@@ -46,8 +46,11 @@
 the human being:
 
     >>> captcha = api.captchas.new()
-    >>> captcha
-    {u'captcha_id': u'...', u'image_url': u'https://api-secure.recaptcha.net/image?c=...'}
+    >>> sorted(captcha.keys())
+    [u'captcha_id', u'image_url']
+    >>> prefix = u'https://api-secure.recaptcha.net/image?c='
+    >>> captcha['image_url'].startswith(prefix)
+    True
 
 As you can see captcha is dictionary with two fields: ``captcha_id``
 which you need to pass to registration function and ``image_url`` which

=== added directory 'identityprovider/api10'
=== added file 'identityprovider/api10/__init__.py'
=== added file 'identityprovider/api10/decorators.py'
--- identityprovider/api10/decorators.py	1970-01-01 00:00:00 +0000
+++ identityprovider/api10/decorators.py	2011-05-24 16:31:52 +0000
@@ -0,0 +1,36 @@
+# Copyright 2010 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from functools import wraps
+
+from django.http import HttpResponseForbidden
+
+from identityprovider.models import (
+    Account,
+    APIUser,
+)
+
+def api_user_required(func):
+    @wraps(func)
+    def wrapper(self, request, *args, **kwargs):
+        user = request.user
+        if user:
+            if isinstance(user, APIUser):
+                return func(self, request, *args, **kwargs)
+        return HttpResponseForbidden('403 Forbidden')
+    return wrapper
+
+
+def plain_user_required(func):
+    @wraps(func)
+    def wrapper(self, request, *args, **kwargs):
+        user = request.user
+        if user:
+            if isinstance(user, Account):
+                return func(self, request, *args, **kwargs)
+        return HttpResponseForbidden('403 Forbidden')
+    return wrapper
+
+def named_operation(func):
+    func.is_named_operation = True
+    return func

=== added file 'identityprovider/api10/forms.py'
--- identityprovider/api10/forms.py	1970-01-01 00:00:00 +0000
+++ identityprovider/api10/forms.py	2011-05-24 16:31:52 +0000
@@ -0,0 +1,55 @@
+# Copyright 2010 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+# We use Django forms for webservice input validation
+
+from django import forms
+from django.forms import fields
+from django.utils.translation import ugettext as _
+
+from identityprovider.utils import password_policy_compliant
+from identityprovider.models.captcha import Captcha, VerifyCaptchaError
+
+
+PASSWORD_POLICY_ERROR = _("Password must be at least "
+                          "8 characters long, and must contain at least one "
+                          "number and an upper case letter.")
+
+
+class WebserviceCreateAccountForm(forms.Form):
+    email = fields.EmailField()
+    password = fields.CharField(max_length=256)
+    captcha_id = fields.CharField(max_length=1024)
+    captcha_solution = fields.CharField(max_length=256)
+    remote_ip = fields.CharField(max_length=256)
+    displayname = fields.CharField(max_length=256, required=False)
+
+    def clean_password(self):
+        if 'password' in self.cleaned_data:
+            password = self.cleaned_data['password']
+            try:
+                str(password)
+            except UnicodeEncodeError:
+                raise forms.ValidationError(
+                    _("Invalid characters in password"))
+            if not password_policy_compliant(password):
+                raise forms.ValidationError(PASSWORD_POLICY_ERROR)
+            return password
+
+    def clean(self):
+        cleaned_data = self.cleaned_data
+        captcha_id = cleaned_data.get('captcha_id')
+        captcha_solution = cleaned_data.get('captcha_solution')
+
+        # The remote IP address is absolutely required, and comes from
+        # SSO itself, not from the client.  If it's missing, it's a
+        # programming error, and should not be returned to the client
+        # as a validation error.  So, we use a normal key lookup here.
+        remote_ip = cleaned_data['remote_ip']
+
+        captcha = Captcha(captcha_id)
+
+        if captcha.verify(captcha_solution, remote_ip):
+            return cleaned_data
+        # not verified
+        raise forms.ValidationError(_("Wrong captcha solution."))

=== added file 'identityprovider/api10/handlers.py'
--- identityprovider/api10/handlers.py	1970-01-01 00:00:00 +0000
+++ identityprovider/api10/handlers.py	2011-05-24 16:31:52 +0000
@@ -0,0 +1,410 @@
+# Copyright 2010 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from django.conf import settings
+from django.core.serializers.json import DateTimeAwareJSONEncoder
+from django.http import HttpResponseBadRequest
+from django.shortcuts import render_to_response
+from django.utils import simplejson
+from piston.emitters import Emitter
+from piston.handler import BaseHandler
+
+from identityprovider.api10.decorators import (
+    api_user_required,
+    plain_user_required,
+    named_operation,
+)
+from identityprovider.api10.forms import (
+    PASSWORD_POLICY_ERROR,
+    WebserviceCreateAccountForm,
+)
+from identityprovider.models import (
+    EmailAddress,
+    Account,
+    AccountPassword,
+    AuthToken,
+    AuthTokenFactory,
+)
+from identityprovider.models.const import (
+    AccountCreationRationale,
+    AccountStatus,
+    EmailStatus,
+    LoginTokenType,
+)
+from identityprovider.models.captcha import (
+    Captcha,
+    NewCaptchaError,
+)
+from identityprovider.views.server import get_team_memberships
+from identityprovider.signals import (
+    account_created,
+    account_email_validated,
+    application_token_created,
+    application_token_invalidated,
+)
+from identityprovider.utils import (
+    CannotResetPasswordException,
+    encrypt_launchpad_password,
+    get_person_and_account_by_email,
+    password_policy_compliant,
+    PersonAndAccountNotFoundException,
+)
+from oauth_backend.models import Token
+
+
+class CanNotResetPasswordError(Exception):
+    pass
+
+
+class LazrRestfulEmitter(Emitter):
+    """JSON emitter, lazr.restful flavoured.
+
+    Reports content-type 'application/json', without specifying a charset
+    as that seems to confuse lazr.restfulclient.
+    """
+    def render(self, request):
+        seria = simplejson.dumps(self.construct(),
+            cls=DateTimeAwareJSONEncoder, ensure_ascii=False, indent=4)
+
+        return seria
+Emitter.register('lazr.restful', LazrRestfulEmitter, 'application/json')
+
+class LazrRestfulHandler(BaseHandler):
+    allowed_methods = ('GET', 'POST')
+
+    response = {}
+
+    baseurl = settings.SSO_ROOT_URL.strip('/')
+
+    def __init__(self):
+        self.response = self.response.copy()
+        for key, value in self.response.items():
+            if key.endswith('_link'):
+                self.response[key] = value % self.baseurl
+
+    def read(self, request):
+        if not 'ws.op' in request.GET:
+            return self.response
+        return self.named_operation(request, request.GET)
+
+    def create(self, request):
+        if not 'ws.op' in request.POST:
+            return HttpResponseBadRequest('No operation name given.')
+        return self.named_operation(request, request.POST)
+
+    def named_operation(self, request, serialized):
+        method_name = serialized['ws.op']
+        method = getattr(self, method_name, None)
+        is_named_operation = getattr(method, 'is_named_operation', False)
+        if not is_named_operation:
+            return HttpResponseBadRequest('No such operation: %s' %
+                method_name)
+        request.data = self.lazr_restful_deserialize(serialized)
+        return method(request)
+
+    def lazr_restful_deserialize(self, serialized):
+        data = {}
+        for key in serialized:
+            if key == 'ws.op':
+                continue
+            data[key] = simplejson.loads(serialized[key])
+        return data
+
+
+class RootHandler(LazrRestfulHandler):
+    allowed_methods = ('GET',)
+
+    response = {
+        "registrations_collection_link": "%s/api/1.0/registration",
+        "captchas_collection_link": "%s/api/1.0/captchas",
+        "validations_collection_link": "%s/api/1.0/validation",
+        "authentications_collection_link": "%s/api/1.0/authentications",
+        "resource_type_link": "%s/api/1.0/#service-root",
+        "accounts_collection_link": "%s/api/1.0/accounts",
+    }
+
+    def read(self, request):
+        if ('application/vd.sun.wadl+xml' in request.META['HTTP_ACCEPT'] or
+            'application/vnd.sun.wadl+xml' in request.META['HTTP_ACCEPT']):
+            context = {'baseurl': self.baseurl}
+            return render_to_response('wadl1.0.xml', context)
+        else:
+            return self.response
+
+class CaptchaHandler(LazrRestfulHandler):
+    response = {
+        "total_size": 0,
+        "start": None,
+        "resource_type_link": "%s/api/1.0/#captchas",
+        "entries": []
+    }
+
+    @named_operation
+    def new(self, request):
+        try:
+            return Captcha.new().serialize()
+        except NewCaptchaError, e:
+            request.environ['oops-dump'] = True
+            logging.warning(e.traceback)
+            logging.warning("Failed to connect to reCaptcha server")
+            # TODO: Some better return here?
+            return e.dummy
+
+
+class RegistrationHandler(LazrRestfulHandler):
+    response = {
+        "total_size": 0,
+        "start": None,
+        "resource_type_link": "%s/api/1.0/#registrations",
+        "entries": []
+    }
+
+    @named_operation
+    def register(self, request):
+        data = request.data
+        data['remote_ip'] = request.environ['REMOTE_ADDR']
+        form = WebserviceCreateAccountForm(data)
+        try:
+            if not form.is_valid():
+                errors = dict((k, map(unicode, v))
+                              for (k, v) in form.errors.items())
+                result = {'status': 'error', 'errors': errors}
+                return result
+        except VerifyCaptchaError, e:
+            request.environment['oops-dump'] = True
+            logging.warning(e.traceback)
+            logging.warning("reCaptcha connection error")
+            return {'status': 'error', 'errors':
+                {'captcha_solution': [
+                    'Unable to verify captcha.  Please try again shortly.']}}
+
+        cleaned_data = form.cleaned_data
+        requested_email = cleaned_data['email']
+        emails = EmailAddress.objects.filter(email__iexact=requested_email)
+        if len(emails) > 0:
+            return {'status': 'error', 'errors':
+                    {'email': ['Email already registered']}}
+
+        account = Account.objects.create(
+            creation_rationale=AccountCreationRationale.OWNER_CREATED_LAUNCHPAD,
+            status=AccountStatus.ACTIVE,
+            displayname=cleaned_data['displayname'])
+
+        account.emailaddress_set.create(
+            email=cleaned_data['email'],
+            status=EmailStatus.NEW)
+
+        AccountPassword.objects.create(
+            password=encrypt_launchpad_password(cleaned_data['password']),
+            account=account)
+
+        token = AuthTokenFactory().new_api_email_validation_token(
+            account, cleaned_data['email'])
+
+        token.sendNewUserEmail('api-newuser.txt')
+
+        account_created.send(sender=self,
+                             openid_identifier=account.openid_identifier)
+
+        return {
+            'status': 'ok',
+            'message': "Email verification required."
+        }
+
+    @named_operation
+    def request_password_reset_token(self, request):
+        data = request.data
+        email = data['email']
+        error = False
+        try:
+            person, account = get_person_and_account_by_email(email)
+        except (CannotResetPasswordException,
+                PersonAndAccountNotFoundException):
+            error = True
+
+        if error or (account is not None and not account.can_reset_password):
+            raise CanNotResetPasswordError(
+                "Can't reset password for this account")
+
+        token = AuthTokenFactory().new(account, email, email,
+                                       LoginTokenType.PASSWORDRECOVERY, None)
+
+        token.sendPasswordResetEmail()
+
+        return {
+            'status': 'ok',
+            'message': "Password reset token sent."
+        }
+
+    @named_operation
+    def set_new_password(self, request):
+        data = request.data
+        new_password = data['new_password']
+        token = AuthToken.objects.get(
+            email=data['email'], token=data['token'],
+            token_type=LoginTokenType.PASSWORDRECOVERY)
+        if not token.requester:
+            token.delete()
+            return {
+                'status': 'error',
+                'message': "Wrong token, request new one."
+            }
+        if not password_policy_compliant(new_password):
+            return {
+                'status': 'error',
+                'errors': [PASSWORD_POLICY_ERROR]
+            }
+        password_obj = token.requester.accountpassword
+        password_obj.password = encrypt_launchpad_password(new_password)
+        password_obj.save()
+
+        token.consume()
+
+        return {
+            'status': 'ok',
+            'message': "Password changed"
+        }
+    
+
+def _serialize_account(user):
+    emails = EmailAddress.objects.filter(account=user,
+                            status=EmailStatus.VALIDATED)
+    preferred_email = user.preferredemail
+    if preferred_email is not None:
+        preferred_email = preferred_email.email
+
+    if user.person:
+        username = user.person.name
+    else:
+        username = user.openid_identifier
+
+    return {
+        'username': username,
+        'displayname': user.displayname,
+        'openid_identifier': user.openid_identifier,
+        'preferred_email': preferred_email,
+        'verified_emails': [e.email for e in emails],
+        'unverified_emails': [e.email for e in user.unverified_emails()],
+    }
+
+
+class AuthenticationHandler(LazrRestfulHandler):
+    """ All these methods assume that they're run behind Basic Auth """
+    response = {
+        "total_size": 0,
+        "start": None,
+        "resource_type_link": "%s/api/1.0/#authentications",
+        "entries": []
+    }
+
+    @plain_user_required
+    @named_operation
+    def authenticate(self, request):
+        data = request.data
+        account = request.user
+        token = account.create_oauth_token(data['token_name'])
+        application_token_created.send(
+            sender=self, openid_identifier=account.openid_identifier)
+        return token.serialize()
+
+    @api_user_required
+    @named_operation
+    def list_tokens(self, request):
+        data = request.data
+        tokens = Token.objects.filter(
+            consumer__user__username=data['consumer_key'])
+        result = [{'token': t.token, 'name': t.name} for t in tokens]
+        return result
+
+    @api_user_required
+    @named_operation
+    def validate_token(self, request):
+        data = request.data
+        try:
+            token = Token.objects.get(
+                consumer__user__username=data['consumer_key'],
+                token=data['token'])
+            return token.serialize()
+        except Token.DoesNotExist:
+            return False
+
+    @api_user_required
+    @named_operation
+    def invalidate_token(self, request):
+        data = request.data
+        tokens = Token.objects.filter(token=data['token'],
+            consumer__user__username=data['consumer_key'])
+        tokens.delete()
+        application_token_invalidated.send(
+            sender=self, openid_identifier=data['consumer_key'])
+
+
+    @api_user_required
+    @named_operation
+    def team_memberships(self, request):
+        data = request.data
+        accounts = Account.objects.filter(
+            openid_identifier=data['openid_identifier'])
+        accounts = list(accounts)
+
+        if len(accounts) == 1:
+            account = accounts[0]
+            memberships = get_team_memberships(data['team_names'],
+                account, False)
+            return memberships
+        else:
+            return []
+
+    @api_user_required
+    @named_operation
+    def account_by_email(self, request):
+        data = request.data
+        account = Account.objects.get_by_email(data['email'])
+        if account:
+            return _serialize_account(account)
+        else:
+            return None
+
+    @api_user_required
+    @named_operation
+    def account_by_openid(self, request):
+        data = request.data
+        try:
+            account = Account.objects.get(openid_identifier=data['openid'])
+        except Account.DoesNotExist:
+            return None
+        else:
+            return _serialize_account(account)
+
+
+class AccountsHandler(LazrRestfulHandler):
+    @named_operation
+    def me(self, request):
+        account = request.user
+        return _serialize_account(account)
+
+    @named_operation
+    def team_memberships(self, request):
+        team_names = request.data['team_names']
+        memberships = get_team_memberships(team_names, request.user, True)
+        return memberships
+
+    @named_operation
+    def validate_email(self, request):
+        email_token = request.data['email_token']
+        try:
+            token = request.user.authtoken_set.get(
+                token=email_token, token_type=LoginTokenType.VALIDATEEMAIL)
+
+            email = EmailAddress.objects.get(email__iexact=token.email)
+            email.status = EmailStatus.VALIDATED
+            email.save()
+
+            token.consume()
+
+            account_email_validated.send(
+                openid_identifier=request.user.openid_identifier,
+                sender=self)
+            return {'email': email.email}
+        except AuthToken.DoesNotExist:
+            return {'errors': {'email_token': ["Bad email token!"]}}

=== added file 'identityprovider/api10/urls.py'
--- identityprovider/api10/urls.py	1970-01-01 00:00:00 +0000
+++ identityprovider/api10/urls.py	2011-05-24 16:31:52 +0000
@@ -0,0 +1,41 @@
+# Copyright 2010 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from django.conf.urls.defaults import patterns, url
+
+from piston.authentication import HttpBasicAuthentication
+from piston.resource import Resource
+
+from identityprovider.api10.handlers import (
+    AccountsHandler,
+    AuthenticationHandler,
+    CaptchaHandler,
+    RegistrationHandler,
+    RootHandler,
+)
+from identityprovider.auth import (
+    basic_authenticate,
+    SSOOAuthAuthentication,
+)
+
+root_resource = Resource(handler=RootHandler)
+captcha_resource = Resource(handler=CaptchaHandler)
+registration_resource = Resource(handler=RegistrationHandler)
+authentication_resource = Resource(handler=AuthenticationHandler,
+    authentication=HttpBasicAuthentication(auth_func=basic_authenticate))
+accounts_resource = Resource(handler=AccountsHandler,
+    authentication=SSOOAuthAuthentication())
+
+urlpatterns = patterns('',
+    url(r'^$', root_resource,
+        kwargs={'emitter_format': 'lazr.restful'}),
+    url(r'^captchas$', captcha_resource,
+        kwargs={'emitter_format': 'lazr.restful'}),
+    url(r'^registration$', registration_resource,
+        kwargs={'emitter_format': 'lazr.restful'}),
+    url(r'^authentications$', authentication_resource,
+        kwargs={'emitter_format': 'lazr.restful'}),
+    url(r'^accounts$', accounts_resource,
+        kwargs={'emitter_format': 'lazr.restful'}),
+)
+

=== modified file 'identityprovider/auth.py'
--- identityprovider/auth.py	2011-03-04 17:09:45 +0000
+++ identityprovider/auth.py	2011-05-24 16:31:52 +0000
@@ -2,9 +2,11 @@
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 from datetime import datetime
+from django.http import HttpResponse
 
 from django.conf import settings
 from oauth_backend.models import Consumer, Token
+from piston.authentication import OAuthAuthentication
 
 from identityprovider.models import Account, AccountPassword, EmailAddress
 from identityprovider.models.api import APIUser
@@ -66,6 +68,30 @@
     return user
 
 
+class SSOOAuthAuthentication(OAuthAuthentication):
+    def is_authenticated(self, request):
+        if not self.is_valid_request(request):
+            return False
+        try:
+            consumer, token, parameters = self.validate_token(request)
+        except oauth.OAuthError, err:
+            return False
+        if not (consumer and token):
+            return False
+        # only allow authentication if account is active
+        account = Account.objects.get(openid_identifier=consumer.key)
+        if not account.is_active:
+            return False
+        request.user = account
+        request.throttle_extra = token.consumer.id
+        return True
+
+    def challenge(self):
+        resp = HttpResponse("Authorization Required")
+        resp['WWW-Authenticate'] = 'OAuth realm="%s"' % self.realm
+        resp.status_code = 401
+        return resp
+
 def oauth_authenticate(oauth_consumer, oauth_token, parameters):
     """Currently only checks that given consumer and token are in database"""
     try:

=== modified file 'identityprovider/models/account.py'
--- identityprovider/models/account.py	2011-05-11 15:29:56 +0000
+++ identityprovider/models/account.py	2011-05-24 16:31:52 +0000
@@ -8,7 +8,6 @@
 from django.contrib.auth.models import User
 from django.db import models
 from django.utils.translation import ugettext_lazy as _
-from zope.interface import classImplements
 
 from oauth_backend.models import Consumer
 
@@ -18,7 +17,6 @@
     encrypt_launchpad_password,
     generate_openid_identifier,
     is_django_13)
-from identityprovider.webservice.interfaces import IAccount
 
 __all__ = (
     'Account',
@@ -293,18 +291,6 @@
         # now go and effectively save it
         super(Account, self).save(force_insert, force_update, **kwargs)
 
-    # IDjangoLocation implementation
-    @property
-    def __parent__(self):
-        from identityprovider.webservice.models import AccountSet
-        return AccountSet()
-
-    @property
-    def __url_path__(self):
-        return str(self.id)
-
-classImplements(Account, IAccount)
-
 
 class AccountPassword(models.Model):
     account = models.OneToOneField(Account, db_column='account')

=== modified file 'identityprovider/preflight.py'
--- identityprovider/preflight.py	2011-03-07 23:22:00 +0000
+++ identityprovider/preflight.py	2011-05-24 16:31:52 +0000
@@ -21,13 +21,13 @@
         return internal_authorize(request.user)
 
     def versions(self):
-        import lazr
         import openid
         import identityprovider
+        import piston.utils
         return [
             {'name': 'SSO', 'version': identityprovider.__version__},
-            {'name': 'lazr.restful', 'version': lazr.restful.__version__},
             {'name': 'openid', 'version': openid.__version__},
+            {'name': 'piston', 'version': piston.utils.get_version()},
         ]
 
 

=== added file 'identityprovider/store.py'
--- identityprovider/store.py	1970-01-01 00:00:00 +0000
+++ identityprovider/store.py	2011-05-24 16:31:52 +0000
@@ -0,0 +1,35 @@
+from oauth.oauth import OAuthToken
+from oauth_backend.models import Token, DataStore
+
+
+class SSODataStore(DataStore):
+    def __init__(self, oauth_request=None):
+        """To serve as a Piston datastore we'll need provide this signature.
+
+        We later won't use the oauth_request, so we can ignore it here.
+        """
+        super(SSODataStore, self).__init__()
+
+    def lookup_token(self, token_type, token_field):
+        """
+        :param token_type: type of token to lookup
+        :param token_field: token to look up
+
+        :note: token_type should always be 'access' as only such tokens are
+               stored in database
+
+        :returns: OAuthToken object
+        """
+        assert token_type == 'access'
+
+        try:
+            token = Token.objects.get(token=token_field)
+            # Piston expects OAuth tokens to have 'consumer' and 'user' atts.
+            # (see piston.authentication.OAuthAuthentication.is_authenticated)
+            oauthtoken = OAuthToken(token.token, token.token_secret)
+            oauthtoken.consumer = token.consumer
+            oauthtoken.user = token.consumer.user
+            return oauthtoken
+        except Token.DoesNotExist:
+            return None
+

=== added file 'identityprovider/templates/wadl1.0.xml'
--- identityprovider/templates/wadl1.0.xml	1970-01-01 00:00:00 +0000
+++ identityprovider/templates/wadl1.0.xml	2011-05-24 16:31:52 +0000
@@ -0,0 +1,1378 @@
+<?xml version="1.0"?>
+<!DOCTYPE application [
+  <!ENTITY nbsp "\&#160;">
+]>
+<wadl:application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                  xmlns="http://research.sun.com/wadl/2006/10"
+                  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                  xmlns:wadl="http://research.sun.com/wadl/2006/10"
+                  xsi:schemaLocation="http://research.sun.com/wadl/2006/10/wadl.xsd">
+
+  <!--There is one "service root" resource, located (as you'd expect)
+      at the service root. This very document is the WADL
+      representation of the "service root" resource.-->
+  <wadl:resources base="{{ baseurl }}/api/1.0/">
+    <wadl:resource path="" type="#service-root"/>
+  </wadl:resources>
+
+  <!--A "service root" resource responds to GET.-->
+  <wadl:resource_type id="service-root">
+    <wadl:doc>The root of the web service.</wadl:doc>
+    <wadl:method name="GET" id="service-root-get">
+      <wadl:response>
+        <wadl:representation href="#service-root-json"/>
+        <wadl:representation mediaType="application/vnd.sun.wadl+xml" id="service-root-wadl"/>
+        </wadl:response>
+      </wadl:method>
+  </wadl:resource_type>
+
+  <!--The JSON representation of a "service root" resource contains a
+      number of links to collection-type resources.-->
+  <wadl:representation mediaType="application/json" id="service-root-json">
+    
+      <wadl:param style="plain"
+                  path="$['registrations_collection_link']"
+                  name="registrations_collection_link">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#registrations"/>
+      </wadl:param>
+    
+    
+      <wadl:param style="plain"
+                  path="$['authentications_collection_link']"
+                  name="authentications_collection_link">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#authentications"/>
+      </wadl:param>
+    
+    
+      <wadl:param style="plain"
+                  path="$['captchas_collection_link']"
+                  name="captchas_collection_link">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#captchas"/>
+      </wadl:param>
+    
+    
+      <wadl:param style="plain"
+                  path="$['accounts_collection_link']"
+                  name="accounts_collection_link">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#accounts"/>
+      </wadl:param>
+    
+    
+      <wadl:param style="plain"
+                  path="$['validations_collection_link']"
+                  name="validations_collection_link">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#accounts"/>
+      </wadl:param>
+    
+    <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+      <wadl:doc>The link to the WADL description of this resource.</wadl:doc>
+      <wadl:link/>
+    </wadl:param>
+  </wadl:representation>
+
+  <!--In addition to the service root, this document describes all the
+      types of resources you might encounter as you browse this web
+      service.-->
+
+  <!--Begin resource_type definitions for collection resources.-->
+  
+    <wadl:resource_type id="accounts">
+      
+      <wadl:method name="GET" id="accounts-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#account-page"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="accounts-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method id="accounts-me" name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Get details for the currently authenticated user.
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="me">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="accounts-team_memberships" name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Query account for team memberships
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="team_memberships">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="team_names">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of team names to check
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="accounts-validate_email" name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Validate email by sending token user received in email
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="validate_email">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email_token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email validation token.
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+    </wadl:resource_type>
+
+  
+  
+    <wadl:resource_type id="authentications">
+      
+      <wadl:method name="GET" id="authentications-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#authentication-page"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="authentications-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method id="authentications-me" name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Get details for the currently authenticated user.
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="me">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-authenticate"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Obtain OAuth token for logged in user
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="authenticate">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="token_name">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Token name.
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-team_memberships"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Query user for team memberships
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="team_memberships">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="team_names">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of team names to check
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="openid_identifier">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+OpenID Identifier used for asking forteam memberships on behalf of other user.
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-validate_token"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+<p>Check that a token is valid.</p>
+<p>If valid, this method return the token and consumer secrets</p>
+
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="validate_token">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+The token you want to validate
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="consumer_key">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+The consumer key (openid identifier)
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-account_by_openid"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Retrieve account information based on OpenID identifier
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="account_by_openid">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="openid">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+OpenID Identifier of the account
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-validate_email"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Validate email by sending token user received in email
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="validate_email">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email_token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email validation token.
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-account_by_email"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Retrieve account information based on email address
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="account_by_email">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email address of the account
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-list_tokens"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Get the currently valid tokens for a given user
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="list_tokens">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="consumer_key">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+User's OpenID identifier
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="authentications-invalidate_token"
+                   name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Make the given token invalid
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="invalidate_token">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+The token you want to invalidate
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="consumer_key">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+The consumer key (openid identifier)
+</wadl:doc>
+              
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+        
+      </wadl:method>
+    </wadl:resource_type>
+
+  
+  
+    <wadl:resource_type id="captchas">
+      
+      <wadl:method name="GET" id="captchas-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#captcha-page"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="captchas-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method id="captchas-new" name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Generate a new captcha
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="new">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+        
+      </wadl:method>
+    </wadl:resource_type>
+
+  
+  
+    <wadl:resource_type id="registrations">
+      
+      <wadl:method name="GET" id="registrations-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#registration-page"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="registrations-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method id="registrations-me" name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Get details for the currently authenticated user.
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="me">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="registrations-team_memberships"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Query account for team memberships
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="team_memberships">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="team_names">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of team names to check
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="registrations-validate_email"
+                   name="GET">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Validate email by sending token user received in email
+</wadl:doc>
+        <wadl:request>
+          
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="validate_email">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email_token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email validation token.
+</wadl:doc>
+              
+            </wadl:param>
+          
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="registrations-request_password_reset_token"
+                   name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Request password reset code to be sent to the email
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="request_password_reset_token">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email address.
+</wadl:doc>
+              
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="registrations-set_new_password"
+                   name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Set new password for given user
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true"
+                        fixed="set_new_password">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="new_password">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+New password
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="token">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Password reset token.
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email address.
+</wadl:doc>
+              
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+        
+      </wadl:method>
+      <wadl:method id="registrations-register" name="POST">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Generate a new captcha
+</wadl:doc>
+        <wadl:request>
+          <wadl:representation
+    mediaType="application/x-www-form-urlencoded">
+            <wadl:param style="query" name="ws.op"
+                        required="true" fixed="register">
+              <wadl:doc>The name of the operation being invoked.</wadl:doc>
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="captcha_solution">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Solution for the generated captcha.
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="captcha_id">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+ID for the generated captcha
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="password">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Password should be at least 8 characters long and contain at least one uppercase letter and a number.
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="false"
+                        name="displayname">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Full name
+</wadl:doc>
+              
+            </wadl:param>
+            <wadl:param style="query" required="true"
+                        name="email">
+             <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Email address.
+</wadl:doc>
+              
+            </wadl:param>
+          </wadl:representation>
+        </wadl:request>
+        
+      </wadl:method>
+    </wadl:resource_type>
+
+  
+  <!--End resource_type definitions for collection resources.-->
+
+  <!--Begin representation and resource_type definitions for entry
+      resources and the collections that contain them. -->
+  
+    <wadl:resource_type id="account">
+      
+      <wadl:method name="GET" id="account-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#account-full"/>
+          <wadl:representation
+    mediaType="application/xhtml+xml" id="account-xhtml"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="account-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method name="PUT" id="account-put">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#account-full"/>
+        </wadl:request>
+      </wadl:method>
+
+      <wadl:method name="PATCH" id="account-patch">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#account-diff"/>
+        </wadl:request>
+      </wadl:method>
+
+      
+
+    </wadl:resource_type>
+
+
+    <wadl:representation mediaType="application/json"
+                         id="account-full">
+      <wadl:param style="plain" name="self_link" path="$['self_link']">
+        <wadl:doc>The canonical link to this resource.</wadl:doc>
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#account"/>
+      </wadl:param>
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:doc>
+          The link to the WADL description of this resource.
+        </wadl:doc>
+        <wadl:link/>
+      </wadl:param>
+      <wadl:param style="plain" name="http_etag" path="$['http_etag']">
+        <wadl:doc>
+          The value of the HTTP ETag for this resource.
+        </wadl:doc>
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <wadl:representation mediaType="application/json"
+                         id="account-diff">
+      <wadl:param style="plain" required="false"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <!--Collection page for this type of entry-->
+    <wadl:resource_type id="account-page-resource">
+      <wadl:method name="GET" id="account-page-resource-get">
+        <wadl:response>
+          <wadl:representation href="#account-page"/>
+        </wadl:response>
+      </wadl:method>
+    </wadl:resource_type>
+
+    <wadl:representation mediaType="application/json"
+                         id="account-page">
+
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:link/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="total_size" path="$['total_size']" required="true"/>
+
+      <wadl:param style="plain" name="start" path="$['start']" required="true"/>
+
+      <wadl:param style="plain" name="next_collection_link" path="$['next_collection_link']">
+        <wadl:link resource_type="#account-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="prev_collection_link" path="$['prev_collection_link']">
+        <wadl:link resource_type="#account-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="entries" path="$['entries']" required="true"/>
+
+      <wadl:param style="plain" name="entry_links" path="$['entries'][*]['self_link']">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#account"/>
+      </wadl:param>
+  </wadl:representation>
+
+  
+  
+    <wadl:resource_type id="authentication">
+      
+      <wadl:method name="GET" id="authentication-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#authentication-full"/>
+          <wadl:representation
+    mediaType="application/xhtml+xml"
+    id="authentication-xhtml"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="authentication-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method name="PUT" id="authentication-put">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#authentication-full"/>
+        </wadl:request>
+      </wadl:method>
+
+      <wadl:method name="PATCH" id="authentication-patch">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#authentication-diff"/>
+        </wadl:request>
+      </wadl:method>
+
+      
+
+    </wadl:resource_type>
+
+
+    <wadl:representation mediaType="application/json"
+                         id="authentication-full">
+      <wadl:param style="plain" name="self_link" path="$['self_link']">
+        <wadl:doc>The canonical link to this resource.</wadl:doc>
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#authentication"/>
+      </wadl:param>
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:doc>
+          The link to the WADL description of this resource.
+        </wadl:doc>
+        <wadl:link/>
+      </wadl:param>
+      <wadl:param style="plain" name="http_etag" path="$['http_etag']">
+        <wadl:doc>
+          The value of the HTTP ETag for this resource.
+        </wadl:doc>
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <wadl:representation mediaType="application/json"
+                         id="authentication-diff">
+      <wadl:param style="plain" required="false"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <!--Collection page for this type of entry-->
+    <wadl:resource_type id="authentication-page-resource">
+      <wadl:method name="GET"
+                   id="authentication-page-resource-get">
+        <wadl:response>
+          <wadl:representation href="#authentication-page"/>
+        </wadl:response>
+      </wadl:method>
+    </wadl:resource_type>
+
+    <wadl:representation mediaType="application/json"
+                         id="authentication-page">
+
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:link/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="total_size" path="$['total_size']" required="true"/>
+
+      <wadl:param style="plain" name="start" path="$['start']" required="true"/>
+
+      <wadl:param style="plain" name="next_collection_link" path="$['next_collection_link']">
+        <wadl:link resource_type="#authentication-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="prev_collection_link" path="$['prev_collection_link']">
+        <wadl:link resource_type="#authentication-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="entries" path="$['entries']" required="true"/>
+
+      <wadl:param style="plain" name="entry_links" path="$['entries'][*]['self_link']">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#authentication"/>
+      </wadl:param>
+  </wadl:representation>
+
+  
+  
+    <wadl:resource_type id="captcha">
+      
+      <wadl:method name="GET" id="captcha-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#captcha-full"/>
+          <wadl:representation
+    mediaType="application/xhtml+xml" id="captcha-xhtml"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="captcha-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method name="PUT" id="captcha-put">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#captcha-full"/>
+        </wadl:request>
+      </wadl:method>
+
+      <wadl:method name="PATCH" id="captcha-patch">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#captcha-diff"/>
+        </wadl:request>
+      </wadl:method>
+
+      
+
+    </wadl:resource_type>
+
+
+    <wadl:representation mediaType="application/json"
+                         id="captcha-full">
+      <wadl:param style="plain" name="self_link" path="$['self_link']">
+        <wadl:doc>The canonical link to this resource.</wadl:doc>
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#captcha"/>
+      </wadl:param>
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:doc>
+          The link to the WADL description of this resource.
+        </wadl:doc>
+        <wadl:link/>
+      </wadl:param>
+      <wadl:param style="plain" name="http_etag" path="$['http_etag']">
+        <wadl:doc>
+          The value of the HTTP ETag for this resource.
+        </wadl:doc>
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['content']" name="content">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Captcha content
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Captcha ID
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <wadl:representation mediaType="application/json"
+                         id="captcha-diff">
+      <wadl:param style="plain" required="false"
+                  path="$['content']" name="content">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Captcha content
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Captcha ID
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <!--Collection page for this type of entry-->
+    <wadl:resource_type id="captcha-page-resource">
+      <wadl:method name="GET" id="captcha-page-resource-get">
+        <wadl:response>
+          <wadl:representation href="#captcha-page"/>
+        </wadl:response>
+      </wadl:method>
+    </wadl:resource_type>
+
+    <wadl:representation mediaType="application/json"
+                         id="captcha-page">
+
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:link/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="total_size" path="$['total_size']" required="true"/>
+
+      <wadl:param style="plain" name="start" path="$['start']" required="true"/>
+
+      <wadl:param style="plain" name="next_collection_link" path="$['next_collection_link']">
+        <wadl:link resource_type="#captcha-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="prev_collection_link" path="$['prev_collection_link']">
+        <wadl:link resource_type="#captcha-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="entries" path="$['entries']" required="true"/>
+
+      <wadl:param style="plain" name="entry_links" path="$['entries'][*]['self_link']">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#captcha"/>
+      </wadl:param>
+  </wadl:representation>
+
+  
+  
+    <wadl:resource_type id="registration">
+      
+      <wadl:method name="GET" id="registration-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#registration-full"/>
+          <wadl:representation
+    mediaType="application/xhtml+xml"
+    id="registration-xhtml"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="registration-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method name="PUT" id="registration-put">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#registration-full"/>
+        </wadl:request>
+      </wadl:method>
+
+      <wadl:method name="PATCH" id="registration-patch">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#registration-diff"/>
+        </wadl:request>
+      </wadl:method>
+
+      
+
+    </wadl:resource_type>
+
+
+    <wadl:representation mediaType="application/json"
+                         id="registration-full">
+      <wadl:param style="plain" name="self_link" path="$['self_link']">
+        <wadl:doc>The canonical link to this resource.</wadl:doc>
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#registration"/>
+      </wadl:param>
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:doc>
+          The link to the WADL description of this resource.
+        </wadl:doc>
+        <wadl:link/>
+      </wadl:param>
+      <wadl:param style="plain" name="http_etag" path="$['http_etag']">
+        <wadl:doc>
+          The value of the HTTP ETag for this resource.
+        </wadl:doc>
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <wadl:representation mediaType="application/json"
+                         id="registration-diff">
+      <wadl:param style="plain" required="false"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <!--Collection page for this type of entry-->
+    <wadl:resource_type id="registration-page-resource">
+      <wadl:method name="GET"
+                   id="registration-page-resource-get">
+        <wadl:response>
+          <wadl:representation href="#registration-page"/>
+        </wadl:response>
+      </wadl:method>
+    </wadl:resource_type>
+
+    <wadl:representation mediaType="application/json"
+                         id="registration-page">
+
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:link/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="total_size" path="$['total_size']" required="true"/>
+
+      <wadl:param style="plain" name="start" path="$['start']" required="true"/>
+
+      <wadl:param style="plain" name="next_collection_link" path="$['next_collection_link']">
+        <wadl:link resource_type="#registration-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="prev_collection_link" path="$['prev_collection_link']">
+        <wadl:link resource_type="#registration-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="entries" path="$['entries']" required="true"/>
+
+      <wadl:param style="plain" name="entry_links" path="$['entries'][*]['self_link']">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#registration"/>
+      </wadl:param>
+  </wadl:representation>
+
+  
+  
+    <wadl:resource_type id="validation">
+      
+      <wadl:method name="GET" id="validation-get">
+        <wadl:response>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#validation-full"/>
+          <wadl:representation
+    mediaType="application/xhtml+xml" id="validation-xhtml"/>
+          <wadl:representation
+    mediaType="application/vnd.sun.wadl+xml"
+    id="validation-wadl"/>
+        </wadl:response>
+      </wadl:method>
+
+      <wadl:method name="PUT" id="validation-put">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#validation-full"/>
+        </wadl:request>
+      </wadl:method>
+
+      <wadl:method name="PATCH" id="validation-patch">
+        <wadl:request>
+          <wadl:representation
+    href="{{ baseurl }}/api/1.0/#validation-diff"/>
+        </wadl:request>
+      </wadl:method>
+
+      
+
+    </wadl:resource_type>
+
+
+    <wadl:representation mediaType="application/json"
+                         id="validation-full">
+      <wadl:param style="plain" name="self_link" path="$['self_link']">
+        <wadl:doc>The canonical link to this resource.</wadl:doc>
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#validation"/>
+      </wadl:param>
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:doc>
+          The link to the WADL description of this resource.
+        </wadl:doc>
+        <wadl:link/>
+      </wadl:param>
+      <wadl:param style="plain" name="http_etag" path="$['http_etag']">
+        <wadl:doc>
+          The value of the HTTP ETag for this resource.
+        </wadl:doc>
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="true"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <wadl:representation mediaType="application/json"
+                         id="validation-diff">
+      <wadl:param style="plain" required="false"
+                  path="$['preferred_email']"
+                  name="preferred_email">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Primary email address
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['unverified_emails']"
+                  name="unverified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of unverified emails
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['id']" name="id">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+Account ID
+</wadl:doc>
+        
+      </wadl:param>
+      <wadl:param style="plain" required="false"
+                  path="$['verified_emails']"
+                  name="verified_emails">
+        <wadl:doc xmlns="http://www.w3.org/1999/xhtml">
+List of verified emails
+</wadl:doc>
+        
+      </wadl:param>
+    </wadl:representation>
+
+    <!--Collection page for this type of entry-->
+    <wadl:resource_type id="validation-page-resource">
+      <wadl:method name="GET"
+                   id="validation-page-resource-get">
+        <wadl:response>
+          <wadl:representation href="#validation-page"/>
+        </wadl:response>
+      </wadl:method>
+    </wadl:resource_type>
+
+    <wadl:representation mediaType="application/json"
+                         id="validation-page">
+
+      <wadl:param style="plain" name="resource_type_link" path="$['resource_type_link']">
+        <wadl:link/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="total_size" path="$['total_size']" required="true"/>
+
+      <wadl:param style="plain" name="start" path="$['start']" required="true"/>
+
+      <wadl:param style="plain" name="next_collection_link" path="$['next_collection_link']">
+        <wadl:link resource_type="#validation-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="prev_collection_link" path="$['prev_collection_link']">
+        <wadl:link resource_type="#validation-page-resource"/>
+      </wadl:param>
+
+      <wadl:param style="plain" name="entries" path="$['entries']" required="true"/>
+
+      <wadl:param style="plain" name="entry_links" path="$['entries'][*]['self_link']">
+        <wadl:link resource_type="{{ baseurl }}/api/1.0/#validation"/>
+      </wadl:param>
+  </wadl:representation>
+
+  
+  <!--End representation and resource_type definitions for entry
+      resources. -->
+
+  <!--Finally, describe the 'hosted binary file' type.-->
+  <wadl:resource_type id="HostedFile">
+    <wadl:method name="GET" id="HostedFile-get">
+      <wadl:response>
+        <wadl:representation status="303">
+          <wadl:param style="header" name="Location"/>
+        </wadl:representation>
+      </wadl:response>
+    </wadl:method>
+    <wadl:method name="PUT" id="HostedFile-put"/>
+    <wadl:method name="DELETE" id="HostedFile-delete"/>
+  </wadl:resource_type>
+
+  <!--Define a data type for binary data.-->
+  <xsd:simpleType name="binary">
+   <xsd:list itemType="byte"/>
+  </xsd:simpleType>
+
+</wadl:application>

=== modified file 'identityprovider/tests/test_forms.py'
--- identityprovider/tests/test_forms.py	2011-01-19 20:57:48 +0000
+++ identityprovider/tests/test_forms.py	2011-05-24 16:31:52 +0000
@@ -6,8 +6,8 @@
 from django.conf import settings
 from identityprovider.models.account import Account
 from identityprovider.forms import EditAccountForm, ResetPasswordForm
-from identityprovider.webservice import forms
-from identityprovider.webservice.forms import WebserviceCreateAccountForm
+from identityprovider.api10 import forms
+from identityprovider.api10.forms import WebserviceCreateAccountForm
 from utils import BasicAccountTestCase, SQLCachedTestCase
 
 
@@ -71,17 +71,11 @@
 class WebServiceCreateAccountFormTest(SQLCachedTestCase):
 
     def setUp(self):
+        self.old_dcv = settings.DISABLE_CAPTCHA_VERIFICATION
         settings.DISABLE_CAPTCHA_VERIFICATION = True
 
-        class Request(object):
-            def __init__(self):
-                self.environment = {}
-                self.form = {'captcha_id': None, 'captcha_solution': None}
-        self.old_get_request = forms.get_current_browser_request
-        forms.get_current_browser_request = lambda: Request()
-
     def tearDown(self):
-        forms.get_current_browser_request = self.old_get_request
+        settings.DISABLE_CAPTCHA_VERIFICATION = self.old_dcv
 
     def test_nonascii_password(self):
         data = {'password': 'Curuzú Cuatiá',

=== renamed file 'identityprovider/tests/test_webservice.py' => 'identityprovider/tests/test_handlers.py'
--- identityprovider/tests/test_webservice.py	2011-03-14 12:51:02 +0000
+++ identityprovider/tests/test_handlers.py	2011-05-24 16:31:52 +0000
@@ -1,72 +1,112 @@
 from mock import patch
 
 from identityprovider.tests.utils import SQLCachedTestCase
-from identityprovider.models.authtoken import (AuthTokenFactory,
-                                               LoginTokenType,
-                                               AuthToken)
-from identityprovider.models.api import APIUser
-from identityprovider.models.account import Account
-from identityprovider.models.const import AccountStatus
-from identityprovider.webservice.models import (
-    RegistrationSet, CanNotResetPasswordError, AuthenticationSet)
-
-
-class RegistrationsTestCase(SQLCachedTestCase):
+from identityprovider.models import (
+    Account,
+    APIUser,
+    AuthToken,
+    AuthTokenFactory,
+    EmailAddress,
+)
+from identityprovider.models.const import (
+    AccountStatus,
+    EmailStatus,
+    LoginTokenType,
+)
+from identityprovider.api10.handlers import (
+    AuthenticationHandler,
+    CanNotResetPasswordError,
+    RegistrationHandler,
+)
+
+class MockRequest(object):
+    def __init__(self, data=None, user=None):
+        self.user = user
+        if data is None:
+            data = {}
+        self.data = data
+        self.environ = {'REMOTE_ADDR': '127.0.0.1'}
+
+class RegistrationHandlerTestCase(SQLCachedTestCase):
 
     fixtures = ["test"]
     pgsql_functions = ["generate_openid_identifier"]
 
     def setUp(self):
-        self.registration = RegistrationSet()
+        self.registration = RegistrationHandler()
 
     def test_authtoken_without_requester_is_handled_properly(self):
         authtoken = AuthTokenFactory().new(None, None, "[e-mail]",
                                            LoginTokenType.PASSWORDRECOVERY,
                                            None)
+        request = MockRequest(data={'email': "[e-mail]",
+            'token': authtoken.token, 'new_password': "pass"})
 
-        response = self.registration.set_new_password("[e-mail]",
-                                                      authtoken.token, "pass")
+        response = self.registration.set_new_password(request)
 
         self.assertEquals(response['status'], "error")
 
     def test_reset_token_when_email_is_invalid(self):
+        request = MockRequest(data={'email': "[e-mail]"})
+        
         self.assertRaises(CanNotResetPasswordError,
                           self.registration.request_password_reset_token,
-                          "[e-mail]")
+                          request)
 
     def test_reset_token_when_account_is_disabled(self):
         account = Account.objects.get_by_email("[e-mail]")
         account.status = AccountStatus.SUSPENDED
         account.save()
+        request = MockRequest(data={'email': "[e-mail]"})
 
         self.assertRaises(CanNotResetPasswordError,
                           self.registration.request_password_reset_token,
-                          "[e-mail]")
+                          request)
 
     def test_reset_password_when_not_existing_token_is_passed(self):
+        request = MockRequest(data={'email': "[e-mail]",
+            'token': "not-existing-token", 'new_password': "password"})
+
         self.assertRaises(AuthToken.DoesNotExist,
-                          self.registration.set_new_password,
-                          "[e-mail]", "not-existing-token",
-                          "password")
+                          self.registration.set_new_password, request)
+
+    def test_register_email_error_is_in_list(self):
+        request = MockRequest(data={
+            'email': "[e-mail]",
+            'password': "blogdf3Daa",
+            'captcha_solution': "solution",
+            'captcha_id': "id",
+        })
+        EmailAddress.objects.create(email="[e-mail]",
+            status=EmailStatus.NEW)
+
+        registration = RegistrationHandler()
+        r = registration.register(request)
+
+        self.assertEquals(r['errors'], {'email': ["Email already registered"]})
 
     def test_register_without_displayname(self):
-        response = self.registration.register(
-            email='[e-mail]',
-            password='MySecretPassword1',
-            captcha_id=1,
-            captcha_solution='foobar')
+        request = MockRequest(data={
+            'email': "[e-mail]",
+            'password': "MySecretPassword1",
+            'captcha_solution': "foobar",
+            'captcha_id': "id",
+        })
+        response = self.registration.register(request)
         self.assertEqual(response['status'], 'ok')
 
         account = Account.objects.get_by_email('[e-mail]')
         self.assertEqual(account.displayname, '')
 
     def test_register_with_displayname(self):
-        response = self.registration.register(
-            email='[e-mail]',
-            password='MySecretPassword1',
-            captcha_id=1,
-            captcha_solution='foobar',
-            displayname='Test User')
+        request = MockRequest(data={
+            'email': "[e-mail]",
+            'password': "MySecretPassword1",
+            'captcha_solution': "foobar",
+            'captcha_id': "id",
+            'displayname': 'Test User',
+        })
+        response = self.registration.register(request)
         self.assertEqual(response['status'], 'ok')
 
         account = Account.objects.get_by_email('[e-mail]')
@@ -78,24 +118,18 @@
     fixtures = ["test"]
 
     def setUp(self):
-        self.authentication = AuthenticationSet()
-
-    @patch('identityprovider.webservice.models.get_current_browser_request')
-    def test_account_by_openid_with_valid_openid(self, mock_get_request):
-        mock_get_request.return_value.environment = {
-            'authenticated_user': APIUser()
-        }
-
-        account = self.authentication.account_by_openid(openid="mark_oid")
+        self.authentication = AuthenticationHandler()
+
+    def test_account_by_openid_with_valid_openid(self):
+        request = MockRequest(user=APIUser(), data={'openid': "mark_oid"})
+
+        account = self.authentication.account_by_openid(request)
 
         self.assertEquals(account['openid_identifier'], "mark_oid")
 
-    @patch('identityprovider.webservice.models.get_current_browser_request')
-    def test_account_by_openid_with_invalid_openid(self, mock_get_request):
-        mock_get_request.return_value.environment = {
-            'authenticated_user': APIUser()
-        }
+    def test_account_by_openid_with_invalid_openid(self):
+        request = MockRequest(user=APIUser(), data={'openid': "bad-openid"})
 
-        account = self.authentication.account_by_openid(openid="bad-openid")
+        account = self.authentication.account_by_openid(request)
 
         self.assertTrue(account is None)

=== modified file 'identityprovider/tests/test_models_account.py'
--- identityprovider/tests/test_models_account.py	2011-01-11 15:50:14 +0000
+++ identityprovider/tests/test_models_account.py	2011-05-24 16:31:52 +0000
@@ -15,7 +15,6 @@
 from identityprovider.models.const import AccountCreationRationale, EmailStatus
 from identityprovider.readonly import ReadOnlyManager
 from identityprovider.utils import encrypt_launchpad_password, generate_salt
-from identityprovider.webservice.models import AccountSet
 
 
 class MockBackend(object):
@@ -242,16 +241,6 @@
         password_count = AccountPassword.objects.filter(account=account).count()
         self.assertEqual(password_count, 0)
 
-    def test_parent(self):
-        account = self.get_existing_account()
-        parent = getattr(account, '__parent__')
-        self.assertTrue(isinstance(parent, AccountSet))
-
-    def test_url_path(self):
-        account = self.get_existing_account()
-        url_path = getattr(account, '__url_path__')
-        self.assertEqual(url_path, str(account.id))
-
     def test_create_account_with_rationale(self):
         salt = generate_salt()
         account = Account.objects.create_account('displayname', 'username',

=== modified file 'identityprovider/tests/test_models_api.py'
--- identityprovider/tests/test_models_api.py	2010-09-22 14:36:08 +0000
+++ identityprovider/tests/test_models_api.py	2011-05-24 16:31:52 +0000
@@ -5,8 +5,6 @@
 from identityprovider.models.emailaddress import EmailAddress
 from identityprovider.models.const import EmailStatus
 from identityprovider.models.api import APIUser
-from identityprovider.webservice.models import RegistrationSet
-from identityprovider.webservice import forms
 from identityprovider.tests.utils import SQLCachedTestCase
 from identityprovider.utils import encrypt_launchpad_password, generate_salt
 
@@ -45,22 +43,3 @@
     def test_unicode(self):
         self.assertEqual(unicode(self.user), u'username')
 
-
-class RegistrationSetTestCase(TestCase):
-
-    def test_register_email_error_is_in_list(self):
-        old_gcbr = forms.get_current_browser_request
-        forms.get_current_browser_request = lambda: self
-        self.environment = {}
-        EmailAddress.objects.create(email="[e-mail]",
-                                    status=EmailStatus.NEW)
-
-        registration = RegistrationSet()
-        r = registration.register(email="[e-mail]",
-                                  password="blogdf3Daa",
-                                  captcha_solution="solution",
-                                  captcha_id="id")
-
-        self.assertEquals(r['errors'], {'email': ["Email already registered"]})
-
-        forms.get_current_browser_request = old_gcbr

=== removed file 'identityprovider/tests/test_wsgi.py'
--- identityprovider/tests/test_wsgi.py	2010-11-15 16:24:53 +0000
+++ identityprovider/tests/test_wsgi.py	1970-01-01 00:00:00 +0000
@@ -1,71 +0,0 @@
-from mock import Mock
-
-from unittest import TestCase
-from identityprovider.wsgi import WSGIDispatch, make_app
-
-
-
-class StubWSGIApp(object):
-
-    def __init__(self):
-        self.called = False
-
-    def __call__(self, environ, start_response):
-        self.called = True
-        return []
-
-
-
-class WSGIDispatchTestCase(TestCase):
-
-
-    def setUp(self):
-        self.app_1 = StubWSGIApp()
-        self.app_2 = StubWSGIApp()
-        self.default_app = StubWSGIApp()
-        self.mapping = (('/a1', self.app_1), ('/a2', self.app_2))
-        self.dispatch = WSGIDispatch(self.mapping, self.default_app)
-
-
-    def call_dispatch_with_path(self, path):
-        self.dispatch({'PATH_INFO': path}, lambda x: x)
-
-
-    def test_call_is_routed_to_the_right_application(self):
-        self.call_dispatch_with_path('/a1')
-
-        self.assertTrue(self.app_1.called)
-
-
-    def test_call_is_routed_to_default_if_path_is_not_matching(self):
-        self.call_dispatch_with_path('/other')
-
-        self.assertTrue(self.default_app.called)
-
-
-
-class MakeAppTestCase(TestCase):
-
-
-    def test_make_sure_that_callable_is_returned(self):
-        app = make_app()
-
-        self.assertTrue(callable(app))
-
-
-    def test_oops_from_api_contain_traceback(self):
-        environ = {
-            'REQUEST_METHOD': 'get',
-            'SERVER_NAME': 'test',
-            'SERVER_PORT': 80,
-            'PATH_INFO': '/api/1.0/',
-        }
-
-        mock_app = Mock()
-        mock_app.side_effect = Exception("App error")
-
-        app = make_app()
-        app.mapping[0][1].application = mock_app
-        app(environ, Mock())
-
-        self.assertTrue('oops-dump' in environ)

=== modified file 'identityprovider/urls.py'
--- identityprovider/urls.py	2011-03-04 17:09:45 +0000
+++ identityprovider/urls.py	2011-05-24 16:31:52 +0000
@@ -126,3 +126,8 @@
     urlpatterns += patterns('identityprovider.views.ui',
         (r'^\+(?P<page_name>description|faq)$', 'static_page'),
     )
+
+# Lazr.restful backwards compatible api
+urlpatterns += patterns('',
+    (r'api/1.0/', include('identityprovider.api10.urls')),
+)

=== removed directory 'identityprovider/webservice'
=== removed file 'identityprovider/webservice/__init__.py'
--- identityprovider/webservice/__init__.py	2010-04-21 15:29:24 +0000
+++ identityprovider/webservice/__init__.py	1970-01-01 00:00:00 +0000
@@ -1,2 +0,0 @@
-# Copyright 2010 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).

=== removed file 'identityprovider/webservice/forms.py'
--- identityprovider/webservice/forms.py	2011-03-14 12:51:02 +0000
+++ identityprovider/webservice/forms.py	1970-01-01 00:00:00 +0000
@@ -1,65 +0,0 @@
-# Copyright 2010 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-# We use Django forms for webservice input validation
-
-from django import forms
-from django.forms import fields
-from django.utils.translation import ugettext as _
-from lazr.restful.utils import get_current_browser_request
-
-from identityprovider.utils import password_policy_compliant
-from identityprovider.models.captcha import Captcha, VerifyCaptchaError
-
-
-PASSWORD_POLICY_ERROR = _("Password must be at least "
-                          "8 characters long, and must contain at least one "
-                          "number and an upper case letter.")
-
-
-class WebserviceCreateAccountForm(forms.Form):
-    email = fields.EmailField()
-    password = fields.CharField(max_length=256)
-    captcha_id = fields.CharField(max_length=1024)
-    captcha_solution = fields.CharField(max_length=256)
-    displayname = fields.CharField(required=False)
-    remote_ip = fields.CharField(max_length=256)
-
-    def clean_password(self):
-        if 'password' in self.cleaned_data:
-            password = self.cleaned_data['password']
-            try:
-                str(password)
-            except UnicodeEncodeError:
-                raise forms.ValidationError(
-                    _("Invalid characters in password"))
-            if not password_policy_compliant(password):
-                raise forms.ValidationError(PASSWORD_POLICY_ERROR)
-            return password
-
-    def clean(self):
-        cleaned_data = self.cleaned_data
-        captcha_id = cleaned_data.get('captcha_id')
-        captcha_solution = cleaned_data.get('captcha_solution')
-
-        # The remote IP address is absolutely required, and comes from
-        # SSO itself, not from the client.  If it's missing, it's a
-        # programming error, and should not be returned to the client
-        # as a validation error.  So, we use a normal key lookup here.
-        remote_ip = cleaned_data['remote_ip']
-
-        request = get_current_browser_request()
-
-        captcha = Captcha(captcha_id)
-
-        try:
-            if captcha.verify(captcha_solution, remote_ip):
-                return cleaned_data
-        except VerifyCaptchaError, e:
-            if getattr(request.environment, '__setitem__', False):
-                request.environment['oops-dump'] = True
-            logging.warning(e.traceback)
-            logging.warning("reCaptcha connection error")
-
-        # not verified
-        raise forms.ValidationError(_("Wrong captcha solution."))

=== removed file 'identityprovider/webservice/interfaces.py'
--- identityprovider/webservice/interfaces.py	2011-03-14 12:51:02 +0000
+++ identityprovider/webservice/interfaces.py	1970-01-01 00:00:00 +0000
@@ -1,191 +0,0 @@
-# Copyright 2010 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-from lazr.restful.frameworks.django import IDjangoLocation
-from lazr.restful.declarations import (export_as_webservice_entry,
-    collection_default_content, exported, export_write_operation,
-    export_as_webservice_collection, operation_parameters,
-    export_read_operation)
-from zope.schema import Text, TextLine, List
-
-
-__all__ = [
-    'IAccount',
-    'ICaptcha',
-    'IAccountSet',
-    'ICaptchaSet',
-    'IRegistrationSet',
-    'IValidationSet',
-    'IAuthenticationSet'
-]
-
-
-class IAccount(IDjangoLocation):
-    export_as_webservice_entry()
-    id = exported(Text(title=u"Account ID"))
-    preferred_email = exported(Text(title=u"Primary email address"))
-    verified_emails = exported(List(title=u"List of verified emails",
-                      value_type=Text()))
-    unverified_emails = exported(List(value_type=Text(),
-                        title=u"List of unverified emails"))
-
-
-class IRegistration(IAccount):
-    export_as_webservice_entry()
-
-
-class IValidation(IAccount):
-    export_as_webservice_entry()
-
-
-class IAuthentication(IAccount):
-    export_as_webservice_entry()
-
-
-class ICaptcha(IDjangoLocation):
-    export_as_webservice_entry()
-    id = exported(Text(title=u"Captcha ID"))
-    content = exported(Text(title=u"Captcha content"))
-
-
-class IAccountSet(IDjangoLocation):
-    export_as_webservice_collection(IAccount)
-
-    @collection_default_content()
-    def getAll():
-        """Fail, as no default content should be provided."""
-
-    def get(request, unique_id):
-        """Retrieve a account by its ID."""
-
-    @export_read_operation()
-    def me():
-        """ Get details for the currently authenticated user. """
-
-    @operation_parameters(
-        team_names=List(title=u"List of team names to check",
-                        value_type=Text())
-        )
-    @export_read_operation()
-    def team_memberships(team_names):
-        """Query account for team memberships"""
-
-    @operation_parameters(
-        email_token=TextLine(title=u"Email validation token."))
-    @export_read_operation()
-    def validate_email(email_token):
-        """Validate email by sending token user received in email"""
-
-
-class IAuthenticationSet(IAccountSet):
-    export_as_webservice_collection(IAuthentication)
-
-    @collection_default_content()
-    def getAll():
-        """Fail, as no default content should be provided."""
-
-    @operation_parameters(
-        token_name=TextLine(title=u"Token name."))
-    @export_read_operation()
-    def authenticate(token_name):
-        """Obtain OAuth token for logged in user"""
-
-    @operation_parameters(
-        consumer_key=TextLine(title=u"User's OpenID identifier"))
-    @export_read_operation()
-    def list_tokens(consumer_key):
-        """ Get the currently valid tokens for a given user """
-
-    @operation_parameters(
-        token=TextLine(title=u"The token you want to validate"),
-        consumer_key=TextLine(title=u"The consumer key (openid identifier)")
-        )
-    @export_read_operation()
-    def validate_token(token, consumer_key):
-        """Check that a token is valid.
-
-        If valid, this method return the token and consumer secrets
-        """
-
-    @operation_parameters(
-        token=TextLine(title=u"The token you want to invalidate"),
-        consumer_key=TextLine(title=u"The consumer key (openid identifier)")
-        )
-    @export_write_operation()
-    def invalidate_token(token, consumer_key):
-        """ Make the given token invalid """
-
-    @operation_parameters(
-        team_names=List(title=u"List of team names to check",
-                        value_type=Text()),
-        openid_identifier=Text(title=u"OpenID Identifier used for asking for"
-                               u"team memberships on behalf of other user.")
-        )
-    @export_read_operation()
-    def team_memberships(team_names, openid_identifier):
-        """Query user for team memberships"""
-
-    @operation_parameters(
-        email=Text(title=u"Email address of the account"))
-    @export_read_operation()
-    def account_by_email(email):
-        """Retrieve account information based on email address"""
-
-    @operation_parameters(
-        openid=Text(title=u"OpenID Identifier of the account"))
-    @export_read_operation()
-    def account_by_openid(openid):
-        """Retrieve account information based on OpenID identifier"""
-
-
-class IValidationSet(IAccountSet):
-    pass
-
-
-class IRegistrationSet(IAccountSet):
-    export_as_webservice_collection(IRegistration)
-
-    @collection_default_content()
-    def getAll():
-        """Fail, as no default content should be provided."""
-
-    @operation_parameters(
-        email=TextLine(title=u"Email address."),
-        password=TextLine(title=u"Password should be at least 8 "
-            "characters long and contain at least one uppercase letter "
-            "and a number."),
-        captcha_id=TextLine(title=u"ID for the generated captcha"),
-        captcha_solution=TextLine(title=u"Solution for the generated "
-            "captcha."),
-        displayname=TextLine(title=u"Full name", required=False))
-    @export_write_operation()
-    def register(email, password, captcha_id, captcha_solution, displayname=''):
-        """ Generate a new captcha """
-
-    @operation_parameters(email=TextLine(title=u"Email address."))
-    @export_write_operation()
-    def request_password_reset_token(email):
-        """Request password reset code to be sent to the email"""
-
-    @operation_parameters(
-        email=TextLine(title=u"Email address."),
-        token=TextLine(title=u"Password reset token."),
-        new_password=TextLine(title=u"New password"))
-    @export_write_operation()
-    def set_new_password(email, token, new_password):
-        """Set new password for given user"""
-
-
-class ICaptchaSet(IDjangoLocation):
-    export_as_webservice_collection(ICaptcha)
-
-    @collection_default_content()
-    def getAll():
-        """Fail, as no default content should be provided."""
-
-    def get(request, unique_id):
-        """Retrieve a captcha by its ID."""
-
-    @export_write_operation()
-    def new():
-        """ Generate a new captcha """

=== removed file 'identityprovider/webservice/models.py'
--- identityprovider/webservice/models.py	2011-03-14 12:51:02 +0000
+++ identityprovider/webservice/models.py	1970-01-01 00:00:00 +0000
@@ -1,389 +0,0 @@
-# Copyright 2010 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-from zope.component import getUtility
-from zope.interface import implements, classImplements
-
-from lazr.restful.interfaces import IServiceRootResource
-from lazr.restful.simple import (RootResourceAbsoluteURL, RootResource,
-                                 TraverseWithGet)
-from lazr.restful.frameworks.django import DjangoWebServiceConfiguration
-from lazr.restful.wsgi import BaseWSGIWebServiceConfiguration
-from lazr.restful.utils import get_current_browser_request
-from lazr.restful.declarations import webservice_error
-
-from oauth_backend.models import Token
-from identityprovider.models import (Account, EmailAddress,
-                 AccountPassword, APIUser, Person)
-from identityprovider.models.const import (
-    AccountCreationRationale, AccountStatus, EmailStatus, LoginTokenType)
-from identityprovider.models.authtoken import AuthToken, AuthTokenFactory
-from identityprovider.utils import encrypt_launchpad_password
-from identityprovider.utils import password_policy_compliant
-
-from identityprovider.webservice.interfaces import (IAccount, ICaptcha,
-    IRegistration, IValidation, IAuthentication, IAccountSet,
-    IAuthenticationSet, IRegistrationSet, ICaptchaSet)
-from identityprovider.webservice.forms import (
-    WebserviceCreateAccountForm, PASSWORD_POLICY_ERROR)
-from identityprovider.models.captcha import (
-    Captcha as CaptchaModel,
-    NewCaptchaError,
-)
-from identityprovider.views.server import get_team_memberships
-from identityprovider.utils import (CannotResetPasswordException,
-    PersonAndAccountNotFoundException, get_person_and_account_by_email)
-from identityprovider.signals import (application_token_invalidated,
-                                      application_token_created,
-                                      account_email_validated,
-                                      account_created)
-
-
-def api_user_required(func):
-    def wrapper(*args, **kwargs):
-        request = get_current_browser_request()
-        user = request.environment.get('authenticated_user')
-        if user:
-            if isinstance(user, APIUser):
-                return func(*args, **kwargs)
-        request.response.setStatus(403)
-        return '403 Forbidden'
-    return wrapper
-
-
-class RootAbsoluteURL(RootResourceAbsoluteURL):
-    """
-    This class contains no code of its own. It's defined so that grok will pick
-    it up.
-    """
-
-
-# Create set objects for top-level collections, which are all
-# pretty much the same.
-def make_set(name, url_path, interface, manager, id_field):
-    """Create a object to publish as a top-level collection."""
-    def getAll(self):
-        return []
-
-    def get(self, request, unique_id):
-        return manager.objects.get(**{id_field: unique_id})
-
-    def __parent__(self):
-        return getUtility(IServiceRootResource)
-
-    dict = {'getAll': getAll,
-             'get': get,
-             '__parent__': property(__parent__),
-             '__url_path__': url_path}
-
-    set_class = type(name, (TraverseWithGet,), dict)
-    classImplements(set_class, interface)
-    return set_class
-
-def _serialize_account(user):
-    emails = EmailAddress.objects.filter(account=user,
-                            status=EmailStatus.VALIDATED)
-    preferred_email = user.preferredemail
-    if preferred_email is not None:
-        preferred_email = preferred_email.email
-
-    if user.person:
-        username = user.person.name
-    else:
-        username = user.openid_identifier
-
-    return {
-        'username': username,
-        'displayname': user.displayname,
-        'openid_identifier': user.openid_identifier,
-        'preferred_email': preferred_email,
-        'verified_emails': [e.email for e in emails],
-        'unverified_emails': [e.email for e in user.unverified_emails()],
-    }
-
-
-
-ValidationSet = make_set('ValidationSet', 'validation', IAccountSet,
-                            Account, 'id')
-
-
-class AccountSet(make_set('BaseAccountSet', 'accounts', IAccountSet,
-                            Account, 'id')):
-    """ These methods are protected with OAuth."""
-    def me(self):
-        request = get_current_browser_request()
-        user = request.environment.get('authenticated_user')
-        return _serialize_account(user)
-
-    def team_memberships(self, team_names):
-        request = get_current_browser_request()
-        user = request.environment['authenticated_user']
-        memberships = get_team_memberships(team_names, user, True)
-        return memberships
-
-    def validate_email(self, email_token):
-        request = get_current_browser_request()
-        user = request.environment['authenticated_user']
-        try:
-            token = user.authtoken_set.get(
-                token=email_token, token_type=LoginTokenType.VALIDATEEMAIL)
-
-            email = EmailAddress.objects.get(email__iexact=token.email)
-            email.status = EmailStatus.VALIDATED
-            email.save()
-
-            token.consume()
-
-            account_email_validated.send(
-                openid_identifier=user.openid_identifier,
-                sender=self)
-            return {'email': email.email}
-        except AuthToken.DoesNotExist:
-            return {'errors': {'email_token': ["Bad email token!"]}}
-
-
-def plain_user_required(func):
-    def wrapper(*args, **kwargs):
-        request = get_current_browser_request()
-        user = request.environment.get('authenticated_user')
-        if user:
-            if isinstance(user, Account):
-                return func(*args, **kwargs)
-        request.response.setStatus(403)
-        return '403 Forbidden'
-    return wrapper
-
-
-class AuthenticationSet(make_set('BaseAuthenticationSet', 'authentications',
-                                 IAuthenticationSet, Account, 'id')):
-    """ All these methods assume that they're run behind Basic Auth """
-    @plain_user_required
-    def authenticate(self, token_name):
-        request = get_current_browser_request()
-        account = request.environment['authenticated_user']
-        token = account.create_oauth_token(token_name)
-        application_token_created.send(
-            sender=self, openid_identifier=account.openid_identifier)
-        return token.serialize()
-
-    @api_user_required
-    def list_tokens(self, consumer_key):
-        tokens = Token.objects.filter(
-            consumer__user__username=consumer_key)
-        result = [{'token': t.token, 'name': t.name} for t in tokens]
-        return result
-
-    @api_user_required
-    def validate_token(self, token, consumer_key):
-        try:
-            token = Token.objects.get(
-                consumer__user__username=consumer_key,
-                token=token)
-            return token.serialize()
-        except Token.DoesNotExist:
-            return False
-
-    @api_user_required
-    def invalidate_token(self, token, consumer_key):
-        tokens = Token.objects.filter(token=token,
-            consumer__user__username=consumer_key)
-        tokens.delete()
-        application_token_invalidated.send(
-            sender=self, openid_identifier=consumer_key)
-
-
-    @api_user_required
-    def team_memberships(self, team_names, openid_identifier):
-        accounts = Account.objects.filter(openid_identifier=openid_identifier)
-        accounts = list(accounts)
-
-        if len(accounts) == 1:
-            account = accounts[0]
-            memberships = get_team_memberships(team_names, account, False)
-            return memberships
-        else:
-            return []
-
-    @api_user_required
-    def account_by_email(self, email):
-        account = Account.objects.get_by_email(email)
-        if account:
-            return _serialize_account(account)
-        else:
-            return None
-
-    @api_user_required
-    def account_by_openid(self, openid):
-        try:
-            account = Account.objects.get(openid_identifier=openid)
-        except Account.DoesNotExist:
-            return None
-        else:
-            return _serialize_account(account)
-
-class CanNotResetPasswordError(Exception):
-    webservice_error(403)
-
-
-class RegistrationSet(make_set('BaseRegistrationSet', 'registration',
-                               IRegistrationSet, Account, 'id')):
-    def register(self, **kwargs):
-        request = get_current_browser_request()
-        # TODO: request doesn't exist in a test, unless we go through
-        # the test client browser.
-        if request is None:
-            kwargs['remote_ip'] = '127.0.0.1'
-        else:
-            if hasattr(request, 'environment'):
-                kwargs['remote_ip'] = request.environment['REMOTE_ADDR']
-            else:
-                kwargs['remote_ip'] = request.environ['REMOTE_ADDR']
-        form = WebserviceCreateAccountForm(kwargs)
-        if not form.is_valid():
-            errors = dict((k, map(unicode, v))
-                          for (k, v) in form.errors.items())
-            result = {'status': 'error', 'errors': errors}
-            return result
-
-        cleaned_data = form.cleaned_data
-        requested_email = cleaned_data['email']
-        emails = EmailAddress.objects.filter(email__iexact=requested_email)
-        if len(emails) > 0:
-            return {'status': 'error', 'errors':
-                    {'email': ['Email already registered']}}
-
-        account = Account.objects.create(
-            creation_rationale=AccountCreationRationale.OWNER_CREATED_LAUNCHPAD,
-            status=AccountStatus.ACTIVE,
-            displayname=cleaned_data.get('displayname', ''))
-
-        account.emailaddress_set.create(
-            email=cleaned_data['email'],
-            status=EmailStatus.NEW)
-
-        AccountPassword.objects.create(
-            password=encrypt_launchpad_password(cleaned_data['password']),
-            account=account)
-
-        token = AuthTokenFactory().new_api_email_validation_token(
-            account, cleaned_data['email'])
-
-        token.sendNewUserEmail('api-newuser.txt')
-
-        account_created.send(sender=self,
-                             openid_identifier=account.openid_identifier)
-
-        return {
-            'status': 'ok',
-            'message': "Email verification required."
-        }
-
-    def request_password_reset_token(self, email):
-        error = False
-        try:
-            person, account = get_person_and_account_by_email(email)
-        except (CannotResetPasswordException,
-                PersonAndAccountNotFoundException):
-            error = True
-
-        if error or (account is not None and not account.can_reset_password):
-            raise CanNotResetPasswordError(
-                "Can't reset password for this account")
-
-        token = AuthTokenFactory().new(account, email, email,
-                                       LoginTokenType.PASSWORDRECOVERY, None)
-
-        token.sendPasswordResetEmail()
-
-        return {
-            'status': 'ok',
-            'message': "Password reset token sent."
-        }
-
-    def set_new_password(self, email, token, new_password):
-        token = AuthToken.objects.get(
-            email=email, token=token,
-            token_type=LoginTokenType.PASSWORDRECOVERY)
-        if not token.requester:
-            token.delete()
-            return {
-                'status': 'error',
-                'message': "Wrong token, request new one."
-            }
-        if not password_policy_compliant(new_password):
-            return {
-                'status': 'error',
-                'errors': [PASSWORD_POLICY_ERROR]
-            }
-        password_obj = token.requester.accountpassword
-        password_obj.password = encrypt_launchpad_password(new_password)
-        password_obj.save()
-
-        token.consume()
-
-        return {
-            'status': 'ok',
-            'message': "Password changed"
-        }
-
-
-class Captcha(object):
-    implements(ICaptcha)
-    message = ''
-    date_created = ''
-
-    @property
-    def content(self):
-        return ''
-
-    def __unicode__(self):
-        return "%s" % (self.id,)
-
-    # IDjangoLocation implementation
-    @property
-    def __parent__(self):
-        from identityprovider.webservice.models import CaptchaSet
-        return CaptchaSet()
-
-    @property
-    def __url_path__(self):
-        return str(self.id)
-
-
-class CaptchaSet(make_set('BaseCaptchaSet', 'captchas', ICaptchaSet,
-                          Captcha, 'id')):
-    def new(self):
-        request = get_current_browser_request()
-        try:
-            return CaptchaModel.new().serialize()
-        except NewCaptchaError, e:
-            request.environment['oops-dump'] = True
-            logging.warning(e.traceback)
-            logging.warning("Failed to connect to reCaptcha server")
-            # TODO: Some better return here?
-            return e.dummy
-
-
-
-class SSOWebServiceRootResource(RootResource):
-    """The root resource for the web service"""
-
-    def _build_top_level_objects(self):
-        """Create data structure of top level objects."""
-        collections = {
-            'captchas': (ICaptcha, CaptchaSet()),
-            'registration': (IRegistration, RegistrationSet()),
-            'validation': (IValidation, ValidationSet()),
-            'accounts': (IAccount, AccountSet()),
-            'authentications': (IAuthentication, AuthenticationSet()),
-        }
-        return collections, {}
-
-
-class WebServiceConfiguration(DjangoWebServiceConfiguration,
-                              BaseWSGIWebServiceConfiguration):
-    """Configuration information for this web service.
-
-    This class contains no code of its own. It's defined so that grok
-    will pick it up. The actual configuration is in settings.py.
-    """

=== removed file 'identityprovider/webservice/site.zcml'
--- identityprovider/webservice/site.zcml	2010-04-21 15:29:24 +0000
+++ identityprovider/webservice/site.zcml	1970-01-01 00:00:00 +0000
@@ -1,15 +0,0 @@
-<!-- -*- xml -*- -->
-<configure xmlns="http://namespaces.zope.org/zope"
-  xmlns:webservice="http://namespaces.canonical.com/webservice"
-  xmlns:grok="http://namespaces.zope.org/grok">
-  <!-- Copyright 2010 Canonical Ltd.  This software is licensed under the
-  GNU Affero General Public License version 3 (see the file  LICENSE). -->
-
-  <include package="lazr.restful" file="basic-site.zcml" />
-  <include package="lazr.restful.frameworks" file="django.zcml" />
-  <webservice:register module="identityprovider.webservice.interfaces" />
-  <grok:grok package="identityprovider.webservice" />
-
-  <securityPolicy
-    component="zope.security.simplepolicies.PermissiveSecurityPolicy" />
-</configure>

=== modified file 'identityprovider/wsgi.py'
--- identityprovider/wsgi.py	2010-12-22 15:23:55 +0000
+++ identityprovider/wsgi.py	2011-05-24 16:31:52 +0000
@@ -1,90 +1,7 @@
 # Copyright 2010 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
-import logging
-import traceback
-
 from django.core.handlers.wsgi import WSGIHandler
-from django.conf import settings
-
-from lazr.restful.wsgi import WSGIApplication
-from lazr.authentication.wsgi import BasicAuthMiddleware, OAuthMiddleware
-from identityprovider.auth import basic_authenticate, oauth_authenticate
-from oauth_backend.models import DataStore
-
-
-
-class WSGIDispatch(object):
-    """
-    Dispatch request to various WSGI applications based on beginning of the
-    PATH_INFO.
-
-    """
-    def __init__(self, mapping, default_application):
-        """
-        :param mapping: iterable with each item as (url, wsgi application)
-        :param default_application: application to use if none of urls are
-                                    matching
-        """
-        self.mapping = mapping
-        self.default_application = default_application
-
-
-    def __call__(self, environ, start_response):
-        path_info = environ.get('PATH_INFO', '/')
-        for app_url, app in self.mapping:
-            if path_info.startswith(app_url):
-                return app(environ, start_response)
-        return self.default_application(environ, start_response)
-
-
-
-class OopsTracebackReporter(object):
-
-
-    def __init__(self, application):
-        self.application = application
-
-
-    def __call__(self, environ, start_response):
-        try:
-            return self.application(environ, start_response)
-        except Exception:
-            environ['oops-dump'] = True
-            logging.warning(traceback.format_exc())
-            start_response("500 Internal Server Error",
-                           [("Content-type", "text/plain")])
-            return ["An unexpected error occurred while "
-                    "processing an API request"]
-
-
 
 def make_app():
-    api_re_prefix = r"/api/[\d.]+/"
-
     django = WSGIHandler()
-
-    if not getattr(WSGIApplication, 'configured', False):
-        WSGIApplication.configure_server(settings.API_HOST, None,
-            'identityprovider.webservice')
-        WSGIApplication.configured = True
-
-    lazr_restful = WSGIApplication
-
-    basic = BasicAuthMiddleware(
-        lazr_restful,
-        authenticate_with=basic_authenticate,
-        protect_path_pattern=api_re_prefix + "authentications"
-    )
-
-    oauth = OAuthMiddleware(
-        basic,
-        authenticate_with=oauth_authenticate,
-        data_store=DataStore(),
-        protect_path_pattern=api_re_prefix + "accounts"
-    )
-
-    api = OopsTracebackReporter(oauth)
-
-    dispatch = WSGIDispatch([('/api/1.0', api)], django)
-
-    return dispatch
+    return django

=== modified file 'mockservice/sso_mockserver/mockserver.py'
--- mockservice/sso_mockserver/mockserver.py	2011-03-14 15:55:46 +0000
+++ mockservice/sso_mockserver/mockserver.py	2011-05-24 16:31:52 +0000
@@ -148,7 +148,7 @@
         return
 
     def fail403(self):
-        status = '403 Forbidden'
+        status = '403 FORBIDDEN'
         headers = [('Content-type', 'text/plain')]
         self.start_response(status, headers)
         return
@@ -236,17 +236,17 @@
                 op = form['ws.op']
                 if op == 'authenticate':
                     if not self.check_plain_user():
-                        return ['403 Forbidden']
+                        return ['403 FORBIDDEN']
                     token = new_token(form['token_name'])
                     return self.jsons(json=token)
                 elif op == 'validate_token':
                     if not self.check_server_user():
-                        return ['403 Forbidden']
+                        return ['403 FORBIDDEN']
                     token = tokens[form['token']]
                     return self.jsons(json=simplejson.dumps(token))
                 elif op == 'list_tokens':
                     if not self.check_server_user():
-                        return ['403 Forbidden']
+                        return ['403 FORBIDDEN']
                     result = [{'token': t['token'], 'name': t['name']}
                               for t in tokens.values()
                               if t['consumer_key'] == form['consumer_key']
@@ -276,7 +276,7 @@
                 op = form['ws.op']
                 if op == 'invalidate_token':
                     if not self.check_server_user():
-                        return ['403 Forbidden']
+                        return ['403 FORBIDDEN']
                     if form['token'] in tokens:
                         del tokens[form['token']]
                     return self.jsons(json='null')

=== modified file 'payload/__init__.py'
--- payload/__init__.py	2011-05-11 16:21:15 +0000
+++ payload/__init__.py	2011-05-24 16:31:52 +0000
@@ -47,7 +47,6 @@
     _check_psycopg2_conflicts()
     # bootstrap
     setup_virtualenv()
-    _bootstrap_dependencies()
     install_dependencies()
     _setup_configuration()
 
@@ -157,13 +156,6 @@
         sys.exit(1)
 
 
-def _bootstrap_dependencies():
-    virtualenv('pip install bzr==2.1.1 '
-        '-f http://launchpad.net/'
-        'bzr/2.1/2.1.1/+download/bzr-2.1.1.tar.gz#egg=bzr-2.1.1')
-    virtualenv('pip install lazr.batchnavigator==1.0')
-
-
 def _setup_configuration():
     """Setup the configuration branch."""
     if os.path.exists('django_project/.config'):

=== modified file 'requirements.txt'
--- requirements.txt	2011-03-04 16:49:25 +0000
+++ requirements.txt	2011-05-24 16:31:52 +0000
@@ -1,56 +1,5 @@
-# extra (implicit) dependencies.
-# Made explicit in order to pin them down to versions available on Lucid.
-RestrictedPython==3.5.1
-ZConfig==2.7.1
-ZODB3==3.9.4
-docutils==0.6
-epydoc==3.0.1
-grokcore.component==2.0
-httplib2==0.6.0
-lazr.delegates==1.1.0
-lazr.enum==1.1.2
-lazr.lifecycle==1.0
-lazr.uri==1.0.2
-martian==0.12
-pytz==2010b
-simplejson==2.0.9
-storm==0.15
-transaction==1.0.0
-van.testing==3.0.0
-zc.lockfile==1.0.0
-zdaemon==2.0.4
-zope.app.pagetemplate==3.10.1
-zope.authentication==3.7.0
-zope.browser==1.2
-zope.browserpage==3.11.0
-zope.cachedescriptors==3.5.0
-zope.configuration==3.7.1
-zope.contenttype==3.5.0
-zope.copy==3.5.0
-zope.datetime>=3.4.0,<=3.4.1dev
-zope.dublincore==3.6.0
-zope.event==3.4.1
-zope.exceptions==3.5.2
-zope.i18n==3.7.0
-zope.i18nmessageid==3.5.0
-zope.lifecycleevent==3.6.0
-zope.location==3.8.2
-zope.pagetemplate==3.5.0
-zope.proxy==3.5.0
-zope.publisher==3.10.1
-zope.security==3.7.2
-zope.size==3.4.1
-zope.tal==3.5.2
-zope.tales==3.5.0
-zope.testing==3.8.3
-zope.traversing==3.12.0
-
 # project dependencies
--f http://launchpad.net/lazr.restfulclient/trunk/0.9.11/+download/lazr.restfulclient-0.9.11.tar.gz#egg=lazr.restfulclient-0.9.11
 -e bzr+ssh://bazaar.launchpad.net/~canonical-isd-hackers/django-oauth-backend/trunk/@5#egg=django-oauth-backend
-# make sure lazr.restful is pinned
--f http://launchpad.net/lazr.restful/trunk/0.9.19/+download/lazr.restful-0.9.19.tar.gz#egg=lazr.restful-0.9.19
-lazr.restful==0.9.19
 
 # testing dependencies
 BeautifulSoup==3.1.0.1
@@ -59,10 +8,8 @@
 coverage<3.4
 mock==0.6.0
 wsgiref==0.1.2
-lazr.restfulclient==0.9.11
 wsgi-intercept==0.4
 zope.testbrowser==3.5.1
 
 # development dependencies
 werkzeug
-

=== modified file 'scripts/create_env'
--- scripts/create_env	2011-01-03 20:42:20 +0000
+++ scripts/create_env	2011-05-24 16:31:52 +0000
@@ -24,7 +24,7 @@
     url='http://10.55.56.106:8000'
     pypi="-i $url"
 else
-    pypi="-f https://launchpad.net/lazr.restful/+download?start=21 -f https://launchpad.net/lazr.restfulclient/+download?start=9"
+    pypi="-f https://launchpad.net/lazr.restfulclient/+download?start=9"
 fi
 
 virtualenv --distribute --no-site-packages $ENV

=== modified file 'setup.py'
--- setup.py	2011-05-12 09:18:32 +0000
+++ setup.py	2011-05-24 16:31:52 +0000
@@ -40,7 +40,6 @@
     'coverage==2.85',
     'mock==0.6.0',
     'wsgiref==0.1.2',
-    'lazr.restfulclient==0.9.11',
     'wsgi-intercept==0.4',
     'zope.testbrowser==3.5.1',
 ]
@@ -76,8 +75,6 @@
         #'django-oauth-backend',
         'django-openid-auth==0.2',
         'django-preflight==0.1',
-        'lazr.authentication==0.1.2',
-        'lazr.restful==0.9.19',
 # PyPi calls upstream's 1.0a "1.0.1" maybe because it doesn't
 # understand letters in version strings.  Lucid's package uses "1.0a"
 # as upstream does.
@@ -85,16 +82,12 @@
         'psycopg2==2.0.13',
         'python-memcached==1.44',
         'python-openid==2.2.4',
-        'zope.component==3.8.0',
-        'zope.interface==3.5.3',
-        'zope.schema==3.6.1',
+        'django-piston',
         'gargoyle',
     ],
     tests_require=tests_require,
     extras_require={'test': tests_require},
     dependency_links=[
         'http://initd.org/pub/software/psycopg/PSYCOPG-2-0/',
-        'http://launchpad.net/lazr.restful/trunk/0.9.19/+download/lazr.restful-0.9.19.tar.gz#egg=lazr.restful-0.9.19',
-        'http://launchpad.net/lazr.restfulclient/trunk/0.9.11/+download/lazr.restfulclient-0.9.11.tar.gz#egg=lazr.restfulclient-0.9.11',
     ],
 )