Merge lp:~canonical-isd-hackers/canonical-identity-provider/ssoclient into lp:~ubuntuone-pqm-team/canonical-identity-provider/ssoclient

[Natalia Bidart]

- Bump stable branch to revno 9 from devel branch.

[Martin Albisetti (beuno)]

review: Approve

=== modified file 'ssoclient/tests/test_v2.py'
--- ssoclient/tests/test_v2.py	2013-05-24 12:27:05 +0000
+++ ssoclient/tests/test_v2.py	2013-08-19 16:45:04 +0000
@@ -96,6 +96,29 @@
         super(V2ClientApiTestCase, self).setUp()
         self.client = V2ApiClient('http://foo.com')
 
+        p = patch(REQUEST)
+        self.mock_request = p.start()
+        self.addCleanup(p.stop)
+
+        p = patch('ssoclient.v2.client.OAuth1')
+        self.mock_oauth = p.start()
+        self.addCleanup(p.stop)
+
+        self.credentials = dict(
+            consumer_key='consumer_key',
+            consumer_secret='consumer_secret',
+            token_key='token_key',
+            token_secret='token_secret',
+        )
+
+    def assert_unicode_credentials(self, credentials):
+        self.mock_oauth.assert_called_once_with(
+            credentials['consumer_key'], credentials['consumer_secret'],
+            credentials['token_key'], credentials['token_secret'],
+        )
+        self.assertTrue(all(isinstance(val, unicode) for
+                            val in self.mock_oauth.call_args[0]))
+
 
 class RegisterV2ClientApiTestCase(V2ClientApiTestCase):
 
@@ -106,42 +129,47 @@
         response.json.side_effect = ValueError
         response.text = 'some error message'
 
-        with patch(REQUEST, return_value=response):
-            with self.assertRaises(ExceptionClass) as ctx:
-                self.client.login(email='blah')
+        self.mock_request.return_value = response
+        with self.assertRaises(ExceptionClass) as ctx:
+            self.client.login(email='blah')
 
         if status_code >= 500:
             self.assertIn('some error message', str(ctx.exception))
 
-    @patch(REQUEST, return_value=mock_response(400, code="INVALID_DATA"))
-    def test_register_invalid_data(self, mock_request):
+    def test_register_invalid_data(self):
+        self.mock_request.return_value = mock_response(
+            400, code="INVALID_DATA")
         with self.assertRaises(errors.InvalidData):
             self.client.register(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(401, code="CAPTCHA_REQUIRED"))
-    def test_register_captcha_required(self, mock_request):
+    def test_register_captcha_required(self):
+        self.mock_request.return_value = mock_response(
+            401, code="CAPTCHA_REQUIRED")
         with self.assertRaises(errors.CaptchaRequired):
             self.client.register(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(403, code="CAPTCHA_FAILURE"))
-    def test_register_captcha_failed(self, mock_request):
+    def test_register_captcha_failed(self):
+        self.mock_request.return_value = mock_response(
+            403, code="CAPTCHA_FAILURE")
         with self.assertRaises(errors.CaptchaFailure):
             self.client.register(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(502, code="CAPTCHA_ERROR"))
-    def test_register_captcha_error(self, mock_request):
+    def test_register_captcha_error(self):
+        self.mock_request.return_value = mock_response(
+            502, code="CAPTCHA_ERROR")
         with self.assertRaises(errors.CaptchaError):
             self.client.register(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(409, code="ALREADY_REGISTERED"))
-    def test_register_already_registered(self, mock_request):
+    def test_register_already_registered(self):
+        self.mock_request.return_value = mock_response(
+            409, code="ALREADY_REGISTERED")
         with self.assertRaises(errors.AlreadyRegistered):
             self.client.register(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(201))
-    def test_register_success(self, mock_request):
+    def test_register_success(self):
+        self.mock_request.return_value = mock_response(201)
         self.client.register(email='blah')
-        args = mock_request.call_args[0]
+        args = self.mock_request.call_args[0]
         self.assertEqual(args, ('POST', 'http://foo.com/accounts'))
 
     def test_invalid_response_400(self):
@@ -153,160 +181,275 @@
 
 class LoginV2ClientApiTestCase(V2ClientApiTestCase):
 
-    @patch(REQUEST, return_value=mock_response(400, code="INVALID_DATA"))
-    def test_login_invalid_data(self, mock_request):
+    def test_login_invalid_data(self):
+        self.mock_request.return_value = mock_response(
+            400, code="INVALID_DATA")
         with self.assertRaises(errors.InvalidData):
             self.client.login(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(401, code="ACCOUNT_SUSPENDED"))
-    def test_login_account_suspended(self, mock_request):
+    def test_login_account_suspended(self):
+        self.mock_request.return_value = mock_response(
+            401, code="ACCOUNT_SUSPENDED")
         with self.assertRaises(errors.AccountSuspended):
             self.client.login(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(
-        401, code="ACCOUNT_DEACTIVATED"))
-    def test_login_account_deactivated(self, mock_request):
+    def test_login_account_deactivated(self):
+        self.mock_request.return_value = mock_response(
+            401, code="ACCOUNT_DEACTIVATED")
         with self.assertRaises(errors.AccountDeactivated):
             self.client.login(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(
-        401, code="INVALID_CREDENTIALS"))
-    def test_login_invalid_credentials(self, mock_request):
+    def test_login_invalid_credentials(self):
+        self.mock_request.return_value = mock_response(
+            401, code="INVALID_CREDENTIALS")
         with self.assertRaises(errors.InvalidCredentials):
             self.client.login(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(401, code="TWOFACTOR_REQUIRED"))
-    def test_login_twofactor_required(self, mock_request):
+    def test_login_twofactor_required(self):
+        self.mock_request.return_value = mock_response(
+            401, code="TWOFACTOR_REQUIRED")
         with self.assertRaises(errors.TwoFactorRequired):
             self.client.login(email='blah')
 
-    @patch(REQUEST, return_value=mock_response(403, code="TWOFACTOR_FAILURE"))
-    def test_login_twofactor_failure(self, mock_request):
+    def test_login_twofactor_failure(self):
+        self.mock_request.return_value = mock_response(
+            403, code="TWOFACTOR_FAILURE")
         with self.assertRaises(errors.TwoFactorFailure):
             self.client.login(email='blah')
 
+    def test_login_account_locked(self):
+        self.mock_request.return_value = mock_response(
+            403, code="ACCOUNT_LOCKED")
+        with self.assertRaises(errors.AccountLocked):
+            self.client.login(email='blah')
+
+    def test_login_email_invalidated(self):
+        self.mock_request.return_value = mock_response(
+            403, code="EMAIL_INVALIDATED")
+        with self.assertRaises(errors.EmailInvalidated):
+            self.client.login(email='blah')
+
 
 class PasswordResetV2ClientApiTestCase(V2ClientApiTestCase):
 
-    @patch(REQUEST, return_value=mock_response(201))
-    def test_request_password_reset(self, mock_request):
+    def test_request_password_reset(self):
+        self.mock_request.return_value = mock_response(201)
         response = self.client.request_password_reset('[e-mail]')
         self.assertEqual(response.status_code, 201)
-        self.assertEqual(mock_request.call_args, [
+        self.assertEqual(self.mock_request.call_args, [
             ('POST', 'http://foo.com/tokens/password'),
             {'headers': {'Content-Type': 'application/json'},
              'data': '{"token": null, "email": "[e-mail]"}'},
         ])
 
-    @patch(REQUEST, return_value=mock_response(400, code="INVALID_DATA"))
-    def test_request_password_reset_without_email(self, mock_request):
+    def test_request_password_reset_without_email(self):
+        self.mock_request.return_value = mock_response(
+            400, code="INVALID_DATA")
         with self.assertRaises(errors.InvalidData):
             self.client.request_password_reset(None)
 
-    @patch(REQUEST, return_value=mock_response(400, code="INVALID_DATA"))
-    def test_request_password_reset_with_empty_email(self, mock_request):
+    def test_request_password_reset_with_empty_email(self):
+        self.mock_request.return_value = mock_response(
+            400, code="INVALID_DATA")
         with self.assertRaises(errors.InvalidData):
             self.client.request_password_reset('')
 
-    @patch(REQUEST, return_value=mock_response(201))
-    def test_request_password_reset_with_token(self, mock_request):
+    def test_request_password_reset_with_token(self):
+        self.mock_request.return_value = mock_response(201)
         response = self.client.request_password_reset('[e-mail]',
                                                       'token1234')
         self.assertEqual(response.status_code, 201)
-        self.assertEqual(mock_request.call_args, [
+        self.assertEqual(self.mock_request.call_args, [
             ('POST', 'http://foo.com/tokens/password'),
             {'headers': {'Content-Type': 'application/json'},
              'data': '{"token": "token1234", "email": "[e-mail]"}'},
         ])
 
-    @patch(REQUEST, return_value=mock_response(403, code="ACCOUNT_SUSPENDED"))
-    def test_request_password_reset_for_suspended_account(self, mock_request):
+    def test_request_password_reset_for_suspended_account(self):
+        self.mock_request.return_value = mock_response(
+            403, code="ACCOUNT_SUSPENDED")
         with self.assertRaises(errors.AccountSuspended):
             self.client.request_password_reset('[e-mail]')
 
-    @patch(REQUEST, return_value=mock_response(
-        403, code="ACCOUNT_DEACTIVATED"))
-    def test_request_password_reset_for_deactivated_account(self,
-                                                            mock_request):
+    def test_request_password_reset_for_deactivated_account(self):
+        self.mock_request.return_value = mock_response(
+            403, code="ACCOUNT_DEACTIVATED")
         with self.assertRaises(errors.AccountDeactivated):
             self.client.request_password_reset('[e-mail]')
 
-    @patch(REQUEST, return_value=mock_response(
-        403, code="RESOURCE_NOT_FOUND"))
-    def test_request_password_reset_with_invalid_email(self, mock_request):
+    def test_request_password_reset_with_invalid_email(self):
+        self.mock_request.return_value = mock_response(
+            403, code="RESOURCE_NOT_FOUND")
         with self.assertRaises(errors.ResourceNotFound):
             self.client.request_password_reset('[e-mail]')
 
-    @patch(REQUEST, return_value=mock_response(
-        403, code="CAN_NOT_RESET_PASSWORD"))
-    def test_request_password_reset_not_allowed(self, mock_request):
+    def test_request_password_reset_not_allowed(self):
+        self.mock_request.return_value = mock_response(
+            403, code="CAN_NOT_RESET_PASSWORD")
         with self.assertRaises(errors.CanNotResetPassword):
             self.client.request_password_reset('[e-mail]')
 
-    @patch(REQUEST, return_value=mock_response(403, code="EMAIL_INVALIDATED"))
-    def test_request_password_reset_with_invalidated_email(self,
-                                                           mock_request):
+    def test_request_password_reset_with_invalidated_email(self):
+        self.mock_request.return_value = mock_response(
+            403, code="EMAIL_INVALIDATED")
         with self.assertRaises(errors.EmailInvalidated):
             self.client.request_password_reset('[e-mail]')
 
-    @patch(REQUEST, return_value=mock_response(403, code="TOO_MANY_TOKENS"))
-    def test_request_password_reset_with_too_many_tokens(self, mock_request):
+    def test_request_password_reset_with_too_many_tokens(self):
+        self.mock_request.return_value = mock_response(
+            403, code="TOO_MANY_TOKENS")
         with self.assertRaises(errors.TooManyTokens):
             self.client.request_password_reset('[e-mail]')
 
 
 class AccountDetailsV2ClientApiTestCase(V2ClientApiTestCase):
 
-    @patch(REQUEST, return_value=mock_response(200))
-    def test_account_details(self, mock_request):
-        token = dict(
-            consumer_key='consumer_key',
-            consumer_secret='consumer_secret',
-            token_key='token_key',
-            token_secret='token_secret',
-        )
-        with patch('ssoclient.v2.client.OAuth1') as mock_oauth:
-            response = self.client.account_details('some_openid', token)
-
-        mock_oauth.assert_called_once_with(
-            'consumer_key', 'consumer_secret', 'token_key', 'token_secret'
-        )
-        self.assertTrue(all(isinstance(val, unicode) for
-                            val in mock_oauth.call_args[0]))
-
-        oauth1 = mock_oauth.return_value
-        mock_request.assert_called_once_with(
+    def test_account_details(self):
+        self.mock_request.return_value = mock_response(200)
+        response = self.client.account_details('some_openid', self.credentials)
+        self.assert_unicode_credentials(self.credentials)
+
+        oauth1 = self.mock_oauth.return_value
+        self.mock_request.assert_called_once_with(
             'GET', 'http://foo.com/accounts/some_openid', auth=oauth1,
             headers={}, allow_redirects=True,
         )
 
         # The response is mocked - so this test just confirms that the
         # account_details method "does the right thing" and returns our mock
-        # repsonse
+        # response
         self.assertEqual(response.status_code, 200)
 
-    @patch(REQUEST, return_value=mock_response(200))
-    def test_account_details_anonymous(self, mock_request):
+    def test_account_details_anonymous(self):
+        self.mock_request.return_value = mock_response(200)
         response = self.client.account_details('some_openid')
-        mock_request.assert_called_once_with(
+        self.mock_request.assert_called_once_with(
             'GET', 'http://foo.com/accounts/some_openid', auth=None,
             headers={}, allow_redirects=True,
         )
         self.assertEqual(response.status_code, 200)
 
 
+class EmailsV2ClientApiTestCase(V2ClientApiTestCase):
+
+    def test_details(self):
+        self.mock_request.return_value = mock_response(200)
+
+        response = self.client.email_details('email', self.credentials)
+        self.assert_unicode_credentials(self.credentials)
+
+        oauth1 = self.mock_oauth.return_value
+        self.mock_request.assert_called_once_with(
+            'GET', 'http://foo.com/emails/email', auth=oauth1,
+            headers={}, allow_redirects=True,
+        )
+
+        self.assertEqual(response.status_code, 200)
+
+    def test_details_invalid_credentials(self):
+        self.mock_request.return_value = mock_response(
+            401, code="INVALID_CREDENTIALS")
+        with self.assertRaises(errors.InvalidCredentials):
+            self.client.email_details('blah', {})
+
+    def test_details_not_found(self):
+        self.mock_request.return_value = mock_response(
+            404, code="RESOURCE_NOT_FOUND")
+        with self.assertRaises(errors.ResourceNotFound):
+            self.client.email_details('blah', {})
+
+    def test_delete(self):
+        self.mock_request.return_value = mock_response(204)
+
+        response = self.client.email_delete('email', self.credentials)
+        self.assert_unicode_credentials(self.credentials)
+
+        oauth1 = self.mock_oauth.return_value
+        self.mock_request.assert_called_once_with(
+            'DELETE', 'http://foo.com/emails/email', auth=oauth1,
+            headers={},
+        )
+
+        self.assertEqual(response.status_code, 204)
+
+    def test_delete_invalid_credentials(self):
+        self.mock_request.return_value = mock_response(
+            401, code="INVALID_CREDENTIALS")
+        with self.assertRaises(errors.InvalidCredentials):
+            self.client.email_delete('blah', {})
+
+    def test_delete_not_found(self):
+        self.mock_request.return_value = mock_response(
+            404, code="RESOURCE_NOT_FOUND")
+        with self.assertRaises(errors.ResourceNotFound):
+            self.client.email_delete('blah', {})
+
+
+class TokensV2ClientApiTestCase(V2ClientApiTestCase):
+
+    def test_details(self):
+        self.mock_request.return_value = mock_response(200)
+
+        response = self.client.token_details('token_key', self.credentials)
+        self.assert_unicode_credentials(self.credentials)
+
+        oauth1 = self.mock_oauth.return_value
+        self.mock_request.assert_called_once_with(
+            'GET', 'http://foo.com/tokens/oauth/token_key', auth=oauth1,
+            headers={}, allow_redirects=True,
+        )
+
+        self.assertEqual(response.status_code, 200)
+
+    def test_details_invalid_credentials(self):
+        self.mock_request.return_value = mock_response(
+            401, code="INVALID_CREDENTIALS")
+        with self.assertRaises(errors.InvalidCredentials):
+            self.client.token_details('blah', {})
+
+    def test_details_not_found(self):
+        self.mock_request.return_value = mock_response(
+            404, code="RESOURCE_NOT_FOUND")
+        with self.assertRaises(errors.ResourceNotFound):
+            self.client.token_details('blah', {})
+
+    def test_delete(self):
+        self.mock_request.return_value = mock_response(204)
+
+        response = self.client.token_delete('token_key', self.credentials)
+        self.assert_unicode_credentials(self.credentials)
+
+        oauth1 = self.mock_oauth.return_value
+        self.mock_request.assert_called_once_with(
+            'DELETE', 'http://foo.com/tokens/oauth/token_key', auth=oauth1,
+            headers={},
+        )
+
+        self.assertEqual(response.status_code, 204)
+
+    def test_delete_invalid_credentials(self):
+        self.mock_request.return_value = mock_response(
+            401, code="INVALID_CREDENTIALS")
+        with self.assertRaises(errors.InvalidCredentials):
+            self.client.token_delete('blah', {})
+
+    def test_delete_not_found(self):
+        self.mock_request.return_value = mock_response(
+            404, code="RESOURCE_NOT_FOUND")
+        with self.assertRaises(errors.ResourceNotFound):
+            self.client.token_delete('blah', {})
+
+
 class ValidateRequestV2ClientApiTestCase(V2ClientApiTestCase):
 
-    @patch(REQUEST)
-    def test_valid_request(self, mock_request):
-        mock_request.return_value = mock_response(200, is_valid=True)
+    def test_valid_request(self):
+        self.mock_request.return_value = mock_response(200, is_valid=True)
         result = self.client.validate_request(
             http_url='foo', http_method='GET', authorization='123456789')
         self.assertEqual(result.json(), {'is_valid': True})
 
-    @patch(REQUEST)
-    def test_invalid_request(self, mock_request):
-        mock_request.return_value = mock_response(200, is_valid=False)
+    def test_invalid_request(self):
+        self.mock_request.return_value = mock_response(200, is_valid=False)
         result = self.client.validate_request(
             http_url='foo', http_method='GET', authorization='123456789')
         self.assertEqual(result.json(), {'is_valid': False})

=== modified file 'ssoclient/v2/client.py'
--- ssoclient/v2/client.py	2013-05-22 16:52:20 +0000
+++ ssoclient/v2/client.py	2013-08-19 16:45:04 +0000
@@ -13,6 +13,25 @@
     def __init__(self, endpoint):
         self.session = ApiSession(endpoint)
 
+    def _unicode_credentials(self, credentials):
+        # if openid and credentials come directly from a call to client.login
+        # then whether they are unicode or byte-strings depends on which
+        # json library is in use.
+        # oauthlib requires them to be unicode - so we coerce to be sure.
+        if credentials is not None:
+            consumer_key = unicode(credentials.get('consumer_key', ''))
+            consumer_secret = unicode(credentials.get('consumer_secret', ''))
+            token_key = unicode(credentials.get('token_key', ''))
+            token_secret = unicode(credentials.get('token_secret', ''))
+            oauth = OAuth1(
+                consumer_key,
+                consumer_secret,
+                token_key, token_secret,
+            )
+        else:
+            oauth = None
+        return oauth
+
     def _merge(self, data, extra):
         """Allows data to passed to functions by keyword or dict"""
         if data:
@@ -30,7 +49,9 @@
         return self.session.post('/accounts', data=self._merge(data, kwargs))
 
     @api_exception(errors.AccountDeactivated)
+    @api_exception(errors.AccountLocked)
     @api_exception(errors.AccountSuspended)
+    @api_exception(errors.EmailInvalidated)
     @api_exception(errors.InvalidCredentials)
     @api_exception(errors.InvalidData)
     @api_exception(errors.TwoFactorFailure)
@@ -41,25 +62,34 @@
     @api_exception(errors.InvalidCredentials)
     @api_exception(errors.ResourceNotFound)
     def account_details(self, openid, token=None):
-        # if openid and token come directly from a call to client.login
-        # then whether they are unicode or byte-strings depends on which
-        # json library is in use.
-        # oauthlib requires them to be unicode - so we coerce to be sure.
         openid = unicode(openid)
-        if token is not None:
-            consumer_key = unicode(token['consumer_key'])
-            consumer_secret = unicode(token['consumer_secret'])
-            token_key = unicode(token['token_key'])
-            token_secret = unicode(token['token_secret'])
-            oauth = OAuth1(
-                consumer_key,
-                consumer_secret,
-                token_key, token_secret,
-            )
-        else:
-            oauth = None
+        oauth = self._unicode_credentials(token)
         return self.session.get('/accounts/%s' % openid, auth=oauth)
 
+    @api_exception(errors.InvalidCredentials)
+    @api_exception(errors.ResourceNotFound)
+    def email_delete(self, email, credentials):
+        oauth = self._unicode_credentials(credentials)
+        return self.session.delete('/emails/%s' % email, auth=oauth)
+
+    @api_exception(errors.InvalidCredentials)
+    @api_exception(errors.ResourceNotFound)
+    def email_details(self, email, credentials):
+        oauth = self._unicode_credentials(credentials)
+        return self.session.get('/emails/%s' % email, auth=oauth)
+
+    @api_exception(errors.InvalidCredentials)
+    @api_exception(errors.ResourceNotFound)
+    def token_delete(self, token_key, credentials):
+        oauth = self._unicode_credentials(credentials)
+        return self.session.delete('/tokens/oauth/%s' % token_key, auth=oauth)
+
+    @api_exception(errors.InvalidCredentials)
+    @api_exception(errors.ResourceNotFound)
+    def token_details(self, token_key, credentials):
+        oauth = self._unicode_credentials(credentials)
+        return self.session.get('/tokens/oauth/%s' % token_key, auth=oauth)
+
     def validate_request(self, data=None, **kwargs):
         return self.session.post('/requests/validate',
                                  data=self._merge(data, kwargs))

=== modified file 'ssoclient/v2/errors.py'
--- ssoclient/v2/errors.py	2013-05-24 12:27:05 +0000
+++ ssoclient/v2/errors.py	2013-08-19 16:45:04 +0000
@@ -28,6 +28,10 @@
     error_code = "ACCOUNT_DEACTIVATED"
 
 
+class AccountLocked(ApiException):
+    error_code = "ACCOUNT_LOCKED"
+
+
 class EmailInvalidated(ApiException):
     error_code = "EMAIL_INVALIDATED"