Merge lp:~cjwatson/lazr.restfulclient/oauthlib into lp:lazr.restfulclient

[Colin Watson]

Port from oauth to oauthlib.

Some tests still need to use oauth until lazr.authentication is ported, which is a more difficult job.

[William Grant (wgrant)]

review: Approve (code)

=== modified file 'setup.py'
--- setup.py	2018-04-27 13:50:16 +0000
+++ setup.py	2018-04-27 13:50:17 +0000
@@ -38,6 +38,7 @@
 tests_require = [
     'lazr.authentication',
     'lazr.restful>=0.11.0',
+    'oauth',
     'wsgi_intercept',
     'zope.testrunner',
     ]
@@ -60,8 +61,9 @@
     license='LGPL v3',
     install_requires=[
         'httplib2',
-        'oauth',
+        'oauthlib',
         'setuptools',
+        'six',
         'wadllib>=1.1.4',
         ],
     url='https://launchpad.net/lazr.restfulclient',

=== modified file 'src/lazr/restfulclient/__init__.py'
--- src/lazr/restfulclient/__init__.py	2009-08-06 14:02:10 +0000
+++ src/lazr/restfulclient/__init__.py	2018-04-27 13:50:17 +0000
@@ -19,3 +19,5 @@
 import pkg_resources
 __version__ = pkg_resources.resource_string(
     "lazr.restfulclient", "version.txt").strip()
+if not isinstance(__version__, str):
+    __version__ = __version__.decode('ASCII')

=== modified file 'src/lazr/restfulclient/authorize/oauth.py'
--- src/lazr/restfulclient/authorize/oauth.py	2014-07-28 15:35:35 +0000
+++ src/lazr/restfulclient/authorize/oauth.py	2018-04-27 13:50:17 +0000
@@ -28,12 +28,9 @@
 import platform
 import stat
 import socket
-# Work around relative import behavior.  The below is equivalent to
-# from oauth import oauth
-oauth = __import__('oauth.oauth', {}).oauth
-(OAuthConsumer, OAuthRequest, OAuthSignatureMethod_PLAINTEXT,
- OAuthToken) = (oauth.OAuthConsumer, oauth.OAuthRequest,
-                oauth.OAuthSignatureMethod_PLAINTEXT, oauth.OAuthToken)
+
+from oauthlib import oauth1
+import six
 
 from lazr.restfulclient.authorize import HttpAuthorizer
 from lazr.restfulclient.errors import CredentialsFileError
@@ -50,12 +47,9 @@
 CREDENTIALS_FILE_VERSION = '1'
 
 
-# These two classes are provided for convenience (so applications
-# don't need to import from oauth.oauth), and to provide
-# lazr.restfulclient-specific enhancements like a default argument for
-# secret (which shouldn't be used), and an application name separate
-# from the consumer key.
-class Consumer(oauth.OAuthConsumer):
+# For compatibility, Consumer and AccessToken are defined using terminology
+# from the older oauth library rather than the newer oauthlib.
+class Consumer:
     """An OAuth consumer (application)."""
 
     def __init__(self, key, secret='', application_name=None):
@@ -68,18 +62,29 @@
             from the consumer key. If present, this will be used in
             the User-Agent header.
         """
-        OAuthConsumer.__init__(self, key, secret)
+        self.key = key
+        self.secret = secret
         self.application_name = application_name
 
 
-class AccessToken(oauth.OAuthToken):
+class AccessToken:
     """An OAuth access token."""
 
     def __init__(self, key, secret='', context=None):
-        OAuthToken.__init__(self, key, secret)
+        self.key = key
+        self.secret = secret
         self.context = context
 
 
+class TruthyString(six.text_type):
+    """A Unicode string which is always true."""
+
+    def __bool__(self):
+        return True
+
+    __nonzero__ = __bool__
+
+
 class SystemWideConsumer(Consumer):
     """A consumer associated with the logged-in user rather than an app.
 
@@ -240,9 +245,18 @@
 
     def authorizeRequest(self, absolute_uri, method, body, headers):
         """Sign a request with OAuth credentials."""
-        oauth_request = OAuthRequest.from_consumer_and_token(
-            self.consumer, self.access_token, http_url=absolute_uri)
-        oauth_request.sign_request(
-            OAuthSignatureMethod_PLAINTEXT(),
-            self.consumer, self.access_token)
-        headers.update(oauth_request.to_header(self.oauth_realm))
+        client = oauth1.Client(
+            self.consumer.key,
+            client_secret=self.consumer.secret,
+            resource_owner_key=TruthyString(self.access_token.key or ''),
+            resource_owner_secret=self.access_token.secret,
+            signature_method=oauth1.SIGNATURE_PLAINTEXT,
+            realm=self.oauth_realm)
+        # The older oauth library (which may still be used on the server)
+        # requires the oauth_token parameter to be present and will fail
+        # authentication if it isn't.  This hack forces it to be present
+        # even if its value is the empty string.
+        client.resource_owner_key = TruthyString(client.resource_owner_key)
+        _, signed_headers, _ = client.sign(absolute_uri)
+        for key, value in signed_headers.items():
+            headers[key.encode('UTF-8')] = value.encode('UTF-8')

=== modified file 'src/lazr/restfulclient/docs/NEWS.rst'
--- src/lazr/restfulclient/docs/NEWS.rst	2018-04-27 13:50:16 +0000
+++ src/lazr/restfulclient/docs/NEWS.rst	2018-04-27 13:50:17 +0000
@@ -2,10 +2,12 @@
 NEWS for lazr.restfulclient
 ===========================
 
-0.13.6
+0.14.0
 ======
 
   - Switch from buildout to tox.
+  - Port from oauth to oauthlib.  Some tests still need to use oauth until
+    lazr.authentication is ported.  [bug=1672458]
 
 0.13.5 (2017-09-04)
 ===================