Merge lp:~dobey/ubuntuone-credentials/server-timestamp into lp:ubuntuone-credentials

[dobey]

Retrieve current timestamp from server to use in OAuth signatures.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:219
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/130/
Executed test runs:
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/7/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/7/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/7/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/130/rebuild

review: Needs Fixing (continuous-integration)

[lp:~dobey/ubuntuone-credentials/server-timestamp]

220. By dobey on 2015-12-01

Update the symbols file too.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:220
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/131/
Executed test runs:
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/8/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/8/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/8/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/131/rebuild

review: Needs Fixing (continuous-integration)

[lp:~dobey/ubuntuone-credentials/server-timestamp]

221. By dobey on 2015-12-01

It's 0replaceme, not @replaceme.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:221
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/132/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/9
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/9
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/9/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/9

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/132/rebuild

review: Approve (continuous-integration)

[lp:~dobey/ubuntuone-credentials/server-timestamp]

222. By dobey on 2015-12-03

Add fake server for testing timestamp retrieval.
Add tests for timestamp retrieval.
Use QEventLoop instead of promise/future for synchronous API.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:222
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/135/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/12
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/12
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/12/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/12

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/135/rebuild

review: Approve (continuous-integration)

[lp:~dobey/ubuntuone-credentials/server-timestamp]

223. By dobey on 2015-12-04

Add caching of the timestamp, to avoid hitting server every time.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:223
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/136/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/13
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/13/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/13/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/136/rebuild

review: Needs Fixing (continuous-integration)

[lp:~dobey/ubuntuone-credentials/server-timestamp]

224. By dobey on 2015-12-04

Use uint for the time to check, as QDateTime.toTime_t returns a uint.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:224
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/137/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/14
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/14
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/14/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/14

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/137/rebuild

review: Approve (continuous-integration)

[lp:~dobey/ubuntuone-credentials/server-timestamp]

225. By dobey on 2015-12-04

Fix copyright years.

226. By dobey on 2015-12-04

Update another copyright header.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:225
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/138/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/15
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/15
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/15/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/15

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/138/rebuild

review: Approve (continuous-integration)

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:226
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/139/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/16
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/16
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/16/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/16

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/139/rebuild

review: Approve (continuous-integration)

[Alejandro J. Cura (alecu)]

Please put lines 387-395 in a separate function, and add unit tests for it with the following cases:
- server time is much later than client
- server time is much earlier than client

Even better: make a new class so _ts_check and _ts_skew are member objects and can be accessed easily by tests, and make signUrl have a static instance of that new class.

Please ping me if you need further reviews during my time off.

review: Needs Fixing

[Alejandro J. Cura (alecu)]

Correction: I meant lines 381-395.

[lp:~dobey/ubuntuone-credentials/server-timestamp]

227. By dobey on 2015-12-07

Default to UTC for current times, not local time.
Move code to separate function as requested.
Add requested tests, and remove superfluous test.

228. By dobey on 2015-12-07

Add the new symbol to the symbols file too.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:227
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/140/
Executed test runs:
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/17/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/17/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/17/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/140/rebuild

review: Needs Fixing (continuous-integration)

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:228
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-ci/141/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-amd64-ci/18
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/18
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-armhf-ci/18/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-wily-i386-ci/18

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-ci/141/rebuild

review: Approve (continuous-integration)

[Charles Kerr (charlesk)]

Looks good.

The one nitpick I have is approving while alecu is on leave, since the branch doesn't expose -ts_check and _ts_skew as requested by him. But he expressed it as a stretch goal, and after talking with dobey about it in irc I think this version is fine.

review: Approve

[Alejandro J. Cura (alecu)]

I'm not finding the time to do a proper review, but I see that the changes I requested have been made, so I'm changing my review to Abstain.

review: Abstain

=== modified file '.bzrignore'
--- .bzrignore	2014-01-15 19:35:23 +0000
+++ .bzrignore	2015-12-07 21:37:17 +0000
@@ -8,6 +8,7 @@
 signing-example
 test-ubuntuoneauth
 moc_*.cpp
+mock_sso_server.py
 qmldir
 ui_*.h
 *_automoc.cpp

=== modified file 'debian/libubuntuoneauth-2.0-0.symbols'
--- debian/libubuntuoneauth-2.0-0.symbols	2015-06-17 16:58:41 +0000
+++ debian/libubuntuoneauth-2.0-0.symbols	2015-12-07 21:37:17 +0000
@@ -114,6 +114,8 @@
  (c++)"UbuntuOne::Token::consumerKey() const@Base" 15.10+15.10.20150617
  (c++)"UbuntuOne::Token::created() const@Base" 14.04+14.10.20140818
  (c++)"UbuntuOne::Token::updated() const@Base" 14.04+14.10.20140818
+ (c++)"UbuntuOne::Token::getServerTimestamp() const@Base" 0replaceme
+ (c++)"UbuntuOne::Token::addOAuthTimestamp(QString) const@Base" 0replaceme
  (c++)"UbuntuOne::Keyring::storeToken(UbuntuOne::Token)@Base" 13.08
  (c++)"UbuntuOne::Keyring::storeToken(UbuntuOne::Token, QString const&)@Base" 14.04+14.10.20140802
  (c++)"UbuntuOne::Keyring::tokenFound(UbuntuOne::Token const&)@Base" 13.08

=== modified file 'libubuntuoneauth/tests/CMakeLists.txt'
--- libubuntuoneauth/tests/CMakeLists.txt	2013-06-14 22:30:19 +0000
+++ libubuntuoneauth/tests/CMakeLists.txt	2015-12-07 21:37:17 +0000
@@ -16,6 +16,11 @@
   -L${CMAKE_BINARY_DIR}/libubuntuoneauth
   ${AUTH_LIB_NAME})
 
+configure_file(
+  mock_sso_server.py.in
+  mock_sso_server.py
+)
+
 add_custom_target(ubuntuoneauth-tests
     COMMAND ${CMAKE_CURRENT_BINARY_DIR}/${TESTS_TARGET}
     DEPENDS ${TESTS_TARGET}

=== modified file 'libubuntuoneauth/tests/main.cpp'
--- libubuntuoneauth/tests/main.cpp	2013-06-14 22:30:19 +0000
+++ libubuntuoneauth/tests/main.cpp	2015-12-07 21:37:17 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013 Canonical Ltd.
+ * Copyright 2013-2015 Canonical Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of version 3 of the GNU Lesser General Public
@@ -24,7 +24,7 @@
 #include "test_requests.h"
 #include "test_responses.h"
 
-int main()
+int main(int argc, char** argv)
 {
     QByteArray fake_home = QDir::currentPath().toUtf8() + "/_test_temp";
     /* Need to alter some environment variables to avoid contamination. */
@@ -40,6 +40,8 @@
 
     /* Token tests */
     TestToken test_token;
+    test_token.argc = argc;
+    test_token.argv = argv;
 
     /* Request tests */
     TestOAuthTokenRequests test_oauth_token_requests;

=== added file 'libubuntuoneauth/tests/mock_sso_server.py.in'
--- libubuntuoneauth/tests/mock_sso_server.py.in	1970-01-01 00:00:00 +0000
+++ libubuntuoneauth/tests/mock_sso_server.py.in	2015-12-07 21:37:17 +0000
@@ -0,0 +1,57 @@
+#!/usr/bin/python3
+# -*- Mode: Python; coding: utf-8; indent-tabs-mode: nil; tab-width: 4 -*-
+#
+# Copyright (C) 2015 Canonical Ltd.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3, as published
+# by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import datetime
+import json
+import threading
+
+from email.utils import parsedate_to_datetime
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+
+class MyHandler(BaseHTTPRequestHandler):
+
+    def do_HEAD(self):
+        self.send_response(200)
+        self.end_headers();
+
+    def date_time_string(self):
+        if self.path == '/muchearlier':
+            ctime = parsedate_to_datetime(self.headers['Date'])
+            value = ctime + datetime.timedelta(days=10000)
+            return value.strftime('%a, %d %b %Y %H:%M:%S GMT')
+        elif self.path == '/muchlater':
+            ctime = parsedate_to_datetime(self.headers['Date'])
+            value = ctime - datetime.timedelta(days=10000)
+            return value.strftime('%a, %d %b %Y %H:%M:%S GMT')
+        else:
+            return 'Thu, 01 Jan 1970 00:00:10 GMT'
+
+
+def run_server():
+    server_address = ('', 8000)
+    httpd = HTTPServer(server_address, MyHandler)
+    while True:
+        httpd.handle_request()
+
+
+def run_mocked_settings():
+    t = threading.Thread(target=run_server)
+    t.start()
+
+
+run_mocked_settings()

=== modified file 'libubuntuoneauth/tests/test_token.cpp'
--- libubuntuoneauth/tests/test_token.cpp	2015-05-11 14:25:00 +0000
+++ libubuntuoneauth/tests/test_token.cpp	2015-12-07 21:37:17 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013 Canonical Ltd.
+ * Copyright 2013-2015 Canonical Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of version 3 of the GNU Lesser General Public
@@ -15,6 +15,7 @@
  * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+#include <QDir>
 #include <QHostInfo>
 #include <QUuid>
 
@@ -25,8 +26,16 @@
 using namespace UbuntuOne;
 
 
+void TestToken::cleanupTestCase()
+{
+    qputenv("SSO_AUTH_BASE_URL", old_base_url.toUtf8().data());
+    process->close();
+    process->deleteLater();
+}
+
 TestToken::TestToken()
-    : test_hostname(QHostInfo::localHostName())
+    : test_hostname(QHostInfo::localHostName()),
+      old_base_url("")
 {
 }
 
@@ -96,6 +105,98 @@
     delete token;
 }
 
+void TestToken::testSignUrl()
+{
+    Token *token = new Token("a", "b", "c", "d");
+    auto result = token->signUrl(QStringLiteral("https://login.ubuntu.com"),
+                                 QStringLiteral("GET"));
+    QVERIFY(result.startsWith("OAuth oauth_consumer_key"));
+    delete token;
+}
+
+void TestToken::testGetServerTimestamp()
+{
+    Token *token = new Token("a", "b", "c", "d");
+    auto result = token->getServerTimestamp();
+    delete token;
+
+    QCOMPARE(result.toTime_t(), (uint)time(NULL));
+}
+
+void TestToken::testGetServerTimestampMuchEarlier()
+{
+    old_base_url = qgetenv("SSO_AUTH_BASE_URL");
+    qputenv("SSO_AUTH_BASE_URL", "http://localhost:8000/muchearlier");
+    qputenv("U1_TEST_TIMESTAMP", "Thu, 01 Jan 1970 04:32:16 GMT");
+
+    auto _app = new QCoreApplication(argc, argv);
+
+    QDateTime result;
+    QTimer::singleShot(0, [this, &result, &_app](){
+            process = new QProcess(this);
+            QSignalSpy spy(process, SIGNAL(started()));
+            QString program = "python3";
+            QString script = QDir::currentPath() + "/mock_sso_server.py";
+            process->start(program, QStringList() << script);
+            QTRY_COMPARE(spy.count(), 1);
+
+            // Wait for server to start
+            QTimer timer;
+            QSignalSpy spy2(&timer, SIGNAL(timeout()));
+            timer.setInterval(2000);
+            timer.setSingleShot(true);
+            timer.start();
+            QTRY_COMPARE(spy2.count(), 1);
+
+            Token *token = new Token("a", "b", "c", "d");
+            result = token->getServerTimestamp();
+            delete token;
+
+            _app->quit();
+        });
+
+    _app->exec();
+
+    QCOMPARE(result.toTime_t(), (uint)864016336);
+}
+
+void TestToken::testGetServerTimestampMuchLater()
+{
+    old_base_url = qgetenv("SSO_AUTH_BASE_URL");
+    qputenv("SSO_AUTH_BASE_URL", "http://localhost:8000/muchlater");
+    qputenv("U1_TEST_TIMESTAMP", "Mon, 18 Jan 2038 22:14:07 GMT");
+
+    auto _app = new QCoreApplication(argc, argv);
+
+    QDateTime result;
+    QTimer::singleShot(0, [this, &result, &_app](){
+            process = new QProcess(this);
+            QSignalSpy spy(process, SIGNAL(started()));
+            QString program = "python3";
+            QString script = QDir::currentPath() + "/mock_sso_server.py";
+            process->start(program, QStringList() << script);
+            QTRY_COMPARE(spy.count(), 1);
+
+            // Wait for server to start
+            QTimer timer;
+            QSignalSpy spy2(&timer, SIGNAL(timeout()));
+            timer.setInterval(2000);
+            timer.setSingleShot(true);
+            timer.start();
+            QTRY_COMPARE(spy2.count(), 1);
+
+            Token *token = new Token("a", "b", "c", "d");
+            result = token->getServerTimestamp();
+            delete token;
+
+            _app->quit();
+        });
+
+    _app->exec();
+
+    QCOMPARE(result.toTime_t(), (uint)1283465647);
+}
+
 void TestToken::testTimesCached()
 {
     Token *token = Token::fromQuery("consumer_key=c&consumer_secret=c_s&name=Name+%40+hostname&token=t&token_secret=t_s&updated=2014-08-11+18%3A40%3A20.777777&created=2014-08-11+18%3A40%3A20.777777");

=== modified file 'libubuntuoneauth/tests/test_token.h'
--- libubuntuoneauth/tests/test_token.h	2014-09-09 13:53:07 +0000
+++ libubuntuoneauth/tests/test_token.h	2015-12-07 21:37:17 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013 Canonical Ltd.
+ * Copyright 2013-2015 Canonical Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of version 3 of the GNU Lesser General Public
@@ -18,6 +18,7 @@
 #ifndef _TEST_TOKEN_H_
 #define _TEST_TOKEN_H_
 
+#include <QProcess>
 #include <QtTest/QtTest>
 
 class TestToken: public QObject
@@ -26,10 +27,17 @@
  public:
     TestToken();
 
+    int argc;
+    char** argv;
+
  private:
     QString test_hostname;
+    QProcess *process;
+    QString old_base_url;;
 
     private slots:
+        void cleanupTestCase();
+
         void testEmptyToken();
         void testTokenArgs();
         void testTokenCopy();
@@ -40,6 +48,11 @@
         void testTokenName();
 
         void testSignUrlEmpty();
+        void testSignUrl();
+
+        void testGetServerTimestamp();
+        void testGetServerTimestampMuchEarlier();
+        void testGetServerTimestampMuchLater();
 
         void testTimesCached();
         void testCreatedParsed();

=== modified file 'libubuntuoneauth/token.cpp'
--- libubuntuoneauth/token.cpp	2015-05-06 09:14:54 +0000
+++ libubuntuoneauth/token.cpp	2015-12-07 21:37:17 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013 Canonical Ltd.
+ * Copyright 2013-2015 Canonical Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of version 3 of the GNU Lesser General Public
@@ -15,16 +15,20 @@
  * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+#include "token.h"
+#include "ssoservice.h"
+
 #include <stdlib.h>
 #include <oauth.h>
 
+#include <QCoreApplication>
 #include <QHash>
 #include <QHostInfo>
+#include <QNetworkReply>
+#include <QNetworkRequest>
 #include <QStringList>
 #include <QUrl>
 
-#include "token.h"
-
 #define TOKEN_NAME_KEY "name"
 #define TOKEN_TOKEN_KEY "token"
 #define TOKEN_TOKEN_SEC_KEY "token_secret"
@@ -33,6 +37,8 @@
 #define TOKEN_UPDATED_KEY "updated"
 #define TOKEN_CREATED_KEY "created"
 
+#define TIMESTAMP_CHECK_INTERVAL (60 * 60) // Seconds/minute * minutes
+
 
 namespace UbuntuOne {
 
@@ -128,7 +134,7 @@
     /**
      * \fn QDateTime Token::updated()
      *
-     * Retruns a QDateTime representing the time the token was last updated on
+     * Returns a QDateTime representing the time the token was last updated on
      * the server, or empty if unknown.
      */
     QDateTime Token::updated() const
@@ -141,6 +147,95 @@
     }
 
     /**
+     * \fn QDateTime Token::getServerTimestamp()
+     *
+     * Returns a QDateTime representing the current time known on the
+     * Ubuntu One authentication server, or current local time on errors,
+     * or when a QCoreApplication instance is not running.
+     */
+    QDateTime Token::getServerTimestamp() const
+    {
+        // The DateTime object to return, defaulting to current time
+        QDateTime _dt = QDateTime::currentDateTimeUtc();
+
+        // The timestamp of the client to send to the server.
+        QDateTime _clientDate(_dt);
+        auto _testDate = qgetenv("U1_TEST_TIMESTAMP");
+        if (_testDate != "") {
+            _clientDate = QDateTime::fromString(_testDate, Qt::RFC2822Date);
+        }
+
+        auto _app = QCoreApplication::instance();
+        if (_app != nullptr) {
+            QSharedPointer<QNetworkAccessManager> _nam(new QNetworkAccessManager());
+            QUrl _url{SSOService::getAuthBaseUrl()}; 
+            QSharedPointer<QNetworkRequest> _req(new QNetworkRequest(_url));
+            _req->setRawHeader("Cache-Control", "no-cache");
+            _req->setRawHeader("Date",
+                               _clientDate.toString(Qt::RFC2822Date).toUtf8().data());
+
+            qDebug() << "Getting timestamp from server:" << _url.toString();
+
+            auto _reply = _nam->head(*_req);
+            QEventLoop _loop;
+            QObject::connect(_reply, &QNetworkReply::finished,
+                             [&_loop, &_reply, &_dt]() {
+                                 auto _date = _reply->rawHeader("Date");
+                                 _dt = QDateTime::fromString(_date,
+                                                             Qt::RFC2822Date);
+                                 qDebug() << "Got server timestamp:"
+                                          << _dt.toTime_t();
+                                 _loop.quit();
+                             });
+            typedef void(QNetworkReply::*QNetworkReplyErrorSignal)(QNetworkReply::NetworkError);
+            QObject::connect(_reply, static_cast<QNetworkReplyErrorSignal>(&QNetworkReply::error),
+                             [&_loop, &_reply](QNetworkReply::NetworkError) {
+                                 qCritical() << "Error fetching server timestamp:"
+                                             << _reply->readAll();
+                                 _loop.quit();
+                             });
+
+            _loop.exec();
+        } else {
+            qWarning() << "No main loop, defaulting to local timestamp.";
+        }
+        return _dt;
+    }
+
+    /**
+     * \fn QUrl Token::addOAuthTimestamp(const QString url)
+     *
+     * Returns a QUrl with the oauth_timestamp value added to the query string
+     */
+    QUrl Token::addOAuthTimestamp(const QString url) const
+    {
+        // A copy of the URL in case we need to fix the timestamp
+        QUrl newurl{url};
+
+        // Get and use the server timestamp if necessary
+        QDateTime _now = QDateTime::currentDateTimeUtc();
+        // Static variables for caching the time to check, and skew
+        static uint _ts_check = 0;
+        static int _ts_skew = 0;
+
+        QDateTime timestamp;
+        if (_ts_check <= _now.toTime_t()) {
+            timestamp = getServerTimestamp();
+            _ts_skew = timestamp.toTime_t() - _now.toTime_t();
+        } else {
+            // QDateTime doesn't override + operator, create from time_t
+            timestamp = QDateTime::fromTime_t(_now.toTime_t() + _ts_skew);
+        }
+        _ts_check = _now.toTime_t() + TIMESTAMP_CHECK_INTERVAL;
+        char buf[11];
+        snprintf(buf, 11, "%010u", timestamp.toTime_t());
+        newurl.setQuery(newurl.query(QUrl::FullyEncoded) +
+                        "&oauth_timestamp=" + buf);
+
+        return newurl;
+    }
+
+    /**
      * \fn QString Token::signUrl(const QString url, const QString method,
      *                            bool asQuery = false)
      *
@@ -159,7 +254,9 @@
             return result;
         }
 
-        argc = oauth_split_url_parameters(url.toUtf8().data(), &argv);
+        QUrl copy(addOAuthTimestamp(url));
+        argc = oauth_split_url_parameters(copy.toString().toUtf8().data(),
+                                          &argv);
         // Fixup the URL as liboauth is escaping '+' to ' ' in it, incorrectly.
         for (int a = 0; argv[0][a] != 0; a++)
             argv[0][a] = argv[0][a] == ' ' ? '+' : argv[0][a];

=== modified file 'libubuntuoneauth/token.h'
--- libubuntuoneauth/token.h	2015-05-06 08:59:44 +0000
+++ libubuntuoneauth/token.h	2015-12-07 21:37:17 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013 Canonical Ltd.
+ * Copyright 2013-2015 Canonical Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of version 3 of the GNU Lesser General Public
@@ -21,6 +21,7 @@
 #include <QDateTime>
 #include <QHash>
 #include <QString>
+#include <QUrl>
 
 
 namespace UbuntuOne {
@@ -45,6 +46,8 @@
         QDateTime created() const;
         QDateTime updated() const;
 
+        QDateTime getServerTimestamp() const;
+        QUrl addOAuthTimestamp(const QString url) const;
         QString signUrl(const QString url, const QString method, bool asQuery = false) const;
 
         static Token *fromQuery(const QString query);