Merge lp:~facundo/canonical-identity-provider/multiple-discharges into lp:canonical-identity-provider/release

[Facundo Batista]

Support multiple macaroons in the discharge endpoint.

Support multiple macaroons in the discharge endpoint.

[Facundo Batista (facundo)]

Answered..

[Ricardo Kirkner (ricardokirkner)]

LGTM

review: Approve

=== modified file 'src/api/v20/handlers.py'
--- src/api/v20/handlers.py	2016-03-22 21:06:07 +0000
+++ src/api/v20/handlers.py	2016-04-18 16:05:29 +0000
@@ -438,12 +438,21 @@
         try:
             email = data['email']
             password = data['password']
-            root_macaroon_raw = data['macaroon']
         except KeyError:
-            expected = set(('email', 'password', 'macaroon'))
+            expected = {'email', 'password'}
             missing = dict((k, [FIELD_REQUIRED]) for k in expected - set(data))
             return errors.INVALID_DATA(**missing)
 
+        if 'macaroon' in data:
+            simple_macaroon = True
+            root_macaroons_info = [(None, data['macaroon'])]
+        elif 'macaroons' in data:
+            simple_macaroon = False
+            root_macaroons_info = data['macaroons']
+        else:
+            missing = {'macaroon or macaroons': [FIELD_REQUIRED]}
+            return errors.INVALID_DATA(**missing)
+
         account = None
         response = None
         try:
@@ -481,16 +490,22 @@
         if response is not None:
             return response
 
-        try:
-            discharge = auth.build_discharge_macaroon(
-                account, root_macaroon_raw)
-        except ValidationError:
-            return errors.INVALID_DATA()
-        except AuthenticationError:
-            return errors.INVALID_CREDENTIALS()
+        all_discharges = []
+        for mac_id, root_macaroon_raw in root_macaroons_info:
+            try:
+                discharge = auth.build_discharge_macaroon(
+                    account, root_macaroon_raw)
+            except ValidationError:
+                return errors.INVALID_DATA()
+            except AuthenticationError:
+                return errors.INVALID_CREDENTIALS()
+            all_discharges.append((mac_id, discharge.serialize()))
 
         response = rc.ALL_OK
-        response.content = dict(discharge_macaroon=discharge.serialize())
+        if simple_macaroon:
+            response.content = dict(discharge_macaroon=all_discharges[0][1])
+        else:
+            response.content = dict(discharge_macaroons=all_discharges)
 
         log_type = AuthLogType.API_MACAROON_DISCHARGE_NEW
         login_succeeded.send(sender=self, user=account, request=request,
 
=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2016-04-01 19:35:14 +0000
+++ src/api/v20/tests/test_handlers.py	2016-04-18 16:05:29 +0000
@@ -2344,6 +2344,44 @@
                                  expected_status_code=401,
                                  check_login_failed=False)
 
+    def test_missing_macaroons(self):
+        data = dict(email='[e-mail]', password='foobar123')
+        extra = {'macaroon or macaroons': [handlers.FIELD_REQUIRED]}
+        self.assert_failed_login('INVALID_DATA', data, extra=extra,
+                                 expected_status_code=400,
+                                 check_login_failed=False)
+
+    def test_multiple_macaroons(self):
+        # build *several* macaroons and send them all at once
+        roots, rkeys = zip(*[self.build_macaroon() for _ in range(3)])
+        ids = range(3)
+        roots = dict(zip(ids, roots))
+        rkeys = dict(zip(ids, rkeys))
+        macaroons = [(mac_id, m.serialize()) for mac_id, m in roots.items()]
+        data = dict(email='[e-mail]', password='foobar123',
+                    macaroons=macaroons)
+        json_body = self.do_post(data=data)
+
+        # get all the discharges and verify their integrity
+        verifying_function = lambda c: True
+        for mac_id, discharge_macaroon_raw in json_body['discharge_macaroons']:
+            discharge_macaroon = Macaroon.deserialize(discharge_macaroon_raw)
+            root_macaroon = roots[mac_id]
+            key = rkeys[mac_id]
+            v = Verifier()
+            v.satisfy_general(verifying_function)
+            v.verify(root_macaroon, key, [discharge_macaroon])
+
+    def test_multiple_mixed(self):
+        bad_macaroon, _ = self.build_macaroon(service_location="other service")
+        data = dict(email='[e-mail]', password='foobar123', macaroons=[
+            ('good', self.root_macaroon.serialize()),
+            ('bad', bad_macaroon.serialize()),
+        ])
+        self.assert_failed_login('INVALID_CREDENTIALS', data,
+                                 expected_status_code=401,
+                                 check_login_failed=False)
+
 
 class MacaroonHandlerTimelineTestCase(MacaroonHandlerBaseTestCase,
                                       TimelineActionMixin):