Merge lp:~facundo/canonical-identity-provider/support-caveat-v1 into lp:canonical-identity-provider/release

[Facundo Batista]

Support v0 (unversioned) and v1 caveat_ids.

Support v0 (unversioned) and v1 caveat_ids.

[Ricardo Kirkner (ricardokirkner)]

LGTM

review: Approve

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2016-05-05 15:39:31 +0000
+++ src/api/v20/tests/test_handlers.py	2016-05-05 20:58:38 +0000
@@ -2176,17 +2176,7 @@
         self.account = self.factory.make_account(
             email=self.data['email'], password=self.data['password'])
 
-        self._stats_increment = self.patch('api.v20.handlers.stats.increment')
-
-    def check_stats_increment(self, *args, **kwargs):
-        """Check stats increment was properly called."""
-        calls = self._stats_increment.call_args_list
-        self.assertEqual(len(calls), 1)
-        call_args, call_kwargs = calls[0]
-        self.assertEqual(call_args, args,
-                         "Bad args in stats increment call {}".format(calls))
-        self.assertEqual(call_kwargs, kwargs,
-                         "Bad kwargs in stats increment call {}".format(calls))
+        self.stats_increment = self.patch('api.v20.handlers.stats.increment')
 
 
 class MacaroonDischargeHandlerTestCase(MacaroonHandlerBaseTestCase,
@@ -2342,7 +2332,8 @@
     def test_macaroon_created(self):
         json_body = self.do_post()
         self.assert_response_correct(json_body, self.account)
-        self.check_stats_increment('macaroon.discharge', key='single_macaroon')
+        self.stats_increment.assert_any_call(
+            'macaroon.discharge', key='single_macaroon')
 
     def test_root_macaroon_corrupt(self):
         data = dict(
@@ -2388,7 +2379,8 @@
             v.satisfy_general(verifying_function)
             v.verify(root_macaroon, key, [discharge_macaroon])
 
-        self.check_stats_increment('macaroon.discharge', key='multi_macaroons')
+        self.stats_increment.assert_any_call(
+            'macaroon.discharge', key='multi_macaroons')
 
     def test_multiple_mixed(self):
         bad_macaroon, _, _ = self.build_macaroon(
@@ -2410,7 +2402,8 @@
 
         json_body = self.do_post(data=data)
         self.assert_response_correct(json_body, self.account, bind=True)
-        self.check_stats_increment('macaroon.discharge', key='caveat_id')
+        self.stats_increment.assert_any_call(
+            'macaroon.discharge', key='caveat_id')
 
     def test_caveat_id_corrupt(self):
         data = dict(email='[e-mail]', password='foobar123',
@@ -2545,7 +2538,8 @@
         v.satisfy_general(lambda c: True)
         v.verify(
             self.root_macaroon, self.macaroon_random_key, [discharge_macaroon])
-        self.check_stats_increment('macaroon.refresh', key='root_macaroon')
+        self.stats_increment.assert_any_call(
+            'macaroon.refresh', key='root_macaroon')
 
     def test_just_discharge_refreshed(self):
         json_body = self.do_post()
@@ -2559,4 +2553,5 @@
         v = Verifier()
         v.satisfy_general(lambda c: True)
         v.verify(self.root_macaroon, self.macaroon_random_key, [discharge])
-        self.check_stats_increment('macaroon.refresh', key='just_discharge')
+        self.stats_increment.assert_any_call(
+            'macaroon.refresh', key='just_discharge')

=== modified file 'src/identityprovider/auth.py'
--- src/identityprovider/auth.py	2016-05-05 15:39:31 +0000
+++ src/identityprovider/auth.py	2016-05-05 20:58:38 +0000
@@ -35,6 +35,7 @@
 )
 from identityprovider.models.api import APIUser
 from identityprovider.models.const import EmailStatus, TokenScope
+from identityprovider.stats import stats
 from identityprovider.timeline_helpers import (
     get_request_timing_function,
     maybe_contextmanager,
@@ -511,16 +512,40 @@
     return sso_caveat.caveat_id, caveat_info
 
 
+def _open_caveat_v0(info):
+    """Open the caveat_id, v0 (unversioned, really) format."""
+    caveat_info_raw = settings.CRYPTO_SSO_PRIVKEY.decrypt(
+        base64.b64decode(info))
+    caveat_info = json.loads(caveat_info_raw)
+    return caveat_info
+
+
+def _open_caveat_v1(info):
+    """Open the caveat_id, v1 format."""
+    assert info['version'] == 1  # only supported version
+    info['3rdparty'] = settings.CRYPTO_SSO_PRIVKEY.decrypt(
+        base64.b64decode(info.pop('secret')))
+    return info
+
+
 def _decrypt_caveat(raw_caveat_id):
     """Decrypt and decode the caveat id info."""
     try:
-        caveat_info_raw = settings.CRYPTO_SSO_PRIVKEY.decrypt(
-            base64.b64decode(raw_caveat_id))
-        caveat_info = json.loads(caveat_info_raw)
-    except:
-        # not properly encrypted information inside
+        caveat_info = json.loads(raw_caveat_id)
+        function = _open_caveat_v1
+        stats_key = '1'
+    except:
+        # bad data, or maybe the v0 (unversioned, really) format
+        caveat_info = raw_caveat_id
+        function = _open_caveat_v0
+        stats_key = '0'
+
+    try:
+        caveat_info = function(caveat_info)
+    except:
         raise ValidationError("Bad info in the caveat_id")
 
+    stats.increment('macaroon.auth.caveat_version', key=stats_key)
     return caveat_info
 
 

=== modified file 'src/identityprovider/tests/test_auth.py'
--- src/identityprovider/tests/test_auth.py	2016-05-05 15:39:31 +0000
+++ src/identityprovider/tests/test_auth.py	2016-05-05 20:58:38 +0000
@@ -23,7 +23,7 @@
 from django.test.utils import override_settings
 from django.utils.timezone import now
 from mock import call, Mock, patch
-from pymacaroons import Macaroon, Verifier
+from pymacaroons import Verifier
 
 from identityprovider.auth import (
     LaunchpadBackend,
@@ -1108,36 +1108,66 @@
 
 class MacaroonHelpersTestCase(SSOBaseTestCase):
 
-    def test_get_caveat_ok(self):
-        test_rsa_priv_key, test_rsa_pub_key = self.setup_key_pair()
+    def setUp(self):
+        super(MacaroonHelpersTestCase, self).setUp()
+        self.stats_increment = self.patch(
+            'identityprovider.auth.stats.increment')
 
-        # create a Macaron with the proper third party caveat
-        macaroon_random_key = binascii.hexlify(os.urandom(32))
-        root_macaroon = Macaroon(
-            location='The store ;)',
-            key=macaroon_random_key,
-            identifier='A test macaroon',
-        )
-        random_key = binascii.hexlify(os.urandom(32))
+    def test_get_caveat_ok_v0(self):
         info = {
             'some stuff': 'foo',
             'more stuff': 'bar',
         }
+        _, test_rsa_pub_key = self.setup_key_pair()
         info_encrypted = base64.b64encode(
             test_rsa_pub_key.encrypt(json.dumps(info), 32)[0])
-        root_macaroon.add_third_party_caveat(
-            settings.MACAROON_SERVICE_LOCATION, random_key, info_encrypted)
 
         # check
-        (sso_caveat,) = [c for c in root_macaroon.third_party_caveats()
-                         if c.location == settings.MACAROON_SERVICE_LOCATION]
-        caveat_info = _decrypt_caveat(sso_caveat.caveat_id)
+        caveat_info = _decrypt_caveat(info_encrypted)
         self.assertEqual(caveat_info, info)
-
-    def test_get_caveat_badly_encrypted(self):
+        self.stats_increment.assert_any_call(
+            'macaroon.auth.caveat_version', key='0')
+
+    def test_get_caveat_ok_v1(self):
+        random_key = binascii.hexlify(os.urandom(32))
+        _, test_rsa_pub_key = self.setup_key_pair()
+        caveat_id = json.dumps({
+            'version': 1,
+            'secret': base64.b64encode(
+                test_rsa_pub_key.encrypt(random_key, 32)[0]),
+        })
+
+        # check
+        caveat_info = _decrypt_caveat(caveat_id)
+        self.assertEqual(caveat_info, {
+            'version': 1,
+            '3rdparty': random_key,
+        })
+        self.stats_increment.assert_any_call(
+            'macaroon.auth.caveat_version', key='1')
+
+    def test_get_caveat_v0_badly_encrypted(self):
         self.assertRaises(ValidationError,
                           _decrypt_caveat, b"not really well encrypted stuff")
 
+    def test_get_caveat_v1_bad_version(self):
+        random_key = binascii.hexlify(os.urandom(32))
+        _, test_rsa_pub_key = self.setup_key_pair()
+        caveat_id = json.dumps({
+            'version': 7,
+            'secret': base64.b64encode(
+                test_rsa_pub_key.encrypt(random_key, 32)[0]),
+        })
+        self.assertRaises(ValidationError, _decrypt_caveat, caveat_id)
+
+    def test_get_caveat_v1_badly_encrypted(self):
+        _, test_rsa_pub_key = self.setup_key_pair()
+        caveat_id = json.dumps({
+            'version': 1,
+            'secret': "badly encrypted",
+        })
+        self.assertRaises(ValidationError, _decrypt_caveat, caveat_id)
+
 
 class MacaroonRefreshFromRootTestCase(SSOBaseTestCase):
     """Test the deprecated refresh_macaroons.