Merge lp:~gary/juju-gui/authtoken into lp:juju-gui/experimental

[Gary Poster]

Add authtoken support to the GUI

The authtoken support in this branch includes support for both a real environment and the sandbox. In writing this and testing it, I encountered some code that was not working, and some code that was not tested, and some code that was very difficult to test. This branch is utterly gigantic, for which I apologize. It includes the changes I needed to get everything else working. I should factor it out, now that I have figured out what needs to be done, but I'm a bit fatigued, so I'm asking for reviewer indulgence.

There are two ways you should QA. First, in the sandbox, delete the user and password from the config-debug file and then load the GUI in your browser using a URL like this: http://localhost:8888?authtoken=demoToken . This should log you in, remove the authtoken from the URL, and notify you that you used a token to authenticate. Find some other URLs, like in the charm browser, and copy them. Log out with the button on the top right. Paste the previous URL in to the browser, and then insert ?authtoken=demoToken in the URL. *Note that a querystring should come before a hash, so ?authtoken=demoToken#bws-whatever is correct, not the other way around.* Maybe do that log in, log out cycle a couple of times to try a few different URLs. Now log out and try a different token, like ?authtoken=badToken. It should send you to the login page with an appropriate error message.

Now it's time to QA a live environment. Here's how I suggest you do it.

1. In this branch, run BRANCH_IS_GOOD=1 make distfile . When it is finished, it will tell you what file it made.

2. Get a copy of the lp:~juju-gui/charms/precise/juju-gui/trunk/ branch if you don't have one already. If you do have one, make sure it is up to date.

3. mv the file you made in step 1 to the charm's releases directory. rm the old release in that directory.

4. juju bootstrap.

5. In the charm, run make deploy. Wait until it says it is done deploying the code.

6. Start up Python in your local machine. Edit the following code to include the address from step 5 and the appropriate password from your ~/.juju/environments.yaml file.

import itertools
import json
import pprint
import websocket
address = 'PUBLICADDRESS' # e.g. ec2-107-21-197-193.compute-1.amazonaws.com
password = 'YOURPASSWORD'
url = 'wss://{}:443/ws'.format(address)
ws = websocket.create_connection(url)
counter = itertools.count()
def process(request):
    request = request.copy()
    request['RequestId'] = counter.next()
    ws.send(json.dumps(request))
    pprint.pprint(json.loads(ws.recv()))

process(dict(Type='Admin', Request='Login', Params={'AuthTag': 'user-admin', 'Password': password}))
process(dict(Type='GUIToken', Request='Create', Params={}))

The last response should be something like this:

{u'RequestId': 2,
 u'Response': {u'Created': u'2013-11-25T20:11:41.624417Z',
               u'Expires': u'2013-11-25T20:13:41.624417Z',
               u'Token': u'e8ea8ac912fc4ef6a355e82bb65caf6d'}}

7. Now in your browser construct a url that has the GUI address from step 5 and the authtoken from step 6. It should look something like this:

https://PUBLICADDRESS/?authtoken=AUTHTOKEN

Go to this address. It should log you in as it did in the sandbox.

8. Try logging in and out with different methods to see if everything works as you expect.

Thank you very much!!!

https://codereview.appspot.com/33290043/

[Gary Poster (gary)]

Reviewers: mp+196782_code.launchpad.net,

Message:
Please take a look.

Description:
Add authtoken support to the GUI

The authtoken support in this branch includes support for both a real
environment and the sandbox. In writing this and testing it, I
encountered some code that was not working, and some code that was not
tested, and some code that was very difficult to test. This branch is
utterly gigantic, for which I apologize. It includes the changes I
needed to get everything else working. I should factor it out, now that
I have figured out what needs to be done, but I'm a bit fatigued, so I'm
asking for reviewer indulgence.

There are two ways you should QA. First, in the sandbox, delete the
user and password from the config-debug file and then load the GUI in
your browser using a URL like this:
http://localhost:8888?authtoken=demoToken . This should log you in,
remove the authtoken from the URL, and notify you that you used a token
to authenticate. Find some other URLs, like in the charm browser, and
copy them. Log out with the button on the top right. Paste the
previous URL in to the browser, and then insert ?authtoken=demoToken in
the URL. *Note that a querystring should come before a hash, so
?authtoken=demoToken#bws-whatever is correct, not the other way around.*
  Maybe do that log in, log out cycle a couple of times to try a few
different URLs. Now log out and try a different token, like
?authtoken=badToken. It should send you to the login page with an
appropriate error message.

Now it's time to QA a live environment. Here's how I suggest you do it.

1. In this branch, run BRANCH_IS_GOOD=1 make distfile . When it is
finished, it will tell you what file it made.

2. Get a copy of the lp:~juju-gui/charms/precise/juju-gui/trunk/ branch
if you don't have one already. If you do have one, make sure it is up
to date.

3. mv the file you made in step 1 to the charm's releases directory. rm
the old release in that directory.

4. juju bootstrap.

5. In the charm, run make deploy. Wait until it says it is done
deploying the code.

6. Start up Python in your local machine. Edit the following code to
include the address from step 5 and the appropriate password from your
~/.juju/environments.yaml file.

import itertools
import json
import pprint
import websocket
address = 'PUBLICADDRESS' # e.g.
ec2-107-21-197-193.compute-1.amazonaws.com
password = 'YOURPASSWORD'
url = 'wss://{}:443/ws'.format(address)
ws = websocket.create_connection(url)
counter = itertools.count()
def process(request):
     request = request.copy()
     request['RequestId'] = counter.next()
     ws.send(json.dumps(request))
     pprint.pprint(json.loads(ws.recv()))

process(dict(Type='Admin', Request='Login', Params={'AuthTag':
'user-admin', 'Password': password}))
process(dict(Type='GUIToken', Request='Create', Params={}))

The last response should be something like this:

{u'RequestId': 2,
  u'Response': {u'Created': u'2013-11-25T20:11:41.624417Z',
                u'Expires': u'2013-11-25T20:13:41.624417Z',
                u'Token': u'e8ea8ac912fc4ef6a355e82bb65caf6d'}}

7. Now in your browser construct a url that has the GUI address from
step 5 and the ...

[Madison Scott-Clary (makyo)]

Minors, will QA next.

https://codereview.appspot.com/33290043/diff/1/app/app.js
File app/app.js (right):

https://codereview.appspot.com/33290043/diff/1/app/app.js#newcode521
app/app.js:521: // proxy, withing an authenticated websocket session,
use a
*within

https://codereview.appspot.com/33290043/diff/1/app/store/env/go.js
File app/store/env/go.js (right):

https://codereview.appspot.com/33290043/diff/1/app/store/env/go.js#newcode342
app/store/env/go.js:342: // Indicate if the authentication were from a
token.
*was

https://codereview.appspot.com/33290043/

[Jeff Pihach (hatch)]

LGTM very thorough thanks!

https://codereview.appspot.com/33290043/

[lp:~gary/juju-gui/authtoken]

1214. By Gary Poster on 2013-11-26

respond to review

[Madison Scott-Clary (makyo)]

QA okay, LGTM from me

https://codereview.appspot.com/33290043/

[Gary Poster (gary)]

*** Submitted:

Add authtoken support to the GUI

The authtoken support in this branch includes support for both a real
environment and the sandbox. In writing this and testing it, I
encountered some code that was not working, and some code that was not
tested, and some code that was very difficult to test. This branch is
utterly gigantic, for which I apologize. It includes the changes I
needed to get everything else working. I should factor it out, now that
I have figured out what needs to be done, but I'm a bit fatigued, so I'm
asking for reviewer indulgence.

There are two ways you should QA. First, in the sandbox, delete the
user and password from the config-debug file and then load the GUI in
your browser using a URL like this:
http://localhost:8888?authtoken=demoToken . This should log you in,
remove the authtoken from the URL, and notify you that you used a token
to authenticate. Find some other URLs, like in the charm browser, and
copy them. Log out with the button on the top right. Paste the
previous URL in to the browser, and then insert ?authtoken=demoToken in
the URL. *Note that a querystring should come before a hash, so
?authtoken=demoToken#bws-whatever is correct, not the other way around.*
  Maybe do that log in, log out cycle a couple of times to try a few
different URLs. Now log out and try a different token, like
?authtoken=badToken. It should send you to the login page with an
appropriate error message.

Now it's time to QA a live environment. Here's how I suggest you do it.

1. In this branch, run BRANCH_IS_GOOD=1 make distfile . When it is
finished, it will tell you what file it made.

2. Get a copy of the lp:~juju-gui/charms/precise/juju-gui/trunk/ branch
if you don't have one already. If you do have one, make sure it is up
to date.

3. mv the file you made in step 1 to the charm's releases directory. rm
the old release in that directory.

4. juju bootstrap.

5. In the charm, run make deploy. Wait until it says it is done
deploying the code.

6. Start up Python in your local machine. Edit the following code to
include the address from step 5 and the appropriate password from your
~/.juju/environments.yaml file.

import itertools
import json
import pprint
import websocket
address = 'PUBLICADDRESS' # e.g.
ec2-107-21-197-193.compute-1.amazonaws.com
password = 'YOURPASSWORD'
url = 'wss://{}:443/ws'.format(address)
ws = websocket.create_connection(url)
counter = itertools.count()
def process(request):
     request = request.copy()
     request['RequestId'] = counter.next()
     ws.send(json.dumps(request))
     pprint.pprint(json.loads(ws.recv()))

process(dict(Type='Admin', Request='Login', Params={'AuthTag':
'user-admin', 'Password': password}))
process(dict(Type='GUIToken', Request='Create', Params={}))

The last response should be something like this:

{u'RequestId': 2,
  u'Response': {u'Created': u'2013-11-25T20:11:41.624417Z',
                u'Expires': u'2013-11-25T20:13:41.624417Z',
                u'Token': u'e8ea8ac912fc4ef6a355e82bb65caf6d'}}

7. Now in your browser construct a url that has the GUI address from
step 5 and the authtoken from step 6. It should look something like
this:

https://...

[Gary Poster (gary)]

Thanks again to both of you, and apologies for the size.

https://codereview.appspot.com/33290043/

=== modified file 'app/app.js'
--- app/app.js	2013-11-18 13:27:49 +0000
+++ app/app.js	2013-11-26 22:03:26 +0000
@@ -500,6 +500,9 @@
       });
       this.endpointsController.bind();
 
+      // Stash the location object so that tests can override it.
+      this.location = window.location;
+
       // When the connection resets, reset the db, re-login (a delta will
       // arrive with successful authentication), and redispatch.
       this.env.after('connectedChange', function(ev) {
@@ -511,7 +514,33 @@
           if (credentials && credentials.areAvailable) {
             this.env.login();
           } else {
-            this.checkUserCredentials();
+            // The user can also try to log in with an authentication token.
+            // This will look like ?authtoken=AUTHTOKEN.  For instance,
+            // in the sandbox, try logging in with ?authtoken=demoToken.
+            // To get a real token from the Juju GUI charm's environment
+            // proxy, within an authenticated websocket session, use a
+            // request like this:
+            // {
+            //   'RequestId': 42,
+            //   'Type': 'GUIToken',
+            //   'Request': 'Create',
+            //   'Params': {},
+            // }
+            // You can then use the token once until it expires, within two
+            // minutes of this writing.
+            var querystring = this.location.search.substring(1);
+            var qs = Y.QueryString.parse(querystring);
+            var authtoken = qs.authtoken;
+            if (Y.Lang.isValue(authtoken)) {
+              // De-dupe if necessary.
+              if (Y.Lang.isArray(authtoken)) {
+                authtoken = authtoken[0];
+              }
+              // Try a token login.
+              this.env.tokenLogin(authtoken);
+            } else {
+              this.checkUserCredentials();
+            }
           }
         }
       }, this);
@@ -895,6 +924,31 @@
     },
 
     /**
+    Get the path to which we should redirect after logging in.  Clear it out
+    afterwards so it is clear that we've consumed it.
+
+    This is logic from the onLogin method factored out to make it easier to
+    test.
+
+    @method popLoginRedirectPath
+    @private
+    @return {String} the path to which we should redirect.
+    */
+    popLoginRedirectPath: function() {
+      var result = this.redirectPath;
+      delete this.redirectPath;
+      var currentPath = this.get('currentUrl');
+      var loginPath = /^\/login(\/|$)/;
+      if (currentPath !== '/' && !loginPath.test(currentPath)) {
+        // We used existing credentials or a token to go directly to a url.
+        result = currentPath;
+      } else if (!result || loginPath.test(result)) {
+        result = '/';
+      }
+      return result;
+    },
+
+    /**
      * Hide the login mask and redispatch the router.
      *
      * When the environment gets a response from a login attempt,
@@ -906,25 +960,31 @@
      */
     onLogin: function(e) {
       if (e.data.result) {
-        // We need to save the url to continue on to without redirecting
-        // to root if there are extra path details.
+        // The login was a success.
         this.hideMask();
-        var originalPath = this.get('currentUrl');
-        if (originalPath !== '/' && !originalPath.match(/\/login\//)) {
-          this.redirectPath = originalPath;
+        var redirectPath = this.popLoginRedirectPath();
+        // Handle token authentication.
+        if (e.data.fromToken) {
+          // Alert the user.  In the future, we might want to call out the
+          // password so the user can note it.  That will probably want a
+          // modal or similar.
+          this.env.onceAfter('environmentNameChange', function() {
+            this.db.notifications.add(
+                new models.Notification({
+                  title: 'Logged in with Token',
+                  message: ('You have successfully logged in with a ' +
+                            'single-use authentication token.'),
+                  level: 'important'
+                })
+            );
+          }, this);
         }
-        if (originalPath.match(/login/) && this.redirectPath === '/') {
+        if (redirectPath === '/') {
           setTimeout(
               Y.bind(this.showRootView, this), 0);
           return;
         } else {
-          var nsRouter = this.nsRouter;
-
-          this.navigate(
-              nsRouter.url(nsRouter.parse(this.redirectPath)),
-              {overrideAllNamespaces: true});
-          this.redirectPath = null;
-          return;
+          this.navigate(redirectPath, {overrideAllNamespaces: true});
         }
       } else {
         this.showLogin();
@@ -1239,11 +1299,25 @@
          * @attribute currentUrl.getter
          */
         getter: function() {
-          return [
-            window.location.pathname,
-            window.location.search,
-            window.location.hash
-          ].join('');
+          // The result is a normalized version of the currentURL.
+          // Specifically, it omits any authtokens and uses our standard path
+          // normalizing tool (currently the nsRouter).
+          var nsRouter = this.nsRouter;
+          // `this.location` is a test-friendly access of window.location.
+          var routes = nsRouter.parse(this.location.toString());
+          if (routes.search) {
+            var qs = Y.QueryString.parse(routes.search);
+            var authtoken = qs.authtoken;
+            if (Y.Lang.isValue(authtoken)) {
+              // Remove the token from the URL.  It is a one-shot, designed to
+              // be consumed.  We don't want it to be in the URL after it has
+              // been used.
+              delete qs.authtoken;
+              routes.search = Y.QueryString.stringify(qs);
+            }
+          }
+          // Use the nsRouter to normalize.
+          return nsRouter.url(routes);
         }
       },
       /**
@@ -1358,6 +1432,7 @@
     'model',
     'app-cookies-extension',
     'cookie',
+    'querystring',
     'app-subapp-extension',
     'sub-app',
     'subapp-browser',

=== modified file 'app/store/env/fakebackend.js'
--- app/store/env/fakebackend.js	2013-11-20 19:38:03 +0000
+++ app/store/env/fakebackend.js	2013-11-26 22:03:26 +0000
@@ -44,6 +44,7 @@
   FakeBackend.NAME = 'fake-backend';
   FakeBackend.ATTRS = {
     authorizedUsers: {value: {'admin': 'password'}},
+    token: {value: 'demoToken'},
     authenticated: {value: false},
     store: {required: true},
     defaultSeries: {value: 'precise'},
@@ -171,6 +172,26 @@
       return authenticated;
     },
 
+
+    /**
+    Attempt to log a user in with a token.
+
+    @method tokenlogin
+    @param {String} submittedToken The authentication token.
+    @return {Array} [username, password] if successful, or else undefined.
+    */
+    tokenlogin: function(submittedToken) {
+      var token = this.get('token'),
+          authorizedUsers = this.get('authorizedUsers'),
+          authenticated = token === submittedToken;
+      this.set('authenticated', authenticated);
+      if (authenticated) {
+        var username = Object.keys(authorizedUsers)[0];
+        var password = authorizedUsers[username];
+        return [username, password];
+      }
+    },
+
     /**
       Log out.  If already logged out, no error is raised.
       @method logout

=== modified file 'app/store/env/go.js'
--- app/store/env/go.js	2013-11-20 18:45:37 +0000
+++ app/store/env/go.js	2013-11-26 22:03:26 +0000
@@ -317,21 +317,47 @@
      *
      * @method handleLogin
      * @param {Object} data The response returned by the server.
+     * param {Bool} fromToken Whether the login request was via a token.
      * @return {undefined} Nothing.
      */
-    handleLogin: function(data) {
+    handleLogin: function(data, fromToken) {
+      fromToken = !!fromToken; // Normalize.
       this.pendingLoginResponse = false;
       this.userIsAuthenticated = !data.Error;
       if (this.userIsAuthenticated) {
+        // If this is a token login, set the credentials.
+        var response = data.Response;
+        if (response && response.AuthTag && response.Password) {
+          this.setCredentials({
+            user: response.AuthTag, password: response.Password});
+        }
         // If login succeeded retrieve the environment info.
         this.environmentInfo();
         this._watchAll();
+        // Clean up for log out text.
+        this.failedAuthentication = this.failedTokenAuthentication = false;
       } else {
         // If the credentials were rejected remove them.
         this.setCredentials(null);
-        this.failedAuthentication = true;
+        // Indicate if the authentication was from a token.
+        this.failedAuthentication = !fromToken;
+        this.failedTokenAuthentication = fromToken;
       }
-      this.fire('login', {data: {result: this.userIsAuthenticated}});
+      this.fire(
+          'login',
+          {data: {result: this.userIsAuthenticated,
+                  fromToken: fromToken}});
+    },
+
+    /**
+     * React to the results of sending a token login message to the server.
+     *
+     * @method handleTokenLogin
+     * @param {Object} data The response returned by the server.
+     * @return {undefined} Nothing.
+     */
+    handleTokenLogin: function(data) {
+      this.handleLogin(data, true);
     },
 
     /**
@@ -368,6 +394,28 @@
     },
 
     /**
+     * Attempt to log the user in with a token.
+     *
+     * @method tokenLogin
+     * @return {undefined} Nothing.
+     */
+    tokenLogin: function(token) {
+      // If the user is already authenticated there is nothing to do.
+      if (this.userIsAuthenticated) {
+        this.fire('login', {data: {result: true}});
+        return;
+      }
+      if (this.pendingLoginResponse) {
+        return;
+      }
+      this._send_rpc({
+        Type: 'GUIToken',
+        Request: 'Login',
+        Params: {Token: token}
+      }, this.handleTokenLogin);
+    },
+
+    /**
      * Store the environment info coming from the server.
      *
      * @method handleEnvironmentInfo

=== modified file 'app/store/env/sandbox.js'
--- app/store/env/sandbox.js	2013-11-20 19:42:15 +0000
+++ app/store/env/sandbox.js	2013-11-26 22:03:26 +0000
@@ -820,6 +820,32 @@
     },
 
     /**
+    Handle GUIToken Login messages to the state object.
+
+    @method handleGUITokenLogin
+    @param {Object} data The contents of the API arguments.
+    @param {Object} client The active ClientConnection.
+    @param {Object} state An instance of FakeBackend.
+    @return {undefined} Side effects only.
+    */
+    handleGUITokenLogin: function(data, client, state) {
+      var response = state.tokenlogin(data.Params.Token);
+      if (response) {
+        client.receive({
+          RequestId: data.RequestId,
+          Response: {AuthTag: response[0], Password: response[1]}
+        });
+      } else {
+        client.receive({
+          RequestId: data.RequestId,
+          Error: 'unknown, fulfilled, or expired token',
+          ErrorCode: 'unauthorized access',
+          Response: {}
+        });
+      }
+    },
+
+    /**
     Handle EnvironmentView messages.
 
     @method handleClientEnvironmentInfo
@@ -830,9 +856,12 @@
     */
     handleClientEnvironmentInfo: function(data, client, state) {
       client.receive({
-        ProviderType: state.get('providerType'),
-        DefaultSeries: state.get('defaultSeries'),
-        Name: 'Sandbox'
+        RequestId: data.RequestId,
+        Response: {
+          ProviderType: state.get('providerType'),
+          DefaultSeries: state.get('defaultSeries'),
+          Name: 'Sandbox'
+        }
       });
     },
 

=== modified file 'app/views/login.js'
--- app/views/login.js	2013-05-17 14:51:05 +0000
+++ app/views/login.js	2013-11-26 22:03:26 +0000
@@ -95,14 +95,20 @@
           environment_name_node.get('text') : 'Environment');
       var provider_type = (
           provider_type_node ? provider_type_node.get('text') : '');
+      var error_text = '';
+      if (env.failedAuthentication) {
+        error_text = 'Unknown user or password.';
+      } else if (env.failedTokenAuthentication) {
+        error_text = (
+            'The one-time token was unknown, expired, or already used.');
+      }
       // In order to have events work and the view cleanly be replaced by
       // other views, we need to put the contents in the usual "container"
       // node, even though it is not a child of the mask node.
       this.get('container').setHTML(this.template({
         environment_name: environment_name,
         provider_type: provider_type,
-        error_text: (
-            env.failedAuthentication ? 'Unknown user or password.' : ''),
+        error_text: error_text,
         user: env.get('user') || env.defaultUser,
         help_text: this.get('help_text')
       }));

=== modified file 'test/test_app.js'
--- test/test_app.js	2013-11-05 18:10:05 +0000
+++ test/test_app.js	2013-11-26 22:03:26 +0000
@@ -346,6 +346,54 @@
       });
     });
 
+    it('uses the authtoken when there are no credentials', function(done) {
+      var app = makeApp(false);
+      // Override the local window.location object.
+      app.location = {search: '?authtoken=demoToken'};
+      env.setCredentials(null);
+      env.connect();
+      app.after('ready', function() {
+        assert.equal(conn.messages.length, 1);
+        assert.deepEqual(conn.last_message(), {
+          RequestId: 1,
+          Type: 'GUIToken',
+          Request: 'Login',
+          Params: {Token: 'demoToken'}
+        });
+        done();
+      });
+    });
+
+    it('handles multiple authtokens', function(done) {
+      var app = makeApp(false);
+      // Override the local window.location object.
+      app.location = {search: '?authtoken=demoToken&authtoken=discarded'};
+      env.setCredentials(null);
+      env.connect();
+      app.after('ready', function() {
+        assert.equal(conn.messages.length, 1);
+        assert.deepEqual(conn.last_message(), {
+          RequestId: 1,
+          Type: 'GUIToken',
+          Request: 'Login',
+          Params: {Token: 'demoToken'}
+        });
+        done();
+      });
+    });
+
+    it('ignores the authtoken if credentials exist', function(done) {
+      var app = makeApp(false);
+      // Override the local window.location object.
+      app.location = {search: '?authtoken=demoToken'};
+      env.connect();
+      app.after('ready', function() {
+        assert.equal(1, conn.messages.length);
+        assertIsLogin(conn.last_message());
+        done();
+      });
+    });
+
     it('displays the login view if credentials are not valid', function(done) {
       var app = makeApp(true); // Create a connected app.
       app.after('ready', function() {
@@ -360,12 +408,14 @@
     });
 
     it('login method handler is called after successful login', function(done) {
-      var oldOnLogin = Y.juju.App.onLogin;
+      var oldOnLogin = Y.juju.App.prototype.onLogin;
       Y.juju.App.prototype.onLogin = function(e) {
+        // Clean up.
+        Y.juju.App.prototype.onLogin = oldOnLogin;
+        // Begin assertions.
         assert.equal(conn.messages.length, 1);
         assertIsLogin(conn.last_message());
         assert.isTrue(e.data.result, true);
-        Y.juju.App.onLogin = oldOnLogin;
         done();
       };
       var app = new Y.juju.App({ env: env, viewContainer: container });
@@ -375,6 +425,50 @@
       app.destroy(true);
     });
 
+    it('creates a notification if logged in with a token', function(done) {
+      // We need to change the prototype before we instantiate.
+      // See the "this.reset()" call in the callback below that cleans up.
+      var stub = utils.makeStubMethod(Y.juju.App.prototype, 'onLogin');
+      var app = makeApp(false);
+      utils.makeStubMethod(app, 'hideMask');
+      app.redirectPath = '/foo/bar/';
+      app.location = {
+        toString: function() {return '/login/';},
+        search: '?authtoken=demoToken'};
+      utils.makeStubMethod(app.env, 'onceAfter');
+      utils.makeStubMethod(app, 'navigate');
+      stub.addCallback(function() {
+        // Clean up.
+        this.reset();
+        // Begin assertions.
+        var e = this.lastArguments()[0];
+        // These two really simply verify that our test prep did what we
+        // expected.
+        assert.isTrue(e.data.result);
+        assert.isTrue(e.data.fromToken);
+        this.passThroughToOriginalMethod(app);
+        assert.isTrue(app.hideMask.calledOnce());
+        assert.isTrue(app.env.onceAfter.calledOnce());
+        var onceAfterArgs = app.env.onceAfter.lastArguments();
+        assert.equal(onceAfterArgs[0], 'environmentNameChange');
+        // Call the event handler so we can verify what it does.
+        onceAfterArgs[1].call(onceAfterArgs[2]);
+        assert.equal(
+            app.db.notifications.item(0).get('title'),
+            'Logged in with Token');
+        assert.isTrue(app.navigate.calledOnce());
+        var navigateArgs = app.navigate.lastArguments();
+        assert.equal(navigateArgs[0], '/foo/bar/');
+        assert.deepEqual(navigateArgs[1], {overrideAllNamespaces: true});
+        done();
+      });
+      env.setCredentials(null);
+      env.connect();
+      conn.msg({
+        RequestId: conn.last_message().RequestId,
+        Response: {AuthTag: 'tokenuser', Password: 'tokenpasswd'}});
+    });
+
     it('tries to log in on first connection', function(done) {
       // This is the case when credential are stashed.
       var app = makeApp(true); // Create a disconnected app.
@@ -406,6 +500,96 @@
       assert.equal(null, env.getCredentials());
     });
 
+    it('normally uses window.location', function() {
+      // A lot of the app's authentication dance uses window.location,
+      // both for redirects after login and for authtokens.  For tests,
+      // the app copies window.location to app.location, so that we
+      // can easily override it.  This test verifies that the initialization
+      // actually does stash window.location as we exprect.
+      var app = makeApp(false);
+      assert.strictEqual(window.location, app.location);
+    });
+
+    describe('popLoginRedirectPath', function() {
+      it('returns and clears redirectPath', function() {
+        var app = makeApp(false);
+        app.redirectPath = '/foo/bar/';
+        app.location = {toString: function() {return '/login/';}};
+        assert.equal(app.popLoginRedirectPath(), '/foo/bar/');
+        assert.isUndefined(app.redirectPath);
+      });
+
+      it('prefers the current path if not login', function() {
+        var app = makeApp(false);
+        app.redirectPath = '/';
+        app.location = {toString: function() {return '/foo/bar/';}};
+        assert.equal(app.popLoginRedirectPath(), '/foo/bar/');
+        assert.isUndefined(app.redirectPath);
+      });
+
+      it('uses root if the redirectPath is /login/', function() {
+        var app = makeApp(false);
+        app.redirectPath = '/login/';
+        app.location = {toString: function() {return '/login/';}};
+        assert.equal(app.popLoginRedirectPath(), '/');
+        assert.isUndefined(app.redirectPath);
+      });
+
+      it('uses root if the redirectPath is /login', function() {
+        var app = makeApp(false);
+        // Missing trailing slash is only difference from previous test.
+        app.redirectPath = '/login';
+        app.location = {toString: function() {return '/login';}};
+        assert.equal(app.popLoginRedirectPath(), '/');
+        assert.isUndefined(app.redirectPath);
+      });
+    });
+
+    describe('currentUrl', function() {
+      it('returns the full current path', function() {
+        var app = makeApp(false);
+        var expected = '/foo/bar/';
+        app.location = {
+          toString: function() {return 'https://foo.com' + expected;}};
+        assert.equal(expected, app.get('currentUrl'));
+        expected = '/';
+        assert.equal(expected, app.get('currentUrl'));
+        expected = '/foo/?bar=bing#shazam';
+        assert.equal(expected, app.get('currentUrl'));
+      });
+
+      it('ignores authtokens', function() {
+        // This is intended to be the canonical current path.  This should
+        // never include authtokens, which are transient and can never be
+        // re-used.
+        var app = makeApp(false);
+        var expected_path = '/foo/bar/';
+        var expected_querystring = '';
+        var expected_hash = '';
+        var expected = function(add_authtoken) {
+          var result = expected_path;
+          var querystring = expected_querystring;
+          if (add_authtoken) {
+            querystring += '&authtoken=demoToken';
+          }
+          if (querystring) {
+            result += '?' + querystring;
+          }
+          result += expected_hash;
+          return result;
+        };
+        app.location = {
+          toString: function() {return 'https://foo.com' + expected(true);}};
+        assert.equal(expected(), app.get('currentUrl'));
+        expected_path = '/';
+        assert.equal(expected(), app.get('currentUrl'));
+        expected_path = '/foo/';
+        expected_querystring = 'bar=bing';
+        expected_hash = '#shazam';
+        assert.equal(expected(), app.get('currentUrl'));
+      });
+    });
+
   });
 })();
 

=== modified file 'test/test_env_go.js'
--- test/test_env_go.js	2013-11-20 18:45:37 +0000
+++ test/test_env_go.js	2013-11-26 22:03:26 +0000
@@ -82,7 +82,7 @@
   });
 
   describe('Go Juju environment', function() {
-    var conn, endpointA, endpointB, env, juju, msg, utils, Y, oldHandleLogin;
+    var conn, endpointA, endpointB, env, juju, msg, utils, Y, cleanups;
 
     before(function(done) {
       Y = YUI(GlobalConfig).use(['juju-env', 'juju-tests-utils'], function(Y) {
@@ -98,109 +98,220 @@
         conn: conn, user: 'user', password: 'password'
       }, 'go');
       env.connect();
+      cleanups = [];
     });
 
     afterEach(function()  {
-      env.destroy();
+      cleanups.forEach(function(action) {action();});
+      // We need to clear any credentials stored in sessionStorage.
+      env.setCredentials(null);
+      if (env && env.destroy) {env.destroy();}
+      if (conn && conn.destroy) {conn.destroy();}
     });
 
     var noopHandleLogin = function() {
-      // In order to avoid rewriting all of these go tests we need to destroy
-      // the env created in the beforeEach
-      env.destroy();
-      // We need to clear any credentials stored in sessionStorage.
-      env.setCredentials(null);
-      oldHandleLogin = Y.juju.environments.GoEnvironment.handleLogin;
+      var oldHandleLogin = Y.juju.environments.GoEnvironment.handleLogin;
       Y.juju.environments.GoEnvironment.handleLogin = function() {};
-      conn = new utils.SocketStub();
-      env = juju.newEnvironment({
-        conn: conn, user: 'user', password: 'password'
-      }, 'go');
-      env.connect();
-    };
-
-    var resetHandleLogin = function() {
-      Y.juju.environments.GoEnvironment.handleLogin = oldHandleLogin;
-    };
-
-    it('sends the correct login message', function() {
-      noopHandleLogin();
-      env.login();
-      var last_message = conn.last_message();
-      var expected = {
-        Type: 'Admin',
-        Request: 'Login',
-        RequestId: 1,
-        Params: {AuthTag: 'user', Password: 'password'}
-      };
-      assert.deepEqual(expected, last_message);
-      resetHandleLogin();
-    });
-
-    it('resets the user and password if they are not valid', function() {
-      env.login();
-      // Assume login to be the first request.
-      conn.msg({RequestId: 1, Error: 'Invalid user or password'});
-      assert.isNull(env.getCredentials());
-      assert.isTrue(env.failedAuthentication);
-    });
-
-    it('fires a login event on successful login', function() {
-      var loginFired = false;
-      var result;
-      env.on('login', function(evt) {
-        loginFired = true;
-        result = evt.data.result;
-      });
-      env.login();
-      // Assume login to be the first request.
-      conn.msg({RequestId: 1, Response: {}});
-      assert.isTrue(loginFired);
-      assert.isTrue(result);
-    });
-
-    it('fires a login event on failed login', function() {
-      var loginFired = false;
-      var result;
-      env.on('login', function(evt) {
-        loginFired = true;
-        result = evt.data.result;
-      });
-      env.login();
-      // Assume login to be the first request.
-      conn.msg({RequestId: 1, Error: 'Invalid user or password'});
-      assert.isTrue(loginFired);
-      assert.isFalse(result);
-    });
-
-    it('avoids sending login requests without credentials', function() {
-      env.setCredentials(null);
-      env.login();
-      assert.equal(0, conn.messages.length);
-    });
-
-    it('calls environmentInfo and watchAll ofter login', function() {
-      env.login();
-      // Assume login to be the first request.
-      conn.msg({RequestId: 1, Response: {}});
-      var environmentInfoMessage = conn.last_message(2);
-      // EnvironmentInfo is the second request.
-      var environmentInfoExpected = {
-        Type: 'Client',
-        Request: 'EnvironmentInfo',
-        RequestId: 2,
-        Params: {}
-      };
-      assert.deepEqual(environmentInfoExpected, environmentInfoMessage);
-      var watchAllMessage = conn.last_message();
-      // EnvironmentInfo is the second request.
-      var watchAllExpected = {
-        Type: 'Client',
-        Request: 'WatchAll',
-        RequestId: 3,
-        Params: {}
-      };
-      assert.deepEqual(watchAllExpected, watchAllMessage);
+      cleanups.push(function() {
+        Y.juju.environments.GoEnvironment.handleLogin = oldHandleLogin;
+      });
+    };
+
+    describe('login', function() {
+      it('sends the correct login message', function() {
+        noopHandleLogin();
+        env.login();
+        var last_message = conn.last_message();
+        var expected = {
+          Type: 'Admin',
+          Request: 'Login',
+          RequestId: 1,
+          Params: {AuthTag: 'user', Password: 'password'}
+        };
+        assert.deepEqual(expected, last_message);
+      });
+
+      it('resets the user and password if they are not valid', function() {
+        env.login();
+        // Assume login to be the first request.
+        conn.msg({RequestId: 1, Error: 'Invalid user or password'});
+        assert.isNull(env.getCredentials());
+        assert.isTrue(env.failedAuthentication);
+        assert.isFalse(env.failedTokenAuthentication);
+      });
+
+      it('fires a login event on successful login', function() {
+        var loginFired = false;
+        var result, fromToken;
+        env.on('login', function(evt) {
+          loginFired = true;
+          result = evt.data.result;
+          fromToken = evt.data.fromToken;
+        });
+        env.login();
+        // Assume login to be the first request.
+        conn.msg({RequestId: 1, Response: {}});
+        assert.isTrue(loginFired);
+        assert.isTrue(result);
+        assert.isFalse(fromToken);
+      });
+
+      it('resets failed markers on successful login', function() {
+        env.failedAuthentication = env.failedTokenAuthentication = true;
+        env.login();
+        // Assume login to be the first request.
+        conn.msg({RequestId: 1, Response: {}});
+        assert.isFalse(env.failedAuthentication);
+        assert.isFalse(env.failedTokenAuthentication);
+      });
+
+      it('fires a login event on failed login', function() {
+        var loginFired = false;
+        var result;
+        env.on('login', function(evt) {
+          loginFired = true;
+          result = evt.data.result;
+        });
+        env.login();
+        // Assume login to be the first request.
+        conn.msg({RequestId: 1, Error: 'Invalid user or password'});
+        assert.isTrue(loginFired);
+        assert.isFalse(result);
+      });
+
+      it('avoids sending login requests without credentials', function() {
+        env.setCredentials(null);
+        env.login();
+        assert.equal(0, conn.messages.length);
+      });
+
+      it('calls environmentInfo and watchAll ofter login', function() {
+        env.login();
+        // Assume login to be the first request.
+        conn.msg({RequestId: 1, Response: {}});
+        var environmentInfoMessage = conn.last_message(2);
+        // EnvironmentInfo is the second request.
+        var environmentInfoExpected = {
+          Type: 'Client',
+          Request: 'EnvironmentInfo',
+          RequestId: 2,
+          Params: {}
+        };
+        assert.deepEqual(environmentInfoExpected, environmentInfoMessage);
+        var watchAllMessage = conn.last_message();
+        // EnvironmentInfo is the second request.
+        var watchAllExpected = {
+          Type: 'Client',
+          Request: 'WatchAll',
+          RequestId: 3,
+          Params: {}
+        };
+        assert.deepEqual(watchAllExpected, watchAllMessage);
+      });
+    });
+
+    describe('tokenLogin', function() {
+      it('sends the correct tokenLogin message', function() {
+        noopHandleLogin();
+        env.tokenLogin('demoToken');
+        var last_message = conn.last_message();
+        var expected = {
+          Type: 'GUIToken',
+          Request: 'Login',
+          RequestId: 1,
+          Params: {Token: 'demoToken'}
+        };
+        assert.deepEqual(expected, last_message);
+      });
+
+      it('resets the user and password if the token is not valid', function() {
+        env.tokenLogin('badToken');
+        // Assume login to be the first request.
+        conn.msg({
+          RequestId: 1,
+          Error: 'unknown, fulfilled, or expired token',
+          ErrorCode: 'unauthorized access'
+        });
+        assert.isNull(env.getCredentials());
+        assert.isTrue(env.failedTokenAuthentication);
+        assert.isFalse(env.failedAuthentication);
+      });
+
+      it('fires a login event on successful token login', function() {
+        var loginFired = false;
+        var result, fromToken;
+        env.on('login', function(evt) {
+          loginFired = true;
+          result = evt.data.result;
+          fromToken = evt.data.fromToken;
+        });
+        env.tokenLogin('demoToken');
+        // Assume login to be the first request.
+        conn.msg({
+          RequestId: 1,
+          Response: {AuthTag: 'tokenuser', Password: 'tokenpasswd'}});
+        assert.isTrue(loginFired);
+        assert.isTrue(result);
+        assert.isTrue(fromToken);
+        var credentials = env.getCredentials();
+        assert.equal('tokenuser', credentials.user);
+        assert.equal('tokenpasswd', credentials.password);
+      });
+
+      it('resets failed markers on successful login', function() {
+        env.failedAuthentication = env.failedTokenAuthentication = true;
+        env.tokenLogin('demoToken');
+        // Assume login to be the first request.
+        conn.msg({
+          RequestId: 1,
+          Response: {AuthTag: 'tokenuser', Password: 'tokenpasswd'}});
+        assert.isFalse(env.failedAuthentication);
+        assert.isFalse(env.failedTokenAuthentication);
+      });
+
+      it('fires a login event on failed token login', function() {
+        var loginFired = false;
+        var result;
+        env.on('login', function(evt) {
+          loginFired = true;
+          result = evt.data.result;
+        });
+        env.tokenLogin('badToken');
+        // Assume login to be the first request.
+        conn.msg({
+          RequestId: 1,
+          Error: 'unknown, fulfilled, or expired token',
+          ErrorCode: 'unauthorized access'
+        });
+        assert.isTrue(loginFired);
+        assert.isFalse(result);
+      });
+
+      it('calls environmentInfo and watchAll ofter token login', function() {
+        env.tokenLogin('demoToken');
+        // Assume login to be the first request.
+        conn.msg({
+          RequestId: 1,
+          Response: {AuthTag: 'tokenuser', Password: 'tokenpasswd'}});
+        var environmentInfoMessage = conn.last_message(2);
+        // EnvironmentInfo is the second request.
+        var environmentInfoExpected = {
+          Type: 'Client',
+          Request: 'EnvironmentInfo',
+          RequestId: 2,
+          Params: {}
+        };
+        assert.deepEqual(environmentInfoExpected, environmentInfoMessage);
+        var watchAllMessage = conn.last_message();
+        // EnvironmentInfo is the second request.
+        var watchAllExpected = {
+          Type: 'Client',
+          Request: 'WatchAll',
+          RequestId: 3,
+          Params: {}
+        };
+        assert.deepEqual(watchAllExpected, watchAllMessage);
+      });
     });
 
     it('sends the correct request for environment info', function() {

=== modified file 'test/test_fakebackend.js'
--- test/test_fakebackend.js	2013-11-20 19:38:03 +0000
+++ test/test_fakebackend.js	2013-11-26 22:03:26 +0000
@@ -60,6 +60,37 @@
     });
   });
 
+  describe('FakeBackend.tokenlogin', function() {
+    var requires = ['node', 'juju-env-fakebackend'];
+    var Y, environmentsModule, fakebackend;
+
+    before(function(done) {
+      Y = YUI(GlobalConfig).use(requires, function(Y) {
+        environmentsModule = Y.namespace('juju.environments');
+        done();
+      });
+    });
+
+    afterEach(function() {
+      fakebackend.destroy();
+    });
+
+    it('authenticates', function() {
+      fakebackend = new environmentsModule.FakeBackend();
+      assert.equal(fakebackend.get('authenticated'), false);
+      assert.deepEqual(
+          fakebackend.tokenlogin('demoToken'), ['admin', 'password']);
+      assert.equal(fakebackend.get('authenticated'), true);
+    });
+
+    it('refuses to authenticate', function() {
+      fakebackend = new environmentsModule.FakeBackend();
+      assert.equal(fakebackend.get('authenticated'), false);
+      assert.isUndefined(fakebackend.tokenlogin('not the token'));
+      assert.equal(fakebackend.get('authenticated'), false);
+    });
+  });
+
   describe('FakeBackend.deploy', function() {
     var requires = [
       'node', 'juju-tests-utils', 'juju-models', 'juju-charm-models'];

=== modified file 'test/test_login.js'
--- test/test_login.js	2013-08-27 16:24:00 +0000
+++ test/test_login.js	2013-11-26 22:03:26 +0000
@@ -44,6 +44,7 @@
       env.destroy();
     });
 
+    // These duplicate more thorough tests in test_env_go.js.
     test('the user is initially assumed to be unauthenticated', function() {
       assert.isFalse(env.userIsAuthenticated);
     });

=== modified file 'test/test_sandbox_go.js'
--- test/test_sandbox_go.js	2013-11-20 18:45:37 +0000
+++ test/test_sandbox_go.js	2013-11-26 22:03:26 +0000
@@ -45,6 +45,8 @@
     });
 
     afterEach(function() {
+      // We need to clear any credentials stored in sessionStorage.
+      env.setCredentials(null);
       env.destroy();
       client.destroy();
       juju.destroy();
@@ -154,6 +156,91 @@
       env.login();
     });
 
+    it('can log in with a token.', function(done) {
+      // See FakeBackend's initialization for these default authentication
+      // values.
+      var data = {
+        Type: 'GUIToken',
+        Request: 'Login',
+        Params: {
+          Token: 'demoToken'
+        },
+        RequestId: 42
+      };
+      client.onmessage = function(received) {
+        var expected = {
+          RequestId: 42, Response: {AuthTag: 'admin', Password: 'password'}};
+        assert.deepEqual(Y.JSON.parse(received.data), expected);
+        assert.isTrue(state.get('authenticated'));
+        done();
+      };
+      state.logout();
+      assert.isFalse(state.get('authenticated'));
+      client.open();
+      client.send(Y.JSON.stringify(data));
+    });
+
+    it('does not log in with a bad token.', function(done) {
+      // See FakeBackend's initialization for these default authentication
+      // values.
+      var data = {
+        Type: 'GUIToken',
+        Request: 'Login',
+        Params: {
+          Token: 'badToken'
+        },
+        RequestId: 42
+      };
+      client.onmessage = function(received) {
+        var expected = {
+          RequestId: 42,
+          Error: 'unknown, fulfilled, or expired token',
+          ErrorCode: 'unauthorized access',
+          Response: {}};
+        assert.deepEqual(Y.JSON.parse(received.data), expected);
+        assert.isFalse(state.get('authenticated'));
+        done();
+      };
+      state.logout();
+      assert.isFalse(state.get('authenticated'));
+      client.open();
+      client.send(Y.JSON.stringify(data));
+    });
+
+    it('can log in with a token (environment integration).', function(done) {
+      state.logout();
+      env.after('login', function() {
+        assert.isTrue(env.userIsAuthenticated);
+        assert.deepEqual(env.getCredentials(),
+                         {user: 'admin', password: 'password'});
+        done();
+      });
+      env.connect();
+      assert.isFalse(env.getCredentials().areAvailable);
+      env.tokenLogin('demoToken');
+    });
+
+    it('can return environment information.', function(done) {
+      // See FakeBackend's initialization for these default values.
+      var data = {
+        Type: 'Client',
+        Request: 'EnvironmentInfo',
+        RequestId: 42
+      };
+      client.onmessage = function(received) {
+        var expected = {
+          RequestId: 42,
+          Response: {
+            ProviderType: state.get('providerType'),
+            DefaultSeries: state.get('defaultSeries'),
+            Name: 'Sandbox'}};
+        assert.deepEqual(Y.JSON.parse(received.data), expected);
+        done();
+      };
+      client.open();
+      client.send(Y.JSON.stringify(data));
+    });
+
     it('can start the AllWatcher', function(done) {
       var data = {
         Type: 'Client',

=== modified file 'test/utils.js'
--- test/utils.js	2013-11-21 15:04:59 +0000
+++ test/utils.js	2013-11-26 22:03:26 +0000
@@ -24,6 +24,77 @@
 
   jujuTests.utils = {
 
+    /**
+     * Make a stub function.  Pass in 0 or more arguments to become responses
+     * that the function cycles through.
+     *
+     * @method makeStubFunction
+     * @return {Function} the new stub function.
+     */
+    makeStubFunction: function() {
+      var responses = Array.prototype.slice.call(arguments, 0);
+      if (responses.length === 0) {
+        responses.push(undefined);
+      }
+      var f = function() {
+        var response = responses[(f._allArguments.length) % responses.length];
+        f._allArguments.push(Array.prototype.slice.call(arguments, 0));
+        f._callbacks.forEach(function(cb) {cb.call(f);});
+        return response;
+      };
+      f._allArguments = [];
+      f._callbacks = [];
+      f.called = function() {
+        return !!f._allArguments.length;
+      };
+      f.calledOnce = function() {
+        return f._allArguments.length === 1;
+      };
+      f.callCount = function() {
+        return f._allArguments.length;
+      };
+      f.lastArguments = function() {
+        return f._allArguments[f._allArguments.length - 1];
+      };
+      f.allArguments = function() {
+        return f._allArguments.slice(0);
+      };
+      f.addCallback = function(cb) {
+        f._callbacks.push(cb);
+      };
+      return f;
+    },
+
+    /**
+     * Make a stub method.  Pass in 0 or more arguments to become responses
+     * that the method cycles through.
+     *
+     * The function has all introspection methods from makeMockFunction,
+     * plus "reset", which resets the object with the original value.
+     * This is pre-bound, so it is easy to pass in as a clean-up function.
+     *
+     * @method makeStubMethod
+     * @param {Object} context the object on which the method will sit.
+     * @param {String} name the name to be replaced.
+     * @return {Function} the new stub function.
+     */
+    makeStubMethod: function(context, name) {
+      var responses = Array.prototype.slice.call(arguments, 2);
+      var original = context[name];
+      var f = context[name] = jujuTests.utils.makeStubFunction.apply(
+          jujuTests.utils, responses);
+      f.reset = function() {
+        context[name] = original;
+      };
+      f.passThroughToOriginalMethod = function(instance) {
+        if (!Y.Lang.isValue(instance)) {
+          instance = context;
+        }
+        return original.apply(instance, f.lastArguments());
+      };
+      return f;
+    },
+
     makeContainer: function(id, visibleContainer) {
       var container = Y.Node.create('<div>');
       if (id) {