Merge lp:~mardy/signon/rtm-fixes into lp:~online-accounts/signon/rtm-14.09

[Alberto Mardegan]

Don't bypass the ACL if the identity has no owner

This includes some fixes and refactoring to the unit tests.

Don't bypass the ACL if the identity has no owner

This includes some fixes and refactoring to the unit tests.

[David Barth (dbarth)]

review: Approve

[lp:~mardy/signon/rtm-fixes]

623. By Alberto Mardegan on 2014-11-28

Fix changelog

[David Barth (dbarth)]

review: Approve

Unmerged revisions

623. By Alberto Mardegan on 2014-11-28

Fix changelog

622. By Alberto Mardegan on 2014-11-28

Don't bypass the ACL if the identity has no owner

=== modified file 'debian/changelog'
--- debian/changelog	2014-10-06 07:57:10 +0000
+++ debian/changelog	2014-11-28 12:00:40 +0000
@@ -1,3 +1,9 @@
+signon (8.57+14.10.20141006-0ubuntu2) UNRELEASED; urgency=medium
+
+  * Don't bypass the ACL if the identity has no owner. (LP: #1392380)
+
+ -- Alberto Mardegan <[e-mail]>  Fri, 28 Nov 2014 13:54:25 +0200
+
 signon (8.57+14.10.20141006-0ubuntu1) utopic; urgency=low
 
   [ Alberto Mardegan ]

=== modified file 'lib/plugins/SignOn/uisessiondata_priv.h'
--- lib/plugins/SignOn/uisessiondata_priv.h	2014-10-02 13:57:24 +0000
+++ lib/plugins/SignOn/uisessiondata_priv.h	2014-11-28 12:00:40 +0000
@@ -68,6 +68,8 @@
 
 /* Process ID of the client application */
 #define SSOUI_KEY_PID               QLatin1String("Pid")
+/* Application ID (security context) of the client application */
+#define SSOUI_KEY_APP_ID            QLatin1String("AppId")
 
 #define SSOUI_KEY_SLOT_ACCEPT  "accept"
 #define SSOUI_KEY_SLOT_REJECT  "reject"

=== modified file 'src/signond/accesscontrolmanagerhelper.cpp'
--- src/signond/accesscontrolmanagerhelper.cpp	2013-08-20 08:01:44 +0000
+++ src/signond/accesscontrolmanagerhelper.cpp	2014-11-28 12:00:40 +0000
@@ -89,7 +89,7 @@
 
     IdentityOwnership ownership =
         isPeerOwnerOfIdentity(peerConnection, peerMessage, identityId);
-    if (ownership == ApplicationIsOwner || ownership == IdentityDoesNotHaveOwner)
+    if (ownership == ApplicationIsOwner)
         return true;
 
     if (acl.isEmpty())

=== modified file 'src/signond/signondaemonadaptor.cpp'
--- src/signond/signondaemonadaptor.cpp	2013-08-20 08:01:44 +0000
+++ src/signond/signondaemonadaptor.cpp	2014-11-28 12:00:40 +0000
@@ -172,7 +172,7 @@
 
     /* Access Control */
     if (id != SIGNOND_NEW_IDENTITY) {
-        if (!acm->isPeerAllowedToUseAuthSession(conn, msg, id)) {
+        if (!acm->isPeerAllowedToUseIdentity(conn, msg, id)) {
             SignOn::AccessReply *reply =
                 acm->requestAccessToIdentity(conn, msg, id);
             /* If the request is accepted, we'll need the method name ("type")

=== modified file 'src/signond/signonidentity.cpp'
--- src/signond/signonidentity.cpp	2014-08-21 07:33:45 +0000
+++ src/signond/signonidentity.cpp	2014-11-28 12:00:40 +0000
@@ -471,41 +471,19 @@
     MethodMap methods = container.isValid() ?
         qdbus_cast<MethodMap>(container.value<QDBusArgument>()) : MethodMap();
 
-    //Add creator to owner list if it has AID
-    QStringList ownerList =
-        info.value(SIGNOND_IDENTITY_INFO_OWNER).toStringList();
-    if (!appId.isNull())
-        ownerList.append(appId);
-
     if (m_pInfo == 0) {
         m_pInfo = new SignonIdentityInfo(info);
         m_pInfo->setMethods(methods);
+        //Add creator to owner list if it has AID
+        QStringList ownerList =
+            info.value(SIGNOND_IDENTITY_INFO_OWNER).toStringList();
+        if (!appId.isNull()) {
+            ownerList.append(appId);
+        }
         m_pInfo->setOwnerList(ownerList);
     } else {
-        if (info.contains(SIGNOND_IDENTITY_INFO_SECRET)) {
-            QString secret = info.value(SIGNOND_IDENTITY_INFO_SECRET).toString();
-            m_pInfo->setPassword(secret);
-        }
-        bool storeSecret =
-            info.value(SIGNOND_IDENTITY_INFO_STORESECRET).toBool();
-        QString userName =
-            info.value(SIGNOND_IDENTITY_INFO_USERNAME).toString();
-        QString caption =
-            info.value(SIGNOND_IDENTITY_INFO_CAPTION).toString();
-        QStringList realms =
-            info.value(SIGNOND_IDENTITY_INFO_REALMS).toStringList();
-        QStringList accessControlList =
-            info.value(SIGNOND_IDENTITY_INFO_ACL).toStringList();
-        int type = info.value(SIGNOND_IDENTITY_INFO_TYPE).toInt();
-
-        m_pInfo->setStorePassword(storeSecret);
-        m_pInfo->setUserName(userName);
-        m_pInfo->setCaption(caption);
-        m_pInfo->setMethods(methods);
-        m_pInfo->setRealms(realms);
-        m_pInfo->setAccessControlList(accessControlList);
-        m_pInfo->setOwnerList(ownerList);
-        m_pInfo->setType(type);
+        SignonIdentityInfo newInfo(info);
+        m_pInfo->update(newInfo);
     }
 
     m_id = storeCredentials(*m_pInfo);

=== modified file 'src/signond/signonidentityinfo.cpp'
--- src/signond/signonidentityinfo.cpp	2013-11-26 14:23:18 +0000
+++ src/signond/signonidentityinfo.cpp	2014-11-28 12:00:40 +0000
@@ -60,6 +60,18 @@
     return *this;
 }
 
+void SignonIdentityInfo::update(const SignonIdentityInfo &info)
+{
+    QMapIterator<QString, QVariant> it(info);
+    while (it.hasNext()) {
+        it.next();
+        // We don't allow updating the ID
+        if (it.key() == SIGNOND_IDENTITY_INFO_ID) continue;
+
+        insert(it.key(), it.value());
+    }
+}
+
 bool SignonIdentityInfo::checkMethodAndMechanism(const QString &method,
                                                  const QString &mechanism,
                                                  QString &allowedMechanism)

=== modified file 'src/signond/signonidentityinfo.h'
--- src/signond/signonidentityinfo.h	2013-11-26 14:23:18 +0000
+++ src/signond/signonidentityinfo.h	2014-11-28 12:00:40 +0000
@@ -46,6 +46,8 @@
 
     const QVariantMap toMap() const;
 
+    void update(const SignonIdentityInfo &info);
+
     void setNew() { setId(SIGNOND_NEW_IDENTITY); }
     bool isNew() const { return id() == SIGNOND_NEW_IDENTITY; }
     void setId(quint32 id) { insert(SIGNOND_IDENTITY_INFO_ID, id); }

=== modified file 'src/signond/signonsessioncore.cpp'
--- src/signond/signonsessioncore.cpp	2014-10-02 13:57:24 +0000
+++ src/signond/signonsessioncore.cpp	2014-11-28 12:00:40 +0000
@@ -705,8 +705,12 @@
         request.m_params[SSOUI_KEY_CLIENT_DATA] = m_clientData;
         request.m_params[SSOUI_KEY_METHOD] = m_method;
         request.m_params[SSOUI_KEY_MECHANISM] = request.m_mechanism;
-        request.m_params[SSOUI_KEY_PID] =
-            AccessControlManagerHelper::instance()->pidOfPeer(request.m_conn,
+        /* Pass some data about the requesting client */
+        AccessControlManagerHelper *acm =
+            AccessControlManagerHelper::instance();
+        request.m_params[SSOUI_KEY_PID] = acm->pidOfPeer(request.m_conn,
+                                                         request.m_msg);
+        request.m_params[SSOUI_KEY_APP_ID] = acm->appIdOfPeer(request.m_conn,
                                                               request.m_msg);
 
         CredentialsAccessManager *camManager =

=== modified file 'tests/libsignon-qt-tests/ssotestclient.cpp'
--- tests/libsignon-qt-tests/ssotestclient.cpp	2013-11-22 14:46:01 +0000
+++ tests/libsignon-qt-tests/ssotestclient.cpp	2014-11-28 12:00:40 +0000
@@ -257,16 +257,137 @@
     TEST_DONE
 }
 
+void SsoTestClient::storeCredentials_data()
+{
+    QTest::addColumn<bool>("addMethods");
+
+    QTest::newRow("with methods") << true;
+    QTest::newRow("without methods") << false;
+}
+
 void SsoTestClient::storeCredentials()
 {
     TEST_START
 
-    if (!testAddingNewCredentials()) {
-        QFAIL("Adding new credentials test failed.");
-    }
-
-    if (!testUpdatingCredentials()) {
-        QFAIL("Updating existing credentials test failed.");
+    QFETCH(bool, addMethods);
+
+    m_identityResult.reset();
+
+    QMap<MethodName, MechanismsList> methods;
+    if (addMethods) {
+        methods.insert("dummy", QStringList() << "mech1" << "mech2" << "mech3");
+        methods.insert("dummy1", QStringList() << "mech11" << "mech12" << "mech13");
+    }
+    IdentityInfo info("TEST_CAPTION", "TEST_USERNAME", methods);
+    info.setSecret("TEST_SECRET");
+    info.setRealms(QStringList() << "TEST_REALM1" << "TEST_REALM2");
+    info.setAccessControlList(QStringList() << "*");
+
+    Identity *identity = Identity::newIdentity(info, this);
+
+    QEventLoop loop;
+
+    connect(identity, SIGNAL(error(const SignOn::Error &)),
+            &m_identityResult, SLOT(error(const SignOn::Error &)));
+
+    connect(identity, SIGNAL(credentialsStored(const quint32)),
+            &m_identityResult, SLOT(credentialsStored(const quint32)));
+    connect(&m_identityResult, SIGNAL(testCompleted()), &loop, SLOT(quit()));
+
+    identity->storeCredentials();
+
+    QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
+    loop.exec();
+
+    if (m_identityResult.m_responseReceived ==
+        TestIdentityResult::InexistentResp) {
+        QFAIL("A response was not received.");
+    }
+
+    if (m_identityResult.m_responseReceived == TestIdentityResult::NormalResp) {
+        QCOMPARE(m_identityResult.m_id, identity->id());
+
+        Identity *existingIdentity =
+            Identity::existingIdentity(m_identityResult.m_id, this);
+        QVERIFY2(existingIdentity != NULL,
+                 "Could not create existing identity. '0' ID provided?");
+        connect(existingIdentity, SIGNAL(info(const SignOn::IdentityInfo &)),
+                &m_identityResult, SLOT(info(const SignOn::IdentityInfo &)));
+
+        existingIdentity->queryInfo();
+
+        QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
+        loop.exec();
+        delete existingIdentity;
+
+        if (!TestIdentityResult::compareIdentityInfos(m_identityResult.m_idInfo,
+                                                      info)) {
+            QFAIL("Compared identity infos are not the same.");
+        }
+    } else {
+        QString codeStr = errCodeAsStr(m_identityResult.m_error);
+        qDebug() << "Error reply: " << m_serviceResult.m_errMsg
+                 << ".\nError code: " << codeStr;
+        QFAIL("Error received");
+    }
+
+    // Test update credentials functionality
+
+    Identity *existingIdentity = Identity::existingIdentity(m_identityResult.m_id, this);
+    QVERIFY2(existingIdentity != NULL,
+             "Could not create existing identity. '0' ID provided?");
+
+    methods.clear();
+    if (addMethods) {
+        methods.insert("dummy1", QStringList() << "mech11" << "mech12" << "mech13");
+        methods.insert("dummy2", QStringList() << "mech1_updated" << "mech2" << "mech1_updated2");
+        methods.insert("dummy3", QStringList() << "mech1_updated" << "mech2" << "mech1_updated2");
+    }
+
+    IdentityInfo updateInfo("TEST_CAPTION", "TEST_USERNAME_UPDATED", methods);
+    updateInfo.setSecret("TEST_SECRET_YES", false);
+
+    do
+    {
+        QEventLoop loop;
+
+        connect(existingIdentity, SIGNAL(error(const SignOn::Error &)),
+                &m_identityResult, SLOT(error(const SignOn::Error &)));
+
+        connect(existingIdentity, SIGNAL(credentialsStored(const quint32)),
+                &m_identityResult, SLOT(credentialsStored(const quint32)));
+        connect(&m_identityResult, SIGNAL(testCompleted()), &loop, SLOT(quit()));
+
+        existingIdentity->storeCredentials(updateInfo);
+        qDebug();
+        QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
+        loop.exec();
+    } while(0);
+
+    if (m_identityResult.m_responseReceived ==
+        TestIdentityResult::InexistentResp) {
+        QFAIL("A response was not received.");
+    }
+
+    if (m_identityResult.m_responseReceived == TestIdentityResult::NormalResp) {
+        QEventLoop loop;
+        connect(&m_identityResult, SIGNAL(testCompleted()), &loop, SLOT(quit()));
+        connect(existingIdentity, SIGNAL(info(const SignOn::IdentityInfo &)),
+                &m_identityResult, SLOT(info(const SignOn::IdentityInfo &)));
+
+        existingIdentity->queryInfo();
+        QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
+        loop.exec();
+
+        qDebug() << "ID:" << existingIdentity->id();
+        QCOMPARE(m_identityResult.m_idInfo.caption(), updateInfo.caption());
+        QCOMPARE(m_identityResult.m_idInfo.methods(), updateInfo.methods());
+        QCOMPARE(m_identityResult.m_idInfo.userName(), updateInfo.userName());
+    } else {
+        QString codeStr = errCodeAsStr(m_identityResult.m_error);
+        qDebug() << "Error reply: " << m_serviceResult.m_errMsg
+                 << ".\nError code: " << codeStr;
+        QFAIL("Error received");
     }
 
     TEST_DONE
@@ -566,21 +687,6 @@
     TEST_DONE
 }
 
-void SsoTestClient::storeCredentialsWithoutAuthMethodsTest()
-{
-    TEST_START
-
-    if (!testAddingNewCredentials(false)) {
-        QFAIL("Adding new credentials test failed.");
-    }
-
-    if (!testUpdatingCredentials()) {
-        QFAIL("Updating existing credentials test failed.");
-    }
-
-    TEST_DONE
-}
-
 void SsoTestClient::queryInfo()
 {
     TEST_START
@@ -1448,146 +1554,6 @@
     TEST_DONE
 }
 
-bool SsoTestClient::testAddingNewCredentials(bool addMethods)
-{
-    m_identityResult.reset();
-
-    QMap<MethodName, MechanismsList> methods;
-    if (addMethods) {
-        methods.insert("dummy", QStringList() << "mech1" << "mech2" << "mech3");
-        methods.insert("dummy1", QStringList() << "mech11" << "mech12" << "mech13");
-    }
-    IdentityInfo info("TEST_CAPTION", "TEST_USERNAME", methods);
-    info.setSecret("TEST_SECRET");
-    info.setRealms(QStringList() << "TEST_REALM1" << "TEST_REALM2");
-
-    Identity *identity = Identity::newIdentity(info, this);
-
-    QEventLoop loop;
-
-    connect(identity, SIGNAL(error(const SignOn::Error &)),
-            &m_identityResult, SLOT(error(const SignOn::Error &)));
-
-    connect(identity, SIGNAL(credentialsStored(const quint32)),
-            &m_identityResult, SLOT(credentialsStored(const quint32)));
-    connect(&m_identityResult, SIGNAL(testCompleted()), &loop, SLOT(quit()));
-
-    identity->storeCredentials();
-
-    QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
-    loop.exec();
-
-    if (m_identityResult.m_responseReceived ==
-        TestIdentityResult::InexistentResp) {
-        qDebug() << "A response was not received.";
-        return false;
-    }
-
-    if (m_identityResult.m_responseReceived == TestIdentityResult::NormalResp) {
-        if (m_identityResult.m_id != identity->id()) {
-            qDebug() << "Queried identity id does not match with stored data.";
-            return false;
-        }
-
-        Identity *existingIdentity =
-            Identity::existingIdentity(m_identityResult.m_id, this);
-        if (existingIdentity == NULL) {
-            qDebug() << "Could not create existing identity. '0' ID provided?";
-            return false;
-        }
-        connect(existingIdentity, SIGNAL(info(const SignOn::IdentityInfo &)),
-                &m_identityResult, SLOT(info(const SignOn::IdentityInfo &)));
-
-        existingIdentity->queryInfo();
-
-        QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
-        loop.exec();
-        delete existingIdentity;
-
-        if (!TestIdentityResult::compareIdentityInfos(m_identityResult.m_idInfo,
-                                                      info)) {
-            qDebug() << "Compared identity infos are not the same.";
-            return false;
-        }
-    } else {
-        QString codeStr = errCodeAsStr(m_identityResult.m_error);
-        qDebug() << "Error reply: " << m_serviceResult.m_errMsg
-                 << ".\nError code: " << codeStr;
-        return false;
-    }
-    return true;
-}
-
-bool SsoTestClient::testUpdatingCredentials(bool addMethods)
-{
-    // Test update credentials functionality
-
-    Identity *existingIdentity = Identity::existingIdentity(m_identityResult.m_id, this);
-    if (existingIdentity == NULL) {
-        qDebug() << "Could not create existing identity. '0' ID provided?";
-        return false;
-    }
-
-    QMap<MethodName, MechanismsList> methods;
-    if (addMethods) {
-        methods.insert("dummy1", QStringList() << "mech11" << "mech12" << "mech13");
-        methods.insert("dummy2", QStringList() << "mech1_updated" << "mech2" << "mech1_updated2");
-        methods.insert("dummy3", QStringList() << "mech1_updated" << "mech2" << "mech1_updated2");
-    }
-
-    IdentityInfo updateInfo("TEST_CAPTION", "TEST_USERNAME_UPDATED", methods);
-    updateInfo.setSecret("TEST_SECRET_YES", false);
-
-    do
-    {
-        QEventLoop loop;
-
-        connect(existingIdentity, SIGNAL(error(const SignOn::Error &)),
-                &m_identityResult, SLOT(error(const SignOn::Error &)));
-
-        connect(existingIdentity, SIGNAL(credentialsStored(const quint32)),
-                &m_identityResult, SLOT(credentialsStored(const quint32)));
-        connect(&m_identityResult, SIGNAL(testCompleted()), &loop, SLOT(quit()));
-
-        existingIdentity->storeCredentials(updateInfo);
-        qDebug();
-        QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
-        loop.exec();
-    } while(0);
-
-    qDebug();
-    if (m_identityResult.m_responseReceived ==
-        TestIdentityResult::InexistentResp) {
-        qDebug() << "A response was not received.";
-        return false;
-    }
-
-    if (m_identityResult.m_responseReceived == TestIdentityResult::NormalResp) {
-        QEventLoop loop;
-        connect(&m_identityResult, SIGNAL(testCompleted()), &loop, SLOT(quit()));
-        connect(existingIdentity, SIGNAL(info(const SignOn::IdentityInfo &)),
-                &m_identityResult, SLOT(info(const SignOn::IdentityInfo &)));
-
-        existingIdentity->queryInfo();
-        QTimer::singleShot(test_timeout, &loop, SLOT(quit()));
-        loop.exec();
-
-        qDebug() << "ID:" << existingIdentity->id();
-        if (!TestIdentityResult::compareIdentityInfos(m_identityResult.m_idInfo,
-                                                      updateInfo)) {
-            qDebug() << "Compared identity infos are not the same.";
-            return false;
-        }
-    } else {
-        QString codeStr = errCodeAsStr(m_identityResult.m_error);
-        qDebug() << "Error reply: " << m_serviceResult.m_errMsg
-                 << ".\nError code: " << codeStr;
-
-        return false;
-    }
-    return true;
-}
-
 void SsoTestClient::emptyPasswordRegression()
 {
     TEST_START

=== modified file 'tests/libsignon-qt-tests/ssotestclient.h'
--- tests/libsignon-qt-tests/ssotestclient.h	2013-11-22 14:46:01 +0000
+++ tests/libsignon-qt-tests/ssotestclient.h	2014-11-28 12:00:40 +0000
@@ -56,6 +56,7 @@
      * Identity tests
      */
     void queryAvailableMetods();
+    void storeCredentials_data();
     void storeCredentials();
     void requestCredentialsUpdate();
     void queryInfo();
@@ -65,7 +66,6 @@
     void verifySecret();
     void signOut();
     void remove();
-    void storeCredentialsWithoutAuthMethodsTest();
     void sessionTest();
     void multipleRemove();
     void removeStoreRemove();

=== modified file 'tests/libsignon-qt-tests/testauthsession.cpp'
--- tests/libsignon-qt-tests/testauthsession.cpp	2013-11-12 09:09:04 +0000
+++ tests/libsignon-qt-tests/testauthsession.cpp	2014-11-28 12:00:40 +0000
@@ -361,6 +361,7 @@
     methods.insert(QLatin1String("ssotest"), mechs);
     IdentityInfo info("test_caption", "test_user_name", methods);
     info.setSecret("test_secret");
+    info.setAccessControlList(QStringList() << "*");
     Identity *id = Identity::newIdentity(info, this);
 
     QSignalSpy spyResponseStoreCreds(id, SIGNAL(credentialsStored(const quint32)));

=== modified file 'tests/signond-tests/.gitignore'
--- tests/signond-tests/.gitignore	2013-08-20 08:01:44 +0000
+++ tests/signond-tests/.gitignore	2014-11-28 12:00:40 +0000
@@ -1,6 +1,7 @@
 /identity-tool
 /mock-ac-plugin/identity-ac-helper
 /tst_access_control
+/tst_access_control_manager_helper
 /tst_backup
 /tst_database
 /tst_pluginproxy

=== modified file 'tests/signond-tests/signond-tests.pri'
--- tests/signond-tests/signond-tests.pri	2013-08-20 08:01:43 +0000
+++ tests/signond-tests/signond-tests.pri	2014-11-28 12:00:40 +0000
@@ -23,6 +23,8 @@
     $${TOP_BUILD_DIR}/lib/signond/SignOn
 QMAKE_RPATHDIR = $${QMAKE_LIBDIR}
 
+SIGNOND_SRC = $${TOP_SRC_DIR}/src/signond
+
 DEFINES += SIGNOND_TRACE
 DEFINES += SIGNON_PLUGIN_TRACE
 

=== modified file 'tests/signond-tests/signond-tests.pro'
--- tests/signond-tests/signond-tests.pro	2013-08-20 08:01:44 +0000
+++ tests/signond-tests/signond-tests.pro	2014-11-28 12:00:40 +0000
@@ -1,5 +1,6 @@
 TEMPLATE = subdirs
 SUBDIRS = \
+    tst_access_control_manager_helper.pro \
     tst_timeouts.pro \
     tst_pluginproxy.pro \
     tst_database.pro \

=== modified file 'tests/signond-tests/timeouts.cpp'
--- tests/signond-tests/timeouts.cpp	2013-08-20 08:01:43 +0000
+++ tests/signond-tests/timeouts.cpp	2014-11-28 12:00:40 +0000
@@ -62,6 +62,7 @@
     IdentityInfo info = IdentityInfo(QLatin1String("timeout test"),
                                      QLatin1String("timeout@test"),
                                      methods);
+    info.setAccessControlList(QStringList() << "*");
     Identity *identity = Identity::newIdentity(info);
     QVERIFY(identity != NULL);
 
@@ -135,6 +136,7 @@
     IdentityInfo info = IdentityInfo(QLatin1String("timeout test"),
                                      QLatin1String("timeout@test"),
                                      methods);
+    info.setAccessControlList(QStringList() << "*");
     Identity *identity = Identity::newIdentity(info);
     QVERIFY(identity != NULL);
 

=== added file 'tests/signond-tests/tst_access_control_manager_helper.cpp'
--- tests/signond-tests/tst_access_control_manager_helper.cpp	1970-01-01 00:00:00 +0000
+++ tests/signond-tests/tst_access_control_manager_helper.cpp	2014-11-28 12:00:40 +0000
@@ -0,0 +1,320 @@
+/*
+ * This file is part of signon
+ *
+ * Copyright (C) 2014 Canonical Ltd.
+ *
+ * Contact: Alberto Mardegan <[e-mail]>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * version 2.1 as published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <QByteArray>
+#include <QDBusConnection>
+#include <QDBusMessage>
+#include <QDebug>
+#include <QSignalSpy>
+#include <QTest>
+
+#include <SignOn/AbstractAccessControlManager>
+#include "accesscontrolmanagerhelper.h"
+#include "credentialsaccessmanager.h"
+#include "credentialsdb.h"
+
+using namespace SignOn;
+using namespace SignonDaemonNS;
+
+// mock AbstractAccessControlManager {
+class AcmPlugin: public SignOn::AbstractAccessControlManager
+{
+    Q_OBJECT
+
+public:
+    AcmPlugin(QObject *parent = 0):
+        SignOn::AbstractAccessControlManager(parent) {}
+    ~AcmPlugin() {}
+
+    bool isPeerAllowedToAccess(const QDBusConnection &peerConnection,
+                               const QDBusMessage &peerMessage,
+                               const QString &securityContext) {
+        QStringList appPermissions =
+            m_permissions.value(appIdOfPeer(peerConnection, peerMessage));
+        return appPermissions.contains(securityContext);
+    }
+
+    QString appIdOfPeer(const QDBusConnection &peerConnection,
+                        const QDBusMessage &peerMessage) {
+        Q_UNUSED(peerConnection);
+        return peerMessage.service();
+    }
+
+    QString keychainWidgetAppId() { return m_keychainWidgetAppId; }
+
+    SignOn::AccessReply *handleRequest(const SignOn::AccessRequest &request) {
+        Q_UNUSED(request);
+        return 0;
+    }
+
+private:
+    friend class AccessControlManagerHelperTest;
+    QMap<QString,QStringList> m_permissions;
+    QString m_keychainWidgetAppId;
+};
+// } mock AbstractAccessControlManager
+
+class AccessControlManagerHelperTest: public QObject
+{
+    Q_OBJECT
+
+public:
+    AccessControlManagerHelperTest();
+
+private Q_SLOTS:
+    void init();
+    void testOwnership_data();
+    void testOwnership();
+    void testIdentityAccess_data();
+    void testIdentityAccess();
+
+public:
+    static AccessControlManagerHelperTest *instance() { return m_instance; }
+    SignonDaemonNS::CredentialsDB *credentialsDB() { return &m_db; }
+
+private:
+    void setDbOwners(const QStringList &owners) {
+        if (owners.contains("db-error")) {
+            m_dbOwners = QStringList();
+            m_dbLastError = CredentialsDBError("DB error!",
+                                               CredentialsDBError::ConnectionError);
+        } else {
+            m_dbOwners = owners;
+        }
+    }
+
+    void setDbAcl(const QStringList &acl) {
+        if (acl.contains("db-error")) {
+            m_dbAcl = QStringList();
+            m_dbLastError = CredentialsDBError("DB error!",
+                                               CredentialsDBError::ConnectionError);
+        } else {
+            m_dbAcl = acl;
+        }
+    }
+
+private:
+    friend class SignonDaemonNS::CredentialsDB;
+    static AccessControlManagerHelperTest *m_instance;
+    AcmPlugin m_acmPlugin;
+    SignonDaemonNS::CredentialsDB m_db;
+    SignOn::CredentialsDBError m_dbLastError;
+    QStringList m_dbAcl;
+    QStringList m_dbOwners;
+    QDBusConnection m_conn;
+};
+
+AccessControlManagerHelperTest *AccessControlManagerHelperTest::m_instance = 0;
+
+namespace SignonDaemonNS {
+// mock CredentialsDB {
+CredentialsDB::CredentialsDB(const QString &metaDataDbName,
+                             SignOn::AbstractSecretsStorage *secretsStorage):
+    QObject()
+{
+    Q_UNUSED(metaDataDbName);
+    Q_UNUSED(secretsStorage);
+}
+
+CredentialsDB::~CredentialsDB()
+{
+}
+
+SignOn::CredentialsDBError CredentialsDB::lastError() const
+{
+    return AccessControlManagerHelperTest::instance()->m_dbLastError;
+}
+
+QStringList CredentialsDB::accessControlList(const quint32 identityId)
+{
+    Q_UNUSED(identityId);
+    return AccessControlManagerHelperTest::instance()->m_dbAcl;
+}
+
+QStringList CredentialsDB::ownerList(const quint32 identityId)
+{
+    Q_UNUSED(identityId);
+    return AccessControlManagerHelperTest::instance()->m_dbOwners;
+}
+// } mock CredentialsDB
+
+// mock CredentialsAccessManager {
+CredentialsDB *CredentialsAccessManager::credentialsDB() const {
+    return AccessControlManagerHelperTest::instance()->credentialsDB();
+}
+CredentialsAccessManager *CredentialsAccessManager::instance() {
+    return 0;
+}
+} // namespace
+// } mock CredentialsAccessManager
+
+AccessControlManagerHelperTest::AccessControlManagerHelperTest():
+    QObject(),
+    m_db(QString(), 0),
+    m_conn(QLatin1String("test-connection"))
+{
+    m_instance = this;
+}
+
+void AccessControlManagerHelperTest::init()
+{
+    m_dbOwners = QStringList();
+    m_dbAcl = QStringList();
+    m_dbLastError = CredentialsDBError();
+}
+
+void AccessControlManagerHelperTest::testOwnership_data()
+{
+    QTest::addColumn<QString>("peer");
+    QTest::addColumn<QStringList>("ownerList");
+    QTest::addColumn<int>("expectedOwnership");
+
+    QTest::newRow("DB error") <<
+        "tom" <<
+        (QStringList() << "db-error") <<
+        int(AccessControlManagerHelper::ApplicationIsNotOwner);
+
+    QTest::newRow("empty") <<
+        "tom" <<
+        QStringList() <<
+        int(AccessControlManagerHelper::IdentityDoesNotHaveOwner);
+
+    QTest::newRow("is only owner") <<
+        "tom" <<
+        (QStringList() << "tom") <<
+        int(AccessControlManagerHelper::ApplicationIsOwner);
+
+    QTest::newRow("is co-owner") <<
+        "tom" <<
+        (QStringList() << "Bob" << "tom" << "harry") <<
+        int(AccessControlManagerHelper::ApplicationIsOwner);
+}
+
+void AccessControlManagerHelperTest::testOwnership()
+{
+    QFETCH(QString, peer);
+    QFETCH(QStringList, ownerList);
+    QFETCH(int, expectedOwnership);
+
+    setDbOwners(ownerList);
+
+    m_acmPlugin.m_permissions["tom"] = QStringList() << "tom" << "Tom";
+
+    /* forge a QDBusMessage */
+    QDBusMessage msg =
+        QDBusMessage::createMethodCall(peer, "/", "interface", "hi");
+
+    SignonDaemonNS::AccessControlManagerHelper helper(&m_acmPlugin);
+
+    AccessControlManagerHelper::IdentityOwnership ownership =
+        helper.isPeerOwnerOfIdentity(m_conn, msg, 3);
+
+    QCOMPARE(int(ownership), expectedOwnership);
+}
+
+void AccessControlManagerHelperTest::testIdentityAccess_data()
+{
+    QTest::addColumn<QString>("peer");
+    QTest::addColumn<QStringList>("ownerList");
+    QTest::addColumn<QStringList>("acl");
+    QTest::addColumn<bool>("expectedIsAllowed");
+
+    QTest::newRow("DB error") <<
+        "tom" <<
+        (QStringList() << "tom") <<
+        (QStringList() << "db-error") <<
+        false;
+
+    QTest::newRow("is owner, ACL empty") <<
+        "tom" <<
+        (QStringList() << "tom") <<
+        QStringList() <<
+        true;
+
+    QTest::newRow("is owner, not in ACL") <<
+        "tom" <<
+        (QStringList() << "tom") <<
+        (QStringList() << "bob") <<
+        true;
+
+    QTest::newRow("is owner, in ACL") <<
+        "tom" <<
+        (QStringList() << "tom") <<
+        (QStringList() << "bob" << "tom" << "harry") <<
+        true;
+
+    QTest::newRow("is owner, ACL=*") <<
+        "tom" <<
+        (QStringList() << "tom") <<
+        (QStringList() << "*") <<
+        true;
+
+    QTest::newRow("not owner, ACL empty") <<
+        "tom" <<
+        (QStringList() << "bob") <<
+        QStringList() <<
+        false;
+
+    QTest::newRow("not owner, not in ACL") <<
+        "tom" <<
+        (QStringList() << "bob") <<
+        (QStringList() << "bob") <<
+        false;
+
+    QTest::newRow("not owner, in ACL") <<
+        "tom" <<
+        (QStringList() << "bob") <<
+        (QStringList() << "bob" << "tom" << "harry") <<
+        true;
+
+    QTest::newRow("not owner, ACL=*") <<
+        "tom" <<
+        (QStringList() << "bob") <<
+        (QStringList() << "*") <<
+        true;
+}
+
+void AccessControlManagerHelperTest::testIdentityAccess()
+{
+    QFETCH(QString, peer);
+    QFETCH(QStringList, ownerList);
+    QFETCH(QStringList, acl);
+    QFETCH(bool, expectedIsAllowed);
+
+    setDbOwners(ownerList);
+    setDbAcl(acl);
+
+    m_acmPlugin.m_permissions["tom"] = QStringList() << "tom" << "Tom";
+
+    /* forge a QDBusMessage */
+    QDBusMessage msg =
+        QDBusMessage::createMethodCall(peer, "/", "interface", "hi");
+
+    SignonDaemonNS::AccessControlManagerHelper helper(&m_acmPlugin);
+
+    bool isAllowed = helper.isPeerAllowedToUseIdentity(m_conn, msg, 3);
+
+    QCOMPARE(isAllowed, expectedIsAllowed);
+}
+
+QTEST_MAIN(AccessControlManagerHelperTest)
+#include "tst_access_control_manager_helper.moc"

=== added file 'tests/signond-tests/tst_access_control_manager_helper.pro'
--- tests/signond-tests/tst_access_control_manager_helper.pro	1970-01-01 00:00:00 +0000
+++ tests/signond-tests/tst_access_control_manager_helper.pro	2014-11-28 12:00:40 +0000
@@ -0,0 +1,13 @@
+TARGET = tst_access_control_manager_helper
+
+include(signond-tests.pri)
+
+SOURCES = \
+    $${SIGNOND_SRC}/accesscontrolmanagerhelper.cpp \
+    tst_access_control_manager_helper.cpp
+
+HEADERS = \
+    $${SIGNOND_SRC}/accesscontrolmanagerhelper.h \
+    $${SIGNOND_SRC}/credentialsdb.h
+
+check.commands = "./$$TARGET"