Merge lp:~ricardokirkner/rnr-server/submit-review-with-macaroons into lp:rnr-server

[Ricardo Kirkner]

support submitting reviews using macaroon based authentication

[Fabián Ezequiel Gallina (fgallina)]

added few comments, otherwise is looking good.

[lp:~ricardokirkner/rnr-server/submit-review-with-macaroons]

322. By Ricardo Kirkner on 2016-05-16

improvements per review

[Fabián Ezequiel Gallina (fgallina)]

added question and we are good to go.

[lp:~ricardokirkner/rnr-server/submit-review-with-macaroons]

323. By Ricardo Kirkner on 2016-05-16

switch api from GET to POST

324. By Ricardo Kirkner on 2016-05-17

remove unnecessary decoration

325. By Ricardo Kirkner on 2016-05-17

unify code into update_or_create_user_from_sso

326. By Ricardo Kirkner on 2016-05-17

updated code based on changes on the verify_acl api

[Fabián Ezequiel Gallina (fgallina)]

Looking good, added minor comments.

[lp:~ricardokirkner/rnr-server/submit-review-with-macaroons]

327. By Ricardo Kirkner on 2016-05-17

minor changes per review

[Fabián Ezequiel Gallina (fgallina)]

LGTM

review: Approve

=== modified file 'requirements-devel.txt'
--- requirements-devel.txt	2015-10-26 15:12:50 +0000
+++ requirements-devel.txt	2016-05-17 14:32:36 +0000
@@ -10,5 +10,6 @@
 paste==1.7.5.1
 pep8==1.5.7
 piston-mini-client
+responses==0.5.1
 testtools==0.9.34
 wsgi-intercept==0.5.1
 
=== modified file 'requirements.txt'
--- requirements.txt	2015-10-26 15:11:49 +0000
+++ requirements.txt	2016-05-17 14:32:36 +0000
@@ -12,6 +12,7 @@
 oops-dictconfig==0.0.4
 oops-wsgi==0.0.11                   # bzr+ssh://bazaar.launchpad.net/~ubuntuone-pqm-team/python-oops-wsgi/stable@39
 
+requests==2.6.0
 requests-oauthlib==0.5.0
 south==1.0.2
 txstatsd==1.0.0
 
=== modified file 'src/clickreviews/forms.py'
--- src/clickreviews/forms.py	2015-04-17 12:39:41 +0000
+++ src/clickreviews/forms.py	2016-05-17 14:32:36 +0000
@@ -14,7 +14,7 @@
 from clickreviews.utilities import verify_click_package_published
 from core.forms import JSONErrorMixin
 from core.models import BaseModeration
-from core.utilities import update_or_create_user_from_oauth
+from core.utilities import update_or_create_user_from_sso
 
 
 class ClickPackageReviewForm(forms.ModelForm, JSONErrorMixin):
@@ -239,7 +239,7 @@
 
     def clean_moderator(self):
         openid = self.cleaned_data['moderator']
-        user, __ = update_or_create_user_from_oauth(openid)
+        user, __ = update_or_create_user_from_sso(openid)
         if user is None:
             self.add_error(
                 'moderator', _('User given as moderator not found.'))
 
=== modified file 'src/core/api/auth/__init__.py'
--- src/core/api/auth/__init__.py	2014-09-24 14:57:52 +0000
+++ src/core/api/auth/__init__.py	2016-05-17 14:32:36 +0000
@@ -1,8 +1,10 @@
 from core.api.auth.delegated_sso import DelegatedSSOAuthentication
+from core.api.auth.macaroon import MacaroonsAuthentication
 from core.api.auth.sso import SSOOAuthAuthentication
 
 
 __all__ = [
     'DelegatedSSOAuthentication',
+    'MacaroonsAuthentication',
     'SSOOAuthAuthentication',
 ]
 
=== added file 'src/core/api/auth/macaroon.py'
--- src/core/api/auth/macaroon.py	1970-01-01 00:00:00 +0000
+++ src/core/api/auth/macaroon.py	2016-05-17 14:32:36 +0000
@@ -0,0 +1,82 @@
+#   This file is part of Software Center Ratings and Reviews
+#   Copyright (C) 2016 Canonical Ltd.
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as
+#   published by the Free Software Foundation, either version 3 of the
+#   License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""Macaroon authenticator for Piston."""
+
+from __future__ import absolute_import
+
+import logging
+
+from django.http import HttpResponse
+from piston.authentication import OAuthAuthentication
+
+from core.utilities import (
+    update_or_create_user_from_sso,
+    web_services,
+)
+
+
+logger = logging.getLogger(__name__)
+
+
+def has_macaroon_bits(authorization):
+    """Return whether there are Macaroon bits in authorization.
+
+    Macaroon bits are detected by ensuring the authorization starts with
+    'Macaroon'.
+
+    """
+    has_bits = (
+        authorization and authorization.split()[0].lower() == 'macaroon')
+    return has_bits
+
+
+class MacaroonsAuthentication(OAuthAuthentication):
+    """ This class is a Piston Authentication class.
+
+    See http://bitbucket.org/jespern/django-piston/wiki/Documentation for
+    more info.
+    """
+    def __init__(self, realm='API'):
+        self.realm = realm
+
+    def challenge(self):
+        """ We define our own challenge so that we can provide our own realm
+        and return a simple error message instead of rendering a template.
+        """
+        resp = HttpResponse("Authorization Required")
+        resp['WWW-Authenticate'] = 'Macaroon realm="%s"' % self.realm
+        resp.status_code = 401
+        return resp
+
+    def is_authenticated(self, request):
+        authorization = request.META.get('HTTP_AUTHORIZATION', None)
+        if not has_macaroon_bits(authorization):
+            # skip network request as macaroon headers are missing
+            return False
+        data = web_services.verify_acl(request)
+        account = data and data.get('account', {}) or {}
+        verified = account.get('verified', False)
+        if not verified:
+            return False
+
+        # get or create user account
+        user, _ = update_or_create_user_from_sso(
+            account.get('openid'), account=account)
+
+        # inject user into request
+        request.user = user
+        return True
 
=== modified file 'src/core/api/auth/sso.py'
--- src/core/api/auth/sso.py	2015-10-09 18:54:55 +0000
+++ src/core/api/auth/sso.py	2016-05-17 14:32:36 +0000
@@ -25,7 +25,7 @@
 
 from core.utilities import (
     web_services,
-    update_or_create_user_from_oauth,
+    update_or_create_user_from_sso,
 )
 
 
@@ -93,7 +93,7 @@
 
         openid = oauth_request.get_parameter('oauth_consumer_key')
 
-        user, _ = update_or_create_user_from_oauth(openid)
+        user, _ = update_or_create_user_from_sso(openid)
         if user is not None:
             request.user = user
         else:
 
=== added file 'src/core/tests/doubles.py'
--- src/core/tests/doubles.py	1970-01-01 00:00:00 +0000
+++ src/core/tests/doubles.py	2016-05-17 14:32:36 +0000
@@ -0,0 +1,119 @@
+from __future__ import absolute_import, unicode_literals
+
+import json
+
+import responses
+from django.conf import settings
+from requests import PreparedRequest
+
+from core.utilities import WebServices
+
+
+# XXX: RequestsDouble and RequestsDoubleTestCaseMixin come from
+# appstore-common, this copypasta (with modifications) is an attempt
+# to generalize it a bit and later on move the code into its own
+# module and reuse it across projects.
+class RequestsDouble(object):
+
+    def start(self):
+        self.reset()
+        responses.start()
+
+    def stop(self):
+        # Stopping does not triggers a reset and it should because
+        # responses dirty state can become a problem for other tests.
+        try:
+            self.reset()
+            responses.stop()
+        except RuntimeError:
+            raise RuntimeError(
+                'Calling stop on a RequestDouble that is not started.'
+                'This may be because you are instantiating your own instead '
+                'of reusing the RequestDouble from your TestCase')
+
+    def reset(self):
+        responses.reset()
+
+    def reset_calls(self):
+        responses.calls.reset()
+
+    def make_body(self, data=None, files=None):
+        req = PreparedRequest()
+        # need to define headers before body
+        req.prepare_headers({})
+        req.prepare_body(data=data, files=files)
+        return req.body
+
+    def add_response(self, url, status_code=200, body='',
+                     match_querystring=False, method='GET',
+                     callback=None, reset=False):
+        if reset:
+            self.reset()
+        if callback:
+            responses.add_callback(method, url, callback=callback,
+                                   match_querystring=match_querystring)
+        else:
+            responses.add(method, url, match_querystring=match_querystring,
+                          status=status_code, body=body)
+
+    def _call_has_headers(self, call, headers):
+        has_headers = True
+
+        if headers is not None:
+            # make sure all given headers were included in call
+            for key, value in headers.items():
+                if call.request.headers.get(key) != value:
+                    has_headers = False
+                    break
+
+        return has_headers
+
+    def find_call(self, url, headers=None, body=None, method=None):
+        """Find calls for url optionally matching headers, body and method.
+
+        The given headers can be a subset of the actual call headers,
+        body must be an exact match.
+
+        """
+        for call in responses.calls:
+            test_body = call.request.body if body is None else body
+            if (call.request.url == url
+                    and self._call_has_headers(call, headers)
+                    and test_body == call.request.body):
+                if method is not None and call.request.method != method:
+                    continue
+                return (url, call.request.headers, call.request.body)
+
+    def find_calls(self, url, method=None):
+        calls = (c for c in responses.calls if c.request.url == url)
+        if method:
+            calls = (c for c in calls if c.request.method == method)
+        return [(url, c.request.headers, c.request.body) for c in calls]
+
+
+class SCADouble(WebServices):
+
+    def __init__(self, requests_double, *args, **kwargs):
+        WebServices.__init__(self, *args, **kwargs)
+        self.requests_double = requests_double
+
+        self.verify_acl_url = (
+            settings.SCA_HOST_URL.strip('/') + '/dev/api/acl/verify/')
+
+    def set_verify_acl_response(self, **kwargs):
+        body = {
+            'allowed': True,
+            'refresh_required': False,
+            'account': {
+                'openid': 'oid1234',
+                'email': '[e-mail]',
+                'displayname': 'user1234',
+                'verified': True,
+            },
+            'last_auth': '20160515T12:00:00.000',
+            'permissions': ['package_access'],
+        }
+        body.update(**kwargs)
+        self.requests_double.add_response(
+            self.verify_acl_url, method='POST',
+            body=json.dumps(body))
 
=== modified file 'src/core/tests/helpers.py'
--- src/core/tests/helpers.py	2015-04-22 13:24:20 +0000
+++ src/core/tests/helpers.py	2016-05-17 14:32:36 +0000
@@ -5,6 +5,7 @@
 from mock import patch
 
 from core.utilities import web_services
+from core.tests.doubles import RequestsDouble
 
 
 class SSOTestCaseMixin(object):
@@ -83,3 +84,44 @@
         message += "\n\n\nSecond queries:\n"
         message += format_queries(second.captured_queries)
         raise AssertionError(message)
+
+
+# Why a mixin? Because we want to be able to plug this functionality
+# to any of the variants of TestCases the user may have without
+# relying on hierarchy (e.g. `unittest.TestCase`,
+# `django.test.TestCase`). An effect of this is that `patch_requests`
+# must be explicitly called to activate requests double functionality,
+# which may be a good thing if you want fine-grained control.
+class RequestsDoubleTestCaseMixin(object):
+    """Mixin to add requests double functionality.
+
+    To enable it, `patch_requests` must be called prior your tests are
+    executed, so generally this is a good thing to be placed in the
+    setUp method of your `TestCase` classes unless you wish more
+    fine-grained control.
+    """
+
+    def patch_requests(self):
+        """Enable requests double.
+
+        Takes care of cleaning up itself after a test is run.
+        """
+        self.requests_double = RequestsDouble()
+        self.requests_double.start()
+        self.addCleanup(self.requests_double.stop)
+
+    def patch_choose_boundary(self, boundary='theboundary'):
+        return self.patch(
+            'requests.packages.urllib3.filepost.choose_boundary',
+            return_value=boundary.encode('utf-8'))
+
+    def assert_call(self, url, headers=None, body=None, method=None):
+        """Assert call to url and headers was executed."""
+        call = self.requests_double.find_call(
+            url, headers, body, method=method)
+        if call is None:
+            self.fail(
+                "No matching call found. url=%s headers=%s body=%s "
+                "method=%s" % (url, headers, body, method))
+
+
 
=== modified file 'src/core/tests/test_api_auth.py'
--- src/core/tests/test_api_auth.py	2015-10-09 19:31:57 +0000
+++ src/core/tests/test_api_auth.py	2016-05-17 14:32:36 +0000
@@ -37,9 +37,11 @@
     SSOOAuthAuthentication,
     delegated_sso,
 )
+from core.api.auth.macaroon import MacaroonsAuthentication, has_macaroon_bits
 from core.api.auth.sso import has_oauth_bits
+from core.tests.doubles import SCADouble
 from core.tests.factory import TestCaseWithFactory
-from core.tests.helpers import SSOTestCaseMixin
+from core.tests.helpers import RequestsDoubleTestCaseMixin, SSOTestCaseMixin
 from core.utilities import full_claimed_id
 
 
@@ -53,6 +55,7 @@
         self.method = method
         self.environ = self.META
         self.uri = uri
+        self.user = None
 
     def build_absolute_uri(self):
         return self.uri
@@ -134,6 +137,17 @@
             self.assertFalse(result, self.no_oauth % not_allowed)
 
 
+class HasMacaroonBitsTestCase(TestCase):
+
+    def test_has_macaroon_bits(self):
+        for authorization in ('Macaroon zaraza', 'macaroon zaraza'):
+            self.assertTrue(has_macaroon_bits(authorization))
+
+    def test_has_not_macaroon_bits(self):
+        for authorization in ('OAuth zaraza', 'Auth macaroon zaraza'):
+            self.assertFalse(has_macaroon_bits(authorization))
+
+
 class SSOOAuthAuthenticationTestCase(BaseAuthenticationTestCase):
 
     def _get_auth(self):
@@ -221,7 +235,7 @@
         self.user.delete()
         self.factory.makeUser()
 
-        get_method = 'core.api.auth.sso.update_or_create_user_from_oauth'
+        get_method = 'core.api.auth.sso.update_or_create_user_from_sso'
         with patch(get_method) as mock_get_user:
             mock_get_user.return_value = (None, False)
             response = self.get_resource(request)
@@ -669,3 +683,108 @@
         request = self.make_request('POST', self.signature, body='wrong')
         response = self.post_resource(request)
         self.assertEqual(httplib.UNAUTHORIZED, response.status_code)
+
+
+class MacaroonsAuthenticationTestCase(BaseAuthenticationTestCase,
+                                      RequestsDoubleTestCaseMixin):
+
+    def setUp(self):
+        super(MacaroonsAuthenticationTestCase, self).setUp()
+        self.patch_requests()
+
+        self.sca_double = SCADouble(self.requests_double)
+        p = patch('core.utilities.web_services', new=self.sca_double)
+        p.start()
+        self.addCleanup(p.stop)
+
+    def _get_auth(self):
+        return MacaroonsAuthentication(realm="Ratings and Reviews")
+
+    def make_request(self):
+        request = MockRequest(method='POST')
+        authorization = 'Macaroon root="%s", discharge="%s"' % (
+            'root-macaroon-data', 'discharge-macaroon-data')
+        request.META['HTTP_AUTHORIZATION'] = authorization
+        return request
+
+    def test_no_auth_fails(self):
+        request = MockRequest()
+        assert not request.META.get('HTTP_AUTHORIZATION')
+
+        response = self.post_resource(request)
+
+        self.assertEqual(httplib.UNAUTHORIZED, response.status_code)
+        self.assertEqual('Macaroon realm="Ratings and Reviews"',
+                         response['WWW-Authenticate'])
+
+    def test_no_macaroon_authorization_header(self):
+        request = self.make_request()
+        request.META['HTTP_AUTHORIZATION'] = 'Basic realm="foo"'
+
+        response = self.post_resource(request)
+        self.assertEqual(httplib.UNAUTHORIZED, response.status_code)
+
+    def test_success(self):
+        self.sca_double.set_verify_acl_response()
+        request = self.make_request()
+
+        response = self.post_resource(request)
+        self.assertEqual(httplib.CREATED, response.status_code)
+
+    def test_failure(self):
+        self.requests_double.add_response(
+            self.sca_double.verify_acl_url, method='POST', status_code=400)
+        request = self.make_request()
+
+        response = self.post_resource(request)
+        self.assertEqual(httplib.UNAUTHORIZED, response.status_code)
+
+    def test_successful_authentication_injects_user(self):
+        self.sca_double.set_verify_acl_response(
+            openid='oid1234', displayname='user1234',
+            email='[e-mail]', is_verified=True)
+        request = self.make_request()
+
+        response = self.auth.is_authenticated(request)
+        self.assertTrue(response)
+
+        # a new user was created
+        self.assertEqual(User.objects.count(), 2)
+        user = request.user
+        self.assertIsInstance(user, User)
+        self.assertEqual(user.username, 'oid1234')
+        self.assertEqual(user.last_name, 'user1234')
+        self.assertEqual(user.email, '[e-mail]')
+        openid = user.useropenid_set.get().claimed_id.split('/')[-1]
+        self.assertEqual(openid, 'oid1234')
+
+    def test_do_not_create_user_if_exists(self):
+        account = {
+            'openid': self.openid,
+            'displayname': 'user1234',
+            'email': '[e-mail]',
+            'verified': True,
+        }
+        self.sca_double.set_verify_acl_response(account=account)
+        request = self.make_request()
+
+        response = self.auth.is_authenticated(request)
+        self.assertTrue(response)
+
+        self.assertEqual(request.user, self.user)
+        self.assertEqual(User.objects.count(), 1)
+
+    def test_do_not_create_user_if_user_not_verified(self):
+        account = {
+            'openid': self.openid,
+            'displayname': 'user1234',
+            'email': '[e-mail]',
+            'verified': False,
+        }
+        self.sca_double.set_verify_acl_response(account=account)
+        request = self.make_request()
+
+        response = self.auth.is_authenticated(request)
+        self.assertFalse(response)
+
+        self.assertIsNone(request.user)
 
=== modified file 'src/core/tests/test_utilities.py'
--- src/core/tests/test_utilities.py	2015-04-22 19:38:37 +0000
+++ src/core/tests/test_utilities.py	2016-05-17 14:32:36 +0000
@@ -3,16 +3,20 @@
 from django.conf import settings
 from django.core.cache import cache
 from django.test import TestCase
+from django.test.client import RequestFactory
 from django.test.utils import override_settings
+from django.utils.timezone import now
 from launchpadlib.errors import HTTPError
 from mock import patch, Mock
 from piston_mini_client import PistonResponseObject
 
+from core.tests.doubles import SCADouble
+from core.tests.helpers import RequestsDoubleTestCaseMixin
 from core.tests.factory import TestCaseWithFactory
 from core.utilities import (
     WebServices,
     full_claimed_id,
-    update_or_create_user_from_oauth,
+    update_or_create_user_from_sso,
     web_services,
 )
 
@@ -305,10 +309,10 @@
         self.assertTrue(claimed_id.endswith(consumer_key))
 
 
-class UpdateOrCreateUserFromOauthTestCase(TestCaseWithFactory):
+class UpdateOrCreateUserFromSSOTestCase(TestCaseWithFactory):
 
     def setUp(self):
-        super(UpdateOrCreateUserFromOauthTestCase, self).setUp()
+        super(UpdateOrCreateUserFromSSOTestCase, self).setUp()
         self.user = self.factory.makeUser()
         p = patch('core.utilities.web_services')
         self.mock_web_services = p.start()
@@ -338,28 +342,28 @@
 
     def test_missing_account_data_and_missing_user(self):
         self.mock_get_data.return_value = None
-        user, created = update_or_create_user_from_oauth('inexistent')
+        user, created = update_or_create_user_from_sso('inexistent')
         self.assertIsNone(user)
         self.assertFalse(created)
 
     def test_account_data_with_no_email_and_missing_user(self):
         sso_user_data = self.mock_data_for_account(email='')
         self.mock_get_data.return_value = sso_user_data
-        user, created = update_or_create_user_from_oauth('inexistent')
+        user, created = update_or_create_user_from_sso('inexistent')
         self.assertIsNone(user)
         self.assertFalse(created)
 
     def test_account_data_with_no_displayname_and_missing_user(self):
         sso_user_data = self.mock_data_for_account(displayname=None)
         self.mock_get_data.return_value = sso_user_data
-        user, created = update_or_create_user_from_oauth('inexistent')
+        user, created = update_or_create_user_from_sso('inexistent')
         self.assertIsNone(user)
         self.assertFalse(created)
 
     def test_account_data_unverified_and_missing_user(self):
         sso_user_data = self.mock_data_for_account(verified=False)
         self.mock_get_data.return_value = sso_user_data
-        user, created = update_or_create_user_from_oauth('inexistent')
+        user, created = update_or_create_user_from_sso('inexistent')
         self.assertIsNone(user)
         self.assertFalse(created)
 
@@ -367,7 +371,7 @@
         self.user.delete()
         sso_user_data = self.mock_data_for_account()
         self.mock_get_data.return_value = sso_user_data
-        user, created = update_or_create_user_from_oauth('inexistent')
+        user, created = update_or_create_user_from_sso('inexistent')
         self.assertIsNotNone(user)
         self.assertTrue(created)
         self.assert_user_data(user, sso_user_data)
@@ -380,7 +384,7 @@
         self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        user, created = update_or_create_user_from_oauth(open_id)
+        user, created = update_or_create_user_from_sso(open_id)
         self.assertIsNotNone(user)
         self.assertFalse(created)
         self.assert_user_data(user, sso_user_data)
@@ -391,7 +395,7 @@
         self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        user, created = update_or_create_user_from_oauth(open_id)
+        user, created = update_or_create_user_from_sso(open_id)
         self.assertIsNotNone(user)
         self.assertFalse(created)
 
@@ -403,7 +407,7 @@
         self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        user, created = update_or_create_user_from_oauth(
+        user, created = update_or_create_user_from_sso(
             open_id, update_window=None)
         self.assertIsNotNone(user)
         self.assertFalse(created)
@@ -417,7 +421,7 @@
         user = self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        logged_user, created = update_or_create_user_from_oauth(
+        logged_user, created = update_or_create_user_from_sso(
             open_id, update_window=60 * 60 * 24)
         self.assertIsNotNone(logged_user)
         self.assertFalse(created)
@@ -433,7 +437,7 @@
         self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        user, created = update_or_create_user_from_oauth(
+        user, created = update_or_create_user_from_sso(
             open_id, update_window=None)
         self.assertIsNotNone(user)
         self.assertFalse(created)
@@ -448,7 +452,7 @@
         self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        user, created = update_or_create_user_from_oauth(
+        user, created = update_or_create_user_from_sso(
             open_id, update_window=None)
         self.assertIsNotNone(user)
         self.assertFalse(created)
@@ -463,9 +467,113 @@
         self.factory.makeUser(
             first_name='John', last_name='Does', email='[e-mail]',
             open_id=open_id)
-        user, created = update_or_create_user_from_oauth(
+        user, created = update_or_create_user_from_sso(
             open_id, update_window=None)
         self.assertIsNotNone(user)
         self.assertFalse(created)
         self.assertEqual(user.get_full_name(), 'John Does')
         self.assertEqual(user.email, '[e-mail]')
+
+    def test_get_user_from_account_data(self):
+        openid = 'oid1234'
+        sso_user_data = self.mock_data_for_account(openid=openid)
+
+        db_user = self.factory.makeUser(
+            email=sso_user_data['email'], open_id=openid)
+
+        user, created = update_or_create_user_from_sso(
+            openid, account=sso_user_data)
+        self.assertFalse(created)
+        self.assertEqual(user, db_user)
+
+    def test_create_user_from_account_data(self):
+        openid = 'oid1234'
+        sso_user_data = self.mock_data_for_account(openid=openid)
+
+        user, created = update_or_create_user_from_sso(
+            openid, account=sso_user_data)
+        self.assertTrue(created)
+        self.assertEqual(user.email, sso_user_data['email'])
+        self.assertEqual(user.useropenid_set.first().claimed_id,
+                         full_claimed_id(openid))
+
+
+class VerifyACLTestCase(TestCaseWithFactory, RequestsDoubleTestCaseMixin):
+
+    def setUp(self):
+        super(VerifyACLTestCase, self).setUp()
+        self.patch_requests()
+        self.sca = WebServices()
+        self.sca_double = SCADouble(self.requests_double)
+        p = patch('core.utilities.logger')
+        self.mock_logger = p.start()
+        self.addCleanup(p.stop)
+
+    def make_request(self):
+        request = RequestFactory().post('/')
+        authorization = 'Macaroon root="%s", discharge="%s"' % (
+            'root-macaroon-data', 'discharge-macaroon-data')
+        request.META['HTTP_AUTHORIZATION'] = authorization
+        return request
+
+    def assert_verify_acl_response(self, data, **kwargs):
+        expected = {
+            'allowed': True,
+            'refresh_required': False,
+            'account': {
+                'openid': 'oid1234',
+                'email': '[e-mail]',
+                'displayname': 'user1234',
+                'verified': True,
+            },
+            'last_auth': '20160515T12:00:00.000',
+            'permissions': ['package_access'],
+        }
+        expected.update(**kwargs)
+        self.assertEqual(data, expected)
+
+    def test_verify_acl_allowed(self):
+        self.sca_double.set_verify_acl_response()
+        request = self.make_request()
+        data = self.sca.verify_acl(request)
+        self.assert_verify_acl_response(data)
+
+    def test_verify_acl_not_allowed(self):
+        self.sca_double.set_verify_acl_response(allowed=False)
+        request = self.make_request()
+        data = self.sca.verify_acl(request)
+        self.assertIsNone(data)
+
+    def test_verify_acl_failed(self):
+        self.requests_double.add_response(
+            self.sca_double.verify_acl_url,
+            method='POST', body='some error', status_code=500)
+        request = self.make_request()
+        data = self.sca.verify_acl(request)
+        self.assertIsNone(data)
+        self.mock_logger.warn.assert_called_once_with(
+            'Failed to verify acl. Response: some error (500)')
+
+    def test_verify_acl_asks_for_right_permission(self):
+        self.sca_double.set_verify_acl_response(permissions=['package_upload'])
+        request = self.make_request()
+        data = self.sca.verify_acl(request)
+        self.assertIsNone(data)
+
+    def test_verify_acl_returns_account_data(self):
+        expected = {
+            'allowed': True,
+            'refresh_required': False,
+            'account': {
+                'openid': 'openid',
+                'displayname': 'username',
+                'email': '[e-mail]',
+                'verified': True,
+            },
+            'last_auth': now().isoformat(),
+            'permissions': ['package_access'],
+        }
+        self.sca_double.set_verify_acl_response(**expected)
+        request = self.make_request()
+        data = self.sca.verify_acl(request)
+        self.assert_verify_acl_response(data, **expected)
 
=== modified file 'src/core/utilities.py'
--- src/core/utilities.py	2014-10-03 17:06:49 +0000
+++ src/core/utilities.py	2016-05-17 14:32:36 +0000
@@ -1,9 +1,11 @@
+import json
 import sys
 import time
 
 import logging
 from httplib2 import ServerNotFoundError
 
+import requests
 from django.conf import settings
 from django.contrib.auth.models import User
 from django.core.cache import cache
@@ -189,6 +191,28 @@
 
         return pubs
 
+    def verify_acl(self, request):
+        data = {
+            'auth_data': json.dumps({
+                'http_url': request.build_absolute_uri(),
+                'http_method': request.method,
+                'authorization': request.META.get('HTTP_AUTHORIZATION', None),
+            }),
+        }
+        url = settings.SCA_HOST_URL.strip('/') + '/dev/api/acl/verify/'
+        response = requests.post(url, data=json.dumps(data))
+        if response.ok:
+            data = response.json()
+            if data.get('allowed', False):
+                if 'package_access' in data.get('permissions', []):
+                    # macaroon verified alright
+                    return data
+            # acl verification failed, either request was not allowed,
+            # or lacked necessary permissions
+            return
+        logger.warn('Failed to verify acl. Response: {} ({})'.format(
+            response.content, response.status_code))
+
 
 web_services = WebServices()
 
@@ -226,7 +250,7 @@
 
 
 @transaction.commit_on_success
-def _get_or_create_user_from_oauth(consumer_key):
+def _get_or_create_user_from_sso(consumer_key, account=None):
     claimed_id = full_claimed_id(consumer_key)
     created = False
 
@@ -236,8 +260,9 @@
         user = None
 
     if user is None:
-        account = web_services.get_data_for_account(
-            openid_identifier=consumer_key)
+        if account is None:
+            account = web_services.get_data_for_account(
+                openid_identifier=consumer_key)
         account_data = _get_sso_account_data(account)
 
         if account_data is None:
@@ -271,8 +296,8 @@
     return user, created
 
 
-def update_or_create_user_from_oauth(
-        consumer_key, update_window=settings.SSO_UPDATE_WINDOW):
+def update_or_create_user_from_sso(
+        consumer_key, update_window=settings.SSO_UPDATE_WINDOW, account=None):
     """Update or create user using SSO account data.
 
     This function tries to retrieve a `User` from the database using
@@ -283,15 +308,24 @@
     given `update_window`.  If `update_window` is `None`, SSO data is
     always updated.
 
+    If the optional `account` parameter is provided, SSO will not be contacted
+    for retrieving the initial user data, but the provided `account` data
+    will be used.
+
     Returns:
         A two-element tuple, where the first element is the
         created/updated user or None and the last one is a boolean
         especifying whether the user was created or not.
 
     """
-    user, created = _get_or_create_user_from_oauth(consumer_key)
+    user, created = _get_or_create_user_from_sso(
+        consumer_key, account=account)
 
     if user is not None:
+        # check for update even if account data was provided
+        # account data is only used for the initial user creation;
+        # after that, wether the login is 'fresh' or not (from rnr perspective)
+        # is orthogonal to how the original data was retrieved
         if update_window is None:
             should_update = True
         else:
 
=== modified file 'src/reviewsapp/api/urls.py'
--- src/reviewsapp/api/urls.py	2014-10-09 19:32:45 +0000
+++ src/reviewsapp/api/urls.py	2016-05-17 14:32:36 +0000
@@ -22,7 +22,7 @@
 )
 
 from piston.resource import Resource
-from core.api.auth import SSOOAuthAuthentication
+from core.api.auth import MacaroonsAuthentication, SSOOAuthAuthentication
 from core.api.decorators import (
     gzip_content,
     vary_only_on_accept,
@@ -44,6 +44,7 @@
 )
 
 auth = SSOOAuthAuthentication(realm="Ratings and Reviews")
+macaroons_auth = MacaroonsAuthentication(realm="Ratings and Reviews")
 
 
 # The server status resource should never be cached.
@@ -99,8 +100,8 @@
 
 # The following POST handlers have POST data and will not be cached.
 # The .__name__ hack is needed to support Django 1.1
-submit_review_resource = CSRFExemptResource(handler=SubmitReviewHandler,
-                                            authentication=auth)
+submit_review_resource = CSRFExemptResource(
+    handler=SubmitReviewHandler, authentication=(macaroons_auth, auth))
 modify_review_resource = CSRFExemptResource(handler=ModifyReviewHandler,
                                             authentication=auth)
 flag_review_resource = CSRFExemptResource(handler=FlagReviewHandler,
 
=== modified file 'src/reviewsapp/tests/test_handlers.py'
--- src/reviewsapp/tests/test_handlers.py	2016-04-04 04:10:58 +0000
+++ src/reviewsapp/tests/test_handlers.py	2016-05-17 14:32:36 +0000
@@ -56,7 +56,11 @@
 from piston.emitters import Emitter
 from piston.handler import typemapper
 
-from core.tests.helpers import assert_no_extra_queries_after
+from core.tests.doubles import SCADouble
+from core.tests.helpers import (
+    RequestsDoubleTestCaseMixin,
+    assert_no_extra_queries_after,
+)
 from reviewsapp.api.handlers import (
     Django13JSONEncoder,
     Django13JSONEmitter,
@@ -983,7 +987,8 @@
         self.assertEqual(response['vary'], 'Accept')
 
 
-class SubmitReviewHandlerTestCase(TestCaseWithFactory):
+class SubmitReviewHandlerTestCase(TestCaseWithFactory,
+                                  RequestsDoubleTestCaseMixin):
 
     def setUp(self):
         super(SubmitReviewHandlerTestCase, self).setUp()
@@ -1000,13 +1005,26 @@
         }
         self.factory.makeArch('i386')
 
-    def _post_new_review(self, data, user=None, verify_result=True):
+        self.patch_requests()
+        self.sca_double = SCADouble(self.requests_double)
+        p = patch('core.utilities.web_services', new=self.sca_double)
+        p.start()
+        self.addCleanup(p.stop)
+
+    def _post_new_review(self, data, user=None, verify_result=True,
+                         auth='oauth'):
         # Post a review as an authenticated user.
         url = reverse('rnr-api-reviews')
 
-        if user is None:
-            user = self.factory.makeUser()
-        self.client.login(username=user.username, password='test')
+        headers = {}
+        if auth == 'macaroon':
+            authorization = 'Macaroon root="%s", discharge="%s"' % (
+                'root-macaroon-data', 'discharge-macaroon-data')
+            headers['HTTP_AUTHORIZATION'] = authorization
+        else:
+            if user is None:
+                user = self.factory.makeUser()
+            self.client.login(username=user.username, password='test')
 
         # Ensure we don't hit the network for our tests.
         is_authed_fn = ('core.api.auth.SSOOAuthAuthentication.'
@@ -1022,7 +1040,8 @@
                 with patch(sca_verify_fn) as mock_sca_verify_method:
                     mock_sca_verify_method.return_value = verify_result
                     response = self.client.post(
-                        url, data=data, content_type='application/json')
+                        url, data=data, content_type='application/json',
+                        **headers)
         return response
 
     def test_bogus_data(self):
@@ -1058,6 +1077,18 @@
         response_dict = simplejson.loads(response.content)
         self.assertEqual('inkscape', response_dict['package_name'])
 
+    def test_create_using_macaroon_auth(self):
+        self.sca_double.set_verify_acl_response(
+            is_verified=True, openid='oid1234',
+            email='[e-mail]', displayname='user1234')
+        response = self._post_new_review(simplejson.dumps(self.required_data),
+                                         auth='macaroon')
+        self.assertEqual(httplib.OK, response.status_code)
+        self.assertEqual('application/json; charset=utf-8',
+                         response['content-type'])
+        response_dict = simplejson.loads(response.content)
+        self.assertEqual('inkscape', response_dict['package_name'])
+
     def test_creates_repository_and_software_item(self):
         # Submitting a review for a software item or repository of which
         # we don't yet have a record will create those records (after