Merge lp:~thisfred/u1db/add-basic-auth into lp:u1db

[Eric Casteleijn]

Added basic authentication middleware.

Added basic authentication middleware.

[lp:~thisfred/u1db/add-basic-auth]

396. By Eric Casteleijn on 2012-09-04

prefix configurable

397. By Eric Casteleijn on 2012-09-05

improved testing, removed copy paste detritus

398. By Eric Casteleijn on 2012-09-05

more prefix tests

[Samuele Pedroni (pedronis)]

good

review: Approve

=== added file 'u1db/remote/basic_auth_middleware.py'
--- u1db/remote/basic_auth_middleware.py	1970-01-01 00:00:00 +0000
+++ u1db/remote/basic_auth_middleware.py	2012-09-05 16:09:18 +0000
@@ -0,0 +1,63 @@
+# Copyright 2012 Canonical Ltd.
+#
+# This file is part of u1db.
+#
+# u1db is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License version 3
+# as published by the Free Software Foundation.
+#
+# u1db is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with u1db.  If not, see <http://www.gnu.org/licenses/>.
+"""U1DB Basic Auth authorisation WSGI middleware."""
+import httplib
+try:
+    import simplejson as json
+except ImportError:
+    import json  # noqa
+from wsgiref.util import shift_path_info
+
+
+class BasicAuthMiddleware(object):
+    """U1DB Basic Auth Authorisation WSGI middleware."""
+
+    def __init__(self, app, prefix):
+        self.app = app
+        self.prefix = prefix
+
+    def _error(self, start_response, status, description, message=None):
+        start_response("%d %s" % (status, httplib.responses[status]),
+                       [('content-type', 'application/json')])
+        err = {"error": description}
+        if message:
+            err['message'] = message
+        return [json.dumps(err)]
+
+    def __call__(self, environ, start_response):
+        if self.prefix and not environ['PATH_INFO'].startswith(self.prefix):
+            return self._error(start_response, 400, "bad request")
+        auth = environ.get('HTTP_AUTHORIZATION')
+        if not auth:
+            return self._error(start_response, 401, "unauthorized",
+                               "Missing Basic Authentication.")
+        scheme, encoded = auth.split(None, 1)
+        if scheme.lower() != 'basic':
+            return self._error(
+                start_response, 401, "unauthorized",
+                "Missing Basic Authentication")
+        user, password = encoded.decode('base64').split(':', 1)
+        if not self.verify_user(user, password):
+            return self._error(
+                start_response, 401, "unauthorized",
+                "Incorrect password or login.")
+        del environ['HTTP_AUTHORIZATION']
+        environ['user_id'] = user
+        shift_path_info(environ)
+        return self.app(environ, start_response)
+
+    def verify_user(self, username, password):
+        raise NotImplementedError(self.verify_user)
 
=== modified file 'u1db/remote/oauth_middleware.py'
--- u1db/remote/oauth_middleware.py	2012-08-14 14:31:45 +0000
+++ u1db/remote/oauth_middleware.py	2012-09-05 16:09:18 +0000
@@ -35,9 +35,10 @@
     # from arrival time
     timestamp_threshold = 300
 
-    def __init__(self, app, base_url):
+    def __init__(self, app, base_url, prefix='/~/'):
         self.app = app
         self.base_url = base_url
+        self.prefix = prefix
 
     def get_oauth_data_store(self):
         """Provide a oauth.OAuthDataStore."""
@@ -52,7 +53,7 @@
         return [json.dumps(err)]
 
     def __call__(self, environ, start_response):
-        if not environ['PATH_INFO'].startswith('/~/'):
+        if self.prefix and not environ['PATH_INFO'].startswith(self.prefix):
             return self._error(start_response, 400, "bad request")
         headers = {}
         if 'HTTP_AUTHORIZATION' in environ:
 
=== renamed file 'u1db/tests/test_oauth_middleware.py' => 'u1db/tests/test_auth_middleware.py'
--- u1db/tests/test_oauth_middleware.py	2012-08-14 14:31:45 +0000
+++ u1db/tests/test_auth_middleware.py	2012-09-05 16:09:18 +0000
@@ -26,15 +26,89 @@
 from u1db import tests
 
 from u1db.remote.oauth_middleware import OAuthMiddleware
-
-
-BASE_URL = 'https://u1db.net'
-
-
-class TestAuthMiddleware(tests.TestCase):
-
-    def setUp(self):
-        super(TestAuthMiddleware, self).setUp()
+from u1db.remote.basic_auth_middleware import BasicAuthMiddleware
+
+
+BASE_URL = 'https://example.net'
+
+
+class TestBasicAuthMiddleware(tests.TestCase):
+
+    def setUp(self):
+        super(TestBasicAuthMiddleware, self).setUp()
+        self.got = []
+
+        def witness_app(environ, start_response):
+            start_response("200 OK", [("content-type", "text/plain")])
+            self.got.append((environ['user_id'], environ['PATH_INFO'],
+                             environ['QUERY_STRING']))
+            return ["ok"]
+
+        class MyAuthMiddleware(BasicAuthMiddleware):
+
+            def verify_user(self, user, password):
+                if user != "correct_user":
+                    return False
+                if password != "correct_password":
+                    return False
+                return True
+
+        self.auth_midw = MyAuthMiddleware(witness_app, prefix="/pfx/")
+        self.app = paste.fixture.TestApp(self.auth_midw)
+
+    def test_expect_prefix(self):
+        url = BASE_URL + '/foo/doc/doc-id'
+        resp = self.app.delete(url, expect_errors=True)
+        self.assertEqual(400, resp.status)
+        self.assertEqual('application/json', resp.header('content-type'))
+        self.assertEqual('{"error": "bad request"}', resp.body)
+
+    def test_missing_auth(self):
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
+        resp = self.app.delete(url, expect_errors=True)
+        self.assertEqual(401, resp.status)
+        self.assertEqual('application/json', resp.header('content-type'))
+        self.assertEqual(
+            {"error": "unauthorized",
+             "message": "Missing Basic Authentication."},
+            json.loads(resp.body))
+
+    def test_correct_auth(self):
+        user = "correct_user"
+        password = "correct_password"
+        params = {'old_rev': 'old-rev'}
+        url = BASE_URL + '/pfx/foo/doc/doc-id?%s' % (
+            '&'.join("%s=%s" % (k, v) for k, v in params.items()))
+        auth = '%s:%s' % (user, password)
+        headers = {
+            'Authorization': 'Basic %s' % (auth.encode('base64'),)}
+        resp = self.app.delete(url, headers=headers)
+        self.assertEqual(200, resp.status)
+        self.assertEqual(
+            [('correct_user', '/foo/doc/doc-id', 'old_rev=old-rev')], self.got)
+
+    def test_incorrect_auth(self):
+        user = "correct_user"
+        password = "incorrect_password"
+        params = {'old_rev': 'old-rev'}
+        url = BASE_URL + '/pfx/foo/doc/doc-id?%s' % (
+            '&'.join("%s=%s" % (k, v) for k, v in params.items()))
+        auth = '%s:%s' % (user, password)
+        headers = {
+            'Authorization': 'Basic %s' % (auth.encode('base64'),)}
+        resp = self.app.delete(url, headers=headers, expect_errors=True)
+        self.assertEqual(401, resp.status)
+        self.assertEqual('application/json', resp.header('content-type'))
+        self.assertEqual(
+            {"error": "unauthorized",
+             "message": "Incorrect password or login."},
+            json.loads(resp.body))
+
+
+class TestOAuthMiddlewareDefaultPrefix(tests.TestCase):
+    def setUp(self):
+
+        super(TestOAuthMiddlewareDefaultPrefix, self).setUp()
         self.got = []
 
         def witness_app(environ, start_response):
@@ -61,8 +135,76 @@
         self.assertEqual('application/json', resp.header('content-type'))
         self.assertEqual('{"error": "bad request"}', resp.body)
 
+    def test_oauth_in_header(self):
+        url = BASE_URL + '/~/foo/doc/doc-id'
+        params = {'old_rev': 'old-rev'}
+        oauth_req = oauth.OAuthRequest.from_consumer_and_token(
+            tests.consumer2,
+            tests.token2,
+            parameters=params,
+            http_url=url,
+            http_method='DELETE'
+            )
+        url = oauth_req.get_normalized_http_url() + '?' + (
+            '&'.join("%s=%s" % (k, v) for k, v in params.items()))
+        oauth_req.sign_request(tests.sign_meth_HMAC_SHA1,
+                               tests.consumer2, tests.token2)
+        resp = self.app.delete(url, headers=oauth_req.to_header())
+        self.assertEqual(200, resp.status)
+        self.assertEqual([(tests.token2.key,
+                           '/foo/doc/doc-id', 'old_rev=old-rev')], self.got)
+
+    def test_oauth_in_query_string(self):
+        url = BASE_URL + '/~/foo/doc/doc-id'
+        params = {'old_rev': 'old-rev'}
+        oauth_req = oauth.OAuthRequest.from_consumer_and_token(
+            tests.consumer1,
+            tests.token1,
+            parameters=params,
+            http_url=url,
+            http_method='DELETE'
+            )
+        oauth_req.sign_request(tests.sign_meth_HMAC_SHA1,
+                               tests.consumer1, tests.token1)
+        resp = self.app.delete(oauth_req.to_url())
+        self.assertEqual(200, resp.status)
+        self.assertEqual([(tests.token1.key,
+                           '/foo/doc/doc-id', 'old_rev=old-rev')], self.got)
+
+
+class TestOAuthMiddleware(tests.TestCase):
+
+    def setUp(self):
+        super(TestOAuthMiddleware, self).setUp()
+        self.got = []
+
+        def witness_app(environ, start_response):
+            start_response("200 OK", [("content-type", "text/plain")])
+            self.got.append((environ['token_key'], environ['PATH_INFO'],
+                             environ['QUERY_STRING']))
+            return ["ok"]
+
+        class MyOAuthMiddleware(OAuthMiddleware):
+            get_oauth_data_store = lambda self: tests.testingOAuthStore
+
+            def verify(self, environ, oauth_req):
+                consumer, token = super(MyOAuthMiddleware, self).verify(
+                    environ, oauth_req)
+                environ['token_key'] = token.key
+
+        self.oauth_midw = MyOAuthMiddleware(
+            witness_app, BASE_URL, prefix='/pfx/')
+        self.app = paste.fixture.TestApp(self.oauth_midw)
+
+    def test_expect_prefix(self):
+        url = BASE_URL + '/foo/doc/doc-id'
+        resp = self.app.delete(url, expect_errors=True)
+        self.assertEqual(400, resp.status)
+        self.assertEqual('application/json', resp.header('content-type'))
+        self.assertEqual('{"error": "bad request"}', resp.body)
+
     def test_missing_oauth(self):
-        url = BASE_URL + '/~/foo/doc/doc-id'
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
         resp = self.app.delete(url, expect_errors=True)
         self.assertEqual(401, resp.status)
         self.assertEqual('application/json', resp.header('content-type'))
@@ -71,7 +213,7 @@
             json.loads(resp.body))
 
     def test_oauth_in_query_string(self):
-        url = BASE_URL + '/~/foo/doc/doc-id'
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
         params = {'old_rev': 'old-rev'}
         oauth_req = oauth.OAuthRequest.from_consumer_and_token(
             tests.consumer1,
@@ -88,7 +230,7 @@
                            '/foo/doc/doc-id', 'old_rev=old-rev')], self.got)
 
     def test_oauth_invalid(self):
-        url = BASE_URL + '/~/foo/doc/doc-id'
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
         params = {'old_rev': 'old-rev'}
         oauth_req = oauth.OAuthRequest.from_consumer_and_token(
             tests.consumer1,
@@ -109,7 +251,7 @@
                          err)
 
     def test_oauth_in_header(self):
-        url = BASE_URL + '/~/foo/doc/doc-id'
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
         params = {'old_rev': 'old-rev'}
         oauth_req = oauth.OAuthRequest.from_consumer_and_token(
             tests.consumer2,
@@ -128,7 +270,7 @@
                            '/foo/doc/doc-id', 'old_rev=old-rev')], self.got)
 
     def test_oauth_plain_text(self):
-        url = BASE_URL + '/~/foo/doc/doc-id'
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
         params = {'old_rev': 'old-rev'}
         oauth_req = oauth.OAuthRequest.from_consumer_and_token(
             tests.consumer1,
@@ -145,7 +287,7 @@
                            '/foo/doc/doc-id', 'old_rev=old-rev')], self.got)
 
     def test_oauth_timestamp_threshold(self):
-        url = BASE_URL + '/~/foo/doc/doc-id'
+        url = BASE_URL + '/pfx/foo/doc/doc-id'
         params = {'old_rev': 'old-rev'}
         oauth_req = oauth.OAuthRequest.from_consumer_and_token(
             tests.consumer1,
 
=== modified file 'u1db/tests/test_https.py'
--- u1db/tests/test_https.py	2012-07-05 15:26:52 +0000
+++ u1db/tests/test_https.py	2012-09-05 16:09:18 +0000
@@ -7,7 +7,6 @@
 from paste import httpserver
 
 from u1db import (
-    errors,
     tests,
     )
 from u1db.remote import (
@@ -21,7 +20,7 @@
 def oauth_https_server_def():
     def make_server(host_port, handler, state):
         app = http_app.HTTPApp(state)
-        application = oauth_middleware.OAuthMiddleware(app, None)
+        application = oauth_middleware.OAuthMiddleware(app, None, prefix='/~/')
         application.get_oauth_data_store = lambda: tests.testingOAuthStore
         from OpenSSL import SSL
         cert_file = os.path.join(os.path.dirname(__file__), 'testing-certs',
@@ -36,8 +35,6 @@
                                         handler,
                                         ssl_context=ssl_context
                                         )
-        # workaround apparent interface mismatch
-        orig_shutdown_request = srv.shutdown_request
 
         def shutdown_request(req):
             req.shutdown()
@@ -68,7 +65,7 @@
 
     def setUp(self):
         try:
-            import OpenSSL
+            import OpenSSL  # noqa
         except ImportError:
             self.skipTest("Requires pyOpenSSL")
         self.cacert_pem = os.path.join(os.path.dirname(__file__),
@@ -96,7 +93,7 @@
         self.startServer()
         # don't print expected traceback server-side
         self.server.handle_error = lambda req, cli_addr: None
-        db = self.request_state._create_database('test')
+        self.request_state._create_database('test')
         remote_target = self.getSyncTarget('localhost', 'test')
         try:
             remote_target.record_sync_info('other-id', 2, 'T-id')
@@ -110,11 +107,12 @@
             self.skipTest(
                 "XXX certificate verification happens on linux only for now")
         self.startServer()
-        db = self.request_state._create_database('test')
+        self.request_state._create_database('test')
         self.patch(http_client, 'CA_CERTS', self.cacert_pem)
         remote_target = self.getSyncTarget('127.0.0.1', 'test')
-        self.assertRaises(http_client.CertificateError,
-                          remote_target.record_sync_info, 'other-id', 2, 'T-id')
+        self.assertRaises(
+            http_client.CertificateError, remote_target.record_sync_info,
+            'other-id', 2, 'T-id')
 
 
 load_tests = tests.load_with_scenarios
 
=== modified file 'u1db/tests/test_remote_sync_target.py'
--- u1db/tests/test_remote_sync_target.py	2012-07-19 19:50:58 +0000
+++ u1db/tests/test_remote_sync_target.py	2012-09-05 16:09:18 +0000
@@ -130,7 +130,7 @@
 
     def make_server(host_port, handler, state):
         app = http_app.HTTPApp(state)
-        application = oauth_middleware.OAuthMiddleware(app, None)
+        application = oauth_middleware.OAuthMiddleware(app, None, prefix='/~/')
         application.get_oauth_data_store = lambda: tests.testingOAuthStore
         srv = simple_server.WSGIServer(host_port, handler)
         # patch the value in