Merge lp:~uriboni/oxide/basic-authentication into lp:~oxide-developers/oxide/oxide.trunk

[Ugo Riboni]

Implements basic authentication support

Implements basic authentication support.

[Olivier Tilloy (osomon)]

I’m getting the following error when running the unit tests on a local build:

1: QWARN : qml-api-test::UnknownTestFunc() file:///home/osomon/dev/phablet/oxide/trunk/qt/tests/qmltests/api/tst_WebView_basicAuthentication.qml:25:3: "TestWebView.onBasicAuthenticationRequested" is not available due to component versioning.
1: onBasicAuthenticationRequested: {
1: ^
1: QWARN : qml-api-test::tst_WebView_basicAuthentication::compile()
1: /home/osomon/dev/phablet/oxide/trunk/qt/tests/qmltests/api/tst_WebView_basicAuthentication.qml produced 1 error(s):
1: /home/osomon/dev/phablet/oxide/trunk/qt/tests/qmltests/api/tst_WebView_basicAuthentication.qml:25,3: "TestWebView.onBasicAuthenticationRequested" is not available due to component versioning.
1: Working directory: /home/osomon/dev/phablet/oxide/trunk/objdir-x64-release/qt/tests/qmltests
1: View: QQuickView, import paths:
1: '/home/osomon/dev/phablet/oxide/trunk/objdir-x64-release/out/bin'
1: '/home/osomon/dev/phablet/oxide/trunk/objdir-x64-release/out/imports'
1: '/usr/lib/x86_64-linux-gnu/qt5/qml'
1: Plugin paths:
1: '.'
1:
1: FAIL! : qml-api-test::tst_WebView_basicAuthentication::compile() "TestWebView.onBasicAuthenticationRequested" is not available due to component versioning.
1: Loc: [/home/osomon/dev/phablet/oxide/trunk/qt/tests/qmltests/api/tst_WebView_basicAuthentication.qml(25)]

You will need to import com.canonical.Oxide 1.9 in your tests.

review: Needs Fixing

[lp:~uriboni/oxide/basic-authentication]

1084. By Ugo Riboni on 2015-06-09

Fix the oxide version used in unit tests

1085. By Ugo Riboni on 2015-06-09

Simplify and fix unit tests

[Olivier Tilloy (osomon)]

I’m seeing this really weird warning when running unit tests locally:

1: QWARN : qml-api-test::WebView_beforeUnloadDialog::test_customDialogComponent(row 0) file:///home/osomon/dev/phablet/oxide/trunk/qt/tests/qmltests/api/tst_WebView_basicAuthentication.qml:33: TypeError: Cannot read property of null

I don’t see how WebView_beforeUnloadDialog could possibly be loading tst_WebView_basicAuthentication.qml. Maybe a bug in our custom QML test runner? In any case, worth investigating, given that it showed up in this branch.

[Olivier Tilloy (osomon)]

In qt/core/core.gyp, file paths should be kept sorted alphabetically.

[Chris Coulson (chrisccoulson)]

Thanks for this - I've left some comments inline.

One general point - there's a mixture of 2-space and 4-space indentation. Please stick to 2-space (using 4-space only for wrapped lines). We try to adhere to the Chromium style guide on this - see http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Spaces_vs._Tabs.

Also, what happens if the application doesn't connect a handler, or does connect one but allows the request object to be garbage collected before responding to it? Oxide should take the default action - ie, deny - but it doesn't look like that will happen here. Please take a look at how this is handled for permission requests, and there should also be a test case for this as well.

review: Needs Fixing

[Chris Coulson (chrisccoulson)]

I've just added a couple more comments for things I missed

[lp:~uriboni/oxide/basic-authentication]

1086. By Ugo Riboni on 2015-06-17

Reorder alphabetically the gyp file

1087. By Ugo Riboni on 2015-06-17

Merge upstream changes

1088. By Ugo Riboni on 2015-06-17

Fix indentation

1089. By Ugo Riboni on 2015-06-17

Remove check on login_delegate as it can not be null

1090. By Ugo Riboni on 2015-06-17

Remove the cancellation callback when the QT class is destroyed, for safety

1091. By Ugo Riboni on 2015-06-17

Remove some useless code

1092. By Ugo Riboni on 2015-06-17

Rename *basicAuthentication* to *httpAuthentication* since we are also handling digest auth

1093. By Ugo Riboni on 2015-06-17

Mark some properties as constant since we only assign them at construction

1094. By Ugo Riboni on 2015-06-17

Make private and hidden the constructor of OxideQHttpAuthenticationRequest since it can only be created from within the webview

1095. By Ugo Riboni on 2015-06-17

Invalidate the pointer to the delegate when the request is cancelled, as it will be deleted by chromium immediately after. Check that we have a valid pointer before calling through it elsewhere.

1096. By Ugo Riboni on 2015-06-17

Fix some indentation

1097. By Ugo Riboni on 2015-06-17

Rename tests

1098. By Ugo Riboni on 2015-06-17

Remove non-useful null pointer check

1099. By Ugo Riboni on 2015-06-18

More properly ensure that data is accessed from the right thread

1100. By Ugo Riboni on 2015-06-18

Clear the callback in the right destructor

1101. By Ugo Riboni on 2015-06-18

Move ResourceDispatcherHostLoginDelegate to is own source files, and remove another case of accessing the UrlRequest outside of the IO thread.

1102. By Ugo Riboni on 2015-06-18

Remove Qt code that for some bizarre reason ended up in oxide and still compiles

1103. By Ugo Riboni on 2015-06-18

Simplify the code to access the WebView

1104. By Ugo Riboni on 2015-06-18

Deny the authentication if the request object is ignored and gets destroyed. Add test for this case.

[Chris Coulson (chrisccoulson)]

I've added some more comments inline

review: Needs Fixing

[Olivier Tilloy (osomon)]

Superseded by https://code.launchpad.net/~osomon/oxide/http-auth/+merge/263435.

=== added file 'qt/core/api/oxideqhttpauthenticationrequest.cc'
--- qt/core/api/oxideqhttpauthenticationrequest.cc	1970-01-01 00:00:00 +0000
+++ qt/core/api/oxideqhttpauthenticationrequest.cc	2015-06-18 16:37:15 +0000
@@ -0,0 +1,103 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#include "base/bind.h"
+#include "base/callback.h"
+
+#include "shared/browser/oxide_resource_dispatcher_host_login_delegate.h"
+#include "qt/core/browser/oxide_qt_web_view.h"
+
+#include "oxideqhttpauthenticationrequest.h"
+#include "oxideqhttpauthenticationrequest_p.h"
+
+OxideQHttpAuthenticationRequestPrivate::OxideQHttpAuthenticationRequestPrivate(
+    oxide::ResourceDispatcherHostLoginDelegate* login_delegate)
+    : q_ptr(nullptr),
+      login_delegate_(login_delegate) {
+  // Use of base::Unretained is safe here because we clear the callback
+  // in the destructor, so that it can not called back on a deleted object
+  login_delegate->SetCancelledCallback(
+        base::Bind(&OxideQHttpAuthenticationRequestPrivate::RequestCancelled,
+                   base::Unretained(this)));
+}
+
+OxideQHttpAuthenticationRequestPrivate::~OxideQHttpAuthenticationRequestPrivate() {
+  if (login_delegate_) {
+    login_delegate_->SetCancelledCallback(base::Closure());
+
+    // Always deny the request when we are being destroyed, as it should be the
+    // default action in case the client ignores this request and it gets
+    // garbage collected.
+    // In case an action has already been taken, this is a essentially a no-op.
+    login_delegate_->Deny();
+  }
+}
+
+void OxideQHttpAuthenticationRequestPrivate::RequestCancelled() {
+  Q_Q(OxideQHttpAuthenticationRequest);
+
+  login_delegate_ = nullptr;
+  q->cancelled();
+}
+
+OxideQHttpAuthenticationRequest::OxideQHttpAuthenticationRequest(
+    oxide::ResourceDispatcherHostLoginDelegate* login_delegate)
+    : d_ptr(new OxideQHttpAuthenticationRequestPrivate(login_delegate)) {
+  Q_D(OxideQHttpAuthenticationRequest);
+  d->q_ptr = this;
+}
+
+OxideQHttpAuthenticationRequest::~OxideQHttpAuthenticationRequest() {}
+
+QString OxideQHttpAuthenticationRequest::host() const {
+  Q_D(const OxideQHttpAuthenticationRequest);
+
+  if (d->login_delegate_) {
+    return QString::fromStdString(d->login_delegate_->Host());
+  } else {
+    return QString();
+  }
+}
+
+QString OxideQHttpAuthenticationRequest::realm() const {
+  Q_D(const OxideQHttpAuthenticationRequest);
+
+  if (d->login_delegate_) {
+    return QString::fromStdString(d->login_delegate_->Realm());
+  } else {
+    return QString();
+  }
+}
+
+void OxideQHttpAuthenticationRequest::deny() {
+  Q_D(OxideQHttpAuthenticationRequest);
+
+  if (d->login_delegate_) {
+    d->login_delegate_->Deny();
+    d->login_delegate_ = nullptr;
+  }
+}
+
+void OxideQHttpAuthenticationRequest::allow(const QString &username,
+                                             const QString &password) {
+  Q_D(OxideQHttpAuthenticationRequest);
+
+  if (d->login_delegate_) {
+    d->login_delegate_->Allow(username.toStdString(), password.toStdString());
+    d->login_delegate_ = nullptr;
+  }
+}
 
=== added file 'qt/core/api/oxideqhttpauthenticationrequest.h'
--- qt/core/api/oxideqhttpauthenticationrequest.h	1970-01-01 00:00:00 +0000
+++ qt/core/api/oxideqhttpauthenticationrequest.h	2015-06-18 16:37:15 +0000
@@ -0,0 +1,64 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef OXIDE_Q_HTTP_AUTHENTICATION_REQUEST
+#define OXIDE_Q_HTTP_AUTHENTICATION_REQUEST
+
+#include <QObject>
+#include <QScopedPointer>
+#include <QString>
+#include <QtGlobal>
+
+class OxideQHttpAuthenticationRequestPrivate;
+
+namespace oxide {
+  namespace qt {
+    class WebView;
+  }
+  class ResourceDispatcherHostLoginDelegate;
+}
+
+class Q_DECL_EXPORT OxideQHttpAuthenticationRequest : public QObject {
+  Q_OBJECT
+  Q_PROPERTY(QString host READ host CONSTANT)
+  Q_PROPERTY(QString realm READ realm CONSTANT)
+
+  Q_DECLARE_PRIVATE(OxideQHttpAuthenticationRequest)
+  Q_DISABLE_COPY(OxideQHttpAuthenticationRequest)
+
+ public:
+  ~OxideQHttpAuthenticationRequest();
+
+  QString host() const;
+  QString realm() const;
+
+  Q_INVOKABLE void allow(const QString& username, const QString& password);
+  Q_INVOKABLE void deny();
+
+ Q_SIGNALS:
+  void cancelled() const;
+
+ private:
+  Q_DECL_HIDDEN OxideQHttpAuthenticationRequest(
+      oxide::ResourceDispatcherHostLoginDelegate* login_delegate);
+
+  QScopedPointer<OxideQHttpAuthenticationRequestPrivate> d_ptr;
+
+ friend class oxide::qt::WebView;
+};
+
+#endif // OXIDE_Q_HTTP_AUTHENTICATION_REQUEST
 
=== added file 'qt/core/api/oxideqhttpauthenticationrequest_p.h'
--- qt/core/api/oxideqhttpauthenticationrequest_p.h	1970-01-01 00:00:00 +0000
+++ qt/core/api/oxideqhttpauthenticationrequest_p.h	2015-06-18 16:37:15 +0000
@@ -0,0 +1,47 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef _OXIDE_QT_CORE_API_HTTP_AUTHENTICATION_REQUEST_P_H_
+#define _OXIDE_QT_CORE_API_HTTP_AUTHENTICATION_REQUEST_P_H_
+
+#include <QtGlobal>
+#include <QString>
+
+namespace oxide {
+  class ResourceDispatcherHostLoginDelegate;
+}
+
+class OxideQHttpAuthenticationRequest;
+
+class OxideQHttpAuthenticationRequestPrivate {
+  Q_DECLARE_PUBLIC(OxideQHttpAuthenticationRequest)
+
+ public:
+  virtual ~OxideQHttpAuthenticationRequestPrivate();
+
+ private:
+  OxideQHttpAuthenticationRequestPrivate(
+      oxide::ResourceDispatcherHostLoginDelegate* login_delegate);
+  void RequestCancelled();
+
+  OxideQHttpAuthenticationRequest* q_ptr;
+  QString realm_;
+  oxide::ResourceDispatcherHostLoginDelegate* login_delegate_;
+};
+
+#endif // _OXIDE_QT_CORE_API_HTTP_AUTHENTICATION_REQUEST_P_H_
+
 
=== modified file 'qt/core/browser/oxide_qt_web_view.cc'
--- qt/core/browser/oxide_qt_web_view.cc	2015-06-04 17:11:01 +0000
+++ qt/core/browser/oxide_qt_web_view.cc	2015-06-18 16:37:15 +0000
@@ -58,6 +58,7 @@
 
 #include "qt/core/api/oxideqdownloadrequest.h"
 #include "qt/core/api/oxideqloadevent.h"
+#include "qt/core/api/oxideqhttpauthenticationrequest.h"
 #include "qt/core/api/oxideqnavigationrequest.h"
 #include "qt/core/api/oxideqnewviewrequest.h"
 #include "qt/core/api/oxideqnewviewrequest_p.h"
@@ -744,6 +745,13 @@
   client_->DownloadRequested(&download_request);
 }
 
+void WebView::HttpAuthenticationRequested(
+        oxide::ResourceDispatcherHostLoginDelegate* login_delegate) {
+  // The client takes ownership of the request
+  client_->HttpAuthenticationRequested(
+      new OxideQHttpAuthenticationRequest(login_delegate));
+}
+
 bool WebView::ShouldHandleNavigation(const GURL& url,
                                      WindowOpenDisposition disposition,
                                      bool user_gesture) {
 
=== modified file 'qt/core/browser/oxide_qt_web_view.h'
--- qt/core/browser/oxide_qt_web_view.h	2015-06-04 13:21:49 +0000
+++ qt/core/browser/oxide_qt_web_view.h	2015-06-18 16:37:15 +0000
@@ -141,6 +141,9 @@
       const std::string& cookies,
       const std::string& referrer,
       const std::string& user_agent) override;
+  void HttpAuthenticationRequested(
+      ResourceDispatcherHostLoginDelegate* login_delegate) override;
+
   bool ShouldHandleNavigation(const GURL& url,
                               WindowOpenDisposition disposition,
                               bool user_gesture) override;
 
=== modified file 'qt/core/core.gyp'
--- qt/core/core.gyp	2015-06-07 20:27:38 +0000
+++ qt/core/core.gyp	2015-06-18 16:37:15 +0000
@@ -208,6 +208,7 @@
       'sources': [
         '<(INTERMEDIATE_DIR)/moc_oxideqcertificateerror.cc',
         '<(INTERMEDIATE_DIR)/moc_oxideqdownloadrequest.cc',
+        '<(INTERMEDIATE_DIR)/moc_oxideqhttpauthenticationrequest.cc',
         '<(INTERMEDIATE_DIR)/moc_oxideqloadevent.cc',
         '<(INTERMEDIATE_DIR)/moc_oxideqmediacapturedevices.cc',
         '<(INTERMEDIATE_DIR)/moc_oxideqnetworkcallbackevents.cc',
@@ -227,6 +228,9 @@
         'api/oxideqdownloadrequest_p.h',
         'api/oxideqglobal.cc',
         'api/oxideqglobal.h',
+        'api/oxideqhttpauthenticationrequest.cc',
+        'api/oxideqhttpauthenticationrequest.h',
+        'api/oxideqhttpauthenticationrequest_p.h',
         'api/oxideqloadevent.cc',
         'api/oxideqloadevent.h',
         'api/oxideqloadevent_p.h',
@@ -272,6 +276,11 @@
           'includes': [ 'moc.gypi' ]
         },
         {
+          'action_name': 'moc_oxideqhttpauthenticationrequest.cc',
+          'moc_input': 'api/oxideqhttpauthenticationrequest.h',
+          'includes': [ 'moc.gypi' ]
+        },
+        {
           'action_name': 'moc_oxideqloadevent.cc',
           'moc_input': 'api/oxideqloadevent.h',
           'includes': [ 'moc.gypi' ]
 
=== modified file 'qt/core/glue/oxide_qt_web_view_proxy_client.h'
--- qt/core/glue/oxide_qt_web_view_proxy_client.h	2015-05-27 20:56:59 +0000
+++ qt/core/glue/oxide_qt_web_view_proxy_client.h	2015-06-18 16:37:15 +0000
@@ -32,6 +32,7 @@
 class OxideQMediaAccessPermissionRequest;
 class OxideQNavigationRequest;
 class OxideQNewViewRequest;
+class OxideQHttpAuthenticationRequest;
 
 QT_BEGIN_NAMESPACE
 class QCursor;
@@ -139,6 +140,9 @@
 
   virtual void DownloadRequested(OxideQDownloadRequest* download_request) = 0;
 
+  virtual void HttpAuthenticationRequested(
+      OxideQHttpAuthenticationRequest* authentication_request) = 0;
+
   virtual void CertificateError(OxideQCertificateError* cert_error) = 0;
 
   virtual void ContentBlocked() = 0; // XXX(chrisccoulson): Rename to BlockedContentChanged throughout Oxide
 
=== modified file 'qt/qmlplugin/oxide_qml_plugin.cc'
--- qt/qmlplugin/oxide_qml_plugin.cc	2015-06-05 18:43:21 +0000
+++ qt/qmlplugin/oxide_qml_plugin.cc	2015-06-18 16:37:15 +0000
@@ -25,6 +25,7 @@
 #include "qt/core/api/oxideqcertificateerror.h"
 #include "qt/core/api/oxideqdownloadrequest.h"
 #include "qt/core/api/oxideqfindcontroller.h"
+#include "qt/core/api/oxideqhttpauthenticationrequest.h"
 #include "qt/core/api/oxideqloadevent.h"
 #include "qt/core/api/oxideqnavigationrequest.h"
 #include "qt/core/api/oxideqnewviewrequest.h"
@@ -136,6 +137,10 @@
     qmlRegisterType<OxideQQuickWebView, 4>(uri, 1, 8, "WebView");
 
     qmlRegisterType<OxideQQuickWebContext, 3>(uri, 1, 9, "WebContext");
+
+    qmlRegisterUncreatableType<OxideQHttpAuthenticationRequest>(uri, 1, 9, "HttpAuthenticationRequest",
+        "HttpAuthenticationRequest is delivered by WebView.httpAuthenticationRequested");
+    qmlRegisterType<OxideQQuickWebView, 5>(uri, 1, 9, "WebView");
   }
 };
 
 
=== modified file 'qt/quick/api/oxideqquickwebview.cc'
--- qt/quick/api/oxideqquickwebview.cc	2015-05-28 23:51:39 +0000
+++ qt/quick/api/oxideqquickwebview.cc	2015-06-18 16:37:15 +0000
@@ -43,6 +43,7 @@
 #include "qt/core/api/oxideqcertificateerror.h"
 #include "qt/core/api/oxideqfindcontroller.h"
 #include "qt/core/api/oxideqglobal.h"
+#include "qt/core/api/oxideqhttpauthenticationrequest.h"
 #include "qt/core/api/oxideqloadevent.h"
 #include "qt/core/api/oxideqnewviewrequest.h"
 #include "qt/core/api/oxideqpermissionrequest.h"
@@ -461,6 +462,31 @@
 
 }
 
+void OxideQQuickWebViewPrivate::HttpAuthenticationRequested(
+    OxideQHttpAuthenticationRequest* authentication_request) {
+  Q_Q(OxideQQuickWebView);
+
+  // See the comment in RequestGeolocationPermission
+
+  QQmlEngine* engine = qmlEngine(q);
+  if (!engine) {
+    delete authentication_request;
+    return;
+  }
+
+  {
+    QJSValue val = engine->newQObject(authentication_request);
+    if (!val.isQObject()) {
+      delete authentication_request;
+      return;
+    }
+
+    emit q->httpAuthenticationRequested(val);
+  }
+
+  engine->collectGarbage();
+}
+
 void OxideQQuickWebViewPrivate::HandleUnhandledKeyboardEvent(
     QKeyEvent* event) {
   Q_Q(OxideQQuickWebView);
 
=== modified file 'qt/quick/api/oxideqquickwebview_p.h'
--- qt/quick/api/oxideqquickwebview_p.h	2015-05-28 23:51:39 +0000
+++ qt/quick/api/oxideqquickwebview_p.h	2015-06-18 16:37:15 +0000
@@ -356,6 +356,7 @@
   Q_REVISION(2) void prepareToCloseResponse(bool proceed);
   Q_REVISION(2) void closeRequested();
   Q_REVISION(4) void webProcessStatusChanged();
+  Q_REVISION(5) void httpAuthenticationRequested(const QJSValue& request);
 
   // Deprecated since 1.3
   void loadingChanged(OxideQLoadEvent* loadEvent);
 
=== modified file 'qt/quick/api/oxideqquickwebview_p_p.h'
--- qt/quick/api/oxideqquickwebview_p_p.h	2015-05-28 23:51:39 +0000
+++ qt/quick/api/oxideqquickwebview_p_p.h	2015-06-18 16:37:15 +0000
@@ -135,6 +135,8 @@
   void EvictCurrentFrame() override;
   void SetInputMethodEnabled(bool enabled) override;
   void DownloadRequested(OxideQDownloadRequest* download_request) override;
+  void HttpAuthenticationRequested(
+      OxideQHttpAuthenticationRequest* authentication_request) override;
   void CertificateError(OxideQCertificateError* cert_error) override;
   void ContentBlocked() override;
   void PrepareToCloseResponse(bool proceed) override;
 
=== modified file 'qt/tests/qmltests/TestWebView.qml'
--- qt/tests/qmltests/TestWebView.qml	2015-05-15 15:03:10 +0000
+++ qt/tests/qmltests/TestWebView.qml	2015-06-18 16:37:15 +0000
@@ -1,6 +1,6 @@
 import QtQuick 2.0
 import QtTest 1.0
-import com.canonical.Oxide 1.8
+import com.canonical.Oxide 1.9
 import com.canonical.Oxide.Testing 1.0 as Testing
 import "TestUtils.js" as TestUtils
 
 
=== added file 'qt/tests/qmltests/api/tst_httpAuthentication.py'
--- qt/tests/qmltests/api/tst_httpAuthentication.py	1970-01-01 00:00:00 +0000
+++ qt/tests/qmltests/api/tst_httpAuthentication.py	2015-06-18 16:37:15 +0000
@@ -0,0 +1,31 @@
+from cStringIO import StringIO
+import base64
+
+def handler(request):
+  html = StringIO()
+
+  def send_401():
+      request.send_response(401)
+      request.send_header("WWW-Authenticate", "Basic realm=\"Fake Realm\"")
+      request.send_header("Cache-Control", "no-store")
+      request.send_header("Content-Length", html.tell())
+      request.end_headers()
+
+  if "Authorization" in request.headers:
+      user, password = request.path.split("?")[1].split("_")
+      header = request.headers["Authorization"]
+      credentials = base64.b64decode(header[len("Basic "):]).split(":")
+      if credentials[0] == user and credentials[1] == password:
+          html.write("Authentication success")
+          request.send_response(200)
+          request.send_header("Cache-Control", "no-store")
+          request.send_header("Content-Length", html.tell())
+          request.end_headers()
+      else:
+          html.write("Wrong credentials")
+          send_401()
+  else:
+    html.write("Requested credentials")
+    send_401()
+
+  request.wfile.write(html.getvalue())
 
=== added file 'qt/tests/qmltests/api/tst_httpAuthentication.qml'
--- qt/tests/qmltests/api/tst_httpAuthentication.qml	1970-01-01 00:00:00 +0000
+++ qt/tests/qmltests/api/tst_httpAuthentication.qml	2015-06-18 16:37:15 +0000
@@ -0,0 +1,142 @@
+import QtQuick 2.0
+import QtTest 1.0
+import com.canonical.Oxide 1.9
+import com.canonical.Oxide.Testing 1.0
+
+TestWebView {
+  id: webView
+  width: 200
+  height: 200
+
+  property var lastRequest
+  property int lastStatusCode: -1
+  property int totalRequests: 0
+  property int expectedRequests: 0
+  property int totalCancellations: 0
+  property int expectedCancellations: 0
+  property bool ignoreRequests: false
+
+  // Since the browser caches credentials after the first successful
+  // authentication, we make sure to use a different username for every test
+  property string baseUrl: "http://testsuite/tst_httpAuthentication.py"
+  property int userNameSuffix: 0
+  property string currentUser: "user" + userNameSuffix
+  property string credentialsUrl: baseUrl + "?" + currentUser + "_pass"
+
+  onHttpAuthenticationRequested: {
+      if (!ignoreRequests) {
+          lastRequest = request
+          lastRequest.cancelled.connect(updateCancellations)
+      }
+      totalRequests++
+  }
+
+  onLoadEvent: lastStatusCode = event.httpStatusCode
+
+  function updateCancellations() { totalCancellations++ }
+
+  TestCase {
+    id: test
+    name: "httpAuthentication"
+    when: windowShown
+
+    function init() {
+        ignoreRequests = false
+        if (lastRequest) {
+            lastRequest.cancelled.disconnect(updateCancellations)
+            lastRequest = null
+        }
+        webView.url = "about:blank";
+        verify(webView.waitForLoadSucceeded());
+        totalRequests = 0
+        expectedRequests = 0
+        totalCancellations = 0
+        expectedCancellations = 0
+        lastStatusCode = -1
+        userNameSuffix++
+    }
+
+    function receivedRequest() {
+        return totalRequests == expectedRequests
+    }
+
+    function receivedCancellation() {
+        return totalCancellations == expectedCancellations
+    }
+
+    function test_requestMembers() {
+        expectedRequests++
+        webView.url = credentialsUrl
+        verify(waitFor(receivedRequest), "No authentication request")
+        compare(lastRequest.realm, "Fake Realm")
+        compare(lastRequest.host, "testsuite:80")
+    }
+
+    function test_wrong_password() {
+        expectedRequests++
+        webView.url = credentialsUrl
+        verify(waitFor(receivedRequest), "No authentication request")
+        expectedRequests++
+        lastRequest.allow(currentUser, "wrong")
+        verify(waitFor(receivedRequest), "No authentication request")
+    }
+
+    function test_wrong_username() {
+        expectedRequests++
+        webView.url = credentialsUrl
+        verify(waitFor(receivedRequest), "No authentication request")
+        expectedRequests++
+        lastRequest.allow(currentUser + "_wrong", "pass")
+        verify(waitFor(receivedRequest), "No authentication request")
+    }
+
+    function test_right_credentials() {
+        expectedRequests++
+        webView.url = credentialsUrl
+        verify(waitFor(receivedRequest), "No authentication request")
+        lastRequest.allow(currentUser, "pass")
+        webView.waitForLoadSucceeded()
+        compare(lastStatusCode, 200)
+        compare(expectedRequests, totalRequests)
+    }
+
+    function test_explicit_cancellation() {
+        webView.url = credentialsUrl
+        expectedRequests++
+        verify(waitFor(receivedRequest), "No authentication request")
+
+        lastRequest.deny()
+        webView.waitForLoadSucceeded()
+        compare(lastStatusCode, 401)
+        // when cancelling explicity we should not receive cancellation signals
+        compare(totalCancellations, 0)
+    }
+
+    function test_cancel_by_navigation() {
+        webView.url = credentialsUrl
+        expectedRequests++
+        verify(waitFor(receivedRequest), "No authentication request")
+
+        expectedCancellations++
+        webView.url = "about:blank"
+        verify(waitFor(receivedCancellation), "Authentication not cancelled")
+
+        webView.waitForLoadSucceeded()
+        compare(expectedRequests, totalRequests)
+    }
+
+    function test_ignored_request_cancelled() {
+        ignoreRequests = true
+        webView.url = credentialsUrl
+        expectedRequests++
+        verify(waitFor(receivedRequest), "No authentication request")
+
+        // force garbage collection so the request object will be destroyed
+        // as we did not keep any reference to it.
+        // the request destructor will call request.deny()
+        gc()
+        webView.waitForLoadSucceeded()
+        compare(lastStatusCode, 401)
+    }
+  }
+}
 
=== modified file 'shared/browser/oxide_resource_dispatcher_host_delegate.cc'
--- shared/browser/oxide_resource_dispatcher_host_delegate.cc	2015-06-06 10:38:48 +0000
+++ shared/browser/oxide_resource_dispatcher_host_delegate.cc	2015-06-18 16:37:15 +0000
@@ -18,12 +18,14 @@
 #include "oxide_resource_dispatcher_host_delegate.h"
 
 #include "base/bind.h"
-#include "base/callback.h"
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
+#include "content/public/browser/resource_dispatcher_host.h"
 #include "content/public/browser/resource_context.h"
+#include "content/public/browser/resource_request_info.h"
 #include "content/public/common/referrer.h"
 #include "net/base/mime_util.h"
 #include "net/cookies/cookie_monster.h"
@@ -37,6 +39,7 @@
 #include "oxide_browser_context_delegate.h"
 #include "oxide_browser_platform_integration.h"
 #include "oxide_redirection_intercept_throttle.h"
+#include "oxide_resource_dispatcher_host_login_delegate.h"
 #include "oxide_web_view.h"
 
 namespace oxide {
@@ -193,8 +196,8 @@
           params.render_process_id, params.render_view_id);
   if (!rvh) {
     LOG(ERROR) << "Invalid or non-existent render_process_id & render_view_id:"
-	       << params.render_process_id << ", " << params.render_view_id
-	       << "during download url delegate dispatch";
+               << params.render_process_id << ", " << params.render_view_id
+               << "during download url delegate dispatch";
     return;
   }
 
@@ -239,6 +242,14 @@
   return BrowserPlatformIntegration::GetInstance()->LaunchURLExternally(url);
 }
 
+content::ResourceDispatcherHostLoginDelegate*
+    ResourceDispatcherHostDelegate::CreateLoginDelegate(
+    net::AuthChallengeInfo* auth_info,
+    net::URLRequest* request) {
+  // Chromium will own the delegate
+  return new ResourceDispatcherHostLoginDelegate(auth_info, request);
+}
+
 ResourceDispatcherHostDelegate::ResourceDispatcherHostDelegate() {}
 
 ResourceDispatcherHostDelegate::~ResourceDispatcherHostDelegate() {}
 
=== modified file 'shared/browser/oxide_resource_dispatcher_host_delegate.h'
--- shared/browser/oxide_resource_dispatcher_host_delegate.h	2015-06-02 15:31:02 +0000
+++ shared/browser/oxide_resource_dispatcher_host_delegate.h	2015-06-18 16:37:15 +0000
@@ -18,6 +18,7 @@
 #ifndef _OXIDE_SHARED_BROWSER_RESOURCE_DISPATCHER_HOST_DELEGATE_H_
 #define _OXIDE_SHARED_BROWSER_RESOURCE_DISPATCHER_HOST_DELEGATE_H_
 
+#include "base/callback.h"
 #include "base/macros.h"
 #include "base/strings/string16.h"
 #include "content/public/browser/resource_dispatcher_host_delegate.h"
@@ -35,6 +36,8 @@
 
 namespace oxide {
 
+class ResourceDispatcherHostLoginDelegate;
+
 class ResourceDispatcherHostDelegate
     : public content::ResourceDispatcherHostDelegate {
  public:
@@ -89,6 +92,11 @@
                               ui::PageTransition page_transition,
                               bool has_user_gesture) override;
 
+  content::ResourceDispatcherHostLoginDelegate* CreateLoginDelegate(
+      net::AuthChallengeInfo* auth_info,
+      net::URLRequest* request) override;
+
+private:
   DISALLOW_COPY_AND_ASSIGN(ResourceDispatcherHostDelegate);
 };
 
 
=== added file 'shared/browser/oxide_resource_dispatcher_host_login_delegate.cc'
--- shared/browser/oxide_resource_dispatcher_host_login_delegate.cc	1970-01-01 00:00:00 +0000
+++ shared/browser/oxide_resource_dispatcher_host_login_delegate.cc	2015-06-18 16:37:15 +0000
@@ -0,0 +1,162 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2014-2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#include "oxide_resource_dispatcher_host_login_delegate.h"
+
+#include "base/bind.h"
+#include "base/logging.h"
+#include "base/strings/utf_string_conversions.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/resource_dispatcher_host.h"
+#include "content/public/browser/resource_context.h"
+#include "content/public/browser/resource_request_info.h"
+#include "net/base/auth.h"
+#include "net/url_request/url_request.h"
+
+#include "oxide_web_view.h"
+
+namespace oxide {
+
+ResourceDispatcherHostLoginDelegate::ResourceDispatcherHostLoginDelegate(
+    net::AuthChallengeInfo* auth_info,
+    net::URLRequest* request)
+    : request_(request) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
+
+  host_ = auth_info->challenger.ToString();
+  realm_ = auth_info->realm;
+
+  WebView* webview = GetWebView(request_);
+  if (!webview) {
+    // Deny the request if we can not get access to the webview, as there is
+    // no other sensible thing to do.
+    Deny();
+    return;
+  }
+
+  content::BrowserThread::PostTask(
+      content::BrowserThread::UI,
+      FROM_HERE,
+      base::Bind(&ResourceDispatcherHostLoginDelegate::DispatchRequest,
+          this, webview));
+}
+
+ResourceDispatcherHostLoginDelegate::~ResourceDispatcherHostLoginDelegate() {}
+
+void ResourceDispatcherHostLoginDelegate::SetCancelledCallback(
+    const base::Closure& cancelled_callback) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  cancelled_callback_ = cancelled_callback;
+}
+
+void ResourceDispatcherHostLoginDelegate::OnRequestCancelled() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
+
+  request_ = nullptr;
+
+  content::BrowserThread::PostTask(
+      content::BrowserThread::UI,
+      FROM_HERE,
+      base::Bind(&ResourceDispatcherHostLoginDelegate::DispatchCancelledCallback,
+          this));
+}
+
+void ResourceDispatcherHostLoginDelegate::DispatchCancelledCallback() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  if (!cancelled_callback_.is_null()) {
+    content::BrowserThread::PostTask(
+        content::BrowserThread::UI,
+        FROM_HERE,
+        cancelled_callback_);
+  }
+}
+
+void ResourceDispatcherHostLoginDelegate::Deny() {
+  if (!content::BrowserThread::CurrentlyOn(content::BrowserThread::IO)) {
+    content::BrowserThread::PostTask(
+        content::BrowserThread::IO,
+        FROM_HERE,
+        base::Bind(&ResourceDispatcherHostLoginDelegate::Deny, this));
+    return;
+  }
+
+  if (!request_) {
+    return;
+  }
+
+  request_->CancelAuth();
+  content::ResourceDispatcherHost::Get()->ClearLoginDelegateForRequest(
+      request_);
+  request_ = nullptr;
+}
+
+void ResourceDispatcherHostLoginDelegate::Allow(const std::string &username,
+                                                const std::string &password)
+{
+  if (!content::BrowserThread::CurrentlyOn(content::BrowserThread::IO)) {
+    content::BrowserThread::PostTask(
+        content::BrowserThread::IO,
+        FROM_HERE,
+        base::Bind(&ResourceDispatcherHostLoginDelegate::Allow, this,
+                   username, password));
+    return;
+  }
+
+  if (!request_) {
+    return;
+  }
+
+  request_->SetAuth(net::AuthCredentials(base::UTF8ToUTF16(username),
+                                         base::UTF8ToUTF16(password)));
+  content::ResourceDispatcherHost::Get()->ClearLoginDelegateForRequest(
+        request_);
+  request_ = nullptr;
+}
+
+WebView* ResourceDispatcherHostLoginDelegate::GetWebView(
+    net::URLRequest* request) {
+  int processId;
+  int frameId;
+  content::ResourceRequestInfo::GetRenderFrameForRequest(request, &processId,
+                                                         &frameId);
+  content::RenderFrameHost* rfh = content::RenderFrameHost::FromID(processId,
+                                                                   frameId);
+  if (!rfh) {
+    return nullptr;
+  }
+
+  return WebView::FromRenderFrameHost(rfh);
+}
+
+void ResourceDispatcherHostLoginDelegate::DispatchRequest(WebView* webview) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  webview->HttpAuthenticationRequested(this);
+}
+
+std::string ResourceDispatcherHostLoginDelegate::Host() const {
+  return host_;
+}
+
+std::string ResourceDispatcherHostLoginDelegate::Realm() const {
+  return realm_;
+}
+
+} // namespace oxide
 
=== added file 'shared/browser/oxide_resource_dispatcher_host_login_delegate.h'
--- shared/browser/oxide_resource_dispatcher_host_login_delegate.h	1970-01-01 00:00:00 +0000
+++ shared/browser/oxide_resource_dispatcher_host_login_delegate.h	2015-06-18 16:37:15 +0000
@@ -0,0 +1,65 @@
+// vim:expandtab:shiftwidth=2:tabstop=2:
+// Copyright (C) 2014-2015 Canonical Ltd.
+
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+#ifndef _OXIDE_SHARED_BROWSER_RESOURCE_DISPATCHER_HOST_LOGIN_DELEGATE_H_
+#define _OXIDE_SHARED_BROWSER_RESOURCE_DISPATCHER_HOST_LOGIN_DELEGATE_H_
+
+#include "base/callback.h"
+#include "content/public/browser/resource_dispatcher_host_login_delegate.h"
+
+namespace net {
+class URLRequest;
+class AuthChallengeInfo;
+}
+
+namespace oxide {
+
+class ResourceDispatcherHostDelegate;
+class WebView;
+
+class ResourceDispatcherHostLoginDelegate
+    : public content::ResourceDispatcherHostLoginDelegate {
+ public:
+    ResourceDispatcherHostLoginDelegate(net::AuthChallengeInfo* auth_info,
+                                        net::URLRequest* request);
+    ~ResourceDispatcherHostLoginDelegate() override;
+    void OnRequestCancelled() override;
+
+    void Deny();
+    void Allow(const std::string& username, const std::string& password);
+
+    void SetCancelledCallback(const base::Closure& cancelled_callback);
+
+    std::string Host() const;
+    std::string Realm() const;
+
+private:
+    friend class ResourceDispatcherHostDelegate;
+    void DispatchRequest(WebView* webview);
+    void DispatchCancelledCallback();
+    WebView* GetWebView(net::URLRequest* request);
+
+    net::URLRequest* request_;
+    std::string host_;
+    std::string realm_;
+    base::Closure cancelled_callback_;
+};
+
+} // namespace oxide
+
+#endif // OXIDE_SHARED_BROWSER_RESOURCE_DISPATCHER_HOST_LOGIN_DELEGATE
+
 
=== modified file 'shared/browser/oxide_web_view.cc'
--- shared/browser/oxide_web_view.cc	2015-06-17 21:04:11 +0000
+++ shared/browser/oxide_web_view.cc	2015-06-18 16:37:15 +0000
@@ -1269,7 +1269,7 @@
   DCHECK(root_frame_.get());
 
   if (params->context && init_data_->load_params) {
-    web_contents_->GetController().LoadURLWithParams(*init_data_->load_params);    
+    web_contents_->GetController().LoadURLWithParams(*init_data_->load_params);
   }
 
   web_contents_->GetController().LoadIfNecessary();
@@ -2100,6 +2100,11 @@
                              user_agent);
 }
 
+void WebView::HttpAuthenticationRequested(
+    ResourceDispatcherHostLoginDelegate* login_delegate) {
+  client_->HttpAuthenticationRequested(login_delegate);
+}
+
 CompositorFrameHandle* WebView::GetCompositorFrameHandle() const {
   return current_compositor_frame_.get();
 }
 
=== modified file 'shared/browser/oxide_web_view.h'
--- shared/browser/oxide_web_view.h	2015-06-11 13:06:02 +0000
+++ shared/browser/oxide_web_view.h	2015-06-18 16:37:15 +0000
@@ -98,6 +98,7 @@
 class CompositorFrameHandle;
 class FilePicker;
 class JavaScriptDialog;
+class ResourceDispatcherHostLoginDelegate;
 class RenderWidgetHostView;
 class WebContextMenu;
 class WebFrame;
@@ -310,6 +311,9 @@
       const std::string& referrer,
       const std::string& user_agent);
 
+  void HttpAuthenticationRequested(
+      ResourceDispatcherHostLoginDelegate* login_delegate);
+
   CompositorFrameHandle* GetCompositorFrameHandle() const;
   void DidCommitCompositorFrame();
 
 
=== modified file 'shared/browser/oxide_web_view_client.cc'
--- shared/browser/oxide_web_view_client.cc	2015-06-04 13:21:49 +0000
+++ shared/browser/oxide_web_view_client.cc	2015-06-18 16:37:15 +0000
@@ -168,4 +168,7 @@
 
 void WebViewClient::FindInPageCountChanged() {}
 
+void WebViewClient::HttpAuthenticationRequested(
+    ResourceDispatcherHostLoginDelegate* login_delegate) {}
+
 } // namespace oxide
 
=== modified file 'shared/browser/oxide_web_view_client.h'
--- shared/browser/oxide_web_view_client.h	2015-06-04 13:21:49 +0000
+++ shared/browser/oxide_web_view_client.h	2015-06-18 16:37:15 +0000
@@ -48,6 +48,7 @@
 class CertificateError;
 class FilePicker;
 class JavaScriptDialog;
+class ResourceDispatcherHostLoginDelegate;
 class SecurityStatus;
 class WebContextMenu;
 class WebFrame;
@@ -206,6 +207,9 @@
 
   virtual void FindInPageCurrentChanged();
   virtual void FindInPageCountChanged();
+
+  virtual void HttpAuthenticationRequested(
+      ResourceDispatcherHostLoginDelegate* login_delegate);
 };
 
 } // namespace oxide
 
=== modified file 'shared/shared.gyp'
--- shared/shared.gyp	2015-06-10 13:10:39 +0000
+++ shared/shared.gyp	2015-06-18 16:37:15 +0000
@@ -370,6 +370,8 @@
         'browser/oxide_render_widget_host_view_delegate.h',
         'browser/oxide_resource_dispatcher_host_delegate.cc',
         'browser/oxide_resource_dispatcher_host_delegate.h',
+        'browser/oxide_resource_dispatcher_host_login_delegate.cc',
+        'browser/oxide_resource_dispatcher_host_login_delegate.h',
         'browser/oxide_script_message_dispatcher_browser.cc',
         'browser/oxide_script_message_dispatcher_browser.h',
         'browser/oxide_script_message_impl_browser.cc',