Merge lp:~xnox/launchpad/devel into lp:launchpad

[Dimitri John Ledkov]

[William Grant (wgrant)]

This seems to remove the test that verifies the behaviour that every existing Launchpad API client relies on. Why do you want to change the behaviour in the first place?

review: Needs Fixing (code)

[Dimitri John Ledkov (xnox)]

> This seems to remove the test that verifies the behaviour that every existing
> Launchpad API client relies on. Why do you want to change the behaviour in the
> first place?

Right, i'll readd it back again. At the moment it exposes a bug though, since header-signature type doesn't appear to invalidate request token, thus one can exchange for access token unlimited amount of times. Only body-signature type seems to correctly raise 401 upon subsequent requests.

So at the moment the test change exposes buggy behaviour with header-signature. I'll make sure to re-introduce body-signature tests and test header-signatures separately.

----------------------------------------------------------------------
File "lib/lp/services/oauth/stories/access-token.txt", line 42, in access-token.txt
Failed example:
    auth_browser.open(
        'http://launchpad.dev/+access-token')
Differences (ndiff with -expected +actual):
    - Traceback (most recent call last):
    - ...
    - HTTPError: HTTP Error 401: Unauthorized

[Dimitri John Ledkov (xnox)]

Settings status to "work in progress" appropriately.

[lp:~xnox/launchpad/devel]

16989. By Dimitri John Ledkov on 2014-04-24

Support oauth_callback from header authentication

16990. By Dimitri John Ledkov on 2014-04-25

OAuth Revert access-token.txt to current, add header-signature story.

16991. By Dimitri John Ledkov on 2014-04-25

Revert callback change for now

[Dimitri John Ledkov (xnox)]

Barry, help! =) what's going on wrong here? See the added story, run with:

  ./bin/test -vvct access-token-header

It should fail at second token exchange, but it doesn't fail and instead allows exchanging request token over and over again.

Unmerged revisions

16991. By Dimitri John Ledkov on 2014-04-25

Revert callback change for now

16990. By Dimitri John Ledkov on 2014-04-25

OAuth Revert access-token.txt to current, add header-signature story.

16989. By Dimitri John Ledkov on 2014-04-24

Support oauth_callback from header authentication

16988. By Dimitri John Ledkov on 2014-04-24

Change access-token story to use header authentication.

16987. By Dimitri John Ledkov on 2014-04-24

Fix tests file references in the doctests comment.

16986. By Dimitri John Ledkov on 2014-04-22

Accept oauth signature from either headers or body in +access-token requests.

=== modified file 'lib/lp/services/oauth/browser/__init__.py'
--- lib/lp/services/oauth/browser/__init__.py	2013-04-11 02:12:09 +0000
+++ lib/lp/services/oauth/browser/__init__.py	2014-04-25 11:04:15 +0000
@@ -416,7 +416,7 @@
         (or is not associated with the consumer), the signature does not match
         or no permission has been granted by the user, respond with a 401.
         """
-        form = self.request.form
+        form = get_oauth_authorization(self.request)        
         consumer = getUtility(IOAuthConsumerSet).getByKey(
             form.get('oauth_consumer_key'))
 

=== modified file 'lib/lp/services/oauth/doc/oauth.txt'
--- lib/lp/services/oauth/doc/oauth.txt	2014-01-30 15:04:06 +0000
+++ lib/lp/services/oauth/doc/oauth.txt	2014-04-25 11:04:15 +0000
@@ -1,7 +1,7 @@
 = OAuth =
 
 Most of the OAuth doctests have been converted into unit tests and
-moved to test_oauth_tokens.py
+moved to test_tokens.py
 
 == Nonces and timestamps ==
 

=== added file 'lib/lp/services/oauth/stories/access-token-header.txt'
--- lib/lp/services/oauth/stories/access-token-header.txt	1970-01-01 00:00:00 +0000
+++ lib/lp/services/oauth/stories/access-token-header.txt	2014-04-25 11:04:15 +0000
@@ -0,0 +1,66 @@
+= Exchanging a request token for an access token, using headers =
+
+Once the user has logged into Launchpad and granted access to the
+consumer, the request token is eligible for being exchanged for an
+access token.
+
+This is boiler-plate from access-token.txt to begin with
+
+    # First we create a new request token and review it.
+    >>> from zope.component import getUtility
+    >>> from lp.services.oauth.interfaces import IOAuthConsumerSet
+    >>> from lp.services.webapp.interfaces import OAuthPermission
+    >>> from lp.registry.interfaces.person import IPersonSet
+    >>> from lp.registry.interfaces.product import IProductSet
+    >>> from lp.testing import login, logout
+    >>> login('[e-mail]')
+    >>> consumer = getUtility(IOAuthConsumerSet).getByKey('foobar123451432')
+    >>> token = consumer.newRequestToken()
+    >>> salgado = getUtility(IPersonSet).getByName('salgado')
+    >>> token.review(salgado, OAuthPermission.WRITE_PUBLIC)
+    >>> logout()
+
+    >>> import time
+    >>> from urllib import urlencode
+    >>> data = dict(
+    ...     oauth_consumer_key='foobar123451432',
+    ...     oauth_version='1.0',
+    ...     oauth_token=token.key,
+    ...     oauth_signature_method='PLAINTEXT',
+    ...     oauth_signature='&'.join([consumer.secret, token.secret]),
+    ...     oauth_timestamp=time.time(),
+    ...     oauth_nonce='4572616e48616d6d65724c61686176')
+
+Now, let's do the exchange using the OAuth 1.0 preferred way, by
+setting Authentication Header, instead of urlencoding oauth_
+parameters in the body of the request.
+
+    >>> auth = 'OAuth '+', '.join(['%s="%s"' % item for item in data.items()])
+    >>> auth_browser = setupBrowser(auth=auth)
+    >>> auth_browser.open(
+    ...     'http://launchpad.dev/+access-token')
+
+    >>> print auth_browser.contents
+    oauth_token=...&oauth_token_secret=...
+
+Yeah, token exchange was successful! Let's try again!
+
+    >>> auth_browser.open(
+    ...     'http://launchpad.dev/+access-token')
+
+    >>> print auth_browser.contents
+    oauth_token=...&oauth_token_secret=...
+
+Wait a minute, this sounds like a broken record ( or a PCD song "wait
+a minute"). I expected a 401 here! Let's assert that:
+
+    >>> auth_browser.open(
+    ...     'http://launchpad.dev/+access-token')
+    Traceback (most recent call last):
+    ...
+    HTTPError: HTTP Error 401: Unauthorized
+
+Bugger! +access-token essentially calls 'access_token =
+token.createAccessToken()' which does call 'self.destroySelf()' which
+totally works with body OAuth signature type in access-token.txt
+story, but not with my one-liner patch to enable header signatures.