auth
auth/oauth2_test.go
Write Session tests. Add loginURI as a property to our Context, to keep track of where users should be redirected to log in. Implement the sessionStore in the memstore to let us test with Sessions. Catch when the HTTP Basic Auth header doesn't include two parts, rather than panicking. Return an ErrInvalidAuthFormat. Clean up the error handling for checkCookie to be cleaner. Log unexpected errors from request.Cookie. Stop checking for cookie expiration times--those aren't sent to the server, so we'll never get a valid session if we look for them. Add a helper to build a login redirect URI--a URI the user can be redirected to that has a URL-encoded URL to redirect the user back to after a successful login. Add a wrapper to wrap our Context into HTTP handlers. Create a RegisterOAuth2 helper that adds the OAuth2 endpoints to a Gorilla/mux router. Redirect users to the login page when they have no session set or an invalid session. Return a server error when we can't check our cookie for whatever reason. Log errors. Add sessions to our OAuth2 tests so the tests stop failing--the session check was interfering with them. Add a test for our getBasicAuth helper to ensure that we're parsing basic auth correctly. Add an ErrSessionAlreadyExists error to be returned when a session has an ID conflict. Test that our memstore implementation of the sessionStore works as intended..
1.1 --- a/oauth2_test.go Tue Nov 11 21:30:47 2014 -0500 1.2 +++ b/oauth2_test.go Tue Nov 18 03:28:14 2014 -0500 1.3 @@ -34,6 +34,7 @@ 1.4 grants: store, 1.5 profiles: store, 1.6 tokens: store, 1.7 + sessions: store, 1.8 } 1.9 client := Client{ 1.10 ID: uuid.NewID(), 1.11 @@ -62,10 +63,23 @@ 1.12 if err != nil { 1.13 t.Fatal("Can't store endpoint:", err) 1.14 } 1.15 + session := Session{ 1.16 + ID: "testsession", 1.17 + Active: true, 1.18 + } 1.19 + err = testContext.CreateSession(session) 1.20 + if err != nil { 1.21 + t.Fatal("Can't store session:", err) 1.22 + } 1.23 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil) 1.24 if err != nil { 1.25 t.Fatal("Can't build request:", err) 1.26 } 1.27 + cookie := &http.Cookie{ 1.28 + Name: authCookieName, 1.29 + Value: session.ID, 1.30 + } 1.31 + req.AddCookie(cookie) 1.32 for i := 0; i < 1<<3; i++ { 1.33 w := httptest.NewRecorder() 1.34 params := url.Values{} 1.35 @@ -139,6 +153,7 @@ 1.36 grants: store, 1.37 profiles: store, 1.38 tokens: store, 1.39 + sessions: store, 1.40 } 1.41 client := Client{ 1.42 ID: uuid.NewID(), 1.43 @@ -151,6 +166,14 @@ 1.44 if err != nil { 1.45 t.Fatal("Can't store client:", err) 1.46 } 1.47 + session := Session{ 1.48 + ID: "testsession", 1.49 + Active: true, 1.50 + } 1.51 + err = testContext.CreateSession(session) 1.52 + if err != nil { 1.53 + t.Fatal("Can't store session:", err) 1.54 + } 1.55 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil) 1.56 if err != nil { 1.57 t.Fatal("Can't build request:", err) 1.58 @@ -160,6 +183,11 @@ 1.59 params.Set("response_type", "code") 1.60 params.Set("redirect_uri", "https://test.secondbit.org/") 1.61 req.URL.RawQuery = params.Encode() 1.62 + cookie := &http.Cookie{ 1.63 + Name: authCookieName, 1.64 + Value: session.ID, 1.65 + } 1.66 + req.AddCookie(cookie) 1.67 GetGrantHandler(w, req, testContext) 1.68 if w.Code != http.StatusBadRequest { 1.69 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code) 1.70 @@ -198,6 +226,7 @@ 1.71 grants: store, 1.72 profiles: store, 1.73 tokens: store, 1.74 + sessions: store, 1.75 } 1.76 client := Client{ 1.77 ID: uuid.NewID(), 1.78 @@ -214,10 +243,23 @@ 1.79 if err != nil { 1.80 t.Fatal("Can't store client:", err) 1.81 } 1.82 + session := Session{ 1.83 + ID: "testsession", 1.84 + Active: true, 1.85 + } 1.86 + err = testContext.CreateSession(session) 1.87 + if err != nil { 1.88 + t.Fatal("Can't store session:", err) 1.89 + } 1.90 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil) 1.91 if err != nil { 1.92 t.Fatal("Can't build request:", err) 1.93 } 1.94 + cookie := &http.Cookie{ 1.95 + Name: authCookieName, 1.96 + Value: session.ID, 1.97 + } 1.98 + req.AddCookie(cookie) 1.99 w := httptest.NewRecorder() 1.100 params := url.Values{} 1.101 params.Set("response_type", "code") 1.102 @@ -291,6 +333,7 @@ 1.103 grants: store, 1.104 profiles: store, 1.105 tokens: store, 1.106 + sessions: store, 1.107 } 1.108 client := Client{ 1.109 ID: uuid.NewID(), 1.110 @@ -319,10 +362,23 @@ 1.111 if err != nil { 1.112 t.Fatal("Can't store endpoint:", err) 1.113 } 1.114 + session := Session{ 1.115 + ID: "testsession", 1.116 + Active: true, 1.117 + } 1.118 + err = testContext.CreateSession(session) 1.119 + if err != nil { 1.120 + t.Fatal("Can't store session:", err) 1.121 + } 1.122 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil) 1.123 if err != nil { 1.124 t.Fatal("Can't build request:", err) 1.125 } 1.126 + cookie := &http.Cookie{ 1.127 + Name: authCookieName, 1.128 + Value: session.ID, 1.129 + } 1.130 + req.AddCookie(cookie) 1.131 params := url.Values{} 1.132 params.Set("response_type", "totally not code") 1.133 params.Set("client_id", client.ID.String()) 1.134 @@ -384,6 +440,7 @@ 1.135 grants: store, 1.136 profiles: store, 1.137 tokens: store, 1.138 + sessions: store, 1.139 } 1.140 client := Client{ 1.141 ID: uuid.NewID(), 1.142 @@ -412,10 +469,23 @@ 1.143 if err != nil { 1.144 t.Fatal("Can't store endpoint:", err) 1.145 } 1.146 + session := Session{ 1.147 + ID: "testsession", 1.148 + Active: true, 1.149 + } 1.150 + err = testContext.CreateSession(session) 1.151 + if err != nil { 1.152 + t.Fatal("Can't store session:", err) 1.153 + } 1.154 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil) 1.155 if err != nil { 1.156 t.Fatal("Can't build request:", err) 1.157 } 1.158 + cookie := &http.Cookie{ 1.159 + Name: authCookieName, 1.160 + Value: session.ID, 1.161 + } 1.162 + req.AddCookie(cookie) 1.163 params := url.Values{} 1.164 params.Set("response_type", "code") 1.165 params.Set("client_id", client.ID.String()) 1.166 @@ -449,3 +519,36 @@ 1.167 t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI.String(), red.String()) 1.168 } 1.169 } 1.170 + 1.171 +func TestGetBasicAuth(t *testing.T) { 1.172 + tests := map[string]struct { 1.173 + un string 1.174 + pass string 1.175 + err error 1.176 + }{ 1.177 + "Basic dGVzdHVzZXI6cGFzc3dvcmQx": {"testuser", "password1", nil}, 1.178 + "": {"", "", ErrNoAuth}, 1.179 + "dGVzdHVzZXI6cGFzc3dvcmQx": {"", "", ErrInvalidAuthFormat}, 1.180 + "Basic _*&^##$@#$@&!!@": {"", "", ErrInvalidAuthFormat}, 1.181 + "Basic abcdefgh": {"", "", ErrInvalidAuthFormat}, 1.182 + "Basic dXNlcjo=": {"user", "", nil}, 1.183 + } 1.184 + 1.185 + for header, test := range tests { 1.186 + req, err := http.NewRequest("GET", "https://auth.secondbit.org", nil) 1.187 + if err != nil { 1.188 + t.Error("Unexpected error creating base request:", err) 1.189 + } 1.190 + req.Header.Set("Authorization", header) 1.191 + un, pass, err := getBasicAuth(req) 1.192 + if un != test.un { 1.193 + t.Errorf(`Expected header "%s" to return username "%s", got "%s"`, header, test.un, un) 1.194 + } 1.195 + if pass != test.pass { 1.196 + t.Errorf(`Expected header "%s" to return password "%s", got "%s"`, header, test.pass, pass) 1.197 + } 1.198 + if err != test.err { 1.199 + t.Errorf(`Expected header "%s" to return error "%s", got "%s"`, header, test.err, err) 1.200 + } 1.201 + } 1.202 +}