auth
2015-05-15
Parent:3e8964a914ef
auth/scope_test.go
Switch to a JWT approach. We're going to use a JWT as our access tokens (as discussed in &yet's excellent post https://blog.andyet.com/2015/05/12/micro-services-user-info-and-auth and my ensuing conversation with Fritzy). The benefit of this approach is that we can do authentication and even some authorization without touching the database at all. The drawback is that we can no longer revoke access tokens, only the refresh tokens that grant the access tokens. We need a new config variable to set our private key, used to sign the JWT. We get to remove our token handlers, as we no longer can revoke tokens, so there's no purpose in getting information about it or listing them. Our tokenStore revokeToken gets to be simplified, as it will only ever be used for refresh tokens now. We also updated our postgres and memstore implementations. We added a helper method for generating the signed "access token" (our JWT) and started using it in the places where we're creating a Token. We get to remove the `revoked` SQL column for the tokens table, and rename the `refresh_revoked` column to just be `revoked`. We shortened our access token expiration to 15 minutes instead of an hour, to deal with the token not being revokable.
1 package auth
3 import "os"
4 import "testing"
6 func init() {
7 if os.Getenv("PG_TEST_DB") != "" {
8 p, err := NewPostgres(os.Getenv("PG_TEST_DB"))
9 if err != nil {
10 panic(err)
11 }
12 scopeStores = append(scopeStores, &p)
13 }
14 }
16 var scopeStores = []scopeStore{NewMemstore()}
18 func compareScopes(scope1, scope2 Scope) (success bool, field string, val1, val2 interface{}) {
19 if scope1.ID != scope2.ID {
20 return false, "ID", scope1.ID, scope2.ID
21 }
22 if scope1.Name != scope2.Name {
23 return false, "Name", scope1.Name, scope2.Name
24 }
25 if scope1.Description != scope2.Description {
26 return false, "Description", scope1.Description, scope2.Description
27 }
28 return true, "", nil, nil
29 }
31 func TestScopeInScopeStore(t *testing.T) {
32 scope := Scope{
33 ID: "testscope",
34 Name: "Test Scope",
35 Description: "Access to testing data.",
36 }
37 scope2 := Scope{
38 ID: "testscope2",
39 Name: "Test Scope 2",
40 Description: "Access to minions.",
41 }
42 scope3 := Scope{
43 ID: "testscope3",
44 Name: "Test Scope 3",
45 Description: "Access to bananas.",
46 }
47 updatedName := "Updated Scope"
48 updatedDescription := "An updated scope."
49 update := ScopeChange{
50 Name: &updatedName,
51 }
52 update2 := ScopeChange{
53 Description: &updatedDescription,
54 }
55 update3 := ScopeChange{
56 Name: &updatedName,
57 Description: &updatedDescription,
58 }
59 for _, store := range scopeStores {
60 context := Context{scopes: store}
61 retrieved, err := context.GetScopes([]string{scope.ID})
62 if len(retrieved) != 0 {
63 t.Logf("%+v", retrieved)
64 t.Errorf("Expected %d results, got %d from %T", 0, len(retrieved), store)
65 }
66 err = context.CreateScopes([]Scope{scope})
67 if err != nil {
68 t.Errorf("Error saving scope to %T: %s", store, err)
69 }
70 err = context.CreateScopes([]Scope{scope})
71 if err != ErrScopeAlreadyExists {
72 t.Errorf("Expected ErrScopeAlreadyExists, got %s instead for %T", err, store)
73 }
74 retrieved, err = context.GetScopes([]string{scope.ID})
75 if err != nil {
76 t.Errorf("Unexpected error retrieving scopes from %T: %+v", store, err)
77 }
78 if len(retrieved) != 1 {
79 t.Logf("%+v", retrieved)
80 t.Errorf("Expected %d results, got %d from %T", 1, len(retrieved), store)
81 }
82 success, field, val1, val2 := compareScopes(scope, retrieved[0])
83 if !success {
84 t.Errorf("Expected %s to be %+v, got %+v from %T", field, val1, val2, store)
85 }
86 err = context.CreateScopes([]Scope{scope2, scope3})
87 if err != nil {
88 t.Errorf("Unexpected error trying to create scope2 and scope3 in %T: %+v", store, err)
89 }
90 retrieved, err = context.GetScopes([]string{scope.ID, scope2.ID, scope3.ID})
91 if err != nil {
92 t.Errorf("Unexpected error retrieving scopes from %T: %+v", store, err)
93 }
94 if len(retrieved) != 3 {
95 t.Logf("%+v", retrieved)
96 t.Errorf("Expected %d results, got %d from %T", 3, len(retrieved), store)
97 }
98 for pos, s := range []Scope{scope, scope2, scope3} {
99 success, field, val1, val2 = compareScopes(s, retrieved[pos])
100 if !success {
101 t.Errorf("Expected %s to be %+v for scope %s, got %+v from %T", field, val1, s.ID, val2, store)
102 }
103 }
104 err = context.UpdateScope(scope.ID, update)
105 if err != nil {
106 t.Errorf("Unexpected error updating scope in %T: %+v", store, err)
107 }
108 scope.ApplyChange(update)
109 err = context.UpdateScope(scope2.ID, update2)
110 if err != nil {
111 t.Errorf("Unexpected error updating scope in %T: %+v", store, err)
112 }
113 scope2.ApplyChange(update2)
114 err = context.UpdateScope(scope3.ID, update3)
115 if err != nil {
116 t.Errorf("Unexpected error updating scope in %T: %+v", store, err)
117 }
118 scope3.ApplyChange(update3)
119 retrieved, err = context.ListScopes()
120 if err != nil {
121 t.Errorf("Unexpected error retrieving scopes from %T: %+v", store, err)
122 }
123 if len(retrieved) != 3 {
124 t.Logf("%+v", retrieved)
125 t.Errorf("Expected %d results, got %d from %T", 3, len(retrieved), store)
126 }
127 for pos, s := range []Scope{scope, scope2, scope3} {
128 success, field, val1, val2 = compareScopes(s, retrieved[pos])
129 if !success {
130 t.Errorf("Expected %s to be %+v for scope %s, got %+v from %T", field, val1, s.ID, val2, store)
131 }
132 }
133 err = context.RemoveScopes([]string{scope.ID, scope2.ID, scope3.ID})
134 if err != nil {
135 t.Errorf("Unexpected error removing scopes from %T: %+v", store, err)
136 }
137 retrieved, err = context.ListScopes()
138 if err != nil {
139 t.Errorf("Unexpected error retrieving scopes from %T: %+v", store, err)
140 }
141 if len(retrieved) != 0 {
142 t.Logf("%+v", retrieved)
143 t.Errorf("Expected %d results, got %d from %T", 0, len(retrieved), store)
144 }
145 err = context.RemoveScopes([]string{scope.ID})
146 if err == nil {
147 t.Errorf("No error returned removing non-existent scopes from %T", store)
148 }
149 if err != ErrScopeNotFound {
150 t.Errorf("Unexpected error removing non-existent scopes from %T: %+v", store, err)
151 }
152 err = context.UpdateScope(scope.ID, update)
153 if err != ErrScopeNotFound {
154 t.Errorf("Unexpected error updating non-existent scopes from %T: %+v", store, err)
155 }
156 }
157 }