auth

     1.1 --- a/http.go	Sun Nov 02 23:01:02 2014 -0500
     1.2 +++ b/http.go	Mon Nov 03 01:37:09 2014 -0500
     1.3 @@ -92,7 +92,9 @@
     1.4  		if len(endpoints) != 1 {
     1.5  			validURI = false
     1.6  		} else {
     1.7 -			redirectURI = endpoints[0].URI.String()
     1.8 +			u := endpoints[0].URI // Copy it here to avoid grabbing a pointer to the memstore
     1.9 +			redirectURI = u.String()
    1.10 +			redirectURL = &u
    1.11  		}
    1.12  	} else {
    1.13  		validURI = false
    1.14 @@ -129,18 +131,24 @@
    1.15  			}
    1.16  			err := context.SaveGrant(grant)
    1.17  			if err != nil {
    1.18 -				redirectURL.Query().Add("error", "server_error")
    1.19 -				redirectURL.Query().Add("state", state)
    1.20 +				q := redirectURL.Query()
    1.21 +				q.Add("error", "server_error")
    1.22 +				q.Add("state", state)
    1.23 +				redirectURL.RawQuery = q.Encode()
    1.24  				http.Redirect(w, r, redirectURL.String(), http.StatusFound)
    1.25  				return
    1.26  			}
    1.27 -			redirectURL.Query().Add("code", code)
    1.28 -			redirectURL.Query().Add("state", state)
    1.29 +			q := redirectURL.Query()
    1.30 +			q.Add("code", code)
    1.31 +			q.Add("state", state)
    1.32 +			redirectURL.RawQuery = q.Encode()
    1.33  			http.Redirect(w, r, redirectURL.String(), http.StatusFound)
    1.34  			return
    1.35  		}
    1.36 -		redirectURL.Query().Add("error", "access_denied")
    1.37 -		redirectURL.Query().Add("state", state)
    1.38 +		q := redirectURL.Query()
    1.39 +		q.Add("error", "access_denied")
    1.40 +		q.Add("state", state)
    1.41 +		redirectURL.RawQuery = q.Encode()
    1.42  		http.Redirect(w, r, redirectURL.String(), http.StatusFound)
    1.43  		return
    1.44  	}

     2.1 --- a/http_test.go	Sun Nov 02 23:01:02 2014 -0500
     2.2 +++ b/http_test.go	Mon Nov 03 01:37:09 2014 -0500
     2.3 @@ -1,7 +1,9 @@
     2.4  package auth
     2.5  
     2.6  import (
     2.7 +	"bytes"
     2.8  	"html/template"
     2.9 +	"io/ioutil"
    2.10  	"net/http"
    2.11  	"net/http/httptest"
    2.12  	"net/url"
    2.13 @@ -80,6 +82,9 @@
    2.14  			params.Set("state", "my super secure state string")
    2.15  		}
    2.16  		req.URL.RawQuery = params.Encode()
    2.17 +		req.Method = "GET"
    2.18 +		req.Body = nil
    2.19 +		req.Header.Del("Content-Type")
    2.20  		GetGrantHandler(w, req, testContext)
    2.21  		if w.Code != http.StatusOK {
    2.22  			t.Errorf("Expected status code to be %d, got %d for %s", http.StatusOK, w.Code, req.URL.String())
    2.23 @@ -87,6 +92,41 @@
    2.24  		if w.Body.String() != "Get auth grant" {
    2.25  			t.Errorf("Expected body to be `%s`, got `%s` for %s", "Get auth grant", w.Body.String(), req.URL.String())
    2.26  		}
    2.27 +		req.Method = "POST"
    2.28 +		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    2.29 +		w = httptest.NewRecorder()
    2.30 +		data := url.Values{}
    2.31 +		data.Set("grant", "approved")
    2.32 +		body := bytes.NewBufferString(data.Encode())
    2.33 +		req.Body = ioutil.NopCloser(body)
    2.34 +		GetGrantHandler(w, req, testContext)
    2.35 +		if w.Code != http.StatusFound {
    2.36 +			t.Errorf("Expected status code to be %d, got %d for %s", http.StatusFound, w.Code, req.URL.String())
    2.37 +		}
    2.38 +		redirectedTo := w.Header().Get("Location")
    2.39 +		red, err := url.Parse(redirectedTo)
    2.40 +		if err != nil {
    2.41 +			t.Fatalf(`Being redirected to a non-URL "%s" threw error "%s" for "%s"\n`, redirectedTo, err, req.URL.String())
    2.42 +		}
    2.43 +		t.Log("Redirected to", redirectedTo)
    2.44 +		if red.Query().Get("code") == "" {
    2.45 +			t.Fatalf(`Expected code param in redirect URL to be set, but it wasn't for %s`, req.URL.String())
    2.46 +		}
    2.47 +		if grant, err := testContext.GetGrant(red.Query().Get("code")); err != nil {
    2.48 +			t.Fatalf(`Unexpected error "%s: retrieving the grant "%s" supplied in the redirect URL for %s`, err, grant, req.URL.String())
    2.49 +		}
    2.50 +		err = testContext.DeleteGrant(red.Query().Get("code"))
    2.51 +		if err != nil {
    2.52 +			t.Log(`Unexpected error "%s" deleting grant "%s" for %s`, err, red.Query().Get("code"), req.URL.String())
    2.53 +		}
    2.54 +		stripParam("code", red)
    2.55 +		if red.Query().Get("state") != params.Get("state") {
    2.56 +			t.Errorf(`Expected state param in redirect URL to be "%s", got "%s" for %s`, params.Get("state"), red.Query().Get("state"), req.URL.String())
    2.57 +		}
    2.58 +		stripParam("state", red)
    2.59 +		if red.String() != endpoint.URI.String() {
    2.60 +			t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI.String(), red.String())
    2.61 +		}
    2.62  	}
    2.63  }
    2.64  
    2.65 @@ -334,3 +374,78 @@
    2.66  		t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI.String(), red.String())
    2.67  	}
    2.68  }
    2.69 +
    2.70 +func TestGetGrantCodeDenied(t *testing.T) {
    2.71 +	t.Parallel()
    2.72 +	store := NewMemstore()
    2.73 +	testContext := Context{
    2.74 +		template: template.Must(template.New(getGrantTemplateName).Parse("{{ .error }}")),
    2.75 +		clients:  store,
    2.76 +		grants:   store,
    2.77 +		profiles: store,
    2.78 +		tokens:   store,
    2.79 +	}
    2.80 +	client := Client{
    2.81 +		ID:      uuid.NewID(),
    2.82 +		Secret:  "super secret!",
    2.83 +		OwnerID: uuid.NewID(),
    2.84 +		Name:    "My test client",
    2.85 +		Logo:    "https://secondbit.org/logo.png",
    2.86 +		Website: "https://secondbit.org",
    2.87 +		Type:    "public",
    2.88 +	}
    2.89 +	uri, err := url.Parse("https://test.secondbit.org/redirect")
    2.90 +	if err != nil {
    2.91 +		t.Fatal("Can't parse URL:", err)
    2.92 +	}
    2.93 +	endpoint := Endpoint{
    2.94 +		ID:       uuid.NewID(),
    2.95 +		ClientID: client.ID,
    2.96 +		URI:      *uri,
    2.97 +		Added:    time.Now(),
    2.98 +	}
    2.99 +	err = testContext.SaveClient(client)
   2.100 +	if err != nil {
   2.101 +		t.Fatal("Can't store client:", err)
   2.102 +	}
   2.103 +	err = testContext.AddEndpoint(client.ID, endpoint)
   2.104 +	if err != nil {
   2.105 +		t.Fatal("Can't store endpoint:", err)
   2.106 +	}
   2.107 +	req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
   2.108 +	if err != nil {
   2.109 +		t.Fatal("Can't build request:", err)
   2.110 +	}
   2.111 +	params := url.Values{}
   2.112 +	params.Set("response_type", "code")
   2.113 +	params.Set("client_id", client.ID.String())
   2.114 +	params.Set("redirect_uri", endpoint.URI.String())
   2.115 +	params.Set("scope", "testscope")
   2.116 +	params.Set("state", "my super secure state string")
   2.117 +	data := url.Values{}
   2.118 +	data.Set("grant", "denied")
   2.119 +	req.URL.RawQuery = params.Encode()
   2.120 +	req.Body = ioutil.NopCloser(bytes.NewBufferString(data.Encode()))
   2.121 +	req.Method = "POST"
   2.122 +	w := httptest.NewRecorder()
   2.123 +	GetGrantHandler(w, req, testContext)
   2.124 +	if w.Code != http.StatusFound {
   2.125 +		t.Errorf("Expected status code to be %d, got %d", http.StatusFound, w.Code)
   2.126 +	}
   2.127 +	redirectedTo := w.Header().Get("Location")
   2.128 +	red, err := url.Parse(redirectedTo)
   2.129 +	if err != nil {
   2.130 +		t.Fatalf("Being redirected to a non-URL (%s) threw error: %s\n", redirectedTo, err)
   2.131 +	}
   2.132 +	if red.Query().Get("error") != "access_denied" {
   2.133 +		t.Errorf(`Expected error param in redirect URL to be "%s", got "%s"`, "access_denied", red.Query().Get("error"))
   2.134 +	}
   2.135 +	stripParam("error", red)
   2.136 +	if red.Query().Get("state") != params.Get("state") {
   2.137 +		t.Errorf(`Expected state param in redirect URL to be "%s", got "%s"`, params.Get("state"), red.Query().Get("state"))
   2.138 +	}
   2.139 +	stripParam("state", red)
   2.140 +	if red.String() != endpoint.URI.String() {
   2.141 +		t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI.String(), red.String())
   2.142 +	}
   2.143 +}