Additional OAuth2 tests

google_apis/gaia/fake_gaia.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "google_apis/gaia/fake_gaia.h"
 
 #include <vector>
 
 #include "base/base_paths.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
+#include "base/memory/linked_ptr.h"
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "net/base/url_util.h"
+#include "net/cookies/parsed_cookie.h"
 #include "net/http/http_status_code.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "url/url_parse.h"
 
 #define REGISTER_RESPONSE_HANDLER(url, method) \
   request_handlers_.insert(std::make_pair( \
         url.path(), base::Bind(&FakeGaia::method, base::Unretained(this))))
 
 #define REGISTER_PATH_RESPONSE_HANDLER(path, method) \
   request_handlers_.insert(std::make_pair( \
         path, base::Bind(&FakeGaia::method, base::Unretained(this))))
 
 using namespace net::test_server;
 
 namespace {
 
 const base::FilePath::CharType kServiceLogin[] =
     FILE_PATH_LITERAL("google_apis/test/service_login.html");
 
 // OAuth2 Authentication header value prefix.
 const char kAuthHeaderBearer[] = "Bearer ";
 const char kAuthHeaderOAuth[] = "OAuth ";
 
+typedef std::map<std::string, std::string> CookieMap;
+
+// Parses cookie name-value map our of |request|.
+CookieMap GetRequestCookies(const HttpRequest& request) {
+  CookieMap result;
+  std::map<std::string, std::string>::const_iterator iter =
+           request.headers.find("Cookie");
+  if (iter != request.headers.end()) {
+    std::vector<std::string> cookie_nv_pairs;
+    base::SplitString(iter->second, ' ', &cookie_nv_pairs);
+    for(std::vector<std::string>::const_iterator cookie_line =
+            cookie_nv_pairs.begin();
+        cookie_line != cookie_nv_pairs.end();
+        ++cookie_line) {
+      std::vector<std::string> name_value;
+      base::SplitString(*cookie_line, '=', &name_value);
+      if (name_value.size() != 2)
+        continue;
+
+      std::string value = name_value[1];
+      if (value.size() && value[value.size() - 1] == ';')
+        value = value.substr(0, value.size() -1);
+
+      result.insert(std::make_pair(name_value[0], value));
+    }
+  }
+  return result;
+}
+
+// Extracts the |access_token| from authorization header of |request|.
+bool GetAccessToken(const HttpRequest& request,
+                    const char* auth_token_prefix,
+                    std::string* access_token) {
+  std::map<std::string, std::string>::const_iterator auth_header_entry =
+      request.headers.find("Authorization");
+  if (auth_header_entry != request.headers.end()) {
+    if (StartsWithASCII(auth_header_entry->second, auth_token_prefix, true)) {
+      *access_token = auth_header_entry->second.substr(
+          strlen(auth_token_prefix));
+      return true;
+    }
+  }
+
+  return false;
+}
+
 }
 
 FakeGaia::AccessTokenInfo::AccessTokenInfo()
   : expires_in(3600) {}
 
 FakeGaia::AccessTokenInfo::~AccessTokenInfo() {}
 
+FakeGaia::MergeSessionParams::MergeSessionParams() {
+}
+
+FakeGaia::MergeSessionParams::~MergeSessionParams() {
+}
+
 FakeGaia::FakeGaia() {
   base::FilePath source_root_dir;
   PathService::Get(base::DIR_SOURCE_ROOT, &source_root_dir);
   CHECK(base::ReadFileToString(
       source_root_dir.Append(base::FilePath(kServiceLogin)),
       &service_login_response_));
 }
 
 FakeGaia::~FakeGaia() {}
 
-void FakeGaia::SetAuthTokens(const std::string& auth_code,
-                             const std::string& refresh_token,
-                             const std::string& access_token,
-                             const std::string& gaia_uber_token,
-                             const std::string& session_sid_cookie,
-                             const std::string& session_lsid_cookie) {
-  fake_auth_code_ = auth_code;
-  fake_refresh_token_ = refresh_token;
-  fake_access_token_ = access_token;
-  fake_gaia_uber_token_ = gaia_uber_token;
-  fake_session_sid_cookie_ = session_sid_cookie;
-  fake_session_lsid_cookie_ = session_lsid_cookie;
+void FakeGaia::SetMergeSessionParams(
+    const MergeSessionParams& params) {
+  merge_session_params_ = params;
 }
 
 void FakeGaia::Initialize() {
   GaiaUrls* gaia_urls = GaiaUrls::GetInstance();
   // Handles /ServiceLogin GAIA call.
   REGISTER_RESPONSE_HANDLER(
       gaia_urls->service_login_url(), HandleServiceLogin);
 
   // Handles /ServiceLoginAuth GAIA call.
   REGISTER_RESPONSE_HANDLER(
@@ skipping 23 matching lines @@
   REGISTER_RESPONSE_HANDLER(
       gaia_urls->oauth2_token_info_url(), HandleTokenInfo);
 
   // Handles /SSO GAIA call (not GAIA, made up for SAML tests).
   REGISTER_PATH_RESPONSE_HANDLER("/SSO", HandleSSO);
 }
 
 void FakeGaia::HandleProgramaticAuth(
     const HttpRequest& request,
     BasicHttpResponse* http_response) {
+  http_response->set_code(net::HTTP_UNAUTHORIZED);
+  if (merge_session_params_.auth_code.empty()) {
+    http_response->set_code(net::HTTP_BAD_REQUEST);
+    return;
+  }
+
   GaiaUrls* gaia_urls = GaiaUrls::GetInstance();
   std::string scope;
   if (!GetQueryParameter(request.content, "scope", &scope) ||
       gaia_urls->oauth1_login_scope() != scope) {
-    http_response->set_code(net::HTTP_BAD_REQUEST);
+    return;
+  }
+
+  CookieMap cookies = GetRequestCookies(request);
+  CookieMap::const_iterator sid_iter = cookies.find("SID");
+  if (sid_iter == cookies.end() ||
+      sid_iter->second != merge_session_params_.auth_sid_cookie) {
+    LOG(ERROR) << "/o/oauth2/programmatic_auth missing SID cookie";
+    return;
+  }
+  CookieMap::const_iterator lsid_iter = cookies.find("LSID");
+  if (lsid_iter == cookies.end() ||
+      lsid_iter->second != merge_session_params_.auth_lsid_cookie) {
+    LOG(ERROR) << "/o/oauth2/programmatic_auth missing LSID cookie";
     return;
   }
 
   std::string client_id;
   if (!GetQueryParameter(request.content, "client_id", &client_id) ||
       gaia_urls->oauth2_chrome_client_id() != client_id) {
-    http_response->set_code(net::HTTP_BAD_REQUEST);
     return;
   }
 
   http_response->AddCustomHeader(
       "Set-Cookie",
       base::StringPrintf(
           "oauth_code=%s; Path=/o/GetOAuth2Token; Secure; HttpOnly;",
-          fake_auth_code_.c_str()));
+          merge_session_params_.auth_code.c_str()));
   http_response->set_code(net::HTTP_OK);
   http_response->set_content_type("text/html");
 }
 
 void FakeGaia::HandleServiceLogin(const HttpRequest& request,
                                   BasicHttpResponse* http_response) {
   http_response->set_code(net::HTTP_OK);
   http_response->set_content(service_login_response_);
   http_response->set_content_type("text/html");
 }
 
 void FakeGaia::HandleOAuthLogin(const HttpRequest& request,
                                 BasicHttpResponse* http_response) {
-  http_response->set_code(net::HTTP_BAD_REQUEST);
+  http_response->set_code(net::HTTP_UNAUTHORIZED);
+  if (merge_session_params_.gaia_uber_token.empty()) {
+    http_response->set_code(net::HTTP_FORBIDDEN);
+    return;
+  }
+
   std::string access_token;
   if (!GetAccessToken(request, kAuthHeaderOAuth, &access_token)) {
     LOG(ERROR) << "/OAuthLogin missing access token in the header";
     return;
   }
 
   GURL request_url = GURL("http://localhost").Resolve(request.relative_url);
   std::string request_query = request_url.query();
 
   std::string source;
   if (!GetQueryParameter(request_query, "source", &source)) {
     LOG(ERROR) << "Missing 'source' param in /OAuthLogin call";
     return;
   }
 
   std::string issue_uberauth;
   if (GetQueryParameter(request_query, "issueuberauth", &issue_uberauth) &&
       issue_uberauth == "1") {
-    http_response->set_content(fake_gaia_uber_token_);
+    http_response->set_content(merge_session_params_.gaia_uber_token);
     http_response->set_code(net::HTTP_OK);
     // Issue GAIA uber token.
   } else {
     LOG(FATAL) << "/OAuthLogin for SID/LSID is not supported";
   }
 }
 
 void FakeGaia::HandleMergeSession(const HttpRequest& request,
                                   BasicHttpResponse* http_response) {
-  http_response->set_code(net::HTTP_BAD_REQUEST);
+  http_response->set_code(net::HTTP_UNAUTHORIZED);
+  if (merge_session_params_.session_sid_cookie.empty() ||
+      merge_session_params_.session_lsid_cookie.empty()) {
+    http_response->set_code(net::HTTP_BAD_REQUEST);
+    return;
+  }
 
   std::string uber_token;
   if (!GetQueryParameter(request.content, "uberauth", &uber_token) ||
-      uber_token != fake_gaia_uber_token_) {
+      uber_token != merge_session_params_.gaia_uber_token) {
     LOG(ERROR) << "Missing or invalid 'uberauth' param in /MergeSession call";
     return;
   }
 
   std::string continue_url;
   if (!GetQueryParameter(request.content, "continue", &continue_url)) {
     LOG(ERROR) << "Missing or invalid 'continue' param in /MergeSession call";
     return;
   }
 
   std::string source;
   if (!GetQueryParameter(request.content, "source", &source)) {
     LOG(ERROR) << "Missing or invalid 'source' param in /MergeSession call";
     return;
   }
 
   http_response->AddCustomHeader(
       "Set-Cookie",
       base::StringPrintf(
-          "SID=%s; LSID=%s; Path=/; Secure; HttpOnly;",
-          fake_session_sid_cookie_.c_str(),
-          fake_session_lsid_cookie_.c_str()));
+          "SID=%s; Path=/; HttpOnly;",
+          merge_session_params_.session_sid_cookie.c_str()));
+  http_response->AddCustomHeader(
+      "Set-Cookie",
+      base::StringPrintf(
+          "LSID=%s; Path=/; HttpOnly;",
+          merge_session_params_.session_lsid_cookie.c_str()));
   // TODO(zelidrag): Not used now.
   http_response->set_content("OK");
   http_response->set_code(net::HTTP_OK);
 }
 
 
 void FakeGaia::HandleServiceLoginAuth(const HttpRequest& request,
                                       BasicHttpResponse* http_response) {
   std::string continue_url =
       GaiaUrls::GetInstance()->service_login_url().spec();
   GetQueryParameter(request.content, "continue", &continue_url);
 
   std::string redirect_url = continue_url;
 
   std::string email;
   if (GetQueryParameter(request.content, "Email", &email) &&
       saml_account_idp_map_.find(email) != saml_account_idp_map_.end()) {
     GURL url(saml_account_idp_map_[email]);
     url = net::AppendQueryParameter(url, "SAMLRequest", "fake_request");
     url = net::AppendQueryParameter(url, "RelayState", continue_url);
     redirect_url = url.spec();
   }
 
+  if (!merge_session_params_.auth_sid_cookie.empty() &&
+      !merge_session_params_.auth_lsid_cookie.empty()) {
+    http_response->AddCustomHeader(
+        "Set-Cookie",
+        base::StringPrintf(
+            "SID=%s; Path=/; HttpOnly;",
+            merge_session_params_.auth_sid_cookie.c_str()));
+    http_response->AddCustomHeader(
+        "Set-Cookie",
+        base::StringPrintf(
+            "LSID=%s; Path=/; HttpOnly;",
+            merge_session_params_.auth_lsid_cookie.c_str()));
+  }
+
   http_response->set_code(net::HTTP_TEMPORARY_REDIRECT);
   http_response->AddCustomHeader("Location", redirect_url);
 }
 
 void FakeGaia::HandleSSO(const HttpRequest& request,
                          BasicHttpResponse* http_response) {
   std::string relay_state;
   GetQueryParameter(request.content, "RelayState", &relay_state);
   std::string redirect_url = relay_state;
   http_response->set_code(net::HTTP_TEMPORARY_REDIRECT);
@@ skipping 11 matching lines @@
   GetQueryParameter(request.content, "scope", &scope);
 
   if (!GetQueryParameter(request.content, "grant_type", &grant_type)) {
     http_response->set_code(net::HTTP_BAD_REQUEST);
     LOG(ERROR) << "No 'grant_type' param in /o/oauth2/token";
     return;
   }
 
   if (grant_type == "authorization_code") {
     if (!GetQueryParameter(request.content, "code", &auth_code) ||
-        auth_code != fake_auth_code_) {
+        auth_code != merge_session_params_.auth_code) {
       http_response->set_code(net::HTTP_BAD_REQUEST);
       LOG(ERROR) << "No 'code' param in /o/oauth2/token";
       return;
     }
 
     if (GaiaUrls::GetInstance()->oauth1_login_scope() != scope) {
       http_response->set_code(net::HTTP_BAD_REQUEST);
       LOG(ERROR) << "Invalid scope for /o/oauth2/token - " << scope;
       return;
     }
 
     base::DictionaryValue response_dict;
-    response_dict.SetString("refresh_token", fake_refresh_token_);
-    response_dict.SetString("access_token", fake_access_token_);
+    response_dict.SetString("refresh_token",
+                            merge_session_params_.refresh_token);
+    response_dict.SetString("access_token",
+                            merge_session_params_.access_token);
     response_dict.SetInteger("expires_in", 3600);
     FormatJSONResponse(response_dict, http_response);
   } else if (GetQueryParameter(request.content,
                                "refresh_token",
                                &refresh_token) &&
              GetQueryParameter(request.content,
                                "client_id",
                                &client_id) &&
              (token_info = FindAccessTokenInfo(refresh_token,
                                               client_id,
@@ skipping 57 matching lines @@
     response_dict.SetString("issueAdvice", "auto");
     response_dict.SetString("expiresIn",
                             base::IntToString(token_info->expires_in));
     response_dict.SetString("token", token_info->token);
     FormatJSONResponse(response_dict, http_response);
   } else {
     http_response->set_code(net::HTTP_BAD_REQUEST);
   }
 }
 
-
 scoped_ptr<HttpResponse> FakeGaia::HandleRequest(const HttpRequest& request) {
   // The scheme and host of the URL is actually not important but required to
   // get a valid GURL in order to parse |request.relative_url|.
   GURL request_url = GURL("http://localhost").Resolve(request.relative_url);
   std::string request_path = request_url.path();
   scoped_ptr<BasicHttpResponse> http_response(new BasicHttpResponse());
   RequestHandlerMap::iterator iter = request_handlers_.find(request_path);
   if (iter != request_handlers_.end()) {
     LOG(WARNING) << "Serving request " << request_path;
     iter->second.Run(request, http_response.get());
@@ skipping 49 matching lines @@
 
 // static
 bool FakeGaia::GetQueryParameter(const std::string& query,
                                  const std::string& key,
                                  std::string* value) {
   // Name and scheme actually don't matter, but are required to get a valid URL
   // for parsing.
   GURL query_url("http://localhost?" + query);
   return net::GetValueForKeyInQuery(query_url, key, value);
 }
-
-// static
-bool FakeGaia::GetAccessToken(const HttpRequest& request,
-                              const char* auth_token_prefix,
-                              std::string* access_token) {
-  std::map<std::string, std::string>::const_iterator auth_header_entry =
-      request.headers.find("Authorization");
-  if (auth_header_entry != request.headers.end()) {
-    if (StartsWithASCII(auth_header_entry->second, auth_token_prefix, true)) {
-      *access_token = auth_header_entry->second.substr(
-          strlen(auth_token_prefix));
-      return true;
-    }
-  }
-
-  return false;
-}