Add support for authorization of HTTP client requests

runtime/bin/http_impl.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 class _HttpHeaders implements HttpHeaders {
   _HttpHeaders() : _headers = new Map<String, List<String>>();
 
   List<String> operator[](String name) {
     name = name.toLowerCase();
     return _headers[name];
@@ skipping 290 matching lines @@
   List<String> _noFoldingHeaders;
 
   String _host;
   int _port;
 }
 
 
 class _HeaderValue implements HeaderValue {
   _HeaderValue([String this.value = ""]);
 
-  _HeaderValue.fromString(String value) {
+  _HeaderValue.fromString(String value, [this.parameterSeparator = ";"]) {
     // Parse the string.
     _parse(value);
   }
 
   Map<String, String> get parameters {
     if (_parameters == null) _parameters = new Map<String, String>();
     return _parameters;
   }
 
   String toString() {
@@ skipping 18 matching lines @@
     void skipWS() {
       while (!done()) {
         if (s[index] != " " && s[index] != "\t") return;
         index++;
       }
     }
 
     String parseValue() {
       int start = index;
       while (!done()) {
-        if (s[index] == " " || s[index] == "\t" || s[index] == ";") break;
+        if (s[index] == " " ||
+            s[index] == "\t" ||
+            s[index] == parameterSeparator) break;
         index++;
       }
       return s.substring(start, index).toLowerCase();
     }
 
     void expect(String expected) {
-      if (done()) throw new HttpException("Failed to parse header value [$s]");
+      if (done()) throw new HttpException("Failed to parse header value $expected [$s]");

[Mads Ager (google), 2012/10/17 11:26:43]

Long line.

[Søren Gjesse, 2012/10/26 09:43:00]

Done.

       if (s[index] != expected) {
-        throw new HttpException("Failed to parse header value [$s]");
+        throw new HttpException("Failed to parse header value x $expected [$s]");

[Mads Ager (google), 2012/10/17 11:26:43]

Ditto.

[Søren Gjesse, 2012/10/26 09:43:00]

Done.

       }
       index++;
     }
 
+    void maybeExpect(String expected) {
+      if (s[index] == expected) index++;
+    }
+
     void parseParameters() {
       _parameters = new Map<String, String>();
 
       String parseParameterName() {
         int start = index;
         while (!done()) {
           if (s[index] == " " || s[index] == "\t" || s[index] == "=") break;
           index++;
         }
         return s.substring(start, index).toLowerCase();
       }
 
       String parseParameterValue() {
         if (s[index] == "\"") {
           // Parse quoted value.
           StringBuffer sb = new StringBuffer();
           index++;
           while (!done()) {
             if (s[index] == "\\") {
               if (index + 1 == s.length) {
-                throw new HttpException("Failed to parse header value [$s]");
+                throw new HttpException("Failed to parse header value y [$s]");

[Mads Ager (google), 2012/10/17 11:26:43]

Accidental edit?

[Søren Gjesse, 2012/10/26 09:43:00]

Done.

               }
               index++;
             } else if (s[index] == "\"") {
               index++;
               break;
             }
             sb.add(s[index]);
             index++;
           }
           return sb.toString();
         } else {
           // Parse non-quoted value.
           return parseValue();
         }
       }
 
       while (!done()) {
         skipWS();
         if (done()) return;
         String name = parseParameterName();
         skipWS();
         expect("=");
         skipWS();
         String value = parseParameterValue();
         _parameters[name] = value;
         skipWS();
         if (done()) return;
-        expect(";");
+        expect(parameterSeparator);
       }
     }
 
     skipWS();
     value = parseValue();
     skipWS();
     if (done()) return;
-    expect(";");
+    maybeExpect(parameterSeparator);
     parseParameters();
   }
 
   String value;
+  String parameterSeparator;
   Map<String, String> _parameters;
 }
 
 
 class _ContentType extends _HeaderValue implements ContentType {
   _ContentType(String primaryType, String subType)
       : _primaryType = primaryType, _subType = subType, super("");
 
   _ContentType.fromString(String value) : super.fromString(value);
 
@@ skipping 1283 matching lines @@
     _reasonPhrase = reasonPhrase;
   }
 
   void _onHeaderReceived(String name, String value) {
     _headers.add(name, value);
     if (name == "content-length") {
       _contentLength = parseInt(value);
     }
   }
 
+  void _handleUnauthorized() {
+    // Only try to authenticate if there is a challenge in the response.
+    List<String> challenge = _headers[HttpHeaders.WWW_AUTHENTICATE];
+    if (challenge != null && challenge.length == 1) {
+      HeaderValue header =
+          new HeaderValue.fromString(challenge[0], parameterSeparator: ",");
+      _AuthenticationScheme scheme =
+          new _AuthenticationScheme.fromString(header.value);
+      String realm = header.parameters["realm"];
+
+      // See if any credentials are available.
+      _Credentials cr =

[Mads Ager (google), 2012/10/17 11:26:43]

What if we authorize once and the credentials are added to the credentials
store. Then there is a password change and another request with the same client.
That could get us in here again with another challenge? However, we will use the
cached credentials without calling authenticate again? Shouldn't we add a
mechanism to remove the credentials and reauthorize if they did not give access?

[Søren Gjesse, 2012/10/26 09:43:00]

Added a used flag on credentials in the cache so that is credentials which have
been send, but come back with 401 will be removed and re-authorization will
happen.

+          _connection._client._findCredentials(
+              _connection._request._uri, scheme);
+
+      // Ask for more credentials if none found.
+      if (cr == null) {
+        if (_connection._client._authenticate(
+                _connection._request._uri, scheme, realm)) {
+          cr = _connection._client._findCredentials(_connection._request._uri,
+                                                    scheme);
+        }
+      }
+
+      // If credentials found prepare for retrying the request.
+      if (cr != null) {
+        if (cr.scheme == _AuthenticationScheme.DIGEST) {
+          cr.nonce = header.parameters["nonce"];
+          cr.algorithm = header.parameters["algorithm"];
+          cr.qop = header.parameters["qop"];
+        }
+        // Drain body and retry.
+        // TODO(sgesse): Support digest.
+        if (cr.scheme == _AuthenticationScheme.DIGEST) {
+          inputStream.onData = inputStream.read;
+          inputStream.onClosed = _connection.retry;
+          return;
+        }
+      }
+    }
+
+    // Fall through to here to perform normal response handling if
+    // there is no sensible authorization handling.
+    if (_connection._onResponse != null) {
+      _connection._onResponse(this);
+    }
+  }
+
   void _onHeadersComplete() {
     _headers._mutable = false;
     _buffer = new _BufferList();
     if (isRedirect && _connection.followRedirects) {
       if (_connection._redirects == null ||
           _connection._redirects.length < _connection.maxRedirects) {
         // Check the location header.
         List<String> location = headers[HttpHeaders.LOCATION];
         if (location == null || location.length > 1) {
            throw new RedirectException("Invalid redirect",
                                        _connection._redirects);
         }
         // Check for redirect loop
         if (_connection._redirects != null) {
           Uri redirectUrl = new Uri.fromString(location[0]);
           for (int i = 0; i < _connection._redirects.length; i++) {
             if (_connection._redirects[i].location.toString() ==
                 redirectUrl.toString()) {
               throw new RedirectLoopException(_connection._redirects);
             }
           }
         }
         // Drain body and redirect.
         inputStream.onData = inputStream.read;
         inputStream.onClosed = _connection.redirect;
       } else {
         throw new RedirectLimitExceededException(_connection._redirects);
       }
+    } else if (statusCode == HttpStatus.UNAUTHORIZED) {
+      _handleUnauthorized();
     } else if (_connection._onResponse != null) {
       _connection._onResponse(this);
     }
   }
 
   void _onDataReceived(List<int> data) {
     _buffer.add(data);
     if (_inputStream != null) _inputStream._dataReceived();
   }
 
@@ skipping 134 matching lines @@
   }
 
   void set onResponse(void handler(HttpClientResponse response)) {
     _onResponse = handler;
   }
 
   void set onError(void callback(e)) {
     _onErrorCallback = callback;
   }
 
+  void retry() {
+    if (_socketConn != null) {
+      throw new HttpException("Cannot retry with body data pending");
+    }
+    // Retry the URL using the same connection instance.
+    _client._openUrl(_method, _request._uri, this);
+  }
+
   void redirect([String method, Uri url]) {
     if (_socketConn != null) {
       throw new HttpException("Cannot redirect with body data pending");
     }
     if (method == null) method = _method;
     if (url == null) {
       url = new Uri.fromString(_response.headers.value(HttpHeaders.LOCATION));
     }
     if (_redirects == null) {
       _redirects = new List<_RedirectInfo>();
@@ skipping 104 matching lines @@
   final String host;
   final int port;
   final bool isDirect;
 }
 
 class _HttpClient implements HttpClient {
   static const int DEFAULT_EVICTION_TIMEOUT = 60000;
 
   _HttpClient() : _openSockets = new Map(),
                   _activeSockets = new Set(),
+                  credentials = new List<_HttpClientCredentials>(),
                   _shutdown = false;
 
   HttpClientConnection open(
       String method, String host, int port, String path) {
     // TODO(sgjesse): The path set here can contain both query and
     // fragment. They should be cracked and set correctly.
     return _open(method, new Uri.fromComponents(
         scheme: "http", domain: host, port: port, path: path));
   }
 
@@ skipping 10 matching lines @@
   HttpClientConnection openUrl(String method, Uri url) {
     return _openUrl(method, url);
   }
 
   HttpClientConnection _openUrl(String method,
                                 Uri url,
                                 [_HttpClientConnection connection]) {
     if (url.scheme != "http") {
       throw new HttpException("Unsupported URL scheme ${url.scheme}");
     }
-    if (url.userInfo != "") {
-      throw new HttpException("Unsupported user info ${url.userInfo}");
-    }
     return _open(method, url, connection);
   }
 
   HttpClientConnection get(String host, int port, String path) {
     return open("GET", host, port, path);
   }
 
   HttpClientConnection getUrl(Uri url) => _openUrl("GET", url);
 
   HttpClientConnection post(String host, int port, String path) {
     return open("POST", host, port, path);
   }
 
   HttpClientConnection postUrl(Uri url) => _openUrl("POST", url);
 
+  set authenticate(f(Uri uri, String realm)) => _authenticate = f;
+
+  void addCredentials(
+      Uri url, String realm, HttpClientCredentials cr) {
+    credentials.add(new _Credentials(url, realm, cr));
+  }
+
   set findProxy(String f(Uri uri)) => _findProxy = f;
 
   void shutdown() {
      _openSockets.forEach((String key, Queue<_SocketConnection> connections) {
        while (!connections.isEmpty()) {
          _SocketConnection socketConn = connections.removeFirst();
          socketConn._socket.close();
        }
      });
      _activeSockets.forEach((_SocketConnection socketConn) {
@@ skipping 23 matching lines @@
                               int proxyIndex) {
 
       void _connectionOpened(_SocketConnection socketConn,
                              _HttpClientConnection connection,
                              bool usingProxy) {
         connection._usingProxy = usingProxy;
         connection._connectionEstablished(socketConn);
         HttpClientRequest request = connection.open(method, url);
         request.headers.host = host;
         request.headers.port = port;
+        if (url.userInfo != null && !url.userInfo.isEmpty()) {
+          // If the URL contains user information use that for basic
+          // authorization
+          _UTF8Encoder encoder = new _UTF8Encoder();
+          String auth =
+              CryptoUtils.bytesToBase64(encoder.encodeString(url.userInfo));
+          request.headers.set(HttpHeaders.AUTHORIZATION, "Basic $auth");
+        } else {
+          // Look for credentials.
+          _Credentials cr = _findCredentials(url);
+          if (cr != null) {
+            cr.authorize(request);
+          }
+        }
         if (connection._onRequest != null) {
           connection._onRequest(request);
         } else {
           request.outputStream.close();
         }
       }
 
       assert(proxyIndex < proxyConfiguration.proxies.length);
 
       // Determine the actual host to connect to.
@@ skipping 123 matching lines @@
         if (_openSockets.isEmpty()) _cancelEvictionTimer();
       }
       _evictionTimer = new Timer.repeating(10000, _handleEviction);
     }
 
     // Return connection.
     _activeSockets.remove(socketConn);
     sockets.addFirst(socketConn);
   }
 
+  _Credentials _findCredentials(Uri url, [_AuthenticationScheme scheme]) {
+    // Look for credentials.
+    _Credentials cr =
+        credentials.reduce(null, (_Credentials prev, _Credentials value) {
+            if (prev != null) return prev;

[Mads Ager (google), 2012/10/17 11:26:43]

I would use a two-space indent for these three lines.

[Søren Gjesse, 2012/10/26 09:43:00]

Done.

+            if (value.applies(url, scheme)) return value;
+          });
+    return cr;
+  }
+
   Function _onOpen;
   Map<String, Queue<_SocketConnection>> _openSockets;
   Set<_SocketConnection> _activeSockets;
+  List<_HttpClientCredentials> credentials;
   Timer _evictionTimer;
   Function _findProxy;
+  Function _authenticate;
   bool _shutdown;  // Has this HTTP client been shutdown?
 }
 
 
 class _HttpConnectionInfo implements HttpConnectionInfo {
   String remoteHost;
   int remotePort;
   int localPort;
 }
 
 
 class _DetachedSocket implements DetachedSocket {
   _DetachedSocket(this._socket, this._unparsedData);
   Socket get socket => _socket;
   List<int> get unparsedData => _unparsedData;
   Socket _socket;
   List<int> _unparsedData;
 }
 
 
+class _AuthenticationScheme {
+  static const UNKNOWN = const _AuthenticationScheme(-1);
+  static const BASIC = const _AuthenticationScheme(0);
+  static const DIGEST = const _AuthenticationScheme(1);
+
+  const _AuthenticationScheme(this._scheme);
+
+  factory _AuthenticationScheme.fromString(String scheme) {
+    if (scheme.toLowerCase() == "basic") return BASIC;
+    if (scheme.toLowerCase() == "digest") return DIGEST;
+    return UNKNOWN;
+  }
+
+  String toString() {
+    if (this == BASIC) return "Basic";
+    if (this == DIGEST) return "Digest";
+    return "Unknown";
+  }
+
+  final int _scheme;
+}
+
+
+class _Credentials {
+  _Credentials(this.uri, this.realm, this.credentials);
+
+  _AuthenticationScheme get scheme => credentials.scheme;
+
+  bool applies(Uri uri, _AuthenticationScheme scheme) {
+    if (scheme != null && credentials.scheme != scheme) return false;
+    if (uri.domain != this.uri.domain) return false;
+    int thisPort =
+        this.uri.port == 0 ? HttpClient.DEFAULT_HTTP_PORT : this.uri.port;
+    int otherPort = uri.port == 0 ? HttpClient.DEFAULT_HTTP_PORT : uri.port;
+    if (otherPort != thisPort) return false;
+    return uri.path.startsWith(this.uri.path);
+  }
+
+
+  void authorize(HttpClientRequest request) {
+    credentials.authorize(this, request);
+  }
+
+  Uri uri;
+  String realm;
+  _HttpClientCredentials credentials;
+
+  // Digest specific fields.
+  String nonce;
+  String algorithm;
+  String qop;
+}
+
+
+class _HttpClientCredentials implements HttpClientCredentials {
+  abstract _AuthenticationScheme get scheme;
+  abstract void authorize(HttpClientRequest request);
+}
+
+
+class _HttpClientBasicCredentials implements HttpClientBasicCredentials {
+  _HttpClientBasicCredentials(this.username,
+                              this.password);
+
+  _AuthenticationScheme get scheme => _AuthenticationScheme.BASIC;
+
+  void authorize(_Credentials _, HttpClientRequest request) {
+    // There is no mentioning of username/password encoding in RFC
+    // 2617. However there is an open draft for adding an additional
+    // accept-charset parameter to the WWW-Authenticate and
+    // Proxy-Authenticate headers, see
+    // http://tools.ietf.org/html/draft-reschke-basicauth-enc-06. For
+    // now always use UTF-8 encoding.
+    _UTF8Encoder encoder = new _UTF8Encoder();
+    String auth =
+        CryptoUtils.bytesToBase64(encoder.encodeString(
+            "$username:$password"));
+    request.headers.set(HttpHeaders.AUTHORIZATION, "Basic $auth");
+  }
+
+  String username;
+  String password;
+}
+
+
+class _HttpClientDigestCredentials implements HttpClientDigestCredentials {
+  _HttpClientDigestCredentials(this.username,
+                               this.password);
+
+  _AuthenticationScheme get scheme => _AuthenticationScheme.DIGEST;
+
+  void authorize(_Credentials credentials, HttpClientRequest request) {
+    // TODO(sgjesse): Implement!!!
+  }
+
+  String username;
+  String password;
+}
+
+
+
 class _RedirectInfo implements RedirectInfo {
   const _RedirectInfo(int this.statusCode,
                       String this.method,
                       Uri this.location);
   final int statusCode;
   final String method;
   final Uri location;
 }