Add support for authorization of HTTP client requests

runtime/bin/http_impl.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 class _HttpHeaders implements HttpHeaders {
   _HttpHeaders() : _headers = new Map<String, List<String>>();
 
   List<String> operator[](String name) {
     name = name.toLowerCase();
     return _headers[name];
@@ skipping 290 matching lines @@
   List<String> _noFoldingHeaders;
 
   String _host;
   int _port;
 }
 
 
 class _HeaderValue implements HeaderValue {
   _HeaderValue([String this.value = ""]);
 
-  _HeaderValue.fromString(String value) {
+  _HeaderValue.fromString(String value, [this.parameterSeparator = ";"]) {
     // Parse the string.
     _parse(value);
   }
 
   Map<String, String> get parameters {
     if (_parameters == null) _parameters = new Map<String, String>();
     return _parameters;
   }
 
   String toString() {
@@ skipping 18 matching lines @@
     void skipWS() {
       while (!done()) {
         if (s[index] != " " && s[index] != "\t") return;
         index++;
       }
     }
 
     String parseValue() {
       int start = index;
       while (!done()) {
-        if (s[index] == " " || s[index] == "\t" || s[index] == ";") break;
+        if (s[index] == " " ||
+            s[index] == "\t" ||
+            s[index] == parameterSeparator) break;
         index++;
       }
       return s.substring(start, index).toLowerCase();
     }
 
     void expect(String expected) {
-      if (done()) throw new HttpException("Failed to parse header value [$s]");
-      if (s[index] != expected) {
-        throw new HttpException("Failed to parse header value [$s]");
+      if (done() || s[index] != expected) {
+        throw new HttpException("Failed to parse header value");
       }
       index++;
     }
 
+    void maybeExpect(String expected) {
+      if (s[index] == expected) index++;
+    }
+
     void parseParameters() {
       _parameters = new Map<String, String>();
 
       String parseParameterName() {
         int start = index;
         while (!done()) {
           if (s[index] == " " || s[index] == "\t" || s[index] == "=") break;
           index++;
         }
         return s.substring(start, index).toLowerCase();
       }
 
       String parseParameterValue() {
         if (s[index] == "\"") {
           // Parse quoted value.
           StringBuffer sb = new StringBuffer();
           index++;
           while (!done()) {
             if (s[index] == "\\") {
               if (index + 1 == s.length) {
-                throw new HttpException("Failed to parse header value [$s]");
+                throw new HttpException("Failed to parse header value");
               }
               index++;
             } else if (s[index] == "\"") {
               index++;
               break;
             }
             sb.add(s[index]);
             index++;
           }
           return sb.toString();
         } else {
           // Parse non-quoted value.
           return parseValue();
         }
       }
 
       while (!done()) {
         skipWS();
         if (done()) return;
         String name = parseParameterName();
         skipWS();
         expect("=");
         skipWS();
         String value = parseParameterValue();
         _parameters[name] = value;
         skipWS();
         if (done()) return;
-        expect(";");
+        expect(parameterSeparator);
       }
     }
 
     skipWS();
     value = parseValue();
     skipWS();
     if (done()) return;
-    expect(";");
+    maybeExpect(parameterSeparator);
     parseParameters();
   }
 
   String value;
+  String parameterSeparator;
   Map<String, String> _parameters;
 }
 
 
 class _ContentType extends _HeaderValue implements ContentType {
   _ContentType(String primaryType, String subType)
       : _primaryType = primaryType, _subType = subType, super("");
 
   _ContentType.fromString(String value) : super.fromString(value);
 
@@ skipping 1283 matching lines @@
     _reasonPhrase = reasonPhrase;
   }
 
   void _onHeaderReceived(String name, String value) {
     _headers.add(name, value);
     if (name == "content-length") {
       _contentLength = parseInt(value);
     }
   }
 
+  void _handleUnauthorized() {
+    // Only try to authenticate if there is a challenge in the response.
+    List<String> challenge = _headers[HttpHeaders.WWW_AUTHENTICATE];
+    if (challenge != null && challenge.length == 1) {
+      HeaderValue header =
+          new HeaderValue.fromString(challenge[0], parameterSeparator: ",");
+      _AuthenticationScheme scheme =
+          new _AuthenticationScheme.fromString(header.value);
+      String realm = header.parameters["realm"];
+
+      // See if any credentials are available.
+      _Credentials cr =
+          _connection._client._findCredentials(
+              _connection._request._uri, scheme);
+
+      // Ask for more credentials if none found or the one found has
+      // already been used. If is has already been used it must now be

[Mads Ager (google), 2012/10/26 11:07:02]

is -> it

[Søren Gjesse, 2012/10/26 12:59:02]

Done.

+      // invalid and is removed.
+      if (cr == null || cr.used) {
+        if (cr != null) {
+          _connection._client._removeCredentials(cr);
+        }
+        cr = null;
+        if (_connection._client._authenticate != null &&
+            _connection._client._authenticate(
+                _connection._request._uri, scheme.toString(), realm)) {
+          cr = _connection._client._findCredentials(_connection._request._uri,
+                                                    scheme);
+        }
+      }
+
+      // If credentials found prepare for retrying the request.
+      if (cr != null) {
+        if (cr.scheme == _AuthenticationScheme.DIGEST) {
+          cr.nonce = header.parameters["nonce"];
+          cr.algorithm = header.parameters["algorithm"];
+          cr.qop = header.parameters["qop"];
+        }
+        // Drain body and retry.
+        // TODO(sgesse): Support digest.

[Mads Ager (google), 2012/10/26 11:07:02]

Should we throw an Unsupported exception for now or something similar.

[Søren Gjesse, 2012/10/26 12:59:02]

As it is it will just fall through and pass the status code 401 to the client,
which I think is fine.

+        if (cr.scheme == _AuthenticationScheme.BASIC) {
+          inputStream.onData = inputStream.read;
+          inputStream.onClosed = _connection.retry;
+          return;
+        }
+      }
+    }
+
+    // Fall through to here to perform normal response handling if
+    // there is no sensible authorization handling.
+    if (_connection._onResponse != null) {
+      _connection._onResponse(this);
+    }
+  }
+
   void _onHeadersComplete() {
     _headers._mutable = false;
     _buffer = new _BufferList();
     if (isRedirect && _connection.followRedirects) {
       if (_connection._redirects == null ||
           _connection._redirects.length < _connection.maxRedirects) {
         // Check the location header.
         List<String> location = headers[HttpHeaders.LOCATION];
         if (location == null || location.length > 1) {
            throw new RedirectException("Invalid redirect",
                                        _connection._redirects);
         }
         // Check for redirect loop
         if (_connection._redirects != null) {
           Uri redirectUrl = new Uri.fromString(location[0]);
           for (int i = 0; i < _connection._redirects.length; i++) {
             if (_connection._redirects[i].location.toString() ==
                 redirectUrl.toString()) {
               throw new RedirectLoopException(_connection._redirects);
             }
           }
         }
         // Drain body and redirect.
         inputStream.onData = inputStream.read;
         inputStream.onClosed = _connection.redirect;
       } else {
         throw new RedirectLimitExceededException(_connection._redirects);
       }
+    } else if (statusCode == HttpStatus.UNAUTHORIZED) {
+      _handleUnauthorized();
     } else if (_connection._onResponse != null) {
       _connection._onResponse(this);
     }
   }
 
   void _onDataReceived(List<int> data) {
     _buffer.add(data);
     if (_inputStream != null) _inputStream._dataReceived();
   }
 
@@ skipping 134 matching lines @@
   }
 
   void set onResponse(void handler(HttpClientResponse response)) {
     _onResponse = handler;
   }
 
   void set onError(void callback(e)) {
     _onErrorCallback = callback;
   }
 
+  void retry() {
+    if (_socketConn != null) {
+      throw new HttpException("Cannot retry with body data pending");
+    }
+    // Retry the URL using the same connection instance.
+    _client._openUrl(_method, _request._uri, this);
+  }
+
   void redirect([String method, Uri url]) {
     if (_socketConn != null) {
       throw new HttpException("Cannot redirect with body data pending");
     }
     if (method == null) method = _method;
     if (url == null) {
       url = new Uri.fromString(_response.headers.value(HttpHeaders.LOCATION));
     }
     if (_redirects == null) {
       _redirects = new List<_RedirectInfo>();
@@ skipping 104 matching lines @@
   final String host;
   final int port;
   final bool isDirect;
 }
 
 class _HttpClient implements HttpClient {
   static const int DEFAULT_EVICTION_TIMEOUT = 60000;
 
   _HttpClient() : _openSockets = new Map(),
                   _activeSockets = new Set(),
+                  credentials = new List<_Credentials>(),
                   _shutdown = false;
 
   HttpClientConnection open(
       String method, String host, int port, String path) {
     // TODO(sgjesse): The path set here can contain both query and
     // fragment. They should be cracked and set correctly.
     return _open(method, new Uri.fromComponents(
         scheme: "http", domain: host, port: port, path: path));
   }
 
@@ skipping 10 matching lines @@
   HttpClientConnection openUrl(String method, Uri url) {
     return _openUrl(method, url);
   }
 
   HttpClientConnection _openUrl(String method,
                                 Uri url,
                                 [_HttpClientConnection connection]) {
     if (url.scheme != "http") {
       throw new HttpException("Unsupported URL scheme ${url.scheme}");
     }
-    if (url.userInfo != "") {
-      throw new HttpException("Unsupported user info ${url.userInfo}");
-    }
     return _open(method, url, connection);
   }
 
   HttpClientConnection get(String host, int port, String path) {
     return open("GET", host, port, path);
   }
 
   HttpClientConnection getUrl(Uri url) => _openUrl("GET", url);
 
   HttpClientConnection post(String host, int port, String path) {
     return open("POST", host, port, path);
   }
 
   HttpClientConnection postUrl(Uri url) => _openUrl("POST", url);
 
+  set authenticate(bool f(Uri url, String scheme, String realm)) {
+    _authenticate = f;
+  }
+
+  void addCredentials(
+      Uri url, String realm, HttpClientCredentials cr) {
+    credentials.add(new _Credentials(url, realm, cr));
+  }
+
   set findProxy(String f(Uri uri)) => _findProxy = f;
 
   void shutdown() {
      _openSockets.forEach((String key, Queue<_SocketConnection> connections) {
        while (!connections.isEmpty()) {
          _SocketConnection socketConn = connections.removeFirst();
          socketConn._socket.close();
        }
      });
      _activeSockets.forEach((_SocketConnection socketConn) {
@@ skipping 23 matching lines @@
                               int proxyIndex) {
 
       void _connectionOpened(_SocketConnection socketConn,
                              _HttpClientConnection connection,
                              bool usingProxy) {
         connection._usingProxy = usingProxy;
         connection._connectionEstablished(socketConn);
         HttpClientRequest request = connection.open(method, url);
         request.headers.host = host;
         request.headers.port = port;
+        if (url.userInfo != null && !url.userInfo.isEmpty()) {
+          // If the URL contains user information use that for basic
+          // authorization
+          _UTF8Encoder encoder = new _UTF8Encoder();
+          String auth =
+              CryptoUtils.bytesToBase64(encoder.encodeString(url.userInfo));
+          request.headers.set(HttpHeaders.AUTHORIZATION, "Basic $auth");
+        } else {
+          // Look for credentials.
+          _Credentials cr = _findCredentials(url);
+          if (cr != null) {
+            cr.authorize(request);
+          }
+        }
         if (connection._onRequest != null) {
           connection._onRequest(request);
         } else {
           request.outputStream.close();
         }
       }
 
       assert(proxyIndex < proxyConfiguration.proxies.length);
 
       // Determine the actual host to connect to.
@@ skipping 123 matching lines @@
         if (_openSockets.isEmpty()) _cancelEvictionTimer();
       }
       _evictionTimer = new Timer.repeating(10000, _handleEviction);
     }
 
     // Return connection.
     _activeSockets.remove(socketConn);
     sockets.addFirst(socketConn);
   }
 
+  _Credentials _findCredentials(Uri url, [_AuthenticationScheme scheme]) {
+    // Look for credentials.
+    _Credentials cr =
+        credentials.reduce(null, (_Credentials prev, _Credentials value) {
+          if (value.applies(url, scheme)) {
+            if (prev == null) return value;
+            return value.uri.path.length > prev.uri.path.length ? value : prev;
+          } else {
+            return prev;
+          }
+        });
+    return cr;
+  }
+
+  void _removeCredentials(_Credentials cr) {
+    int index = credentials.indexOf(cr);
+    if (index != -1) {
+      credentials.removeAt(index);
+    }
+  }
+
   Function _onOpen;
   Map<String, Queue<_SocketConnection>> _openSockets;
   Set<_SocketConnection> _activeSockets;
+  List<_Credentials> credentials;
   Timer _evictionTimer;
   Function _findProxy;
+  Function _authenticate;
   bool _shutdown;  // Has this HTTP client been shutdown?
 }
 
 
 class _HttpConnectionInfo implements HttpConnectionInfo {
   String remoteHost;
   int remotePort;
   int localPort;
 }
 
 
 class _DetachedSocket implements DetachedSocket {
   _DetachedSocket(this._socket, this._unparsedData);
   Socket get socket => _socket;
   List<int> get unparsedData => _unparsedData;
   Socket _socket;
   List<int> _unparsedData;
 }
 
 
+class _AuthenticationScheme {
+  static const UNKNOWN = const _AuthenticationScheme(-1);
+  static const BASIC = const _AuthenticationScheme(0);
+  static const DIGEST = const _AuthenticationScheme(1);
+
+  const _AuthenticationScheme(this._scheme);
+
+  factory _AuthenticationScheme.fromString(String scheme) {
+    if (scheme.toLowerCase() == "basic") return BASIC;
+    if (scheme.toLowerCase() == "digest") return DIGEST;
+    return UNKNOWN;
+  }
+
+  String toString() {
+    if (this == BASIC) return "Basic";
+    if (this == DIGEST) return "Digest";
+    return "Unknown";
+  }
+
+  final int _scheme;
+}
+
+
+class _Credentials {
+  _Credentials(this.uri, this.realm, this.credentials);
+
+  _AuthenticationScheme get scheme => credentials.scheme;
+
+  bool applies(Uri uri, _AuthenticationScheme scheme) {
+    if (scheme != null && credentials.scheme != scheme) return false;
+    if (uri.domain != this.uri.domain) return false;
+    int thisPort =
+        this.uri.port == 0 ? HttpClient.DEFAULT_HTTP_PORT : this.uri.port;
+    int otherPort = uri.port == 0 ? HttpClient.DEFAULT_HTTP_PORT : uri.port;
+    if (otherPort != thisPort) return false;
+    return uri.path.startsWith(this.uri.path);
+  }
+
+  void authorize(HttpClientRequest request) {
+    credentials.authorize(this, request);
+    used = true;
+  }
+
+  bool used = false;
+  Uri uri;
+  String realm;
+  HttpClientCredentials credentials;
+
+  // Digest specific fields.
+  String nonce;
+  String algorithm;
+  String qop;
+}
+
+
+class _HttpClientCredentials implements HttpClientCredentials {
+  abstract _AuthenticationScheme get scheme;
+  abstract void authorize(HttpClientRequest request);
+}
+
+
+class _HttpClientBasicCredentials implements HttpClientBasicCredentials {
+  _HttpClientBasicCredentials(this.username,
+                              this.password);
+
+  _AuthenticationScheme get scheme => _AuthenticationScheme.BASIC;
+
+  void authorize(_Credentials _, HttpClientRequest request) {
+    // There is no mentioning of username/password encoding in RFC
+    // 2617. However there is an open draft for adding an additional
+    // accept-charset parameter to the WWW-Authenticate and
+    // Proxy-Authenticate headers, see
+    // http://tools.ietf.org/html/draft-reschke-basicauth-enc-06. For
+    // now always use UTF-8 encoding.
+    _UTF8Encoder encoder = new _UTF8Encoder();
+    String auth =
+        CryptoUtils.bytesToBase64(encoder.encodeString(
+            "$username:$password"));
+    request.headers.set(HttpHeaders.AUTHORIZATION, "Basic $auth");
+  }
+
+  String username;
+  String password;
+}
+
+
+class _HttpClientDigestCredentials implements HttpClientDigestCredentials {
+  _HttpClientDigestCredentials(this.username,
+                               this.password);
+
+  _AuthenticationScheme get scheme => _AuthenticationScheme.DIGEST;
+
+  void authorize(_Credentials credentials, HttpClientRequest request) {
+    // TODO(sgjesse): Implement!!!

[Mads Ager (google), 2012/10/26 11:07:02]

Throw unsupported exception?

[Søren Gjesse, 2012/10/26 12:59:02]

Done.

+  }
+
+  String username;
+  String password;
+}
+
+
+
 class _RedirectInfo implements RedirectInfo {
   const _RedirectInfo(int this.statusCode,
                       String this.method,
                       Uri this.location);
   final int statusCode;
   final String method;
   final Uri location;
 }