[Rietveld] Allow whitelisted email accounts to access Rietveld.

appengine/chromium_rietveld/tests/test_auth_utils.py

 #!/usr/bin/env python
 # Copyright 2013 Google Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
 #     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
@@ skipping 21 matching lines @@
 
 
 TEST_EMAIL = 'foo@example.com'
 EMAIL_SCOPE = auth_utils.EMAIL_SCOPE
 CLIENT_ID = 'dummy21.apps.googleusercontent.com'
 OTHER_CLIENT_IDS = [
   'dummy34.apps.googleusercontent.com',
   'dummy55.apps.googleusercontent.com',
   'dummy89.apps.googleusercontent.com',
 ]
+WHILTELISTED_EMAILS = [
+  'dummy1@appspot.gserviceaccount.com',
+]
 
 
 
 class TestAuthUtils(TestCase):
 
   def setUp(self):
     super(TestAuthUtils, self).setUp()
     # User service stub used in TestAuthUtils, this protobuf service
     # includes the OAuth API.
     self.oauth_login(TEST_EMAIL)
 
     auth_utils.SecretKey.set_config(CLIENT_ID, 'dummy.secret',
-                                    OTHER_CLIENT_IDS)
+                                    OTHER_CLIENT_IDS, WHILTELISTED_EMAILS)
 
   def tearDown(self):
     super(TestAuthUtils, self).tearDown()
     self.oauth_logout()
 
   def cookie_login(self, email, is_admin=False):
     """Logs in Cookie user identified by email."""
     self.login(email)
     os.environ['USER_IS_ADMIN'] = '1' if is_admin else '0'
 
@@ skipping 117 matching lines @@
     # Is an admin
     self.oauth_login(oauth_mail, is_admin=True)
     self.assertTrue(auth_utils.is_current_user_admin())
 
   def test_is_current_user_admin_both_cookie_and_oauth_user(self):
     self.cookie_login('foo@bar.com', is_admin=True)
     self.oauth_login('oauth@mail.com', is_admin=True)
 
     self.assertTrue(auth_utils.is_current_user_admin())
 
+  def test_is_current_user_oauth_but_not_whitelisted_email(self):
+    self.cookie_logout()
+    self.oauth_login('not-whitelisted@appspot.gserviceaccount.com',
+                     is_admin=False, client_id='anonymous')
+    self.assertIsNone(auth_utils.get_current_rietveld_oauth_user())
+
+  def test_is_current_user_oauth_and_whitelisted_email(self):
+    for email in WHILTELISTED_EMAILS:
+      self.cookie_logout()
+      self.oauth_logout()
+      self.oauth_login(email, is_admin=False, client_id='anonymous')
+      oauth_user = auth_utils.get_current_rietveld_oauth_user()
+      self.assertIsNotNone(oauth_user)
+      self.assertEqual(email, oauth_user.email())
+
 
 if __name__ == '__main__':
   unittest.main()