Merge tag '0.8.0'

Release 0.8.0

8 files changed, 518 insertions, 105 deletions

diff --git a/tests/helpers/bonafide_helper.rb b/tests/helpers/bonafide_helper.rb
index 9b26eaaf..5b886228 100644
--- a/tests/helpers/bonafide_helper.rb
+++ b/tests/helpers/bonafide_helper.rb
@@ -17,45 +17,53 @@ class LeapTest
     raise exc
   end
 
-  def api_url(path)
-    api = property('api')
-    "https://%{domain}:%{port}#{path}" % {
-      :domain   => api['domain'],
-      :port     => api['port']
-    }
-  end
-
   #
   # attempts to create a user account via the API,
   # returning the user object if successful.
   #
-  def assert_create_user
-    user = SRP::User.new
-    url = api_url("/1/users.json")
-    assert_post(url, user.to_params) do |body|
+  def assert_create_user(username=nil, auth=nil)
+    user = SRP::User.new(username)
+    url = api_url("/users.json")
+    params = user.to_params
+    if auth
+      options = api_options(:auth => auth)
+    else
+      options = api_options
+      if property('webapp.invite_required')
+        @invite_code = generate_invite_code
+        params['user[invite_code]'] = @invite_code
+      end
+    end
+
+    assert_post(url, params, options) do |body|
       assert response = JSON.parse(body), 'response should be JSON'
       assert response['ok'], "Creating a user should be successful, got #{response.inspect} instead."
+      user.ok = true
+      user.id = response['id']
     end
-    user.ok = true
     return user
   end
 
+  # TODO: use the api for this instead.
+  def generate_invite_code
+    `cd /srv/leap/webapp/ && sudo -u leap-webapp RAILS_ENV=production bundle exec rake generate_invites[1]`.gsub(/\n/, "")
+  end
+
   #
   # attempts to authenticate user. if successful,
   # user object is updated with id and session token.
   #
   def assert_authenticate_user(user)
-    url = api_url("/1/sessions.json")
+    url = api_url("/sessions.json")
     session = SRP::Session.new(user)
     params = {'login' => user.username, 'A' => session.aa}
-    assert_post(url, params) do |response, body|
+    assert_post(url, params, api_options) do |body, response|
       cookie = response['Set-Cookie'].split(';').first
       assert(response = JSON.parse(body), 'response should be JSON')
       assert(session.bb = response["B"], 'response should include "B"')
-      url = api_url("/1/sessions/login.json")
+      url = api_url("/sessions/login.json")
       params = {'client_auth' => session.m, 'A' => session.aa}
-      options = {:headers => {'Cookie' => cookie}}
-      assert_put(url, params, options) do |body|
+      assert_put(url, params, api_options('Cookie' => cookie)) do |body|
         assert(response = JSON.parse(body), 'response should be JSON')
         assert(response['M2'], 'response should include M2')
         user.session_token = response['token']
@@ -70,30 +78,158 @@ class LeapTest
   # attempts to destroy a user account via the API.
   #
   def assert_delete_user(user)
-    if user && user.ok && user.id && user.session_token && !user.deleted
-      url = api_url("/1/users/#{user.id}.json")
-      options = {:headers => {
-        "Authorization" => "Token token=\"#{user.session_token}\""
-      }}
-      params = {
-        :identities => 'destroy'
+    if user.is_a? String
+      assert_delete_user_by_login(user)
+    elsif user.is_a? SRP::User
+      assert_delete_srp_user(user)
+    end
+  end
+
+  #
+  # returns true if the identity exists, uses monitor token auth
+  #
+  def identity_exists?(address)
+    url = api_url("/identities/#{URI.encode(address)}.json")
+    options = {:ok_codes => [200, 404]}.merge(
+      api_options(:auth => :monitor)
+    )
+    assert_get(url, nil, options) do |body, response|
+      return response.code == "200"
+    end
+  end
+
+  def upload_public_key(user_id, public_key)
+    url = api_url("/users/#{user_id}.json")
+    params = {"user[public_key]" => public_key}
+    assert_put(url, params, api_options(:auth => :monitor))
+  end
+
+  #
+  # return user document as a Hash. uses monitor token auth
+  #
+  def find_user_by_id(user_id)
+    url = api_url("/users/#{user_id}.json")
+    assert_get(url, nil, api_options(:auth => :monitor)) do |body|
+      return JSON.parse(body)
+    end
+  end
+
+  #
+  # return user document as a Hash. uses monitor token auth
+  # NOTE: this relies on deprecated behavior of the API
+  # and will not work when multi-domain support is added.
+  #
+  def find_user_by_login(login)
+    url = api_url("/users/0.json?login=#{login}")
+    options = {:ok_codes => [200, 404]}.merge(
+      api_options(:auth => :monitor)
+    )
+    assert_get(url, nil, options) do |body, response|
+      if response.code == "200"
+        return JSON.parse(body)
+      else
+        return nil
+      end
+    end
+  end
+
+  private
+
+  def api_url(path)
+    unless path =~ /^\//
+      path = '/' + path
+    end
+    if property('testing.api_uri')
+      return property('testing.api_uri') + path
+    elsif property('api')
+      api = property('api')
+      return "https://%{domain}:%{port}/%{version}#{path}" % {
+        :domain   => api['domain'],
+        :port     => api['port'],
+        :version  => api['version'] || 1
+      }
+    else
+      fail 'This node needs to have either testing.api_url or api.{domain,port} configured.'
+    end
+  end
+
+  #
+  # produces an options hash used for api http requests.
+  #
+  # argument options hash gets added to "headers"
+  # of the http request.
+  #
+  # special :auth key in argument will expand to
+  # add api_token_auth header.
+  #
+  # if you want to try manually:
+  #
+  #   export API_URI=`grep api_uri /etc/leap/hiera.yaml | cut -d\" -f2`
+  #   export TOKEN=`grep monitor_auth_token /etc/leap/hiera.yaml | awk '{print $2}'`
+  #   curl -H "Accept: application/json" -H "Token: $TOKEN" $API_URI
+  #
+  def api_options(options={})
+    # note: must be :headers, not "headers"
+    hsh = {
+      :headers => {
+        "Accept" => "application/json"
       }
+    }
+    if options[:auth]
+      hsh[:headers].merge!(api_token_auth(options.delete(:auth)))
+    end
+    hsh[:headers].merge!(options)
+    return hsh
+  end
+
+  #
+  # add token authentication to a http request.
+  #
+  # returns a hash suitable for adding to the 'headers' option
+  # of an http function.
+  #
+  def api_token_auth(token)
+    if token.is_a?(Symbol) && property('testing')
+      if token == :monitor
+        token_str = property('testing.monitor_auth_token')
+      else
+        raise ArgumentError.new 'no such token'
+      end
+    else
+      token_str = token
+    end
+    {"Authorization" => "Token token=\"#{token_str}\""}
+  end
+
+  #
+  # not actually used in any test, but useful when
+  # writing new tests.
+  #
+  def assert_delete_user_by_login(login_name)
+    user = find_user_by_login(login_name)
+    url = api_url("/users/#{user['id']}.json")
+    params =  {:identities => 'destroy'}
+    delete(url, params, api_options(:auth => :monitor)) do |body, response, error|
+      assert error.nil?, "Error deleting user: #{error}"
+      assert response.code.to_i == 200, "Unable to delete user: HTTP response from API should have code 200, was #{response.code} #{error} #{body}"
+      assert(response = JSON.parse(body), 'Delete response should be JSON')
+      assert(response["success"], 'Deleting user should be a success')
+    end
+  end
+
+  def assert_delete_srp_user(user)
+    if user && user.ok && user.id && user.session_token && !user.deleted
+      url = api_url("users/#{user.id}.json")
+      params = {:identities => 'destroy'}
       user.deleted = true
-      delete(url, params, options) do |body, response, error|
+      delete(url, params, api_options(:auth => user.session_token)) do |body, response, error|
         assert error.nil?, "Error deleting user: #{error}"
         assert response.code.to_i == 200, "Unable to delete user: HTTP response from API should have code 200, was #{response.code} #{error} #{body}"
         assert(response = JSON.parse(body), 'Delete response should be JSON')
         assert(response["success"], 'Deleting user should be a success')
       end
-      domain = property('domain.full_suffix')
-      identities_url = couchdb_url("/identities/_design/Identity/_view/by_address?key=%22#{user.username}@#{domain}%22")
-      get(identities_url) do |body, response, error|
-        assert error.nil?, "Error checking identities db: #{error}"
-        assert response.code.to_i == 200, "Unable to check that user identity was deleted: HTTP response from API should have code 200, was #{response.code} #{error} #{body}"
-        assert(response = JSON.parse(body), 'Couch response should be JSON')
-        assert response['rows'].empty?, "Identity should have been deleted for test user #{user.username} (id #{user.id}), but was not! Response was: #{body}."
-      end
     end
   end
 
+
 end
diff --git a/tests/helpers/client_side_db.py b/tests/helpers/client_side_db.py
new file mode 100644
index 00000000..2f8c220f
--- /dev/null
+++ b/tests/helpers/client_side_db.py
@@ -0,0 +1,167 @@
+import logging
+import os
+import tempfile
+import getpass
+import binascii
+import json
+
+try:
+    import requests
+    import srp._pysrp as srp
+except ImportError:
+    pass
+
+from twisted.internet.defer import inlineCallbacks
+
+from leap.soledad.client import Soledad
+
+
+"""
+Helper functions to give access to client-side Soledad database.
+Copied over from soledad/scripts folder.
+"""
+
+# create a logger
+logger = logging.getLogger(__name__)
+
+# DEBUG: enable debug logs
+# LOG_FORMAT = '%(asctime)s %(message)s'
+# logging.basicConfig(format=LOG_FORMAT, level=logging.DEBUG)
+
+
+safe_unhexlify = lambda x: binascii.unhexlify(x) if (
+    len(x) % 2 == 0) else binascii.unhexlify('0' + x)
+
+
+def _fail(reason):
+    logger.error('Fail: ' + reason)
+    exit(2)
+
+
+def get_soledad_instance(uuid, passphrase, basedir, server_url, cert_file,
+                         token):
+    # setup soledad info
+    logger.info('UUID is %s' % uuid)
+    logger.info('Server URL is %s' % server_url)
+    secrets_path = os.path.join(
+        basedir, '%s.secret' % uuid)
+    local_db_path = os.path.join(
+        basedir, '%s.db' % uuid)
+    # instantiate soledad
+    return Soledad(
+        uuid,
+        unicode(passphrase),
+        secrets_path=secrets_path,
+        local_db_path=local_db_path,
+        server_url=server_url,
+        cert_file=cert_file,
+        auth_token=token,
+        defer_encryption=True)
+
+
+def _get_api_info(provider):
+    info = requests.get(
+        'https://'+provider+'/provider.json', verify=False).json()
+    return info['api_uri'], info['api_version']
+
+
+def _login(username, passphrase, provider, api_uri, api_version):
+    usr = srp.User(username, passphrase, srp.SHA256, srp.NG_1024)
+    auth = None
+    try:
+        auth = _authenticate(api_uri, api_version, usr).json()
+    except requests.exceptions.ConnectionError:
+        _fail('Could not connect to server.')
+    if 'errors' in auth:
+        _fail(str(auth['errors']))
+    return api_uri, api_version, auth
+
+
+def _authenticate(api_uri, api_version, usr):
+    api_url = "%s/%s" % (api_uri, api_version)
+    session = requests.session()
+    uname, A = usr.start_authentication()
+    params = {'login': uname, 'A': binascii.hexlify(A)}
+    init = session.post(
+        api_url + '/sessions', data=params, verify=False).json()
+    if 'errors' in init:
+        _fail('test user not found')
+    M = usr.process_challenge(
+        safe_unhexlify(init['salt']), safe_unhexlify(init['B']))
+    return session.put(api_url + '/sessions/' + uname, verify=False,
+                       data={'client_auth': binascii.hexlify(M)})
+
+
+def _get_soledad_info(username, provider, passphrase, basedir):
+    api_uri, api_version = _get_api_info(provider)
+    auth = _login(username, passphrase, provider, api_uri, api_version)
+    # get soledad server url
+    service_url = '%s/%s/config/soledad-service.json' % \
+                  (api_uri, api_version)
+    soledad_hosts = requests.get(service_url, verify=False).json()['hosts']
+    hostnames = soledad_hosts.keys()
+    # allow for choosing the host
+    host = hostnames[0]
+    if len(hostnames) > 1:
+        i = 1
+        print "There are many available hosts:"
+        for h in hostnames:
+            print "  (%d) %s.%s" % (i, h, provider)
+            i += 1
+        choice = raw_input("Choose a host to use (default: 1): ")
+        if choice != '':
+            host = hostnames[int(choice) - 1]
+    server_url = 'https://%s:%d/user-%s' % \
+        (soledad_hosts[host]['hostname'], soledad_hosts[host]['port'],
+         auth[2]['id'])
+    # get provider ca certificate
+    ca_cert = requests.get('https://%s/ca.crt' % provider, verify=False).text
+    cert_file = os.path.join(basedir, 'ca.crt')
+    with open(cert_file, 'w') as f:
+        f.write(ca_cert)
+    return auth[2]['id'], server_url, cert_file, auth[2]['token']
+
+
+def _get_passphrase(args):
+    passphrase = args.passphrase
+    if passphrase is None:
+        passphrase = getpass.getpass(
+            'Password for %s@%s: ' % (args.username, args.provider))
+    return passphrase
+
+
+def _get_basedir(args):
+    basedir = args.basedir
+    if basedir is None:
+        basedir = tempfile.mkdtemp()
+    elif not os.path.isdir(basedir):
+        os.mkdir(basedir)
+    logger.info('Using %s as base directory.' % basedir)
+    return basedir
+
+
+@inlineCallbacks
+def _export_key(args, km, fname, private=False):
+    address = args.username + "@" + args.provider
+    pkey = yield km.get_key(
+        address, OpenPGPKey, private=private, fetch_remote=False)
+    with open(args.export_private_key, "w") as f:
+        f.write(pkey.key_data)
+
+
+@inlineCallbacks
+def _export_incoming_messages(soledad, directory):
+    yield soledad.create_index("by-incoming", "bool(incoming)")
+    docs = yield soledad.get_from_index("by-incoming", '1')
+    i = 1
+    for doc in docs:
+        with open(os.path.join(directory, "message_%d.gpg" % i), "w") as f:
+            f.write(doc.content["_enc_json"])
+        i += 1
+
+
+@inlineCallbacks
+def _get_all_docs(soledad):
+    _, docs = yield soledad.get_all_docs()
+    for doc in docs:
+        print json.dumps(doc.content, indent=4)
diff --git a/tests/helpers/couchdb_helper.rb b/tests/helpers/couchdb_helper.rb
index d4d3c0e0..b9085c1e 100644
--- a/tests/helpers/couchdb_helper.rb
+++ b/tests/helpers/couchdb_helper.rb
@@ -15,6 +15,7 @@ class LeapTest
   #         connect_port: 15984
   #
   def couchdb_urls_via_stunnel(path="", options=nil)
+    path = path.gsub('"', '%22')
     if options && options[:username] && options[:password]
       userpart = "%{username}:%{password}@" % options
     else
@@ -46,6 +47,7 @@ class LeapTest
   #         writable: true
   #
   def couchdb_url_via_haproxy(path="", options=nil)
+    path = path.gsub('"', '%22')
     if options && options[:username] && options[:password]
       userpart = "%{username}:%{password}@" % options
     else
@@ -66,6 +68,7 @@ class LeapTest
   #   port: 5984
   #
   def couchdb_url_via_localhost(path="", options=nil)
+    path = path.gsub('"', '%22')
     port = (options && options[:port]) || assert_property('couch.port')
     if options && options[:username]
       password = property("couch.users.%{username}.password" % options)
@@ -100,4 +103,40 @@ class LeapTest
     end
   end
 
+  def assert_destroy_user_db(user_id, options=nil)
+    db_name = "user-#{user_id}"
+    url = couchdb_url("/#{db_name}", options)
+    http_options = {:ok_codes => [200, 404]} # ignore missing dbs
+    assert_delete(url, nil, http_options)
+  end
+
+  def assert_create_user_db(user_id, options=nil)
+    db_name = "user-#{user_id}"
+    url = couchdb_url("/#{db_name}", options)
+    http_options = {:ok_codes => [200, 404]} # ignore missing dbs
+    assert_put(url, nil, :format => :json) do |body|
+      assert response = JSON.parse(body), "PUT response should be JSON"
+      assert response["ok"], "PUT response should be OK"
+    end
+  end
+
+  #
+  # returns true if the per-user db created by soledad-server exists.
+  #
+  def user_db_exists?(user_id, options=nil)
+    db_name = "user-#{user_id}"
+    url = couchdb_url("/#{db_name}", options)
+    get(url) do |body, response, error|
+      if response.nil?
+        fail "could not query couchdb #{url}: #{error}\n#{body}"
+      elsif response.code.to_i == 200
+        return true
+      elsif response.code.to_i == 404
+        return false
+      else
+        fail ["could not query couchdb #{url}: expected response code 200 or 404, but got #{response.code}.", error, body].compact.join("\n")
+      end
+    end
+  end
+
 end
\ No newline at end of file
diff --git a/tests/helpers/http_helper.rb b/tests/helpers/http_helper.rb
index 0b13b754..0d0bb7d5 100644
--- a/tests/helpers/http_helper.rb
+++ b/tests/helpers/http_helper.rb
@@ -81,19 +81,31 @@ class LeapTest
 
   #
   # calls http_send, yielding results if successful or failing with
-  # descriptive infor otherwise.
+  # descriptive info otherwise.
+  #
+  # options:
+  # - error_msg: custom error message to display.
+  # - ok_codes: in addition to 2xx, codes in this array will not produce an error.
   #
   def assert_http_send(method, url, params=nil, options=nil, &block)
     options ||= {}
     error_msg = options[:error_msg] || (url.respond_to?(:memo) ? url.memo : nil)
     http_send(method, url, params, options) do |body, response, error|
-      if body && response && response.code.to_i >= 200 && response.code.to_i < 300
-        if block
-          yield(body) if block.arity == 1
-          yield(response, body) if block.arity == 2
+      if response
+        code = response.code.to_i
+        ok = code >= 200 && code < 300
+        if options[:ok_codes]
+          ok ||= options[:ok_codes].include?(code)
+        end
+        if ok
+          if block
+            yield(body) if block.arity == 1
+            yield(body, response) if block.arity == 2
+            yield(body, response, error) if block.arity == 3
+          end
+        else
+          fail ["Expected success code from #{method} #{url}, but got #{response.code} instead.", error_msg, body].compact.join("\n")
         end
-      elsif response
-        fail ["Expected a 200 status code from #{method} #{url}, but got #{response.code} instead.", error_msg, body].compact.join("\n")
       else
         fail ["Expected a response from #{method} #{url}, but got \"#{error}\" instead.", error_msg, body].compact.join("\n"), error
       end
diff --git a/tests/helpers/os_helper.rb b/tests/helpers/os_helper.rb
index aad67dda..da9ac843 100644
--- a/tests/helpers/os_helper.rb
+++ b/tests/helpers/os_helper.rb
@@ -9,7 +9,10 @@ class LeapTest
     output.each_line.map{|line|
       pid = line.split(' ')[0]
       process = line.gsub(/(#{pid} |\n)/, '')
-      if process =~ /pgrep --full --list-name/
+      # filter out pgrep cmd itself
+      # on wheezy hosts, the "process" var contains the whole cmd including all parameters
+      # on jessie hosts, it only contains the first cmd (which is the default sheel invoked by 'sh')
+      if process =~ /^sh/
         nil
       else
         {:pid => pid, :process => process}
diff --git a/tests/helpers/smtp_helper.rb b/tests/helpers/smtp_helper.rb
new file mode 100644
index 00000000..ea7fb9fa
--- /dev/null
+++ b/tests/helpers/smtp_helper.rb
@@ -0,0 +1,45 @@
+require 'net/smtp'
+
+class LeapTest
+
+  TEST_EMAIL_USER = "test_user_email"
+  TEST_BAD_USER = "test_user_bad"
+
+  MSG_BODY = %(Since it seems that any heart which beats for freedom has the right only to a
+lump of lead, I too claim my share. If you let me live, I shall never stop
+crying for revenge and I shall avenge my brothers. I have finished. If you are
+not cowards, kill me!
+
+--Louise Michel)
+
+  def send_email(recipient, options={})
+    sender = options[:sender] || recipient
+    helo_domain = property('domain.full_suffix')
+    headers = {
+      "Date" => Time.now.utc,
+      "From" => sender,
+      "To" => recipient,
+      "Subject" => "Test Message",
+      "X-LEAP-TEST" => "true"
+    }.merge(options[:headers]||{})
+    message = []
+    headers.each do |key, value|
+      message << "#{key}: #{value}"
+    end
+    message << ""
+    message << MSG_BODY
+    Net::SMTP.start('localhost', 25, helo_domain) do |smtp|
+      smtp.send_message message.join("\n"), recipient, sender
+    end
+  end
+
+  def assert_send_email(recipient, options={})
+    begin
+      send_email(recipient, options)
+    rescue IOError, Net::OpenTimeout,
+           Net::ReadTimeout, Net::SMTPError => e
+      fail "Could not send mail to #{recipient} (#{e})"
+    end
+  end
+
+end
\ No newline at end of file
diff --git a/tests/helpers/soledad_sync.py b/tests/helpers/soledad_sync.py
index 2fb865fc..f4fc81ae 100755
--- a/tests/helpers/soledad_sync.py
+++ b/tests/helpers/soledad_sync.py
@@ -1,78 +1,89 @@
 #!/usr/bin/env python
+"""
+soledad_sync.py
 
-#
-# Test Soledad sync
-#
-# This script performs a slightly modified U1DB sync to the Soledad server and
-# returns whether that sync was successful or not.
-#
-# It takes three arguments:
-#
-#   uuid   -- uuid of the user to sync
-#   token  -- a valid session token
-#   server -- the url of the soledad server we should connect to
-#
-# For example:
-#
-#   soledad_sync.py f6bef0586fcfdb8705e26a58f2d9e580 uYO-4ucEJFksJ6afjmcYwIyap2vW7bv6uLxk0w_RfCc https://199.119.112.9:2323/user-f6bef0586fcfdb8705e26a58f2d9e580
-#
+This script exercises soledad synchronization.
+Its exit code is 0 if the sync took place correctly, 1 otherwise.
 
+It takes 5 arguments:
+
+  uuid: uuid of the user to sync
+  token: a valid session token
+  server: the url of the soledad server we should connect to
+  cert_file: the file containing the certificate for the CA that signed the
+             cert for the soledad server.
+  password: the password for the user to sync
+
+__author__: kali@leap.se
+"""
 import os
+import shutil
 import sys
-import traceback
 import tempfile
-import shutil
-import u1db
 
-from u1db.remote.http_target import HTTPSyncTarget
+# This is needed because the twisted shipped with wheezy is too old
+# to do proper ssl verification.
+os.environ['SKIP_TWISTED_SSL_CHECK'] = '1'
+
+from twisted.internet import defer, reactor
+from twisted.python import log
+
+from client_side_db import get_soledad_instance
+from leap.common.events import flags
+
+flags.set_events_enabled(False)
+
+NUMDOCS = 1
+USAGE = "Usage: %s uuid token server cert_file password" % sys.argv[0]
 
-#
-# monkey patch U1DB's HTTPSyncTarget to perform token based auth
-#
 
-def set_token_credentials(self, uuid, token):
-    self._creds = {'token': (uuid, token)}
+def bail(msg, exitcode):
+    print "[!] %s" % msg
+    sys.exit(exitcode)
 
-def _sign_request(self, method, url_query, params):
-    uuid, token = self._creds['token']
-    auth = '%s:%s' % (uuid, token)
-    return [('Authorization', 'Token %s' % auth.encode('base64')[:-1])]
 
-HTTPSyncTarget.set_token_credentials = set_token_credentials
-HTTPSyncTarget._sign_request = _sign_request
+def create_docs(soledad):
+    """
+    Populates the soledad database with dummy messages, so we can exercise
+    sending payloads during the sync.
+    """
+    deferreds = []
+    for index in xrange(NUMDOCS):
+        deferreds.append(soledad.create_doc({'payload': 'dummy'}))
+    return defer.gatherResults(deferreds)
 
-#
-# Create a temporary local u1db replica and attempt to sync to it.
-# Returns a failure message if something went wrong.
-#
+# main program
+
+if __name__ == '__main__':
 
-def soledad_sync(uuid, token, server):
     tempdir = tempfile.mkdtemp()
-    try:
-        db = u1db.open(os.path.join(tempdir, '%s.db' % uuid), True)
-        creds = {'token': {'uuid': uuid, 'token': token}}
-        db.sync(server, creds=creds, autocreate=False)
-    finally:
+
+    def rm_tempdir():
         shutil.rmtree(tempdir)
 
-#
-# exit codes:
-#
-# 0 - OK
-# 1 - WARNING
-# 2 - ERROR
-#
+    if len(sys.argv) < 6:
+        bail(USAGE, 2)
 
-if __name__ == '__main__':
-    try:
-        uuid, token, server = sys.argv[1:]
-        result = soledad_sync(uuid, token, server)
-        if result is None:
-            exit(0)
-        else:
-            print(result)
-            exit(1)
-    except Exception as exc:
-        print(exc.message or str(exc))
-        traceback.print_exc(file=sys.stdout)
-        exit(2)
+    uuid, token, server, cert_file, passphrase = sys.argv[1:]
+    s = get_soledad_instance(
+        uuid, passphrase, tempdir, server, cert_file, token)
+
+    def onSyncDone(sync_result):
+        print "SYNC_RESULT:", sync_result
+        s.close()
+        rm_tempdir()
+        reactor.stop()
+
+    def log_and_exit(f):
+        log.err(f)
+        rm_tempdir()
+        reactor.stop()
+
+    def start_sync():
+        d = create_docs(s)
+        d.addCallback(lambda _: s.sync())
+        d.addCallback(onSyncDone)
+        d.addErrback(log_and_exit)
+
+    reactor.callWhenRunning(start_sync)
+    reactor.run()
diff --git a/tests/helpers/srp_helper.rb b/tests/helpers/srp_helper.rb
index 5d30b459..b30fa768 100644
--- a/tests/helpers/srp_helper.rb
+++ b/tests/helpers/srp_helper.rb
@@ -138,8 +138,8 @@ d15dc7d7b46154d6b6ce8ef4ad69b15d4982559b297bcf1885c529f566660e5
 
     attr_accessor :username, :password, :salt, :verifier, :id, :session_token, :ok, :deleted
 
-    def initialize
-      @username = "test_user_" + SecureRandom.urlsafe_base64(10).downcase.gsub(/[_-]/, '')
+    def initialize(username=nil)
+      @username = username || "tmp_user_" + SecureRandom.urlsafe_base64(10).downcase.gsub(/[_-]/, '')
       @password = "password_" + SecureRandom.urlsafe_base64(10)
       @salt     = bigrand(4).hex
       @verifier = modpow(GENERATOR, private_key)