1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
require 'test_helper'
require_relative 'rack_test'
class AccountFlowTest < RackTest
setup do
@login = "integration_test_user"
Identity.find_by_address(@login + '@' + APP_CONFIG[:domain]).tap{|i| i.destroy if i}
User.find_by_login(@login).tap{|u| u.destroy if u}
@password = "srp, verify me!"
@srp = SRP::Client.new @login, :password => @password
@user_params = {
:login => @login,
:password_verifier => @srp.verifier.to_s(16),
:password_salt => @srp.salt.to_s(16)
}
post 'http://api.lvh.me:3000/1/users.json', :user => @user_params
@user = User.find_by_login(@login)
end
teardown do
if @user.reload
@user.identity.destroy
@user.destroy
end
Warden.test_reset!
end
# this test wraps the api and implements the interface the ruby-srp client.
def handshake(login, aa)
post "http://api.lvh.me:3000/1/sessions.json",
:login => login,
'A' => aa,
:format => :json
response = JSON.parse(last_response.body)
if response['errors']
raise RECORD_NOT_FOUND.new(response['errors'])
else
return response['B']
end
end
def validate(m)
put "http://api.lvh.me:3000/1/sessions/" + @login + '.json',
:client_auth => m,
:format => :json
return JSON.parse(last_response.body)
end
test "signup response" do
assert_json_response :login => @login, :ok => true
assert last_response.successful?
end
test "signup and login with srp via api" do
server_auth = @srp.authenticate(self)
assert last_response.successful?
assert_nil server_auth["errors"]
assert server_auth["M2"]
end
test "signup and wrong password login attempt" do
srp = SRP::Client.new @login, :password => "wrong password"
server_auth = srp.authenticate(self)
assert_json_error "base" => "Not a valid username/password combination"
assert !last_response.successful?
assert_nil server_auth["M2"]
end
test "signup and wrong username login attempt" do
srp = SRP::Client.new "wrong_login", :password => @password
server_auth = nil
assert_raises RECORD_NOT_FOUND do
server_auth = srp.authenticate(self)
end
assert_json_error "base" => "Not a valid username/password combination"
assert !last_response.successful?
assert_nil server_auth
end
test "update password via api" do
@srp.authenticate(self)
@password = "No! Verify me instead."
@srp = SRP::Client.new @login, :password => @password
@user_params = {
# :login => @login,
:password_verifier => @srp.verifier.to_s(16),
:password_salt => @srp.salt.to_s(16)
}
put "http://api.lvh.me:3000/1/users/" + @user.id + '.json',
:user => @user_params,
:format => :json
server_auth = @srp.authenticate(self)
assert last_response.successful?
assert_nil server_auth["errors"]
assert server_auth["M2"]
end
test "update user" do
server_auth = @srp.authenticate(self)
test_public_key = 'asdlfkjslfdkjasd'
original_login = @user.login
new_login = 'zaph'
User.find_by_login(new_login).try(:destroy)
Identity.by_address.key(new_login + '@' + APP_CONFIG[:domain]).each do |identity|
identity.destroy
end
put "http://api.lvh.me:3000/1/users/" + @user.id + '.json', :user => {:public_key => test_public_key, :login => new_login}, :format => :json
assert last_response.successful?
assert_equal test_public_key, Identity.for(@user).keys[:pgp]
# does not change login if no password_verifier is present
assert_equal original_login, @user.login
# eventually probably want to remove most of this into a non-integration functional test
# should not overwrite public key:
put "http://api.lvh.me:3000/1/users/" + @user.id + '.json', :user => {:blee => :blah}, :format => :json
assert_equal test_public_key, Identity.for(@user).keys[:pgp]
# should overwrite public key:
put "http://api.lvh.me:3000/1/users/" + @user.id + '.json', :user => {:public_key => nil}, :format => :json
assert_nil Identity.for(@user).keys[:pgp]
end
end
|
