|
@@ -1,16 +1,20 @@
|
|
|
|
|
+import com.weEat.controllers.UserController
|
|
|
import play.api.test.Helpers._
|
|
import play.api.test.Helpers._
|
|
|
-import play.api.test.{FakeRequest,WithApplication}
|
|
|
|
|
|
|
+import play.api.test.FakeRequest
|
|
|
import play.api.mvc.{Results,Headers}
|
|
import play.api.mvc.{Results,Headers}
|
|
|
-import play.api.libs.json.{JsObject,Json}
|
|
|
|
|
|
|
+import play.api.libs.json.Json
|
|
|
import org.scalatest.BeforeAndAfterAll
|
|
import org.scalatest.BeforeAndAfterAll
|
|
|
-import org.scalatest.tagobjects.Slow
|
|
|
|
|
import org.scalatestplus.play._
|
|
import org.scalatestplus.play._
|
|
|
import org.scalatestplus.play.guice.GuiceOneServerPerSuite
|
|
import org.scalatestplus.play.guice.GuiceOneServerPerSuite
|
|
|
import com.weEat.shared.models.{User,UserAuthorization}
|
|
import com.weEat.shared.models.{User,UserAuthorization}
|
|
|
-import scala.concurrent.duration._
|
|
|
|
|
import java.util.Base64
|
|
import java.util.Base64
|
|
|
|
|
+import org.bson.types.ObjectId
|
|
|
|
|
+import scala.concurrent.Future
|
|
|
|
|
+import javax.inject.Inject
|
|
|
|
|
|
|
|
-class OAuthSpec extends PlaySpec
|
|
|
|
|
|
|
+class OAuthSpec @Inject()(
|
|
|
|
|
+ userController: UserController
|
|
|
|
|
+) extends PlaySpec
|
|
|
with BeforeAndAfterAll
|
|
with BeforeAndAfterAll
|
|
|
with Results
|
|
with Results
|
|
|
with GuiceOneServerPerSuite {
|
|
with GuiceOneServerPerSuite {
|
|
@@ -21,8 +25,8 @@ class OAuthSpec extends PlaySpec
|
|
|
val lname = "user"
|
|
val lname = "user"
|
|
|
|
|
|
|
|
val users = Seq(
|
|
val users = Seq(
|
|
|
- (User("test", "user", "tuser@sample.org"), "password"),
|
|
|
|
|
- (User("another", "user", "usert@sample.org"), "password")
|
|
|
|
|
|
|
+ (User(new ObjectId(), "test", "user", "tuser@sample.org"), "password"),
|
|
|
|
|
+ (User(new ObjectId(), "another", "user", "usert@sample.org"), "password")
|
|
|
)
|
|
)
|
|
|
|
|
|
|
|
implicit class CSRFWrapper[T](requ: FakeRequest[T]) {
|
|
implicit class CSRFWrapper[T](requ: FakeRequest[T]) {
|
|
@@ -38,8 +42,8 @@ class OAuthSpec extends PlaySpec
|
|
|
Headers(("Authorization" -> s"${auth.tokenType} ${auth.accessToken}"))
|
|
Headers(("Authorization" -> s"${auth.tokenType} ${auth.accessToken}"))
|
|
|
|
|
|
|
|
override def beforeAll() = {
|
|
override def beforeAll() = {
|
|
|
- for ((User(fname, lname, email), password) <- users) {
|
|
|
|
|
- val Some(resp) = route(app, FakeRequest(PUT, "/user/").withJsonBody(
|
|
|
|
|
|
|
+ for ((User(_, fname, lname, email), password) <- users) {
|
|
|
|
|
+ val Some(resp) = route(app, FakeRequest(PUT, "/v1/user/").withJsonBody(
|
|
|
Json.parse(s"""|{
|
|
Json.parse(s"""|{
|
|
|
| "fname": "$fname",
|
|
| "fname": "$fname",
|
|
|
| "lname": "$lname",
|
|
| "lname": "$lname",
|
|
@@ -51,6 +55,22 @@ class OAuthSpec extends PlaySpec
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
+ override def afterAll() = {
|
|
|
|
|
+ implicit val ec: scala.concurrent.ExecutionContext = scala.concurrent.ExecutionContext.global
|
|
|
|
|
+ Future.sequence(Seq(
|
|
|
|
|
+ userController.deleteUser(users(0)._1._id),
|
|
|
|
|
+ )).map { (deletes) =>
|
|
|
|
|
+ deletes must matchPattern {
|
|
|
|
|
+ case Seq(_) =>
|
|
|
|
|
+ }
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
|
|
+ // val Some(resp) = route(app, FakeRequest(DELETE, s"/v1/user/${users(0)._id}"))
|
|
|
|
|
+ // status(resp) mustEqual OK
|
|
|
|
|
+ // val Some(resp) = route(app, FakeRequest(DELETE, s"/v1/user/${users(1)._id}"))
|
|
|
|
|
+ // status(resp) mustEqual OK
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
"the token endpoint" should {
|
|
"the token endpoint" should {
|
|
|
"reject an empty request" in {
|
|
"reject an empty request" in {
|
|
|
val Some(resp) = route(app, FakeRequest(POST, "/authorize/")
|
|
val Some(resp) = route(app, FakeRequest(POST, "/authorize/")
|
|
@@ -98,7 +118,7 @@ class OAuthSpec extends PlaySpec
|
|
|
)
|
|
)
|
|
|
status(resp) mustEqual OK
|
|
status(resp) mustEqual OK
|
|
|
contentAsJson(resp).as[UserAuthorization] must matchPattern {
|
|
contentAsJson(resp).as[UserAuthorization] must matchPattern {
|
|
|
- case UserAuthorization(_, _, _, _) =>
|
|
|
|
|
|
|
+ case UserAuthorization(_, _, _, _, _) =>
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
|
|
|
|
@@ -113,10 +133,10 @@ class OAuthSpec extends PlaySpec
|
|
|
val resp1Auth = contentAsJson(resp1).as[UserAuthorization]
|
|
val resp1Auth = contentAsJson(resp1).as[UserAuthorization]
|
|
|
val resp2Auth = contentAsJson(resp2).as[UserAuthorization]
|
|
val resp2Auth = contentAsJson(resp2).as[UserAuthorization]
|
|
|
resp1Auth must matchPattern {
|
|
resp1Auth must matchPattern {
|
|
|
- case UserAuthorization(_, _, _, _) =>
|
|
|
|
|
|
|
+ case UserAuthorization(_, _, _, _, _) =>
|
|
|
}
|
|
}
|
|
|
resp2Auth must matchPattern {
|
|
resp2Auth must matchPattern {
|
|
|
- case UserAuthorization(_, _, _, _) =>
|
|
|
|
|
|
|
+ case UserAuthorization(_, _, _, _, _) =>
|
|
|
}
|
|
}
|
|
|
resp1Auth.accessToken mustNot equal(resp2Auth.accessToken)
|
|
resp1Auth.accessToken mustNot equal(resp2Auth.accessToken)
|
|
|
resp1Auth.refreshToken mustNot equal(resp2Auth.refreshToken)
|
|
resp1Auth.refreshToken mustNot equal(resp2Auth.refreshToken)
|
|
@@ -194,7 +214,7 @@ class OAuthSpec extends PlaySpec
|
|
|
status(resp) mustEqual OK
|
|
status(resp) mustEqual OK
|
|
|
val newAuth = contentAsJson(resp).as[UserAuthorization]
|
|
val newAuth = contentAsJson(resp).as[UserAuthorization]
|
|
|
newAuth must matchPattern {
|
|
newAuth must matchPattern {
|
|
|
- case UserAuthorization(_, _, _, _) =>
|
|
|
|
|
|
|
+ case UserAuthorization(_, _, _, _, _) =>
|
|
|
}
|
|
}
|
|
|
newAuth.accessToken mustNot equal(auth.accessToken)
|
|
newAuth.accessToken mustNot equal(auth.accessToken)
|
|
|
newAuth.refreshToken mustNot equal(auth.refreshToken)
|
|
newAuth.refreshToken mustNot equal(auth.refreshToken)
|
|
@@ -217,7 +237,7 @@ class OAuthSpec extends PlaySpec
|
|
|
)
|
|
)
|
|
|
status(resp1) mustEqual OK
|
|
status(resp1) mustEqual OK
|
|
|
contentAsJson(resp1).as[UserAuthorization] must matchPattern {
|
|
contentAsJson(resp1).as[UserAuthorization] must matchPattern {
|
|
|
- case UserAuthorization(_, _, _, _) =>
|
|
|
|
|
|
|
+ case UserAuthorization(_, _, _, _, _) =>
|
|
|
}
|
|
}
|
|
|
val Some(resp2) = route(app, FakeRequest(POST, "/authorize/")
|
|
val Some(resp2) = route(app, FakeRequest(POST, "/authorize/")
|
|
|
.withJsonBody(Json.parse(s"""|{
|
|
.withJsonBody(Json.parse(s"""|{
|
|
@@ -293,8 +313,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withHeaders(makeAuthHeader(users(0)._1.email, users(0)._2))
|
|
.withHeaders(makeAuthHeader(users(0)._1.email, users(0)._2))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
).get).as[UserAuthorization]
|
|
).get).as[UserAuthorization]
|
|
|
- val fakeToken = (auth.refreshToken.charAt(0)+1) +
|
|
|
|
|
- auth.refreshToken.substring(1);
|
|
|
|
|
|
|
+ val fakeToken = s"${auth.refreshToken.charAt(0)+1}${auth.refreshToken.substring(1)}";
|
|
|
val Some(resp) = route(app, FakeRequest(POST, "/authorize/")
|
|
val Some(resp) = route(app, FakeRequest(POST, "/authorize/")
|
|
|
.withJsonBody(Json.parse(s"""|{
|
|
.withJsonBody(Json.parse(s"""|{
|
|
|
| "grant_type": "refresh_token",
|
|
| "grant_type": "refresh_token",
|
|
@@ -318,7 +337,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withHeaders(makeAuthHeader(email, password))
|
|
.withHeaders(makeAuthHeader(email, password))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
).get).as[UserAuthorization]
|
|
).get).as[UserAuthorization]
|
|
|
- val Some(resp) = route(app, FakeRequest(GET, "/user/self/name/")
|
|
|
|
|
|
|
+ val Some(resp) = route(app, FakeRequest(GET, "/v1/user/self/name/")
|
|
|
.withHeaders(makeAuthHeader(auth))
|
|
.withHeaders(makeAuthHeader(auth))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
@@ -328,7 +347,7 @@ class OAuthSpec extends PlaySpec
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
"reject an unauthorized request" in {
|
|
"reject an unauthorized request" in {
|
|
|
- val Some(resp) = route(app, FakeRequest(GET, "/user/self/name/")
|
|
|
|
|
|
|
+ val Some(resp) = route(app, FakeRequest(GET, "/v1/user/self/name/")
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
|
status(resp) mustEqual BAD_REQUEST
|
|
status(resp) mustEqual BAD_REQUEST
|
|
@@ -340,7 +359,7 @@ class OAuthSpec extends PlaySpec
|
|
|
|
|
|
|
|
"reject an forged authorized request" in {
|
|
"reject an forged authorized request" in {
|
|
|
val fakeToken = "7pKNy790TV5lKVjQw3k/pwJmMS8XBhHaLTVaI6ftd5M="
|
|
val fakeToken = "7pKNy790TV5lKVjQw3k/pwJmMS8XBhHaLTVaI6ftd5M="
|
|
|
- val Some(resp) = route(app, FakeRequest(GET, "/user/self/name/")
|
|
|
|
|
|
|
+ val Some(resp) = route(app, FakeRequest(GET, "/v1/user/self/name/")
|
|
|
.withHeaders(("Authorization" -> s"Bearer $fakeToken"))
|
|
.withHeaders(("Authorization" -> s"Bearer $fakeToken"))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
@@ -366,7 +385,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
|
status(resp1) mustEqual OK
|
|
status(resp1) mustEqual OK
|
|
|
- val Some(resp2) = route(app, FakeRequest(GET, "/user/self/name/")
|
|
|
|
|
|
|
+ val Some(resp2) = route(app, FakeRequest(GET, "/v1/user/self/name/")
|
|
|
.withHeaders(makeAuthHeader(auth))
|
|
.withHeaders(makeAuthHeader(auth))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
@@ -393,7 +412,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
|
status(resp1) mustEqual OK
|
|
status(resp1) mustEqual OK
|
|
|
- val Some(resp2) = route(app, FakeRequest(GET, "/user/self/name/")
|
|
|
|
|
|
|
+ val Some(resp2) = route(app, FakeRequest(GET, "/v1/user/self/name/")
|
|
|
.withHeaders(makeAuthHeader(auth))
|
|
.withHeaders(makeAuthHeader(auth))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
)
|
|
)
|
|
@@ -411,7 +430,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withHeaders(makeAuthHeader(email, password))
|
|
.withHeaders(makeAuthHeader(email, password))
|
|
|
).get).as[UserAuthorization]
|
|
).get).as[UserAuthorization]
|
|
|
Thread.sleep((1 hour).toMillis)
|
|
Thread.sleep((1 hour).toMillis)
|
|
|
- val Some(resp) = route(app, FakeRequest(GET, "/user/self/name/")
|
|
|
|
|
|
|
+ val Some(resp) = route(app, FakeRequest(GET, "/v1/user/self/name/")
|
|
|
.withHeaders(makeAuthHeader(auth)))
|
|
.withHeaders(makeAuthHeader(auth)))
|
|
|
status(resp) mustEqual UNAUTHORIZED
|
|
status(resp) mustEqual UNAUTHORIZED
|
|
|
headers(resp) must contain ("WWW-Authenticate" ->
|
|
headers(resp) must contain ("WWW-Authenticate" ->
|
|
@@ -448,8 +467,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withHeaders(makeAuthHeader(users(0)._1.email, users(0)._2))
|
|
.withHeaders(makeAuthHeader(users(0)._1.email, users(0)._2))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
).get).as[UserAuthorization]
|
|
).get).as[UserAuthorization]
|
|
|
- val fakeToken = (auth.accessToken.charAt(0)+1) +
|
|
|
|
|
- auth.accessToken.substring(1);
|
|
|
|
|
|
|
+ val fakeToken = s"${auth.accessToken.charAt(0)+1}${auth.accessToken.substring(1)}";
|
|
|
val Some(resp) = route(app, FakeRequest(DELETE, "/authorize/")
|
|
val Some(resp) = route(app, FakeRequest(DELETE, "/authorize/")
|
|
|
.withJsonBody(Json.parse(s"""|{
|
|
.withJsonBody(Json.parse(s"""|{
|
|
|
| "grant_type": "refresh_token",
|
|
| "grant_type": "refresh_token",
|
|
@@ -493,8 +511,7 @@ class OAuthSpec extends PlaySpec
|
|
|
.withHeaders(makeAuthHeader(users(0)._1.email, users(0)._2))
|
|
.withHeaders(makeAuthHeader(users(0)._1.email, users(0)._2))
|
|
|
.withCSRFToken()
|
|
.withCSRFToken()
|
|
|
).get).as[UserAuthorization]
|
|
).get).as[UserAuthorization]
|
|
|
- val fakeToken = (auth.refreshToken.charAt(0)+1) +
|
|
|
|
|
- auth.refreshToken.substring(1);
|
|
|
|
|
|
|
+ val fakeToken = s"${auth.refreshToken.charAt(0)+1}${auth.refreshToken.substring(1)}";
|
|
|
val Some(resp) = route(app, FakeRequest(DELETE, "/authorize/")
|
|
val Some(resp) = route(app, FakeRequest(DELETE, "/authorize/")
|
|
|
.withJsonBody(Json.parse(s"""|{
|
|
.withJsonBody(Json.parse(s"""|{
|
|
|
| "grant_type": "refresh_token",
|
|
| "grant_type": "refresh_token",
|