ó
ûR‹_c           @   sø  d  d l  Z  d  d l Z d  d l Z d  d l Z d  d l Z y d  d l m Z Wn e k
 ro d  d l Z n Xd  d l Z	 d  d l
 m Z d  d l m Z m Z d  d l m Z d  d l m Z d  d l m Z m Z d Z d	 „  Z d
 e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ d e j f d „  ƒ  YZ  d e j f d „  ƒ  YZ! d d  d „  ƒ  YZ" d S(!   iÿÿÿÿN(   t   mock(   t   MemoryCache(   t   Clientt   scope_matches(   t   _decoded(   t   unittest(   t   urlparset   parse_qss   https://server/v1c           C   sJ   t  j t  j d d t t j j t j j t ƒ d ƒ ƒ j	 ƒ  d d ƒd  S(   Ns   https://server/v1/jwkst   bodys	   jwks.jsont   content_types   application/json(
   t	   responsest   addt   GETt   opent   ost   patht   joint   dirnamet   __file__t   read(    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   add_jwks_response   s    -t   TestClientServerUrlc           B   s,   e  Z d  „  Z d „  Z d „  Z d „  Z RS(   c         C   s,   t  d d d ƒ } |  j | j j t ƒ d  S(   Nt   abct   cakes   https://server/(   R   t   assertEqualt	   apiclientt
   server_urlt   TEST_SERVER_URL(   t   selft   client(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt/   test_trailing_slash_without_prefix_added_prefix#   s    c         C   s,   t  d d d ƒ } |  j | j j t ƒ d  S(   NR   R   s   https://server(   R   R   R   R   R   (   R   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt    test_without_prefix_added_prefix'   s    c         C   s,   t  d d d ƒ } |  j | j j t ƒ d  S(   NR   R   s   https://server/v1/(   R   R   R   R   R   (   R   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_trailing_slash_with_prefix+   s    c         C   s,   t  d d d ƒ } |  j | j j t ƒ d  S(   NR   R   s   https://server/v1(   R   R   R   R   R   (   R   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_with_prefix/   s    (   t   __name__t
   __module__R   R   R    R!   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR   "   s   			t   TestClientTradeCodec           B   sŒ   e  Z e Z e j d  „  ƒ Z d „  Z d „  Z d „  Z	 d „  Z
 e j d „  ƒ Z e j d „  ƒ Z e j d „  ƒ Z e j d „  ƒ Z RS(	   c         C   sf   t  d d |  j ƒ |  _ d } t j t j d d | d d ƒ|  j j d ƒ |  _ t j d	 |  _	 d  S(
   NR   R   s   {"access_token": "yeah"}s   https://server/v1/tokenR   R	   s   application/jsont   1234i    (
   R   R   R   R
   R   t   POSTt
   trade_codet   tokenst   callst   response(   R   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   setUp8   s    c         C   s    t  j t t j d j j ƒ ƒ S(   Ni    (   t   jsont   loadsR   R
   R)   t   requestR   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   _get_request_bodyE   s    c         C   s   |  j  |  j j j d ƒ d  S(   Ns   https://server/v1/token(   R   R*   R.   t   url(   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt    test_reaches_server_on_token_urlH   s    c         C   sM   t  j t |  j j j ƒ ƒ } i d d 6d d 6d d 6} |  j | | ƒ d  S(   NR   t   client_secretR%   t   codeR   t	   client_id(   R,   R-   R   R*   R.   R   R   (   R   R   t   expected(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_posts_code_to_serverL   s    
c         C   s   |  j  |  j d d ƒ d  S(   Nt   access_tokent   yeah(   R   R(   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt)   test_returns_access_token_given_by_serverU   s    c      	   C   sQ   t  j t  j d d d d d ƒ|  j t j j |  j j d d d d	 d
 d ƒd  S(   Ns   https://server/v1/tokenR   s   {"missing": "token"}R	   s   application/jsonR4   R   R2   R   R3   R%   (	   R
   R   R&   t   assertRaisest   fxat   errorst   OutOfProtocolErrorR   R'   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt.   test_raises_error_if_access_token_not_returnedX   s    c         C   sà   t  j t  j d d d d d ƒ|  j j d d d ƒ } |  j | i d	 d
 6ƒ |  j |  j ƒ  i d d 6d d 6d d 6ƒ |  j j d d d d d d ƒ } |  j | i d	 d
 6ƒ |  j |  j ƒ  i d d 6d d 6d d 6ƒ d  S(   Ns   https://server/v1/tokenR   s   {"access_token": "tokay"}R	   s   application/jsonR%   R   t   cake2t   tokayR7   R4   R2   R3   (   R
   R   R&   R   R'   R   R/   (   R   R(   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt9   test_trade_token_can_take_client_credentials_as_argumentsd   s&    	c         C   s‡   t  j t  j d d d d d ƒ|  j j d d d d	 ƒ } |  j | i d
 d 6ƒ |  j |  j ƒ  i d d 6d d 6d d 6d	 d 6ƒ d  S(   Ns   https://server/v1/tokenR   s   {"access_token": "tokay"}R	   s   application/jsonR3   R%   t   code_verifiert   verifymeR@   R7   R   R4   R   R2   (   R
   R   R&   R   R'   R   R/   (   R   R(   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt3   test_trade_token_can_take_pkce_verifier_as_argument   s    	c         C   s‡   t  j t  j d d d d d ƒ|  j j d d d d	 ƒ } |  j | i d
 d 6ƒ |  j |  j ƒ  i d d 6d d 6d d 6d	 d 6ƒ d  S(   Ns   https://server/v1/tokenR   s   {"access_token": "tokay"}R	   s   application/jsonR3   R%   t   ttlix   R@   R7   R   R4   R   R2   (   R
   R   R&   R   R'   R   R/   (   R   R(   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_trade_token_can_take_ttl‘   s    	(   R"   R#   R   R   R
   t   activateR+   R/   R1   R6   R9   R>   RA   RD   RF   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR$   4   s   					t   TestAuthClientVerifyCodec           B   s_   e  Z e Z e j d  „  ƒ Z d „  Z d „  Z d „  Z	 e j d „  ƒ Z
 e j d „  ƒ Z RS(   c         C   sm   t  d |  j ƒ |  _ d } t j t j d d | d d ƒt ƒ  |  j j d d ƒ |  _ t j	 d	 |  _
 d  S(
   NR   s;   {"user": "alice", "scope": ["profile"], "client_id": "abc"}s   https://server/v1/verifyR   R	   s   application/jsont   tokenR   i   (   R   R   R   R
   R   R&   R   t   verify_tokent   verificationR)   R*   (   R   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR+   ¨   s    c         C   s   |  j  |  j j j d ƒ d  S(   Ns   https://server/v1/verify(   R   R*   R.   R0   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt!   test_reaches_server_on_verify_urlµ   s    c         C   s?   t  j t |  j j j ƒ ƒ } i d d 6} |  j | | ƒ d  S(   NR   RI   (   R,   R-   R   R*   R.   R   R   (   R   R   R5   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_posts_token_to_server¹   s    
c         C   s5   i d d 6d g d 6d d 6} |  j  |  j | ƒ d  S(   Nt   alicet   usert   profilet   scopeR   R4   (   R   RK   (   R   R5   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt%   test_returns_response_given_by_serverÀ   s
    

c         C   sL   t  j t  j d d d d d ƒt ƒ  |  j t j j |  j j	 d d ƒd  S(   Ns   https://server/v1/verifyR   s   {"missing": "attributes"}R	   s   application/jsonRI   R%   (
   R
   R   R&   R   R:   R;   R<   R=   R   RJ   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt5   test_raises_error_if_some_attributes_are_not_returnedÈ   s    c         C   sX   d } t  j t  j d d | d d ƒt ƒ  |  j t j j |  j j	 d d d d	 ƒd  S(
   Ns9   {"user": "alice", "scope": ["files"], "client_id": "abc"}s   https://server/v1/verifyR   R	   s   application/jsonRI   R%   RQ   t   readinglist(
   R
   R   R&   R   R:   R;   R<   t   ScopeMismatchErrorR   RJ   (   R   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_raises_error_if_scopes_do_not_matchÓ   s    (   R"   R#   R   R   R
   RG   R+   RL   RM   RR   RS   RV   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyRH   ¤   s   			t   TestOAuthClientRedirectURLc           B   s;   e  Z e Z e j d  „  ƒ Z d „  Z d „  Z d „  Z	 RS(   c         C   s   t  d d |  j ƒ|  _ d  S(   Nt   abcdefR   (   R   R   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR+   å   s    c         C   sÅ   t  |  j j ƒ  ƒ } t  |  j ƒ } |  j | j | j ƒ |  j | j | j d ƒ t | j d t	 ƒ} |  j t
 | j ƒ  ƒ d d g ƒ |  j | d d |  j j ƒ |  j | d d d ƒ d  S(   Ns   /authorizationt   keep_blank_valuesR4   t   statei    t    (   R   R   t   get_redirect_urlR   R   t   hostnameR   R   t   queryt   Truet   sortedt   keysR4   (   R   t   redirect_urlR   t   params(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_redirect_url_with_default_argumentsé   s    "c         C   sn   t  |  j j d d ƒ ƒ } t | j d t ƒ} |  j t | j ƒ  ƒ d d g ƒ |  j | d d d ƒ d  S(   NR4   t   XXRY   RZ   i    (	   R   R   R\   R   R^   R_   R   R`   Ra   (   R   Rb   Rc   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_redirect_url_takes_custom_client_idô   s    "c         C   sÅ  t  |  j j d d d d d d d d d	 d
 d d d d d d d d ƒ 	ƒ } t  |  j ƒ } |  j | j | j ƒ t | j d t ƒ} d d	 d d d d d d d d g
 } |  j t	 | j
 ƒ  ƒ t	 | ƒ ƒ |  j | d d |  j j ƒ |  j | d d d ƒ |  j | d d d ƒ |  j | d d d ƒ |  j | d d d ƒ |  j | d	 d d
 ƒ |  j | d d d ƒ |  j | d d d ƒ |  j | d d d ƒ |  j | d d d ƒ d  S(   NRZ   t   applicationstatet   redirect_uris   https://my.site/oauthRQ   s   profile profile:emailt   actiont   signupt   emails   test@example.comt   code_challenget	   challenget   code_challenge_methodt   S1234t   access_typet   offlinet   keys_jwkt   MockJWKRY   R4   i    (   R   R   R\   R   R   R]   R   R^   R_   R`   Ra   R4   (   R   Rb   R   Rc   t
   all_params(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt-   test_redirect_url_takes_custom_url_parametersú   s6    "(
   R"   R#   R   R   R
   RG   R+   Rd   Rf   Ru   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyRW   á   s
   		t   TestAuthClientAuthorizeCodec           B   sq   e  Z e Z d  „  Z e j d „  ƒ Z e j d „  ƒ Z e j d „  ƒ Z	 e j d „  ƒ Z
 e j d „  ƒ Z RS(   c         C   sG   d „  } t  d d d |  j ƒ|  _ t j t j d d | d d ƒd  S(	   Nc         S   sU   t  j t |  j ƒ ƒ } i d d 6} i d j | d ƒ d 6} d | t  j | ƒ f S(   Ns   application/jsons   Content-Types%   https://relier/page?code=qed&state={}RZ   t   redirectiÈ   (   R,   R-   R   R   t   formatt   dumps(   R.   t   datat   headersR   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   authorization_callback  s    
R   t   xyzR   s   https://server/v1/authorizationt   callbackR	   s   application/json(   R   R   R   R
   t   add_callbackR&   (   R   R|   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR+     s    	
c         C   s|   d } |  j  j | ƒ } |  j | d ƒ t j t t j d j j	 ƒ ƒ } |  j | i | d 6|  j  j
 d 6t ƒ  d 6ƒ d  S(   Nt   A_FAKE_ASSERTIONt   qedi    t	   assertionR4   RZ   (   R   t   authorize_codeR   R,   R-   R   R
   R)   R.   R   R4   t   AnyStringValue(   R   R‚   R3   t   req_body(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt*   test_authorize_code_with_default_arguments.  s    "c         C   s‰   d } |  j  j | d d ƒ} |  j | d ƒ t j t t j d j j	 ƒ ƒ } |  j | i | d 6|  j  j
 d 6t ƒ  d 6d d 6ƒ d  S(	   NR€   RQ   s   profile:emailR�   i    R‚   R4   RZ   (   R   Rƒ   R   R,   R-   R   R
   R)   R.   R   R4   R„   (   R   R‚   R3   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt'   test_authorize_code_with_explicit_scope:  s    "
c         C   s|   d } |  j  j | d d ƒ} |  j | d ƒ t j t t j d j j	 ƒ ƒ } |  j | i | d 6d d 6t
 ƒ  d 6ƒ d  S(   NR€   R4   t   cbaR�   i    R‚   RZ   (   R   Rƒ   R   R,   R-   R   R
   R)   R.   R   R„   (   R   R‚   R3   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt+   test_authorize_code_with_explicit_client_idG  s    "c         C   sß   d } |  j  j ƒ  \ } } |  j t | ƒ d d g ƒ |  j t | ƒ d g ƒ |  j  j | | � } |  j | d ƒ t j t t j	 d j
 j ƒ ƒ } |  j | i | d 6|  j  j d 6t ƒ  d	 6| d d 6| d d 6ƒ d  S(
   NR€   Rl   Rn   RB   R�   i    R‚   R4   RZ   (   R   t   generate_pkce_challengeR   R`   Rƒ   R,   R-   R   R
   R)   R.   R   R4   R„   (   R   R‚   Rm   t   verifierR3   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt'   test_authorize_code_with_pkce_challengeS  s    
"
c         C   s­   t  j ƒ  } d | j _ |  j j | ƒ } | j j d t d |  j j ƒ |  j	 | d ƒ t
 j t t j d j j ƒ ƒ } |  j	 | i d d 6|  j j d 6t ƒ  d 6ƒ d  S(	   Nt   IDENTITYt   audiencet   serviceR�   i    R‚   R4   RZ   (   R    t   Mockt   get_identity_assertiont   return_valueR   Rƒ   t   assert_called_once_withR   R4   R   R,   R-   R   R
   R)   R.   R   R„   (   R   t   sessionR3   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt'   test_authorize_code_with_session_objectf  s    "(   R"   R#   R   R   R+   R
   RG   R†   R‡   R‰   RŒ   R•   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyRv     s   	t   TestAuthClientAuthorizeTokenc           B   s_   e  Z e Z d  „  Z e j d „  ƒ Z e j d „  ƒ Z e j d „  ƒ Z	 e j d „  ƒ Z
 RS(   c         C   sE   t  d d d |  j ƒ|  _ t j t j d d d d d ƒt ƒ  d  S(	   NR   R}   R   s   https://server/v1/authorizationR   s   {"access_token": "izatoken"}R	   s   application/json(   R   R   R   R
   R   R&   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR+   |  s    c         C   sƒ   d } |  j  j | ƒ } |  j | d ƒ t j t t j d j j	 ƒ ƒ } |  j | i | d 6|  j  j
 d 6t ƒ  d 6d d 6ƒ d  S(	   NR€   t   izatokeni    R‚   R4   RZ   RI   t   response_type(   R   t   authorize_tokenR   R,   R-   R   R
   R)   R.   R   R4   R„   (   R   R‚   RI   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt+   test_authorize_token_with_default_arguments„  s    "
c         C   s�   d } |  j  j | d d ƒ} |  j | d ƒ t j t t j d j j	 ƒ ƒ } |  j | i | d 6|  j  j
 d 6t ƒ  d 6d	 d
 6d d 6ƒ d  S(   NR€   RQ   t   storageR—   i    R‚   R4   RZ   RI   R˜   (   R   R™   R   R,   R-   R   R
   R)   R.   R   R4   R„   (   R   R‚   RI   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_authorize_token_with_explicit_scope‘  s    "
c         C   sƒ   d } |  j  j | d d ƒ} |  j | d ƒ t j t t j d j j	 ƒ ƒ } |  j | i | d 6d d 6t
 ƒ  d 6d d	 6ƒ d  S(
   NR€   R4   Rˆ   R—   i    R‚   RZ   RI   R˜   (   R   R™   R   R,   R-   R   R
   R)   R.   R   R„   (   R   R‚   RI   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt,   test_authorize_token_with_explicit_client_idŸ  s    "
c         C   s´   t  j ƒ  } d | j _ |  j j | ƒ } | j j d t d |  j j ƒ |  j	 | d ƒ t
 j t t j d j j ƒ ƒ } |  j	 | i d d 6|  j j d 6t ƒ  d 6d	 d
 6ƒ d  S(   NR�   RŽ   R�   R—   i    R‚   R4   RZ   RI   R˜   (   R    R�   R‘   R’   R   R™   R“   R   R4   R   R,   R-   R   R
   R)   R.   R   R„   (   R   R”   RI   R…   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_authorize_token_with_session_object¬  s    "
(   R"   R#   R   R   R+   R
   RG   Rš   Rœ   R�   Rž   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR–   x  s   	t   TestScopeMatchc           B   sb   e  Z d  „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z	 d „  Z
 d	 „  Z RS(
   c         C   s   |  j  t d g g  ƒ ƒ d  S(   NR   (   t
   assertTrueR   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_always_matches_if_required_is_emptyÀ  s    c         C   sC   |  j  t d g d ƒ ƒ |  j t ƒ � t d g d  ƒ Wd  QXd  S(   NR   R[   (   t   assertFalseR   R:   t	   Exceptiont   None(   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt+   test_do_not_match_if_invalid_scope_providedÃ  s    c         C   s9   |  j  t d g d ƒ ƒ |  j  t d g d g ƒ ƒ d  S(   NR   t   def(   R¢   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt.   test_do_not_match_if_root_scopes_are_differentÈ  s    c         C   s?   |  j  t d d g d ƒ ƒ |  j  t d d g d g ƒ ƒ d  S(   NR   R¦   (   R    R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_matches_if_root_scopes_are_the_sameÌ  s    c         C   s#   |  j  t d g d d g ƒ ƒ d  S(   NR   R¦   (   R¢   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt/   test_matches_if_one_of_required_is_not_providedÐ  s    c         C   s}   |  j  t d g d ƒ ƒ |  j  t d g d g ƒ ƒ |  j  t d d g d d g ƒ ƒ |  j  t d d g d d g ƒ ƒ d  S(   NR   s   abc:xyzR¦   s   def:123(   R    R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt&   test_matches_if_required_is_a_subscopeÓ  s    "c         C   s<   |  j  t d g d ƒ ƒ |  j  t d g d d g ƒ ƒ d  S(   Ns   abc:xyzs   abc:123(   R¢   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt+   test_do_not_match_if_subscopes_do_not_matchÙ  s    c         C   s[   |  j  t d g d ƒ ƒ |  j  t d g d g ƒ ƒ |  j  t d d g d d g ƒ ƒ d  S(   Ns   abc:xyzR   R¦   (   R¢   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt+   test_do_not_match_if_provided_is_a_subscopeÝ  s    c         C   së   d d g d d g d d g d d g d d g d d g d d g d d g d d	 g d d
 g d d g d d g d d g d d g d d g d d g d d g g } xE | D]= \ } } |  j  t | j ƒ  | j ƒ  ƒ d j | | ƒ ƒ q¦ Wd  S(   Ns   profile:writeRP   s   profile:emails   profile:email:writes   profile profile:email:writes   profile:display_names1   profile https://identity.mozilla.com/apps/oldsyncs   foo bar:bazs   foo:dees   bar:bazs   foo:mah:pa bar:baz:quuxs)   https://identity.mozilla.com/apps/oldsyncs.   https://identity.mozilla.com/apps/oldsync#reads3   https://identity.mozilla.com/apps/oldsync/bookmarkss8   https://identity.mozilla.com/apps/oldsync/bookmarks#reads6   https://identity.mozilla.com/apps/oldsync#read profiles   "{}" should match "{}"(   R    R   t   splitRx   (   R   t   VALID_MATCHESt   providedt   required(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt-   test_published_test_vectors_for_valid_matchesâ  s4    											c         C   sâ   d d g d d g d d g d d g d d g d d	 g d
 d g d d	 g d	 d g d d g d d g d d g d d g d d g d	 d g d d g g } xE | D]= \ } } |  j  t | j ƒ  | j ƒ  ƒ d j | | ƒ ƒ q� Wd  S(   Ns   profile:email:writeRP   s   profile:writes   profile:emails   profile:display_namet   profilebogeys   foo bar:bazt   bars)   https://identity.mozilla.com/apps/oldsyncs   profile profile:email:writet   httpss.   https://identity.mozilla.com/apps/oldsync#reads2   https://identity.mozila.com/apps/oldsync/bookmarkss/   https://identity.mozilla.com/apps/oldsync#writes7   https://identity.mozila.com/apps/oldsync/bookmarks#reads3   https://identity.mozilla.com/apps/oldsync/bookmarkss(   https://identity.mozila.com/apps/oldsyncs2   https://identity.mozila.com/apps/oldsync/passwordss+   https://identity.mozilla.com/apps/oldsyncers*   https://identity.mozila.com/apps/oldsyncers)   https://identity.mozilla.org/apps/oldsyncs   "{}" should not match "{}"(   R¢   R   R­   Rx   (   R   t   INVALID_MATCHESR¯   R°   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt/   test_published_test_vectors_for_invalid_matches   s4    									(   R"   R#   R¡   R¥   R§   R¨   R©   Rª   R«   R¬   R±   R¶   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyRŸ   ¿  s   									t   TestCachedClientc           B   sh   e  Z e Z d  „  Z d „  Z d „  Z d „  Z e j	 d „  ƒ Z
 e j	 d „  ƒ Z e j	 d „  ƒ Z RS(   c         C   sK   t  d |  j ƒ |  _ d |  _ t j t j d d |  j d d ƒt ƒ  d  S(   NR   s:   {"user": "alice", "scope": ["profile"],"client_id": "abc"}s   https://server/v1/verifyR   R	   s   application/json(   R   R   R   R   R
   R   R&   R   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR+   "  s    		c         C   s0   |  j  |  j j ƒ |  j |  j j j d ƒ d  S(   Ni,  (   t   assertIsNotNoneR   t   cacheR   RE   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_has_default_cache,  s    c         C   sQ   t  d ƒ } t d | ƒ |  _ |  j |  j j | ƒ |  j |  j j j d ƒ d  S(   Ng{®Gáz„?R¹   (   R   R   R   R   R¹   RE   (   R   R¹   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_can_change_default_cache0  s    c         C   s)   t  d d  ƒ |  _ |  j |  j j ƒ d  S(   NR¹   (   R   R¤   R   t   assertIsNoneR¹   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_can_deactivate_cache6  s    c         C   s‘   t  j j |  j j d ƒ �p } t  j j |  j j d d d  ƒ�F |  j j d d ƒ } |  j | j ƒ |  j	 | t
 j |  j ƒ ƒ Wd  QXWd  QXd  S(   Nt   sett   getR’   RI   R   (   R    t   patcht   objectR   R¹   R¤   RJ   R    t   calledt   assertDictEqualR,   R-   R   (   R   t
   mocked_setRK   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt!   test_client_verify_code_is_cached:  s    
c         C   s”   t  j j |  j j d ƒ �s } t  j j |  j j d d |  j ƒ�F |  j j d d ƒ } |  j | j ƒ |  j	 | t
 j |  j ƒ ƒ Wd  QXWd  QXd  S(   NR¾   R¿   R’   RI   R   (   R    RÀ   RÁ   R   R¹   R   RJ   R¢   RÂ   RÃ   R,   R-   (   R   RÄ   RK   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt,   test_client_verify_code_cached_value_is_usedD  s    c         C   s�   t  d d  d |  j ƒ |  _ |  j j d d ƒ } |  j | t j |  j ƒ ƒ |  j j d d ƒ } |  j | t j |  j ƒ ƒ d  S(   NR¹   R   RI   R   (	   R   R¤   R   R   RJ   RÃ   R,   R-   R   (   R   RK   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt<   test_client_verify_code_cached_value_is_not_used_if_no_cacheN  s
    (   R"   R#   R   R   R+   Rº   R»   R½   R
   RG   RÅ   RÆ   RÇ   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR·     s   	
			

t   TestGeventPatchc           B   s&   e  Z e j e j d  ƒ d „  ƒ Z RS(   s   gevent works only with Python 2c         C   sv   d d  l  } d d  l } d d  l } | j j } | j ƒ  |  j | j j | ƒ |  j | j j | ƒ | | j _ d  S(   Niÿÿÿÿ(   R;   t
   fxa._utilst	   grequestst   _utilst   requestst   monkey_patch_for_geventt   assertNotEqualR   (   R   R;   RÊ   t   old_requests(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_monkey_patch_for_gevent\  s    
(   R"   R#   R   t
   skipUnlesst   sixt   PY2RÐ   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyRÈ   Z  s   t   TestJwtTokenc           B   sØ   e  Z e Z d  „  Z d i d d 6d „ Z d „  Z d „  Z e j	 d „  ƒ Z
 e j	 d „  ƒ Z e j	 d	 „  ƒ Z e j	 d
 „  ƒ Z e j	 d „  ƒ Z e j	 d „  ƒ Z e j	 d „  ƒ Z e j	 d „  ƒ Z d „  Z RS(   c         C   s&   |  j  r d i  |  j f Sd i  d f S(   NiÈ   iô  s   {}(   t   verify_will_succeedR   (   R   R.   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR~   n  s    	t   RS256s   at+jwtt   typc         C   s+   | j  ƒ  } t j t j | | | | ƒ ƒ S(   N(   t   copyRÒ   t   ensure_textt   jwtt   encode(   R   t   payloadt   keyt   algt   header(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt	   _make_jwts  s    c         C   sT   t  d |  j ƒ |  _ d |  _ t j t j d d |  j d d ƒt ƒ  t	 |  _
 d  S(   NR   s:   {"user": "alice", "scope": ["profile"],"client_id": "abc"}s   https://server/v1/verifyR~   R	   s   application/json(   R   R   R   R   R
   R   R&   R~   R   R_   RÕ   (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR+   w  s    		c         C   s:   t  j j j t t j j t j j t	 ƒ | ƒ ƒ j
 ƒ  ƒ S(   N(   RÚ   t
   algorithmst   RSAAlgorithmt   from_jwkR   R   R   R   R   R   R   (   R   t   filename(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   get_file_contents‚  s    	c         C   s   |  j  d ƒ } |  j i d d 6d d 6d d 6| ƒ } |  j j | ƒ x2 t j D]' } | j j d k rP t d	 ƒ ‚ qP qP Wd  S(
   Ns   private-key.jsont   asdft   subt   qwerRQ   t   fooR4   s   https://server/v1/verifysu   testing with a good token should not have                                  resulted in a call to /verify, but it did.(	   Rå   Rà   R   RJ   R
   R)   R.   R0   R£   (   R   t   private_keyRI   t   c(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_good_jwt_tokenŠ  s    		c         C   sŒ   |  j  d ƒ } |  j i d d 6d d 6d d 6| d i d	 d
 6ƒ} |  j j | ƒ x2 t j D]' } | j j d k r] t d ƒ ‚ q] q] Wd  S(   Ns   private-key.jsonRæ   Rç   Rè   RQ   Ré   R4   Rß   s   application/at+JWTR×   s   https://server/v1/verifysu   testing with a good token should not have                                  resulted in a call to /verify, but it did.(	   Rå   Rà   R   RJ   R
   R)   R.   R0   R£   (   R   Rê   RI   Rë   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt-   test_good_jwt_token_with_long_form_typ_header˜  s    		c         C   sP   |  j  d ƒ } |  j i d d 6d d 6d d 6| ƒ } |  j j | d d ƒd  S(	   Ns   private-key.jsonRæ   Rç   s   qwer teeRQ   Ré   R4   t   tee(   Rå   Rà   R   RJ   (   R   Rê   RI   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt&   test_good_jwt_token_with_correct_scope¨  s    		c         C   sl   |  j  d ƒ } |  j i d d 6d d 6d d 6| ƒ } |  j t j j ƒ � |  j j | d d ƒWd  QXd  S(	   Ns   private-key.jsonRæ   Rç   Rè   RQ   Ré   R4   Rî   (   Rå   Rà   R:   R;   R<   t
   TrustErrorR   RJ   (   R   Rê   RI   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt(   test_good_jwt_token_with_incorrect_scope²  s    		c         C   s�   t  |  _ |  j d ƒ } |  j i  | ƒ } |  j t j j ƒ � |  j j	 | ƒ Wd  QXx2 t
 j D]' } | j j d k r` t d ƒ ‚ q` q` Wd  S(   Ns   bad-key.jsons   https://server/v1/verifys“   testing with a well-formed token with invalid signature                                  should not have resulted in a call to /verify, but it did.(   t   FalseRÕ   Rå   Rà   R:   R;   R<   Rð   R   RJ   R
   R)   R.   R0   R£   (   R   t   bad_keyRI   Rë   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_wrong_key_jwt_token½  s    	c         C   s_   |  j  d ƒ } |  j i d d 6d d 6| ƒ } |  j t j j ƒ � |  j j | ƒ Wd  QXd  S(   Ns   private-key.jsonRæ   Rè   i    t   exp(   Rå   Rà   R:   R;   R<   Rð   R   RJ   (   R   Rê   RI   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_expired_jwt_tokenÉ  s     c         C   sl   |  j  d ƒ } |  j i d d 6d d 6| d i d d 6ƒ} |  j t j j ƒ � |  j j | ƒ Wd  QXd  S(	   Ns   private-key.jsonRæ   Rè   i    Rõ   Rß   s   rt+jwtR×   (   Rå   Rà   R:   R;   R<   Rð   R   RJ   (   R   Rê   RI   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_jwt_token_with_wrong_typÐ  s
     c         C   so   t  |  _ |  j t j j ƒ � |  j j d ƒ Wd  QXx3 t j	 D] } | j
 j d k r? Pq? q? Wt d ƒ ‚ d  S(   Nt   garbages   https://server/v1/verifyse   testing with a garbage token should have                              called /verify, but it did not.(   Rò   RÕ   R:   R;   R<   t   ServerErrorR   RJ   R
   R)   R.   R0   R£   (   R   Rë   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_garbage_jwt_tokenÙ  s    	c      
   C   s  t  d |  j d g  ƒ } |  j | j g  ƒ t j j t j j t ƒ d ƒ } t	 j
 t | ƒ j ƒ  ƒ d } t  d |  j d | ƒ } |  j | j | ƒ | j d ƒ |  j t ƒ � t  d |  j d | ƒ Wd  QX| j ƒ  d | d d <|  j t j j ƒ � t  d |  j d | ƒ Wd  QXd  S(	   NR   t   jwkss	   jwks.jsonRa   s&   this is not the JWK you're looking fort
   InvalidKtyi    t   kty(   R   R   R   Rû   R   R   R   R   R   R,   R-   R   R   t   appendR:   t   AttributeErrort   popRÚ   t
   exceptionst   InvalidKeyError(   R   R   t	   jwks_fileRû   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   test_jwks_param_validationå  s    !
(   R"   R#   R   R   R~   Rà   R+   Rå   R
   RG   Rì   Rí   Rï   Rñ   Rô   Rö   R÷   Rú   R  (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyRÔ   j  s   			
	R„   c           B   s   e  Z d  „  Z d „  Z RS(   c         C   s   t  | t j ƒ S(   N(   t
   isinstanceRÒ   t   string_types(   R   t   other(    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   __eq__ú  s    c         C   s   d S(   Ns
   any string(    (   R   (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   __repr__ý  s    (   R"   R#   R  R	  (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyR„   ø  s   	(    (#   R   R,   RÚ   R
   RÒ   R   R    t   ImportErrort
   fxa.errorsR;   t	   fxa.cacheR   t	   fxa.oauthR   R   RÉ   R   t   fxa.tests.utilst   six.moves.urllib.parseR   R   R   R   t   TestCaseR   R$   RH   RW   Rv   R–   RŸ   R·   RÈ   RÔ   R„   (    (    (    sM   /var/www/syncserver/local/lib/python2.7/site-packages/fxa/tests/test_oauth.pyt   <module>   s6   	p=8_G`;Ž