diff options
Diffstat (limited to 'test/rubygems/test_gem_gemcutter_utilities.rb')
| -rw-r--r-- | test/rubygems/test_gem_gemcutter_utilities.rb | 213 |
1 files changed, 151 insertions, 62 deletions
diff --git a/test/rubygems/test_gem_gemcutter_utilities.rb b/test/rubygems/test_gem_gemcutter_utilities.rb index 2ca5b402d9..a3236e6276 100644 --- a/test/rubygems/test_gem_gemcutter_utilities.rb +++ b/test/rubygems/test_gem_gemcutter_utilities.rb @@ -1,14 +1,18 @@ # frozen_string_literal: true + require_relative "helper" +require_relative "multifactor_auth_utilities" require "rubygems" require "rubygems/command" require "rubygems/gemcutter_utilities" +require "rubygems/config_file" class TestGemGemcutterUtilities < Gem::TestCase def setup super credential_setup + @fetcher = SignInFetcher.new # below needed for random testing, class property Gem.configuration.disable_default_gem_server = nil @@ -38,7 +42,7 @@ class TestGemGemcutterUtilities < Gem::TestCase } File.open Gem.configuration.credentials_path, "w" do |f| - f.write keys.to_yaml + f.write Gem::ConfigFile.dump_with_rubygems_yaml(keys) end ENV["RUBYGEMS_HOST"] = "http://rubygems.engineyard.com" @@ -49,10 +53,10 @@ class TestGemGemcutterUtilities < Gem::TestCase end def test_api_key - keys = { :rubygems_api_key => "KEY" } + keys = { rubygems_api_key: "KEY" } File.open Gem.configuration.credentials_path, "w" do |f| - f.write keys.to_yaml + f.write Gem::ConfigFile.dump_with_rubygems_yaml(keys) end Gem.configuration.load_api_keys @@ -61,10 +65,10 @@ class TestGemGemcutterUtilities < Gem::TestCase end def test_api_key_override - keys = { :rubygems_api_key => "KEY", :other => "OTHER" } + keys = { rubygems_api_key: "KEY", other: "OTHER" } File.open Gem.configuration.credentials_path, "w" do |f| - f.write keys.to_yaml + f.write Gem::ConfigFile.dump_with_rubygems_yaml(keys) end Gem.configuration.load_api_keys @@ -92,120 +96,111 @@ class TestGemGemcutterUtilities < Gem::TestCase end def test_sign_in - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - util_sign_in [api_key, 200, "OK"] + util_sign_in - assert_match %r{Enter your RubyGems.org credentials.}, @sign_in_ui.output + assert_match(/Enter your RubyGems.org credentials./, @sign_in_ui.output) assert @fetcher.last_request["authorization"] - assert_match %r{Signed in.}, @sign_in_ui.output + assert_match(/Signed in./, @sign_in_ui.output) credentials = load_yaml_file Gem.configuration.credentials_path - assert_equal api_key, credentials[:rubygems_api_key] + assert_equal @fetcher.api_key, credentials[:rubygems_api_key] end def test_sign_in_with_host - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - - util_sign_in [api_key, 200, "OK"], "http://example.com", ["http://example.com"] + @fetcher = SignInFetcher.new(host: "http://example.com") + util_sign_in assert_match "Enter your http://example.com credentials.", @sign_in_ui.output assert @fetcher.last_request["authorization"] - assert_match %r{Signed in.}, @sign_in_ui.output + assert_match(/Signed in./, @sign_in_ui.output) credentials = load_yaml_file Gem.configuration.credentials_path - assert_equal api_key, credentials["http://example.com"] + assert_equal @fetcher.api_key, credentials["http://example.com"] end def test_sign_in_with_host_nil - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - - util_sign_in [api_key, 200, "OK"], nil, [nil] + @fetcher = SignInFetcher.new(host: nil) + util_sign_in(args: [nil]) assert_match "Enter your RubyGems.org credentials.", @sign_in_ui.output assert @fetcher.last_request["authorization"] - assert_match %r{Signed in.}, @sign_in_ui.output + assert_match(/Signed in./, @sign_in_ui.output) credentials = load_yaml_file Gem.configuration.credentials_path - assert_equal api_key, credentials[:rubygems_api_key] + assert_equal @fetcher.api_key, credentials[:rubygems_api_key] end def test_sign_in_with_host_ENV - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - util_sign_in [api_key, 200, "OK"], "http://example.com" + @fetcher = SignInFetcher.new(host: "http://example.com") + util_sign_in assert_match "Enter your http://example.com credentials.", @sign_in_ui.output assert @fetcher.last_request["authorization"] - assert_match %r{Signed in.}, @sign_in_ui.output + assert_match(/Signed in./, @sign_in_ui.output) credentials = load_yaml_file Gem.configuration.credentials_path - assert_equal api_key, credentials["http://example.com"] + assert_equal @fetcher.api_key, credentials["http://example.com"] end def test_sign_in_skips_with_existing_credentials - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - Gem.configuration.rubygems_api_key = api_key + Gem.configuration.rubygems_api_key = @fetcher.api_key - util_sign_in [api_key, 200, "OK"] + util_sign_in assert_equal "", @sign_in_ui.output end def test_sign_in_skips_with_key_override - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" Gem.configuration.api_keys[:KEY] = "other" @cmd.options[:key] = :KEY - util_sign_in [api_key, 200, "OK"] + util_sign_in assert_equal "", @sign_in_ui.output end def test_sign_in_with_other_credentials_doesnt_overwrite_other_keys - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" other_api_key = "f46dbb18bb6a9c97cdc61b5b85c186a17403cdcbf" + config = Hash[:other_api_key, other_api_key] + File.open Gem.configuration.credentials_path, "w" do |f| - f.write Hash[:other_api_key, other_api_key].to_yaml + f.write Gem::ConfigFile.dump_with_rubygems_yaml(config) end - util_sign_in [api_key, 200, "OK"] + util_sign_in - assert_match %r{Enter your RubyGems.org credentials.}, @sign_in_ui.output - assert_match %r{Signed in.}, @sign_in_ui.output + assert_match(/Enter your RubyGems.org credentials./, @sign_in_ui.output) + assert_match(/Signed in./, @sign_in_ui.output) credentials = load_yaml_file Gem.configuration.credentials_path - assert_equal api_key, credentials[:rubygems_api_key] + assert_equal @fetcher.api_key, credentials[:rubygems_api_key] assert_equal other_api_key, credentials[:other_api_key] end def test_sign_in_with_bad_credentials + @fetcher.respond_with_forbidden_api_key_response assert_raise Gem::MockGemUi::TermError do - util_sign_in ["Access Denied.", 403, "Forbidden"] + util_sign_in end - assert_match %r{Enter your RubyGems.org credentials.}, @sign_in_ui.output - assert_match %r{Access Denied.}, @sign_in_ui.output + assert_match(/Enter your RubyGems.org credentials./, @sign_in_ui.output) + assert_match(/Access Denied./, @sign_in_ui.output) end def test_signin_with_env_otp_code ENV["GEM_HOST_OTP_CODE"] = "111111" - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - util_sign_in [api_key, 200, "OK"] + util_sign_in assert_match "Signed in with API key:", @sign_in_ui.output assert_equal "111111", @fetcher.last_request["OTP"] end def test_sign_in_with_correct_otp_code - api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" - response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry." - - util_sign_in(proc do - @call_count ||= 0 - (@call_count += 1).odd? ? [response_fail, 401, "Unauthorized"] : [api_key, 200, "OK"] - end, nil, [], "111111\n") + @fetcher.respond_with_require_otp + util_sign_in(extra_input: "111111\n") assert_match "You have enabled multi-factor authentication. Please enter OTP code.", @sign_in_ui.output assert_match "Code: ", @sign_in_ui.output @@ -216,8 +211,9 @@ class TestGemGemcutterUtilities < Gem::TestCase def test_sign_in_with_incorrect_otp_code response = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry." + @fetcher.respond_with_unauthorized_api_key_response assert_raise Gem::MockGemUi::TermError do - util_sign_in [response, 401, "Unauthorized"], nil, [], "111111\n" + util_sign_in(extra_input: "111111\n") end assert_match "You have enabled multi-factor authentication. Please enter OTP code.", @sign_in_ui.output @@ -226,23 +222,91 @@ class TestGemGemcutterUtilities < Gem::TestCase assert_equal "111111", @fetcher.last_request["OTP"] end - def util_sign_in(response, host = nil, args = [], extra_input = "") - email = "you@example.com" - password = "secret" - profile_response = [ "mfa: disabled\n" , 200, "OK"] + def test_sign_in_with_webauthn_enabled + server = Gem::MockTCPServer.new + + @fetcher.respond_with_require_otp + @fetcher.respond_with_webauthn_url + TCPServer.stub(:new, server) do + Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:otp] = "Uvh6T57tkWuUnWYo" }) do + util_sign_in + end + end + + assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \ + "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \ + "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output + assert_match "You are verified with a security device. You may close the browser window.", @sign_in_ui.output + assert_equal "Uvh6T57tkWuUnWYo", @fetcher.last_request["OTP"] + end + + def test_sign_in_with_webauthn_enabled_with_error + server = Gem::MockTCPServer.new + error = Gem::WebauthnVerificationError.new("Something went wrong") + + @fetcher.respond_with_require_otp + @fetcher.respond_with_webauthn_url + error = assert_raise Gem::MockGemUi::TermError do + TCPServer.stub(:new, server) do + Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:error] = error }) do + util_sign_in + end + end + end + assert_equal 1, error.exit_code + + assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \ + "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \ + "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output + assert_match "ERROR: Security device verification failed: Something went wrong", @sign_in_ui.error + refute_match "You are verified with a security device. You may close the browser window.", @sign_in_ui.output + refute_match "Signed in with API key:", @sign_in_ui.output + end + + def test_sign_in_with_webauthn_enabled_with_polling + server = Gem::MockTCPServer.new + @fetcher.respond_with_require_otp + @fetcher.respond_with_webauthn_url + @fetcher.respond_with_webauthn_polling("Uvh6T57tkWuUnWYo") + + TCPServer.stub(:new, server) do + util_sign_in + end + + assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \ + "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \ + "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output + assert_match "You are verified with a security device. You may close the browser window.", @sign_in_ui.output + assert_equal "Uvh6T57tkWuUnWYo", @fetcher.last_request["OTP"] + end + + def test_sign_in_with_webauthn_enabled_with_polling_failure + server = Gem::MockTCPServer.new + @fetcher.respond_with_require_otp + @fetcher.respond_with_webauthn_url + @fetcher.respond_with_webauthn_polling_failure - if host - ENV["RUBYGEMS_HOST"] = host - else - host = Gem.host + assert_raise Gem::MockGemUi::TermError do + TCPServer.stub(:new, server) do + util_sign_in + end end - @fetcher = Gem::FakeFetcher.new - @fetcher.data["#{host}/api/v1/api_key"] = response - @fetcher.data["#{host}/api/v1/profile/me.yaml"] = profile_response + assert_match "You have enabled multi-factor authentication. Please visit #{@fetcher.webauthn_url_with_port(server.port)} " \ + "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \ + "you can re-run the gem signin command with the `--otp [your_code]` option.", @sign_in_ui.output + assert_match "ERROR: Security device verification failed: " \ + "The token in the link you used has either expired or been used already.", @sign_in_ui.error + end + + def util_sign_in(args: [], extra_input: "") + email = "you@example.com" + password = "secret" + + ENV["RUBYGEMS_HOST"] = @fetcher.host Gem::RemoteFetcher.fetcher = @fetcher - @sign_in_ui = Gem::MockGemUi.new("#{email}\n#{password}\n\n\n\n\n\n\n\n\n" + extra_input) + @sign_in_ui = Gem::MockGemUi.new("#{email}\n#{password}\n\n\n" + extra_input) use_ui @sign_in_ui do if args.length > 0 @@ -254,9 +318,9 @@ class TestGemGemcutterUtilities < Gem::TestCase end def test_verify_api_key - keys = { :other => "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" } + keys = { other: "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" } File.open Gem.configuration.credentials_path, "w" do |f| - f.write keys.to_yaml + f.write Gem::ConfigFile.dump_with_rubygems_yaml(keys) end Gem.configuration.load_api_keys @@ -269,4 +333,29 @@ class TestGemGemcutterUtilities < Gem::TestCase @cmd.verify_api_key :missing end end + + class SignInFetcher < Gem::MultifactorAuthFetcher + attr_reader :api_key + + def initialize(host: nil) + super(host: host) + @api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903" + @data["#{@host}/api/v1/api_key"] = Gem::HTTPResponseFactory.create(body: @api_key, code: 200, msg: "OK") + @data["#{@host}/api/v1/profile/me.yaml"] = Gem::HTTPResponseFactory.create(body: "mfa: disabled\n", code: 200, msg: "OK") + end + + def respond_with_require_otp + super("#{host}/api/v1/api_key", @api_key) + end + + def respond_with_forbidden_api_key_response + @data["#{host}/api/v1/api_key"] = Gem::HTTPResponseFactory.create(body: "Access Denied.", code: 403, msg: "Forbidden") + end + + def respond_with_unauthorized_api_key_response + response = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry." + + @data["#{host}/api/v1/api_key"] = Gem::HTTPResponseFactory.create(body: response, code: 401, msg: "Unauthorized") + end + end end |