Implemented loging with captcha with mencache

Carlos Purificação
1 parent 0d2ac9fb
Showing 6 changed files with 125 additions and 38 deletions Show diff stats
lib/noosfero/api/captcha_session_store.rb
lib/noosfero/api/helpers.rb
lib/noosfero/api/session.rb
lib/noosfero/api/v1/articles.rb
test/unit/api/login_captcha_test.rb
test/unit/api/test_helper.rb
@@ -0,0 +1,30 @@
+class Noosfero::API::CaptchaSessionStore
+
+  attr_accessor :data
+  attr_reader :private_token
+
+  def self.create
+    key = SecureRandom.hex
+    store = Noosfero::API::CaptchaSessionStore.new(key)
+    Rails.cache.write(store.private_token, store, expires_in: 300)
+    return store
+  end
+
+  def initialize(key)
+    @private_token = key
+  end
+
+  def self.get(key)
+    Rails.cache.fetch(key)
+  end
+
+  def store
+    Rails.cache.write(@private_token, self)
+  end
+
+  def destroy
+    Rails.cache.delete(@private_token)
+  end
+
+
+end
@@ -23,8 +23,7 @@ require &#39;grape&#39;
       def current_tmp_user
         private_token = (params[PRIVATE_TOKEN_PARAM] || headers['Private-Token']).to_s
-        @current_tmp_user ||= User.find_by_private_token(private_token)
-        @current_tmp_user = nil if !@current_tmp_user.nil? && @current_tmp_user.private_token_expired?
+        @current_tmp_user = Noosfero::API::CaptchaSessionStore.get(private_token)
         @current_tmp_user
       end
@@ -244,6 +243,13 @@ require &#39;grape&#39;
         unauthorized! unless current_user
       end
+      # Allows the anonymous captcha user authentication 
+      # to pass the check. Used by the articles/vote to allow
+      # the vote without login
+      def authenticate_allow_captcha!
+        unauthorized! unless current_tmp_user || current_user
+      end
+
       # Checks the occurrences of uniqueness of attributes, each attribute must be present in the params hash
       # or a Bad Request error is invoked.
       #
@@ -15,13 +15,9 @@ module Noosfero
         # test_captcha will render_api_error! and exit in case of any problem
         # this return is just to improve the clarity of the execution path
         return unless test_captcha(remote_ip, params, environment)
-
-        name = "tmp_user_#{remote_ip}"
-        user = User.new(:name => name)
-        user.generate_private_token!
-
-        @current_tmp_user = user
-        {:private_token => user.private_token}
+        ## Creates and caches a captcha session store
+        store = Noosfero::API::CaptchaSessionStore.create
+        { "private_token" => "#{store.private_token}" }
       end
       # Login to get token
@@ -133,7 +133,8 @@ module Noosfero
             named 'ArticleVote'
           end
           post ':id/vote' do
-            authenticate!
+            ## The vote api should allow regular login or with captcha
+            authenticate_allow_captcha!
             value = (params[:value] || 1).to_i
             # FIXME verify allowed values
             render_api_error!('Vote value not allowed', 400) unless [-1, 1].include?(value)
@@ -2,50 +2,72 @@ require File.dirname(__FILE__) + &#39;/test_helper&#39;
 class LoginCaptchaTest < ActiveSupport::TestCase
-  url = "/api/v1/login-captcha?"
-
   def setup()
-	environment = Environment.default
-    environment.api_captcha_settings = {
+    @environment = Environment.default
+    @environment.api_captcha_settings = {
         enabled: true,
         provider: 'serpro',
         serpro_client_id:  '0000000000000000',
         verify_uri:  'http://captcha.serpro.gov.br/validate',
     }
-    environment.save!
-  	
+    @environment.save!
+  	@url = "/api/v1/login-captcha?"
+  end
+
+  def create_article(name)
+    person = fast_create(Person, :environment_id => @environment.id)
+    fast_create(Article, :profile_id => person.id, :name => name)    
+  end
+
+  should 'not perform a vote without authentication' do
+    article = create_article('Article 1')
+    params = {}
+    params[:value] = 1
+
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal 401, last_response.status
+  end
+
+  should 'perform login from helpers' do
+    login_with_captcha
+    assert_not_nil @private_token
+  end
+
+
+  should 'perform a vote in an article identified by id' do
+    login_with_captcha
+    article = create_article('Article 1')
+    params[:value] = 1
+
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    
+    assert_not_equal 401, last_response.status
+    assert_equal true, json['vote']
+  end
+
+  should 'not follow any article' do
+    login_with_captcha
+    article = create_article('Article 1')
+    post "/api/v1/articles/#{article.id}/follow?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+
+    assert_equal 401, last_response.status
   end
   should 'not generate private token when login without captcha' do
     params = {}
-    post "#{url}#{params.to_query}"
+    post "#{@url}#{params.to_query}"
     json = JSON.parse(last_response.body)
-    puts "JSon1: #{json}"
     assert json["private_token"].blank?
   end
   should 'generate private token when login with captcha' do
-  	#request = mock()
-	stub_request(:post, "http://captcha.serpro.gov.br/validate").
-  		with(:body => "0000000000000000&4324343&4030320",
-       		:headers => {'Accept'=>'*/*', 'User-Agent'=>'Ruby'}).
-  				to_return(:status => 200, :body => "1", :headers => {})
-  	
-    # Mock the user to check the private_token
-    token = "private_token@1234"
-    user = mock
-    User.expects(:new).returns(user)
-    user.expects(:generate_private_token!).returns(token)
-    # To store the user session helpers.rb call the private_token method
-    user.expects(:private_token).times(2).returns(token)
-
-    params = {:txtToken_captcha_serpro_gov_br => '4324343', :captcha_text => '4030320'}  	
-    post "#{url}#{params.to_query}"
-    json = JSON.parse(last_response.body)
-    puts "JSon2: #{json}"
-    assert !json["private_token"].blank?
+    json = login_with_captcha
     ret = json["private_token"]
-    assert ret == token
+    assert !ret.blank?
+    assert ret == @private_token
   end
 end
 \ No newline at end of file
@@ -8,6 +8,38 @@ class ActiveSupport::TestCase
     Noosfero::API::API
   end
+  def login_with_captcha
+    json = do_login_captcha_from_api
+    @private_token = json["private_token"]
+    @params = { "private_token" => @private_token}
+    json
+  end
+
+  ## Performs a login using the session.rb but mocking the
+  ## real HTTP request to validate the captcha.
+  def do_login_captcha_from_api
+    # Request mocking
+    #Net::HTTP::Post Mock
+    request = mock
+    #Net::HTTP Mock
+    http = mock
+    uri = URI(environment.api_captcha_settings[:verify_uri])
+    Net::HTTP.expects(:new).with(uri.host, uri.port).returns(http)
+    Net::HTTP::Post.expects(:new).with(uri.path).returns(request)
+
+    # Captcha required codes
+    request.stubs(:body=).with("0000000000000000&4324343&4030320")
+    http.stubs(:request).with(request).returns(http)
+
+    # Captcha validation success !!
+    http.stubs(:body).returns("1")
+
+    params = {:txtToken_captcha_serpro_gov_br => '4324343', :captcha_text => '4030320'}   
+    post "#{@url}#{params.to_query}"
+    json = JSON.parse(last_response.body)    
+    json
+  end
+
   def login_api
     @environment = Environment.default
     @user = User.create!(:login => 'testapi', :password => 'testapi', :password_confirmation => 'testapi', :email => 'test@test.org', :environment => @environment)
@@ -0,0 +1,30 @@		@@ -0,0 +1,30 @@
	1	+class Noosfero::API::CaptchaSessionStore
	2	+
	3	+ attr_accessor :data
	4	+ attr_reader :private_token
	5	+
	6	+ def self.create
	7	+ key = SecureRandom.hex
	8	+ store = Noosfero::API::CaptchaSessionStore.new(key)
	9	+ Rails.cache.write(store.private_token, store, expires_in: 300)
	10	+ return store
	11	+ end
	12	+
	13	+ def initialize(key)
	14	+ @private_token = key
	15	+ end
	16	+
	17	+ def self.get(key)
	18	+ Rails.cache.fetch(key)
	19	+ end
	20	+
	21	+ def store
	22	+ Rails.cache.write(@private_token, self)
	23	+ end
	24	+
	25	+ def destroy
	26	+ Rails.cache.delete(@private_token)
	27	+ end
	28	+
	29	+
	30	+end
	@@ -8,6 +8,38 @@ class ActiveSupport::TestCase		@@ -8,6 +8,38 @@ class ActiveSupport::TestCase
8	Noosfero::API::API	8	Noosfero::API::API
9	end	9	end
10		10
		11	+ def login_with_captcha
		12	+ json = do_login_captcha_from_api
		13	+ @private_token = json["private_token"]
		14	+ @params = { "private_token" => @private_token}
		15	+ json
		16	+ end
		17	+
		18	+ ## Performs a login using the session.rb but mocking the
		19	+ ## real HTTP request to validate the captcha.
		20	+ def do_login_captcha_from_api
		21	+ # Request mocking
		22	+ #Net::HTTP::Post Mock
		23	+ request = mock
		24	+ #Net::HTTP Mock
		25	+ http = mock
		26	+ uri = URI(environment.api_captcha_settings[:verify_uri])
		27	+ Net::HTTP.expects(:new).with(uri.host, uri.port).returns(http)
		28	+ Net::HTTP::Post.expects(:new).with(uri.path).returns(request)
		29	+
		30	+ # Captcha required codes
		31	+ request.stubs(:body=).with("0000000000000000&4324343&4030320")
		32	+ http.stubs(:request).with(request).returns(http)
		33	+
		34	+ # Captcha validation success !!
		35	+ http.stubs(:body).returns("1")
		36	+
		37	+ params = {:txtToken_captcha_serpro_gov_br => '4324343', :captcha_text => '4030320'}
		38	+ post "#{@url}#{params.to_query}"
		39	+ json = JSON.parse(last_response.body)
		40	+ json
		41	+ end
		42	+
11	def login_api	43	def login_api
12	@environment = Environment.default	44	@environment = Environment.default
13	@user = User.create!(:login => 'testapi', :password => 'testapi', :password_confirmation => 'testapi', :email => 'test@test.org', :environment => @environment)	45	@user = User.create!(:login => 'testapi', :password => 'testapi', :password_confirmation => 'testapi', :email => 'test@test.org', :environment => @environment)