initial import for Open Source 🎉

auth/test/test_auth_context_type.py

@@ -0,0 +1,51 @@
+import pytest
+
+from auth.auth_context_type import SignedAuthContext, ValidatedAuthContext, ContextEntityKind
+from data import model, database
+
+from test.fixtures import *
+
+def get_oauth_token(_):
+  return database.OAuthAccessToken.get()
+
+
+@pytest.mark.parametrize('kind, entity_reference, loader', [
+  (ContextEntityKind.anonymous, None, None),
+  (ContextEntityKind.appspecifictoken, '%s%s' % ('a' * 60, 'b' * 60),
+   model.appspecifictoken.access_valid_token),
+  (ContextEntityKind.oauthtoken, None, get_oauth_token),
+  (ContextEntityKind.robot, 'devtable+dtrobot', model.user.lookup_robot),
+  (ContextEntityKind.user, 'devtable', model.user.get_user),
+])
+@pytest.mark.parametrize('v1_dict_format', [
+  (True),
+  (False),
+])
+def test_signed_auth_context(kind, entity_reference, loader, v1_dict_format, initialized_db):
+  if kind == ContextEntityKind.anonymous:
+    validated = ValidatedAuthContext()
+    assert validated.is_anonymous
+  else:
+    ref = loader(entity_reference)
+    validated = ValidatedAuthContext(**{kind.value: ref})
+    assert not validated.is_anonymous
+
+  assert validated.entity_kind == kind
+  assert validated.unique_key
+
+  signed = SignedAuthContext.build_from_signed_dict(validated.to_signed_dict(),
+                                                    v1_dict_format=v1_dict_format)
+
+  if not v1_dict_format:
+    # Under legacy V1 format, we don't track the app specific token, merely its associated user.
+    assert signed.entity_kind == kind
+    assert signed.description == validated.description
+    assert signed.credential_username == validated.credential_username
+    assert signed.analytics_id_and_public_metadata() == validated.analytics_id_and_public_metadata()
+    assert signed.unique_key == validated.unique_key
+
+  assert signed.is_anonymous == validated.is_anonymous
+  assert signed.authed_user == validated.authed_user
+  assert signed.has_nonrobot_user == validated.has_nonrobot_user
+
+  assert signed.to_signed_dict() == validated.to_signed_dict()

auth/test/test_basic.py

@@ -0,0 +1,98 @@
+# -*- coding: utf-8 -*-
+
+import pytest
+
+from base64 import b64encode
+
+from auth.basic import validate_basic_auth
+from auth.credentials import (ACCESS_TOKEN_USERNAME, OAUTH_TOKEN_USERNAME,
+                              APP_SPECIFIC_TOKEN_USERNAME)
+from auth.validateresult import AuthKind, ValidateResult
+from data import model
+
+from test.fixtures import *
+
+
+def _token(username, password):
+  assert isinstance(username, basestring)
+  assert isinstance(password, basestring)
+  return 'basic ' + b64encode('%s:%s' % (username, password))
+
+
+@pytest.mark.parametrize('token, expected_result', [
+  ('', ValidateResult(AuthKind.basic, missing=True)),
+  ('someinvalidtoken', ValidateResult(AuthKind.basic, missing=True)),
+  ('somefoobartoken', ValidateResult(AuthKind.basic, missing=True)),
+  ('basic ', ValidateResult(AuthKind.basic, missing=True)),
+  ('basic some token', ValidateResult(AuthKind.basic, missing=True)),
+  ('basic sometoken', ValidateResult(AuthKind.basic, missing=True)),
+  (_token(APP_SPECIFIC_TOKEN_USERNAME, 'invalid'), ValidateResult(AuthKind.basic,
+                                                                  error_message='Invalid token')),
+  (_token(ACCESS_TOKEN_USERNAME, 'invalid'), ValidateResult(AuthKind.basic,
+                                                            error_message='Invalid access token')),
+  (_token(OAUTH_TOKEN_USERNAME, 'invalid'),
+   ValidateResult(AuthKind.basic, error_message='OAuth access token could not be validated')),
+  (_token('devtable', 'invalid'), ValidateResult(AuthKind.basic,
+                                                 error_message='Invalid Username or Password')),
+  (_token('devtable+somebot', 'invalid'), ValidateResult(
+    AuthKind.basic, error_message='Could not find robot with username: devtable+somebot')),
+  (_token('disabled', 'password'), ValidateResult(
+    AuthKind.basic,
+    error_message='This user has been disabled. Please contact your administrator.')),])
+def test_validate_basic_auth_token(token, expected_result, app):
+  result = validate_basic_auth(token)
+  assert result == expected_result
+
+
+def test_valid_user(app):
+  token = _token('devtable', 'password')
+  result = validate_basic_auth(token)
+  assert result == ValidateResult(AuthKind.basic, user=model.user.get_user('devtable'))
+
+
+def test_valid_robot(app):
+  robot, password = model.user.create_robot('somerobot', model.user.get_user('devtable'))
+  token = _token(robot.username, password)
+  result = validate_basic_auth(token)
+  assert result == ValidateResult(AuthKind.basic, robot=robot)
+
+
+def test_valid_token(app):
+  access_token = model.token.create_delegate_token('devtable', 'simple', 'sometoken')
+  token = _token(ACCESS_TOKEN_USERNAME, access_token.get_code())
+  result = validate_basic_auth(token)
+  assert result == ValidateResult(AuthKind.basic, token=access_token)
+
+
+def test_valid_oauth(app):
+  user = model.user.get_user('devtable')
+  app = model.oauth.list_applications_for_org(model.user.get_user_or_org('buynlarge'))[0]
+  oauth_token, code = model.oauth.create_access_token_for_testing(user, app.client_id, 'repo:read')
+  token = _token(OAUTH_TOKEN_USERNAME, code)
+  result = validate_basic_auth(token)
+  assert result == ValidateResult(AuthKind.basic, oauthtoken=oauth_token)
+
+
+def test_valid_app_specific_token(app):
+  user = model.user.get_user('devtable')
+  app_specific_token = model.appspecifictoken.create_token(user, 'some token')
+  full_token = model.appspecifictoken.get_full_token_string(app_specific_token)
+  token = _token(APP_SPECIFIC_TOKEN_USERNAME, full_token)
+  result = validate_basic_auth(token)
+  assert result == ValidateResult(AuthKind.basic, appspecifictoken=app_specific_token)
+
+
+def test_invalid_unicode(app):
+  token = '\xebOH'
+  header = 'basic ' + b64encode(token)
+  result = validate_basic_auth(header)
+  assert result == ValidateResult(AuthKind.basic, missing=True)
+
+
+def test_invalid_unicode_2(app):
+  token = '“4JPCOLIVMAY32Q3XGVPHC4CBF8SKII5FWNYMASOFDIVSXTC5I5NBU”'
+  header = 'basic ' + b64encode('devtable+somerobot:%s' % token)
+  result = validate_basic_auth(header)
+  assert result == ValidateResult(
+    AuthKind.basic,
+    error_message='Could not find robot with username: devtable+somerobot and supplied password.')

auth/test/test_cookie.py

@@ -0,0 +1,66 @@
+import uuid
+
+from flask_login import login_user
+
+from app import LoginWrappedDBUser
+from data import model
+from auth.cookie import validate_session_cookie
+from test.fixtures import *
+
+
+def test_anonymous_cookie(app):
+  assert validate_session_cookie().missing
+
+
+def test_invalidformatted_cookie(app):
+  # "Login" with a non-UUID reference.
+  someuser = model.user.get_user('devtable')
+  login_user(LoginWrappedDBUser('somenonuuid', someuser))
+
+  # Ensure we get an invalid session cookie format error.
+  result = validate_session_cookie()
+  assert result.authed_user is None
+  assert result.context.identity is None
+  assert not result.has_nonrobot_user
+  assert result.error_message == 'Invalid session cookie format'
+
+
+def test_disabled_user(app):
+  # "Login" with a disabled user.
+  someuser = model.user.get_user('disabled')
+  login_user(LoginWrappedDBUser(someuser.uuid, someuser))
+
+  # Ensure we get an invalid session cookie format error.
+  result = validate_session_cookie()
+  assert result.authed_user is None
+  assert result.context.identity is None
+  assert not result.has_nonrobot_user
+  assert result.error_message == 'User account is disabled'
+
+
+def test_valid_user(app):
+  # Login with a valid user.
+  someuser = model.user.get_user('devtable')
+  login_user(LoginWrappedDBUser(someuser.uuid, someuser))
+
+  result = validate_session_cookie()
+  assert result.authed_user == someuser
+  assert result.context.identity is not None
+  assert result.has_nonrobot_user
+  assert result.error_message is None
+
+
+def test_valid_organization(app):
+  # "Login" with a valid organization.
+  someorg = model.user.get_namespace_user('buynlarge')
+  someorg.uuid = str(uuid.uuid4())
+  someorg.verified = True
+  someorg.save()
+
+  login_user(LoginWrappedDBUser(someorg.uuid, someorg))
+
+  result = validate_session_cookie()
+  assert result.authed_user is None
+  assert result.context.identity is None
+  assert not result.has_nonrobot_user
+  assert result.error_message == 'Cannot login to organization'

auth/test/test_credentials.py

@@ -0,0 +1,147 @@
+# -*- coding: utf-8 -*-
+
+from auth.credentials import validate_credentials, CredentialKind
+from auth.credential_consts import (ACCESS_TOKEN_USERNAME, OAUTH_TOKEN_USERNAME,
+                                    APP_SPECIFIC_TOKEN_USERNAME)
+from auth.validateresult import AuthKind, ValidateResult
+from data import model
+
+from test.fixtures import *
+
+def test_valid_user(app):
+  result, kind = validate_credentials('devtable', 'password')
+  assert kind == CredentialKind.user
+  assert result == ValidateResult(AuthKind.credentials, user=model.user.get_user('devtable'))
+
+def test_valid_robot(app):
+  robot, password = model.user.create_robot('somerobot', model.user.get_user('devtable'))
+  result, kind = validate_credentials(robot.username, password)
+  assert kind == CredentialKind.robot
+  assert result == ValidateResult(AuthKind.credentials, robot=robot)
+
+def test_valid_robot_for_disabled_user(app):
+  user = model.user.get_user('devtable')
+  user.enabled = False
+  user.save()
+
+  robot, password = model.user.create_robot('somerobot', user)
+  result, kind = validate_credentials(robot.username, password)
+  assert kind == CredentialKind.robot
+
+  err = 'This user has been disabled. Please contact your administrator.'
+  assert result == ValidateResult(AuthKind.credentials, error_message=err)
+
+def test_valid_token(app):
+  access_token = model.token.create_delegate_token('devtable', 'simple', 'sometoken')
+  result, kind = validate_credentials(ACCESS_TOKEN_USERNAME, access_token.get_code())
+  assert kind == CredentialKind.token
+  assert result == ValidateResult(AuthKind.credentials, token=access_token)
+
+def test_valid_oauth(app):
+  user = model.user.get_user('devtable')
+  app = model.oauth.list_applications_for_org(model.user.get_user_or_org('buynlarge'))[0]
+  oauth_token, code = model.oauth.create_access_token_for_testing(user, app.client_id, 'repo:read')
+  result, kind = validate_credentials(OAUTH_TOKEN_USERNAME, code)
+  assert kind == CredentialKind.oauth_token
+  assert result == ValidateResult(AuthKind.oauth, oauthtoken=oauth_token)
+
+def test_invalid_user(app):
+  result, kind = validate_credentials('devtable', 'somepassword')
+  assert kind == CredentialKind.user
+  assert result == ValidateResult(AuthKind.credentials,
+                                  error_message='Invalid Username or Password')
+
+def test_valid_app_specific_token(app):
+  user = model.user.get_user('devtable')
+  app_specific_token = model.appspecifictoken.create_token(user, 'some token')
+  full_token = model.appspecifictoken.get_full_token_string(app_specific_token)
+  result, kind = validate_credentials(APP_SPECIFIC_TOKEN_USERNAME, full_token)
+  assert kind == CredentialKind.app_specific_token
+  assert result == ValidateResult(AuthKind.credentials, appspecifictoken=app_specific_token)
+
+def test_valid_app_specific_token_for_disabled_user(app):
+  user = model.user.get_user('devtable')
+  user.enabled = False
+  user.save()
+
+  app_specific_token = model.appspecifictoken.create_token(user, 'some token')
+  full_token = model.appspecifictoken.get_full_token_string(app_specific_token)
+  result, kind = validate_credentials(APP_SPECIFIC_TOKEN_USERNAME, full_token)
+  assert kind == CredentialKind.app_specific_token
+
+  err = 'This user has been disabled. Please contact your administrator.'
+  assert result == ValidateResult(AuthKind.credentials, error_message=err)
+
+def test_invalid_app_specific_token(app):  
+  result, kind = validate_credentials(APP_SPECIFIC_TOKEN_USERNAME, 'somecode')
+  assert kind == CredentialKind.app_specific_token
+  assert result == ValidateResult(AuthKind.credentials, error_message='Invalid token')
+
+def test_invalid_app_specific_token_code(app):
+  user = model.user.get_user('devtable')
+  app_specific_token = model.appspecifictoken.create_token(user, 'some token')
+  full_token = app_specific_token.token_name + 'something'
+  result, kind = validate_credentials(APP_SPECIFIC_TOKEN_USERNAME, full_token)
+  assert kind == CredentialKind.app_specific_token
+  assert result == ValidateResult(AuthKind.credentials, error_message='Invalid token')
+
+def test_unicode(app):  
+  result, kind = validate_credentials('someusername', 'some₪code')
+  assert kind == CredentialKind.user
+  assert not result.auth_valid
+  assert result == ValidateResult(AuthKind.credentials,
+                                  error_message='Invalid Username or Password')
+
+def test_unicode_robot(app):  
+  robot, _ = model.user.create_robot('somerobot', model.user.get_user('devtable'))
+  result, kind = validate_credentials(robot.username, 'some₪code')
+
+  assert kind == CredentialKind.robot
+  assert not result.auth_valid
+
+  msg = 'Could not find robot with username: devtable+somerobot and supplied password.'
+  assert result == ValidateResult(AuthKind.credentials, error_message=msg)
+
+def test_invalid_user(app):
+  result, kind = validate_credentials('someinvaliduser', 'password')
+  assert kind == CredentialKind.user
+  assert not result.authed_user
+  assert not result.auth_valid
+
+def test_invalid_user_password(app):
+  result, kind = validate_credentials('devtable', 'somepassword')
+  assert kind == CredentialKind.user
+  assert not result.authed_user
+  assert not result.auth_valid
+
+def test_invalid_robot(app):
+  result, kind = validate_credentials('devtable+doesnotexist', 'password')
+  assert kind == CredentialKind.robot
+  assert not result.authed_user
+  assert not result.auth_valid
+
+def test_invalid_robot_token(app):
+  robot, _ = model.user.create_robot('somerobot', model.user.get_user('devtable'))
+  result, kind = validate_credentials(robot.username, 'invalidpassword')
+  assert kind == CredentialKind.robot
+  assert not result.authed_user
+  assert not result.auth_valid
+
+def test_invalid_unicode_robot(app):
+  token = '“4JPCOLIVMAY32Q3XGVPHC4CBF8SKII5FWNYMASOFDIVSXTC5I5NBU”'
+  result, kind = validate_credentials('devtable+somerobot', token)
+  assert kind == CredentialKind.robot
+  assert not result.auth_valid
+  msg = 'Could not find robot with username: devtable+somerobot'
+  assert result == ValidateResult(AuthKind.credentials, error_message=msg)
+
+def test_invalid_unicode_robot_2(app):
+  user = model.user.get_user('devtable')
+  robot, password = model.user.create_robot('somerobot', user)
+
+  token = '“4JPCOLIVMAY32Q3XGVPHC4CBF8SKII5FWNYMASOFDIVSXTC5I5NBU”'
+  result, kind = validate_credentials('devtable+somerobot', token)
+  assert kind == CredentialKind.robot
+  assert not result.auth_valid
+  msg = 'Could not find robot with username: devtable+somerobot and supplied password.'
+  assert result == ValidateResult(AuthKind.credentials, error_message=msg)

auth/test/test_decorators.py

@@ -0,0 +1,105 @@
+import pytest
+
+from flask import session
+from flask_login import login_user
+from werkzeug.exceptions import HTTPException
+
+from app import LoginWrappedDBUser
+from auth.auth_context import get_authenticated_user
+from auth.decorators import (
+  extract_namespace_repo_from_session, require_session_login, process_auth_or_cookie)
+from data import model
+from test.fixtures import *
+
+
+def test_extract_namespace_repo_from_session_missing(app):
+  def emptyfunc():
+    pass
+
+  session.clear()
+  with pytest.raises(HTTPException):
+    extract_namespace_repo_from_session(emptyfunc)()
+
+
+def test_extract_namespace_repo_from_session_present(app):
+  encountered = []
+
+  def somefunc(namespace, repository):
+    encountered.append(namespace)
+    encountered.append(repository)
+
+  # Add the namespace and repository to the session.
+  session.clear()
+  session['namespace'] = 'foo'
+  session['repository'] = 'bar'
+
+  # Call the decorated method.
+  extract_namespace_repo_from_session(somefunc)()
+
+  assert encountered[0] == 'foo'
+  assert encountered[1] == 'bar'
+
+
+def test_require_session_login_missing(app):
+  def emptyfunc():
+    pass
+
+  with pytest.raises(HTTPException):
+    require_session_login(emptyfunc)()
+
+
+def test_require_session_login_valid_user(app):
+  def emptyfunc():
+    pass
+
+  # Login as a valid user.
+  someuser = model.user.get_user('devtable')
+  login_user(LoginWrappedDBUser(someuser.uuid, someuser))
+
+  # Call the function.
+  require_session_login(emptyfunc)()
+
+  # Ensure the authenticated user was updated.
+  assert get_authenticated_user() == someuser
+
+
+def test_require_session_login_invalid_user(app):
+  def emptyfunc():
+    pass
+
+  # "Login" as a disabled user.
+  someuser = model.user.get_user('disabled')
+  login_user(LoginWrappedDBUser(someuser.uuid, someuser))
+
+  # Call the function.
+  with pytest.raises(HTTPException):
+    require_session_login(emptyfunc)()
+
+  # Ensure the authenticated user was not updated.
+  assert get_authenticated_user() is None
+
+
+def test_process_auth_or_cookie_invalid_user(app):
+  def emptyfunc():
+    pass
+
+  # Call the function.
+  process_auth_or_cookie(emptyfunc)()
+
+  # Ensure the authenticated user was not updated.
+  assert get_authenticated_user() is None
+
+
+def test_process_auth_or_cookie_valid_user(app):
+  def emptyfunc():
+    pass
+
+  # Login as a valid user.
+  someuser = model.user.get_user('devtable')
+  login_user(LoginWrappedDBUser(someuser.uuid, someuser))
+
+  # Call the function.
+  process_auth_or_cookie(emptyfunc)()
+
+  # Ensure the authenticated user was  updated.
+  assert get_authenticated_user() == someuser

auth/test/test_oauth.py

@@ -0,0 +1,55 @@
+import pytest
+
+from auth.oauth import validate_bearer_auth, validate_oauth_token
+from auth.validateresult import AuthKind, ValidateResult
+from data import model
+from test.fixtures import *
+
+
+@pytest.mark.parametrize('header, expected_result', [
+  ('', ValidateResult(AuthKind.oauth, missing=True)),
+  ('somerandomtoken', ValidateResult(AuthKind.oauth, missing=True)),
+  ('bearer some random token', ValidateResult(AuthKind.oauth, missing=True)),
+  ('bearer invalidtoken',
+   ValidateResult(AuthKind.oauth, error_message='OAuth access token could not be validated')),])
+def test_bearer(header, expected_result, app):
+  assert validate_bearer_auth(header) == expected_result
+
+
+def test_valid_oauth(app):
+  user = model.user.get_user('devtable')
+  app = model.oauth.list_applications_for_org(model.user.get_user_or_org('buynlarge'))[0]
+  token_string = '%s%s' % ('a' * 20, 'b' * 20)
+  oauth_token, _ = model.oauth.create_access_token_for_testing(user, app.client_id, 'repo:read',
+                                                               access_token=token_string)
+  result = validate_bearer_auth('bearer ' + token_string)
+  assert result.context.oauthtoken == oauth_token
+  assert result.authed_user == user
+  assert result.auth_valid
+
+
+def test_disabled_user_oauth(app):
+  user = model.user.get_user('disabled')
+  token_string = '%s%s' % ('a' * 20, 'b' * 20)
+  oauth_token, _ = model.oauth.create_access_token_for_testing(user, 'deadbeef', 'repo:admin',
+                                                               access_token=token_string)
+
+  result = validate_bearer_auth('bearer ' + token_string)
+  assert result.context.oauthtoken is None
+  assert result.authed_user is None
+  assert not result.auth_valid
+  assert result.error_message == 'Granter of the oauth access token is disabled'
+
+
+def test_expired_token(app):
+  user = model.user.get_user('devtable')
+  token_string = '%s%s' % ('a' * 20, 'b' * 20)
+  oauth_token, _ = model.oauth.create_access_token_for_testing(user, 'deadbeef', 'repo:admin',
+                                                               access_token=token_string,
+                                                               expires_in=-1000)
+
+  result = validate_bearer_auth('bearer ' + token_string)
+  assert result.context.oauthtoken is None
+  assert result.authed_user is None
+  assert not result.auth_valid
+  assert result.error_message == 'OAuth access token has expired'

auth/test/test_permissions.py

@@ -0,0 +1,37 @@
+import pytest
+
+from auth import scopes
+from auth.permissions import SuperUserPermission, QuayDeferredPermissionUser
+from data import model
+
+from test.fixtures import *
+
+SUPER_USERNAME = 'devtable'
+UNSUPER_USERNAME = 'freshuser'
+
+@pytest.fixture()
+def superuser(initialized_db):
+  return model.user.get_user(SUPER_USERNAME)
+
+
+@pytest.fixture()
+def normie(initialized_db):
+  return model.user.get_user(UNSUPER_USERNAME)
+
+
+def test_superuser_matrix(superuser, normie):
+  test_cases = [
+    (superuser, {scopes.SUPERUSER}, True),
+    (superuser, {scopes.DIRECT_LOGIN}, True),
+    (superuser, {scopes.READ_USER, scopes.SUPERUSER}, True),
+    (superuser, {scopes.READ_USER}, False),
+    (normie, {scopes.SUPERUSER}, False),
+    (normie, {scopes.DIRECT_LOGIN}, False),
+    (normie, {scopes.READ_USER, scopes.SUPERUSER}, False),
+    (normie, {scopes.READ_USER}, False),
+  ]
+
+  for user_obj, scope_set, expected in test_cases:
+    perm_user = QuayDeferredPermissionUser.for_user(user_obj, scope_set)
+    has_su = perm_user.can(SuperUserPermission())
+    assert has_su == expected

auth/test/test_registry_jwt.py

@@ -0,0 +1,203 @@
+# -*- coding: utf-8 -*-
+
+import time
+
+import jwt
+import pytest
+
+from app import app, instance_keys
+from auth.auth_context_type import ValidatedAuthContext
+from auth.registry_jwt_auth import identity_from_bearer_token, InvalidJWTException
+from data import model  # TODO: remove this after service keys are decoupled
+from data.database import ServiceKeyApprovalType
+from initdb import setup_database_for_testing, finished_database_for_testing
+from util.morecollections import AttrDict
+from util.security.registry_jwt import ANONYMOUS_SUB, build_context_and_subject
+
+TEST_AUDIENCE = app.config['SERVER_HOSTNAME']
+TEST_USER = AttrDict({'username': 'joeuser', 'uuid': 'foobar', 'enabled': True})
+MAX_SIGNED_S = 3660
+TOKEN_VALIDITY_LIFETIME_S = 60 * 60  # 1 hour
+ANONYMOUS_SUB = '(anonymous)'
+SERVICE_NAME = 'quay'
+
+# This import has to come below any references to "app".
+from test.fixtures import *
+
+
+def _access(typ='repository', name='somens/somerepo', actions=None):
+  actions = [] if actions is None else actions
+  return [{
+    'type': typ,
+    'name': name,
+    'actions': actions,
+  }]
+
+
+def _delete_field(token_data, field_name):
+  token_data.pop(field_name)
+  return token_data
+
+
+def _token_data(access=[], context=None, audience=TEST_AUDIENCE, user=TEST_USER, iat=None,
+                exp=None, nbf=None, iss=None, subject=None):
+  if subject is None:
+    _, subject = build_context_and_subject(ValidatedAuthContext(user=user))
+  return {
+    'iss': iss or instance_keys.service_name,
+    'aud': audience,
+    'nbf': nbf if nbf is not None else int(time.time()),
+    'iat': iat if iat is not None else int(time.time()),
+    'exp': exp if exp is not None else int(time.time() + TOKEN_VALIDITY_LIFETIME_S),
+    'sub': subject,
+    'access': access,
+    'context': context,
+  }
+
+
+def _token(token_data, key_id=None, private_key=None, skip_header=False, alg=None):
+  key_id = key_id or instance_keys.local_key_id
+  private_key = private_key or instance_keys.local_private_key
+
+  if alg == "none":
+    private_key = None
+
+  token_headers = {'kid': key_id}
+
+  if skip_header:
+    token_headers = {}
+
+  token_data = jwt.encode(token_data, private_key, alg or 'RS256', headers=token_headers)
+  return 'Bearer {0}'.format(token_data)
+
+
+def _parse_token(token):
+  return identity_from_bearer_token(token)[0]
+
+
+def test_accepted_token(initialized_db):
+  token = _token(_token_data())
+  identity = _parse_token(token)
+  assert identity.id == TEST_USER.username, 'should be %s, but was %s' % (TEST_USER.username,
+                                                                          identity.id)
+  assert len(identity.provides) == 0
+
+  anon_token = _token(_token_data(user=None))
+  anon_identity = _parse_token(anon_token)
+  assert anon_identity.id == ANONYMOUS_SUB, 'should be %s, but was %s' % (ANONYMOUS_SUB,
+                                                                          anon_identity.id)
+  assert len(identity.provides) == 0
+
+
+@pytest.mark.parametrize('access', [
+  (_access(actions=['pull', 'push'])),
+  (_access(actions=['pull', '*'])),
+  (_access(actions=['*', 'push'])),
+  (_access(actions=['*'])),
+  (_access(actions=['pull', '*', 'push'])),])
+def test_token_with_access(access, initialized_db):
+  token = _token(_token_data(access=access))
+  identity = _parse_token(token)
+  assert identity.id == TEST_USER.username, 'should be %s, but was %s' % (TEST_USER.username,
+                                                                          identity.id)
+  assert len(identity.provides) == 1
+
+  role = list(identity.provides)[0][3]
+  if "*" in access[0]['actions']:
+    assert role == 'admin'
+  elif "push" in access[0]['actions']:
+    assert role == 'write'
+  elif "pull" in access[0]['actions']:
+    assert role == 'read'
+
+
+@pytest.mark.parametrize('token', [
+  pytest.param(_token(
+    _token_data(access=[{
+      'toipe': 'repository',
+      'namesies': 'somens/somerepo',
+      'akshuns': ['pull', 'push', '*']}])), id='bad access'),
+  pytest.param(_token(_token_data(audience='someotherapp')), id='bad aud'),
+  pytest.param(_token(_delete_field(_token_data(), 'aud')), id='no aud'),
+  pytest.param(_token(_token_data(nbf=int(time.time()) + 600)), id='future nbf'),
+  pytest.param(_token(_delete_field(_token_data(), 'nbf')), id='no nbf'),
+  pytest.param(_token(_token_data(iat=int(time.time()) + 600)), id='future iat'),
+  pytest.param(_token(_delete_field(_token_data(), 'iat')), id='no iat'),
+  pytest.param(_token(_token_data(exp=int(time.time()) + MAX_SIGNED_S * 2)), id='exp too long'),
+  pytest.param(_token(_token_data(exp=int(time.time()) - 60)), id='expired'),
+  pytest.param(_token(_delete_field(_token_data(), 'exp')), id='no exp'),
+  pytest.param(_token(_delete_field(_token_data(), 'sub')), id='no sub'),
+  pytest.param(_token(_token_data(iss='badissuer')), id='bad iss'),
+  pytest.param(_token(_delete_field(_token_data(), 'iss')), id='no iss'),
+  pytest.param(_token(_token_data(), skip_header=True), id='no header'),
+  pytest.param(_token(_token_data(), key_id='someunknownkey'), id='bad key'),
+  pytest.param(_token(_token_data(), key_id='kid7'), id='bad key :: kid7'),
+  pytest.param(_token(_token_data(), alg='none', private_key=None), id='none alg'),
+  pytest.param('some random token', id='random token'),
+  pytest.param('Bearer: sometokenhere', id='extra bearer'),
+  pytest.param('\nBearer: dGVzdA', id='leading newline'),
+])
+def test_invalid_jwt(token, initialized_db):
+  with pytest.raises(InvalidJWTException):
+    _parse_token(token)
+
+
+def test_mixing_keys_e2e(initialized_db):
+  token_data = _token_data()
+
+  # Create a new key for testing.
+  p, key = model.service_keys.generate_service_key(instance_keys.service_name, None, kid='newkey',
+                                                   name='newkey', metadata={})
+  private_key = p.exportKey('PEM')
+
+  # Test first with the new valid, but unapproved key.
+  unapproved_key_token = _token(token_data, key_id='newkey', private_key=private_key)
+  with pytest.raises(InvalidJWTException):
+    _parse_token(unapproved_key_token)
+
+  # Approve the key and try again.
+  admin_user = model.user.get_user('devtable')
+  model.service_keys.approve_service_key(key.kid, ServiceKeyApprovalType.SUPERUSER, approver=admin_user)
+
+  valid_token = _token(token_data, key_id='newkey', private_key=private_key)
+
+  identity = _parse_token(valid_token)
+  assert identity.id == TEST_USER.username
+  assert len(identity.provides) == 0
+
+  # Try using a different private key with the existing key ID.
+  bad_private_token = _token(token_data, key_id='newkey',
+                             private_key=instance_keys.local_private_key)
+  with pytest.raises(InvalidJWTException):
+    _parse_token(bad_private_token)
+
+  # Try using a different key ID with the existing private key.
+  kid_mismatch_token = _token(token_data, key_id=instance_keys.local_key_id,
+                              private_key=private_key)
+  with pytest.raises(InvalidJWTException):
+    _parse_token(kid_mismatch_token)
+
+  # Delete the new key.
+  key.delete_instance(recursive=True)
+
+  # Ensure it still works (via the cache.)
+  deleted_key_token = _token(token_data, key_id='newkey', private_key=private_key)
+  identity = _parse_token(deleted_key_token)
+  assert identity.id == TEST_USER.username
+  assert len(identity.provides) == 0
+
+  # Break the cache.
+  instance_keys.clear_cache()
+
+  # Ensure the key no longer works.
+  with pytest.raises(InvalidJWTException):
+    _parse_token(deleted_key_token)
+
+
+@pytest.mark.parametrize('token', [
+  u'someunicodetoken✡',
+  u'\xc9\xad\xbd',
+])
+def test_unicode_token(token):
+  with pytest.raises(InvalidJWTException):
+    _parse_token(token)

auth/test/test_scopes.py

@@ -0,0 +1,50 @@
+import pytest
+
+from auth.scopes import (
+  scopes_from_scope_string, validate_scope_string, ALL_SCOPES, is_subset_string)
+
+
+@pytest.mark.parametrize(
+  'scopes_string, expected',
+  [
+    # Valid single scopes.
+    ('repo:read', ['repo:read']),
+    ('repo:admin', ['repo:admin']),
+
+    # Invalid scopes.
+    ('not:valid', []),
+    ('repo:admins', []),
+
+    # Valid scope strings.
+    ('repo:read repo:admin', ['repo:read', 'repo:admin']),
+    ('repo:read,repo:admin', ['repo:read', 'repo:admin']),
+    ('repo:read,repo:admin repo:write', ['repo:read', 'repo:admin', 'repo:write']),
+
+    # Partially invalid scopes.
+    ('repo:read,not:valid', []),
+    ('repo:read repo:admins', []),
+
+    # Invalid scope strings.
+    ('repo:read|repo:admin', []),
+
+    # Mixture of delimiters.
+    ('repo:read, repo:admin', []),])
+def test_parsing(scopes_string, expected):
+  expected_scope_set = {ALL_SCOPES[scope_name] for scope_name in expected}
+  parsed_scope_set = scopes_from_scope_string(scopes_string)
+  assert parsed_scope_set == expected_scope_set
+  assert validate_scope_string(scopes_string) == bool(expected)
+
+
+@pytest.mark.parametrize('superset, subset, result', [
+  ('repo:read', 'repo:read', True),
+  ('repo:read repo:admin', 'repo:read', True),
+  ('repo:read,repo:admin', 'repo:read', True),
+  ('repo:read,repo:admin', 'repo:admin', True),
+  ('repo:read,repo:admin', 'repo:admin repo:read', True),
+  ('', 'repo:read', False),
+  ('unknown:tag', 'repo:read', False),
+  ('repo:read unknown:tag', 'repo:read', False),
+  ('repo:read,unknown:tag', 'repo:read', False),])
+def test_subset_string(superset, subset, result):
+  assert is_subset_string(superset, subset) == result

auth/test/test_signedgrant.py

@@ -0,0 +1,32 @@
+import pytest
+
+from auth.signedgrant import validate_signed_grant, generate_signed_token, SIGNATURE_PREFIX
+from auth.validateresult import AuthKind, ValidateResult
+
+
+@pytest.mark.parametrize('header, expected_result', [
+  pytest.param('', ValidateResult(AuthKind.signed_grant, missing=True), id='Missing'),
+  pytest.param('somerandomtoken', ValidateResult(AuthKind.signed_grant, missing=True),
+               id='Invalid header'),
+  pytest.param('token somerandomtoken', ValidateResult(AuthKind.signed_grant, missing=True),
+               id='Random Token'),
+  pytest.param('token ' + SIGNATURE_PREFIX + 'foo',
+               ValidateResult(AuthKind.signed_grant,
+                              error_message='Signed grant could not be validated'),
+               id='Invalid token'),
+])
+def test_token(header, expected_result):
+  assert validate_signed_grant(header) == expected_result
+
+
+def test_valid_grant():
+  header = 'token ' + generate_signed_token({'a': 'b'}, {'c': 'd'})
+  expected = ValidateResult(AuthKind.signed_grant, signed_data={
+    'grants': {
+      'a': 'b',
+    },
+    'user_context': {
+      'c': 'd'
+    },
+  })
+  assert validate_signed_grant(header) == expected

auth/test/test_validateresult.py

@@ -0,0 +1,63 @@
+import pytest
+
+from auth.auth_context import get_authenticated_context
+from auth.validateresult import AuthKind, ValidateResult
+from data import model
+from data.database import AppSpecificAuthToken
+from test.fixtures import *
+
+def get_user():
+  return model.user.get_user('devtable')
+
+def get_app_specific_token():
+  return AppSpecificAuthToken.get()
+
+def get_robot():
+  robot, _ = model.user.create_robot('somebot', get_user())
+  return robot
+
+def get_token():
+  return model.token.create_delegate_token('devtable', 'simple', 'sometoken')
+
+def get_oauthtoken():
+  user = model.user.get_user('devtable')
+  return list(model.oauth.list_access_tokens_for_user(user))[0]
+
+def get_signeddata():
+  return {'grants': {'a': 'b'}, 'user_context': {'c': 'd'}}
+
+@pytest.mark.parametrize('get_entity,entity_kind', [
+  (get_user, 'user'),
+  (get_robot, 'robot'),
+  (get_token, 'token'),
+  (get_oauthtoken, 'oauthtoken'),
+  (get_signeddata, 'signed_data'),
+  (get_app_specific_token, 'appspecifictoken'),
+])
+def test_apply_context(get_entity, entity_kind, app):
+  assert get_authenticated_context() is None
+
+  entity = get_entity()
+  args = {}
+  args[entity_kind] = entity
+
+  result = ValidateResult(AuthKind.basic, **args)
+  result.apply_to_context()
+
+  expected_user = entity if entity_kind == 'user' or entity_kind == 'robot' else None
+  if entity_kind == 'oauthtoken':
+    expected_user = entity.authorized_user
+
+  if entity_kind == 'appspecifictoken':
+    expected_user = entity.user
+
+  expected_token = entity if entity_kind == 'token' else None
+  expected_oauth = entity if entity_kind == 'oauthtoken' else None
+  expected_appspecifictoken = entity if entity_kind == 'appspecifictoken' else None
+  expected_grant = entity if entity_kind == 'signed_data' else None
+
+  assert get_authenticated_context().authed_user == expected_user
+  assert get_authenticated_context().token == expected_token
+  assert get_authenticated_context().oauthtoken == expected_oauth
+  assert get_authenticated_context().appspecifictoken == expected_appspecifictoken
+  assert get_authenticated_context().signed_data == expected_grant