Add ability for users to see their authorized applications and revoke the access

test/test_api_security.py

@@ -17,7 +17,7 @@ from endpoints.api.trigger import (BuildTriggerActivate, BuildTriggerSources, Bu
                                    BuildTriggerList)
 from endpoints.api.webhook import Webhook, WebhookList
 from endpoints.api.user import (PrivateRepositories, ConvertToOrganization, Recovery, Signout,
-                                Signin, User)
+                                Signin, User, UserAuthorizationList, UserAuthorization)
 from endpoints.api.repotoken import RepositoryToken, RepositoryTokenList
 from endpoints.api.prototype import PermissionPrototype, PermissionPrototypeList
 from endpoints.api.logs import UserLogs, OrgLogs, RepositoryLogs
@@ -3039,5 +3039,56 @@ class TestOrganizationApplicationResetClientSecret(ApiTestCase):
     self._run_test('POST', 200, 'devtable', None)
 
 
+
+class TestUserAuthorizationList(ApiTestCase):
+  def setUp(self):
+    ApiTestCase.setUp(self)
+    self._set_url(UserAuthorizationList)
+
+  def test_get_anonymous(self):
+    self._run_test('GET', 401, None, None)
+
+  def test_get_freshuser(self):
+    self._run_test('GET', 200, 'freshuser', None)
+
+  def test_get_reader(self):
+    self._run_test('GET', 200, 'reader', None)
+
+  def test_get_devtable(self):
+    self._run_test('GET', 200, 'devtable', None)
+
+
+
+class TestUserAuthorization(ApiTestCase):
+  def setUp(self):
+    ApiTestCase.setUp(self)
+    self._set_url(UserAuthorization, access_token_uuid='fake')
+
+  def test_get_anonymous(self):
+    self._run_test('GET', 401, None, None)
+
+  def test_get_freshuser(self):
+    self._run_test('GET', 404, 'freshuser', None)
+
+  def test_get_reader(self):
+    self._run_test('GET', 404, 'reader', None)
+
+  def test_get_devtable(self):
+    self._run_test('GET', 404, 'devtable', None)
+
+
+  def test_delete_anonymous(self):
+    self._run_test('DELETE', 401, None, None)
+
+  def test_delete_freshuser(self):
+    self._run_test('DELETE', 404, 'freshuser', None)
+
+  def test_delete_reader(self):
+    self._run_test('DELETE', 404, 'reader', None)
+
+  def test_delete_devtable(self):
+    self._run_test('DELETE', 404, 'devtable', None)
+
+
 if __name__ == '__main__':
   unittest.main()

test/test_api_usage.py

@@ -18,7 +18,9 @@ from endpoints.api.trigger import (BuildTriggerActivate, BuildTriggerSources, Bu
                                    TriggerBuildList, ActivateBuildTrigger, BuildTrigger,
                                    BuildTriggerList)
 from endpoints.api.webhook import Webhook, WebhookList
-from endpoints.api.user import PrivateRepositories, ConvertToOrganization, Signout, Signin, User
+from endpoints.api.user import (PrivateRepositories, ConvertToOrganization, Signout, Signin, User,
+                                UserAuthorizationList, UserAuthorization)
+
 from endpoints.api.repotoken import RepositoryToken, RepositoryTokenList
 from endpoints.api.prototype import PermissionPrototype, PermissionPrototypeList
 from endpoints.api.logs import UserLogs, OrgLogs
@@ -1624,5 +1626,32 @@ class TestBuildTriggers(ApiTestCase):
     self.assertEquals("build-name", start_json['display_name'])
     self.assertEquals(['bar'], start_json['job_config']['docker_tags'])
 
+
+
+class TestUserAuthorizations(ApiTestCase):
+  def test_list_get_delete_user_authorizations(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    json = self.getJsonResponse(UserAuthorizationList)
+        
+    self.assertEquals(1, len(json['authorizations']))
+
+    authorization = json['authorizations'][0]
+
+    assert 'uuid' in authorization
+    assert 'scopes' in authorization
+    assert 'application' in authorization
+
+    # Retrieve the authorization.
+    get_json = self.getJsonResponse(UserAuthorization, params=dict(access_token_uuid = authorization['uuid']))
+    self.assertEquals(authorization, get_json)
+
+    # Delete the authorization.
+    self.deleteResponse(UserAuthorization, params=dict(access_token_uuid = authorization['uuid']))
+
+    # Verify it has been deleted.
+    self.getJsonResponse(UserAuthorization, params=dict(access_token_uuid = authorization['uuid']),
+                         expected_code=404)
+
 if __name__ == '__main__':
   unittest.main()