+ j\(Rt^RIt^RIHt^RIHt^RIHtHt^RI H t H t H t ^RI Ht^RIHt^RIHt^R IHt^R IHt^R IHt^R IHt^R IHtHt^RIHt^RI H!t!H"t"^RI#H$t$^RI%H&t&H't'H(t(^RI)H*t*^RI+H,t,^RI-H.t.Rt/!RR4t0!RR4t1!RR]1]0]Pd4t3!RR]1]Pd4t4!RR]1]Pd4t5]!]Pl4!R R!4t7!R"R#]Pd4t8R#)$z! Tests for L{twisted.web._auth}. N) implementer) verifyObject)errorportal) ANONYMOUSAllowAnonymousAccess'InMemoryUsernamePasswordDatabaseDontUse)IUsernamePassword) IPv4Address)ConnectionDone)EventLoggingObserver)globalLogPublisher)Failure)unittest)basicdigest)BasicCredentialFactory)HTTPAuthSessionWrapperUnauthorizedResource)ICredentialFactory) IResourceResourcegetChildForRequest NOT_DONE_YET)Data) DummyRequestcJ\P!V4P4#N)base64 b64encodestrip)ss&@/usr/lib/python3/dist-packages/twisted/web/test/test_httpauth.pyr r %s   A  $ $ &&cRa]tRt^)toRtRtR RltRtRtRt Rt R t R t Vt R#) BasicAuthTestsMixinz L{TestCase} mixin class which defines a number of tests for L{basic.BasicCredentialFactory}. Because this mixin defines C{setUp}, it must be inherited before L{TestCase}. cVP4VnRVnRVnRVn\ P !VP4VnR#)sfoosdreidsS3CuR1TyN) makeRequestrequestrealmusernamepasswordrrcredentialFactoryselfs&r#setUpBasicAuthTestsMixin.setUp0s>'')    # !&!=!=djj!Ir$Nc 4\VP: R24h)z Create a request object to be passed to L{basic.BasicCredentialFactory.decode} along with a response value. Override this in a subclass. z did not implement makeRequest)NotImplementedError __class__)r/method clientAddresss&&&r#r(BasicAuthTestsMixin.makeRequest7s "T^^$66T"UVVr$c XVP\\VP44R#)z= L{BasicCredentialFactory} implements L{ICredentialFactory}. N assertTruerrr-r.s&r#test_interface"BasicAuthTestsMixin.test_interface?  %79O9OPQr$c \RPVPRVP.44pVPP WP 4pVP\P!V44VPVPVP44VPVPVPR,44R#)z L{basic.BasicCredentialFactory.decode} turns a base64-encoded response into a L{UsernamePassword} object with a password which reflects the one which was encoded in the response. r$:swrongN) r joinr+r,r-decoder)r:r providedBy checkPassword assertFalser/responsecredss& r#test_usernamePassword)BasicAuthTestsMixin.test_usernamePasswordEs SXXt}}dDMM&JKL&&--h E )44U;< ++DMM:; ,,T]]X-EFGr$c f\RPVPRVP.44pVP R4pVP P WP4pVP\\V44VPVPVP44R#)zb L{basic.BasicCredentialFactory.decode} decodes a base64-encoded response with incorrect padding. r$r?=N) r r@r+r,r!r-rAr)r:rr rCrEs& r#test_incorrectPadding)BasicAuthTestsMixin.test_incorrectPaddingRs} SXXt}}dDMM&JKL>>$'&&--h E  %6>? ++DMM:;r$c RpVP\PVPPVVP 44R#)zp L{basic.BasicCredentialFactory.decode} raises L{LoginFailed} if passed a response which is not base64-encoded. xN) assertRaisesr LoginFailedr-rAr(r/rFs& r#test_invalidEncoding(BasicAuthTestsMixin.test_invalidEncoding^s>       " " ) )       r$c \R4pVP\PVPP VVP 44R#)z} L{basic.BasicCredentialFactory.decode} raises L{LoginFailed} when passed a response which is not valid base64-encoded text. s123abc+/N)r rPrrQr-rAr(rRs& r#test_invalidCredentials+BasicAuthTestsMixin.test_invalidCredentialsksC [)      " " ) )       r$)r-r,r*r)r+GETN)__name__ __module__ __qualname____firstlineno____doc__r0r(r;rHrLrSrV__static_attributes____classdictcell__ __classdict__s@r#r&r&)s6 JWR H <     r$r&c*a]tRt^ytoRRltRtVtR#) RequestMixinNc VVf\RRR4p\R4pWnW#nV#)zW Create a L{DummyRequest} (change me to create a L{twisted.web.http.Request} instead). TCP localhosti/)r rr5client)r/r5r6r)s&&& r#r(RequestMixin.makeRequestzs1  '{DAMt$&r$rX)rZr[r\r]r(r_r`ras@r#rdrdys  r$rdc]tRt^tRtRtR#)BasicAuthTestszC Basic authentication tests which use L{twisted.web.http.Request}. rkN)rZr[r\r]r^r_rkr$r#rmrmsr$rmcBa]tRt^toRtRtRtRtRtRt Rt Vt R#) DigestAuthTestszD Digest authentication tests which use L{twisted.web.http.Request}. c RVnRVn\P!VPVP4VnVP 4VnR#)z. Create a DigestCredentialFactory for testing test realmmd5N)r* algorithmrDigestCredentialFactoryr-r(r)r.s&r#r0DigestAuthTests.setUpsD# !'!?!? NNDJJ" '') r$c 6aaaaaRoRoR.o\4oVVVVV3RlpSPSPPRV4SP S\ RS^Q44pSPP SV4SPS^,4R#)z L{digest.DigestCredentialFactory.decode} calls the C{decode} method on L{twisted.cred.digest.DigestCredentialFactory} with the HTTP method and host of the request. s 169.254.0.1rYFc~<SPSV4SPSV4SPSV4RS^&R#)TN) assertEqual) _response_method_hostdonehostr5rFr/s&&&r#check*DigestAuthTests.test_decode..checks<   Xy 1   VW -   T5 )DGr$rArfN)objectpatchr-rr(r rAr:)r/r~reqr|r}r5rFsf @@@@r# test_decodeDigestAuthTests.test_decodes w8   4))00(EBv{5$'CD %%h4 Q r$c XVP\\VP44R#)z> L{DigestCredentialFactory} implements L{ICredentialFactory}. Nr9r.s&r#r;DigestAuthTests.test_interfacer=r$c VPPVP4pVPVR,R4VPVR,R4VPVR,R4VP RV4VP RV4VP 4FpVP R V4K R #) a8 The challenge issued by L{DigestCredentialFactory.getChallenge} must include C{'qop'}, C{'realm'}, C{'algorithm'}, C{'nonce'}, and C{'opaque'} keys. The values for the C{'realm'} and C{'algorithm'} keys must match the values supplied to the factory's initializer. None of the values may have newlines in them. qopauthr*rqrsrrnonceopaque N)r- getChallenger)rxassertInvalues assertNotIn)r/ challengevs& r#test_getChallenge!DigestAuthTests.test_getChallenges**77 E  5)73 7+]; ;/8 gy) h *!!#A   UA &$r$c >VPRR4pVPPV4pVPVR,R4VPVR,R4VPVR,R4VP R V4VP R V4R#) z L{DigestCredentialFactory.getChallenge} can issue a challenge even if the L{Request} it is passed returns L{None} from C{getClientIP}. rYNrrr*rqrsrrrr)r(r-rrxr)r/r)rs& r# test_getChallengeWithoutClientIP0DigestAuthTests.test_getChallengeWithoutClientIPs ""640**77@  5)73 7+]; ;/8 gy) h *r$)rsr-r*r)N) rZr[r\r]r^r0rr;rrr_r`ras@r#roros) *!,R '" + +r$rocHa]tRt^toRtRtRtRtRtRt Rt Rt Vt R #) UnauthorizedResourceTestsz$ Tests for L{UnauthorizedResource}. c \.4pVPVPRR4V4VPVPRR4V4R#)z6 An L{UnauthorizedResource} is every child of itself. fooNbar)rassertIdenticalgetChildWithDefault)r/resources& r#test_getChildWithDefault2UnauthorizedResourceTests.test_getChildWithDefaultsH(+ X99%FQ X99%FQr$c \\R4.4pVPV4VPVPR4VPVP P R4R.4R#)z Render L{UnauthorizedResource} for the given request object and verify that the response code is I{Unauthorized} and that a I{WWW-Authenticate} header is set in the response containing a challenge. example.comwww-authenticatesbasic realm="example.com"N)rrrenderrx responseCoderesponseHeaders getRawHeaders)r/r)rs&& r#_unauthorizedRenderTest1UnauthorizedResourceTests._unauthorizedRenderTestsb ()? )N(OPx  --s3   # # 1 12E F ) * r$c VP4pVPV4VPRRPVP44R#)z L{UnauthorizedResource} renders with a 401 response code and a I{WWW-Authenticate} header and puts a simple unauthorized message into the response body. s Unauthorizedr$Nr(rrxr@writtenr/r)s& r# test_render%UnauthorizedResourceTests.test_renders= ""$ $$W- #((7??*CDr$c VPRR7pVPV4VPRRPVP44R#)z The rendering behavior of L{UnauthorizedResource} for a I{HEAD} request is like its handling of a I{GET} request, but no response body is written. sHEAD)r5r$Nrrs& r#test_renderHEAD)UnauthorizedResourceTests.test_renderHEADsB ""'"2 $$W- chhw78r$c \\R4.4pVP4pVPV4VP VP P R4R.4R#)z The realm value included in the I{WWW-Authenticate} header set in the response when L{UnauthorizedResounrce} is rendered has quotes and backslashes escaped. z example\"foorsbasic realm="example\\\"foo"N)rrr(rrxrr)r/rr)s& r#test_renderQuotesRealm0UnauthorizedResourceTests.test_renderQuotesRealmsZ ()?)P(QR""$x    # # 1 12E F / 0 r$c \\P!RR4.4pVP4pVP V4VP P R4^,pVPRV4VPRV4R#)z The digest value included in the I{WWW-Authenticate} header set in the response when L{UnauthorizedResource} is rendered has quotes and backslashes escaped. rrs example\"foorsrealm="example\\\"foo"shm="md5N)rrrtr(rrrr)r/rr) authHeaders& r#test_renderQuotesDigest1UnauthorizedResourceTests.test_renderQuotesDigestsx (  + +F4D E F ""$x ,,::;NOPQR  2J? j*-r$rkN) rZr[r\r]r^rrrrrrr_r`ras@r#rrs/R  E9   . .r$rc6a]tRtRtoRtRtRtRtRtVt R#)Realmi(a* A simple L{IRealm} implementation which gives out L{WebAvatar} for any avatarId. @type loggedIn: C{int} @ivar loggedIn: The number of times C{requestAvatar} has been invoked for L{IResource}. @type loggedOut: C{int} @ivar loggedOut: The number of times the logout callback has been invoked. c.^Vn^VnWnR#)N) loggedOutloggedIn avatarFactory)r/rs&&r#__init__Realm.__init__5s *r$c\V9d<V;P^, un\VPV4VP3#\ 4h))rrrlogoutr3)r/avatarIdmind interfacess&&&*r# requestAvatarRealm.requestAvatar:s=  " MMQ Md00:DKKG G!##r$c8V;P^, unR#)rN)rr.s&r#r Realm.logout@s !r$)rrrN) rZr[r\r]r^rrrr_r`ras@r#rr(s + $ r$rca]tRtRtoRt]tRtRtRt Rt Rt Rt R t R tR tR tR tRtRtRtRtRtRtRtRtVtR#)HTTPAuthHeaderTestsiDz& Tests for L{HTTPAuthSessionWrapper}. c RVnRVnRVnRVnRVn\ 4VnVP PVPVP4\VPR4Vn VPPVP\VPR44VPVP/Vn \VPP4Vn\P !VPVP .4Vn.Vn\%VPVP"4VnR#)zL Create a realm, portal, and L{HTTPAuthSessionWrapper} to use in the tests. sfoo barsbar bazs&contents of the avatar resource itselfs foo-childs'contents of the foo child of the avatar text/plainN)r+r, avatarContent childName childContentrcheckeraddUserravatarputChildavatarsrgetr*rPortalcredentialFactoriesrwrapperr.s&r#r0HTTPAuthHeaderTests.setUpKs# " F%F>@  T]]DMM:4--|<  T^^T$2C2C\-RS t{{3 4<<++, mmDJJ? #% -dkk4;S;ST r$c \VPR,VP,4pVPP RRV,4\ VP V4#)z Add an I{basic authorization} header to the given request and then dispatch it, starting from C{self.wrapper} and returning the resulting L{IResource}. r? authorizationBasic )r r+r,requestHeaders addRawHeaderrr)r/r) authorizations&& r#_authorizedBasicLogin)HTTPAuthHeaderTests._authorizedBasicLogin^sM "$--$"6"FG ++,WX!$,,88r$c aaSPSP.4o\SPS4pSP 4pVV3RlpVP V4SP V4V#)z Resource traversal which encounters an L{HTTPAuthSessionWrapper} results in an L{UnauthorizedResource} instance when the request does not have the required I{Authorization} headers. c@<SPSPR4R#rNrxrresultr)r/s&r# cbFinished@HTTPAuthHeaderTests.test_getChildWithDefault..cbFinishedr   W113 7r$)r(rrr notifyFinish addCallbackrr/childdrr)sf @r#r,HTTPAuthHeaderTests.test_getChildWithDefaulths^ ""DNN#34"4<<9  " 8 j!ur$c `aaSPP\R44SPSP.4oSP P RV4\SPS4pSP4pVV3RlpVPV4SPV4V#)a Create a request with the given value as the value of an I{Authorization} header and perform resource traversal with it, starting at C{self.wrapper}. Assert that the result is a 401 response code. Return a L{Deferred} which fires when this is all done. rrc@<SPSPR4R#rrrs&r#rAHTTPAuthHeaderTests._invalidAuthorizationTest..cbFinishedrr$) rappendrr(rrrrrrrr)r/rFrrrr)sf& @r#_invalidAuthorizationTest-HTTPAuthHeaderTests._invalidAuthorizationTestys   ''(>}(MN""DNN#34++,HTTPAuthHeaderTests.test_getChildWithDefaultUnrecognizedSchemes --.ABBr$c aaSPP\R44SPSP.4oSP S4pSP 4pVV3RlpVPV4SPV4V#)z Resource traversal which encounters an L{HTTPAuthSessionWrapper} results in an L{IResource} which renders the L{IResource} avatar retrieved from the portal when the request has a valid I{Authorization} header. rcV<SPSPSP.4R#r)rxrrignoredr)r/s&r#rJHTTPAuthHeaderTests.test_getChildWithDefaultAuthorized..cbFinisheds   W__t/@/@.A Br$) rrrr(rrrrrrsf @r#"test_getChildWithDefaultAuthorized6HTTPAuthHeaderTests.test_getChildWithDefaultAuthorizedsy   ''(>}(MN""DNN#34**73  " C j!ur$c aaSPP\R44SP.4oSP S4pSP 4pVV3RlpVP V4SPV4V#)z Resource traversal which terminates at an L{HTTPAuthSessionWrapper} and includes correct authentication headers results in the L{IResource} avatar (not one of its children) retrieved from the portal being rendered. rcV<SPSPSP.4R#r)rxrrrs&r#r=HTTPAuthHeaderTests.test_renderAuthorized..cbFinisheds   W__t/A/A.B Cr$)rrrr(rrrrrsf @r#test_renderAuthorized)HTTPAuthHeaderTests.test_renderAuthorizedsr   ''(>}(MN""2&**73  " D j!ur$c `aaa\\4!RR44pV!4oSPPS4SP SP .4o\ SPS4pSP4pVVV3RlpVPV4SPV4V#)z When L{HTTPAuthSessionWrapper} finds an L{ICredentialFactory} to issue a challenge, it calls the C{getChallenge} method with the request as an argument. c0a]tRtRtoRtRtRtRtVtR#)UHTTPAuthHeaderTests.test_getChallengeCalledWithRequest..DumbCredentialFactoryisdumbc.VnR#rrequestsr.s&r#r^HTTPAuthHeaderTests.test_getChallengeCalledWithRequest..DumbCredentialFactory.__init__s " r$c<VPPV4/#r)rrrs&&r#rbHTTPAuthHeaderTests.test_getChallengeCalledWithRequest..DumbCredentialFactory.getChallenges $$W- r$rN) rZr[r\r]schemerrr_r`ras@r#DumbCredentialFactoryrsF #  r$rcB<SPSPS.4R#r)rxr)r factoryr)r/s&r#rJHTTPAuthHeaderTests.test_getChallengeCalledWithRequest..cbFinisheds   W--y 9r$) rrrrr(rrrrrr)r/rrrrrr)sf @@r#"test_getChallengeCalledWithRequest6HTTPAuthHeaderTests.test_getChallengeCalledWithRequests ' (   ) ()   ''0""DNN#34"4<<9  " : j!ur$c VPP\R44!RR\4pVPP VP V!44VPVP .4pVPV4pVPV4VPVPP^4V#)z Issue a request for an authentication-protected resource using valid credentials and then return the C{DummyRequest} instance which was used. This is a helper for tests about the behavior of the logout callback. rc&a]tRtRtoRtRtVtR#)7HTTPAuthHeaderTests._logoutTest..SlowerResourceic\#rrrs&&r#r>HTTPAuthHeaderTests._logoutTest..SlowerResource.renders##r$rkN)rZr[r\r]rr_r`ras@r#SlowerResourcer$s $ $r$r') rrrrrrrr(rrrxr*r)r/r'r)rs& r# _logoutTestHTTPAuthHeaderTests._logoutTests   ''(>}(MN $X $ T^^^-=>""DNN#34**73u --q1r$c VP4pVP4VPVPP^4R#)zH The realm's logout callback is invoked after the resource is rendered. N)r(finishrxr*rrs& r# test_logoutHTTPAuthHeaderTests.test_logouts6""$ --q1r$c VP4pVP\\R444VP VP P ^4R#)z The realm's logout callback is also invoked if there is an error generating the response (for example, if the client disconnects early). zSimulated disconnectN)r(processingFailedrr rxr*rrs& r#test_logoutOnError&HTTPAuthHeaderTests.test_logoutOnError sE ""$  8N)O!PQ --q1r$c VPP\R44VPVP.4pVP P RR4\VPV4pVPV\4R#)z Resource traversal which enouncters an L{HTTPAuthSessionWrapper} results in an L{UnauthorizedResource} when the request has a I{Basic Authorization} header which cannot be decoded using base64. rrsBasic decode should failN) rrrr(rrrrrassertIsInstancer)r/r)rs& r#test_decodeRaises%HTTPAuthHeaderTests.test_decodeRaisessr   ''(>}(MN""DNN#34++ 9 #4<<9 e%9:r$c RpVPVPPV4R4\R4pVPP V4VPVPPV4VR34R#)z L{HTTPAuthSessionWrapper._selectParseHeader} returns a two-tuple giving the L{ICredentialFactory} to use to parse the header and a string containing the portion of the header which remains to be parsed. sBasic abcdef123456Nrs abcdef123456)NN)rxr_selectParseHeaderrrr)r/basicAuthorizationrs& r#test_selectParseResponse,HTTPAuthHeaderTests.test_selectParseResponse$sv 3  LL + +,> ? )7   ''0  LL + +,> ? o & r$c a\P!V\4p!RR\4o!V3RlR4pVPP V!44VP VP.4pVPPRR4\VPV4pVPV4VPVPR4VP^\!V44VP#V^,R,P$S4VP\!VP'S44^4R #) z Any unexpected exception raised by the credential factory's C{decode} method results in a 500 response code and causes the exception to be logged. c]tRtRtRtR#)KHTTPAuthHeaderTests.test_unexpectedDecodeError..UnexpectedExceptioni=rkNrZr[r\r]r_rkr$r#UnexpectedExceptionr== r$r?c8<a]tRtRtoRtRtV3RltRtVtR#)BHTTPAuthHeaderTests.test_unexpectedDecodeError..BadFactoryi@sbadc/#rrk)r/ris&&r#rOHTTPAuthHeaderTests.test_unexpectedDecodeError..BadFactory.getChallengeCs r$c<S!4hrrk)r/rFr)r?s&&&r#rAIHTTPAuthHeaderTests.test_unexpectedDecodeError..BadFactory.decodeF )++r$rkN) rZr[r\r]rrrAr_r`rbr?s@r# BadFactoryrB@sF  , ,r$rIrsBad abc log_failureN)r createWithCleanupr Exceptionrrr(rrrrrrrxr assertEqualslenr3valueflushLoggedErrors)r/ logObserverrIr)rr?s& @r#test_unexpectedDecodeError.HTTPAuthHeaderTests.test_unexpectedDecodeError5s +<.UnexpectedExceptioniZrkNr>rkr$r#r?rWZr@r$r?c4<a]tRtRto]3tV3RltRtVtR#)DHTTPAuthHeaderTests.test_unexpectedLoginError..BrokenCheckeri]c<S!4hrrk)r/ credentialsr?s&&r#requestAvatarIdTHTTPAuthHeaderTests.test_unexpectedLoginError..BrokenChecker.requestAvatarId`rGr$rkN) rZr[r\r]r credentialInterfacesr\r_r`rHs@r# BrokenCheckerrY]s$5#7  , ,r$r_rrJrKN)r rLr rMrregisterCheckerrrrr(rrrrxrrNrOr3rPrQ)r/rRr_r)rr?s& @r#test_unexpectedLoginError-HTTPAuthHeaderTests.test_unexpectedLoginErrorSs +<}(MN""DNN#34**73u --s3 !S-. k!n];AACVW T334GHI1Mr$c "aaaRo\4SP\&SP\,PSP\ SR44SP P\44SPP\R44SPSP.4o\SPS4pSP4pVVV3RlpVP!V4SP#V4V#)zT Anonymous requests are allowed if a L{Portal} has an anonymous checker registered. s*contents of the unprotected child resourcerrcB<SPSPS.4R#r)rxr)r r)r/unprotectedContentss&r#r.cbFinisheds   W__/B.C Dr$)rrrrrrrr`rrrrr(rrrrr)r/rrrr)resf @@r#test_anonymousAccess(HTTPAuthHeaderTests.test_anonymousAccessms L"** Y Y(( NND!4lC  ##$8$:;   ''(>}(MN""DNN#34"4<<9  " E j!ur$) rrrrrrrr,rr*r+rN)rZr[r\r]r^rr(r0rrrrrrr rr r(r,r0r4r9rSrargr_r`ras@r#rrDsuKU&9"(Q  C&(>,22 ; "N<N4r$r)9r^rzope.interfacerzope.interface.verifyr twisted.credrrtwisted.cred.checkersrrrtwisted.cred.credentialsr twisted.internet.addressr twisted.internet.errorr twisted.internet.testingr twisted.loggerr twisted.python.failurer twisted.trialrtwisted.web._authrrtwisted.web._auth.basicrtwisted.web._auth.wrapperrrtwisted.web.iwebrtwisted.web.resourcerrrtwisted.web.serverrtwisted.web.staticrtwisted.web.test.test_webrr r&rdTestCasermrorIRealmrrrkr$r#r~s &.& 7019-*"+:R/HH+#2'M M `  \#68I8I H+lH$5$5H+VJ. h.?.?J.Z FMM8@(++@r$