initial commit

tests/device_interop.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Real PHP-issued device codes / Rust tokens on a disposable Laravel SQLite copy.
+No source database is modified. Device codes, keys, secrets and tokens are not printed.
+"""
+import argparse
+import base64
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import socket
+import sqlite3
+import subprocess
+import tempfile
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[1]
+PHP_SETUP = r'''<?php
+require getenv('APP_BASE_PATH').'/vendor/autoload.php';
+$app=require getenv('APP_BASE_PATH').'/bootstrap/app.php';
+$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();
+$user=new App\Models\User;
+$user->name='Device fixture';$user->email='device@example.invalid';$user->password='Synthetic-device-password-4620';$user->save();
+$clients=app(Laravel\Passport\ClientRepository::class);
+$client=$clients->createAuthorizationCodeGrantClient('Device fixture',[],false,null,true);
+$other=$clients->createAuthorizationCodeGrantClient('Other device fixture',[],false,null,true);
+$server=app(League\OAuth2\Server\AuthorizationServer::class);
+$request=(new GuzzleHttp\Psr7\ServerRequest('POST',getenv('APP_URL').'/oauth/device/code'))->withParsedBody(['client_id'=>(string)$client->id,'scope'=>'*']);
+$response=$server->respondToDeviceAuthorizationRequest($request,new GuzzleHttp\Psr7\Response);
+$code=json_decode((string)$response->getBody(),true);
+echo json_encode(['client_id'=>(string)$client->id,'other_id'=>(string)$other->id,'user_id'=>(string)$user->id,'device_code'=>$code['device_code'],'user_code'=>$code['user_code']]);
+'''
+PHP_OPERATION = r'''<?php
+require getenv('APP_BASE_PATH').'/vendor/autoload.php';
+$app=require getenv('APP_BASE_PATH').'/bootstrap/app.php';
+$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();
+$input=json_decode(file_get_contents(getenv('DEVICE_CONTROL')),true);
+if ($input['operation']==='approve' || $input['operation']==='deny') {
+ app(League\OAuth2\Server\AuthorizationServer::class)->completeDeviceAuthorizationRequest($input['device_code'],$input['user_id'],$input['operation']==='approve');
+ echo json_encode(['completed'=>true]);
+} elseif ($input['operation']==='read') {
+ $model=Laravel\Passport\Passport::deviceCode()->findOrFail($input['device_code']);
+ $entity=app(Laravel\Passport\Bridge\DeviceCodeRepository::class)->getDeviceCodeEntityByDeviceCode($input['device_code']);
+ echo json_encode(['client_id'=>(string)$model->client_id,'user_code'=>$model->user_code,'scopes'=>$model->scopes,'revoked'=>(bool)$model->revoked,'entity_readable'=>$entity!==null]);
+} elseif ($input['operation']==='validate') {
+ $request=(new GuzzleHttp\Psr7\ServerRequest('GET',getenv('APP_URL').'/api/v1/user'))->withHeader('Authorization','Bearer '.$input['access_token']);
+ $request=app(League\OAuth2\Server\ResourceServer::class)->validateAuthenticatedRequest($request);
+ echo json_encode(['user_id'=>(string)$request->getAttribute('oauth_user_id'),'scopes'=>$request->getAttribute('oauth_scopes')]);
+}
+'''
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('binary', nargs='?', type=Path, default=ROOT/'target/debug/twofauth-rs')
+    parser.add_argument('--php', type=Path, default=Path(os.environ.get('PHP_BINARY','/tmp/twofauth-reference-runtime/php')))
+    parser.add_argument('--source', type=Path, default=ROOT.parent/'upstream')
+    parser.add_argument('--output', type=Path)
+    args=parser.parse_args()
+    source=args.source.resolve();php=args.php.resolve();binary=args.binary.resolve()
+    if not (source/'vendor/autoload.php').is_file():parser.error('pinned upstream Composer dependencies required')
+    with tempfile.TemporaryDirectory(prefix='device-php-rust-') as directory:
+        work=Path(directory);app=work/'reference'
+        shutil.copytree(source,app,ignore=shutil.ignore_patterns('vendor','node_modules','.env*','cache','logs','sessions','testing'))
+        (app/'vendor').symlink_to(source/'vendor',target_is_directory=True)
+        for path in ('bootstrap/cache','storage/logs','storage/framework/cache/data','storage/framework/sessions','storage/framework/views'):(app/path).mkdir(parents=True,exist_ok=True)
+        with socket.socket() as reserve:reserve.bind(('127.0.0.1',0));port=reserve.getsockname()[1]
+        base=f'http://127.0.0.1:{port}'
+        runtime={name:os.environ[name] for name in ('PATH','PHPRC','LD_LIBRARY_PATH') if name in os.environ}
+        app_key='base64:'+base64.b64encode(b'0123456789abcdef0123456789abcdef').decode()
+        reference_db=work/'reference.sqlite';candidate_db=work/'candidate.sqlite'
+        env=dict(runtime,APP_BASE_PATH=str(app),APP_ENV='local',APP_DEBUG='false',APP_KEY=app_key,APP_URL=base,DB_CONNECTION='sqlite',DB_DATABASE=str(reference_db),SESSION_DRIVER='file',CACHE_STORE='file',MAIL_MAILER='array')
+        def command(argv,environment=env,cwd=app):
+            result=subprocess.run([str(value) for value in argv],env=environment,cwd=cwd,capture_output=True)
+            if result.returncode:raise RuntimeError('fixture command failed')
+            return result.stdout
+        command([php,'artisan','migrate','--force']);command([php,'artisan','passport:keys','--force'])
+        setup=work/'setup.php';setup.write_text(PHP_SETUP)
+        fixture=json.loads(command([php,setup]))
+        with sqlite3.connect(reference_db) as original,sqlite3.connect(candidate_db) as candidate:original.backup(candidate)
+        rust_env=dict(runtime,DATABASE_URL='sqlite://'+str(candidate_db),APP_KEY=app_key,APP_URL=base,PASSPORT_KEY_PATH=str(app/'storage'),RUST_COOKIE_SECURE='false',RUST_PUBLIC_DIR=str(ROOT/'public'))
+        command([binary,'prepare-sqlite'],rust_env,work)
+        operation=work/'operation.php';operation.write_text(PHP_OPERATION)
+        control=work/'control.json'
+        php_env=dict(env,DB_DATABASE=str(candidate_db),DEVICE_CONTROL=str(control))
+        def php_operation(name,**values):
+            control.write_text(json.dumps({'operation':name,**values}));control.chmod(0o600)
+            return json.loads(command([php,operation],php_env))
+        def request(path,values=None):
+            data=None if values is None else urllib.parse.urlencode(values).encode()
+            req=urllib.request.Request(base+path,data=data,headers={'Accept':'application/json','Content-Type':'application/x-www-form-urlencoded'})
+            try:response=urllib.request.urlopen(req,timeout=15)
+            except urllib.error.HTTPError as error:response=error
+            with response:
+                body=response.read()
+                try:payload=json.loads(body)
+                except ValueError:payload=None
+                return response.status,payload,response.headers
+        urn='urn:ietf:params:oauth:grant-type:device_code'
+        def poll(code,client=None):return request('/oauth/token',{'grant_type':urn,'client_id':client or fixture['client_id'],'device_code':code})
+        def issue():
+            status,body,headers=request('/oauth/device/code',{'client_id':fixture['client_id'],'scope':'*'})
+            assert status==200,'Rust device issuance failed'
+            assert re.fullmatch('[0-9a-f]{80}',body['device_code']) and re.fullmatch('[BCDFGHJKLMNPQRSTVWXZ]{8}',body['user_code'])
+            assert body['verification_uri']==base+'/oauth/device' and body['verification_uri_complete']==base+'/oauth/device?user_code='+body['user_code']
+            assert 590<=body['expires_in']<=600 and body['interval']==5
+            assert headers['Cache-Control']=='no-store, private' and headers['Pragma']=='no-cache'
+            return body
+        checks={}
+        with (work/'rust.log').open('w') as log:
+            process=subprocess.Popen([str(binary),'serve','--listen',f'127.0.0.1:{port}'],env=rust_env,cwd=work,stdout=log,stderr=subprocess.STDOUT)
+            try:
+                for _ in range(100):
+                    if process.poll() is not None:raise RuntimeError('Rust exited before readiness')
+                    try:
+                        if request('/up')[0]==200:break
+                    except OSError:time.sleep(.05)
+                else:raise RuntimeError('Rust startup timed out')
+                status,body,_=poll(fixture['device_code']);assert status==400 and body['error']=='authorization_pending' and body['hint']==''
+                status,body,_=poll(fixture['device_code']);assert status==400 and body['error']=='slow_down' and body['hint']==''
+                checks['php_issued_device_pending_backoff']=True
+                php_operation('approve',device_code=fixture['device_code'],user_id=fixture['user_id'])
+                status,tokens,_=poll(fixture['device_code']);assert status==200 and tokens.get('refresh_token'),'approved device exchange failed'
+                validated=php_operation('validate',access_token=tokens['access_token']);assert validated=={'user_id':fixture['user_id'],'scopes':[]}
+                checks['php_approval_rust_token_php_resource_server']=True
+                status,body,_=poll(fixture['device_code']);assert status==400 and body['error']=='invalid_grant' and body['hint']==''
+                assert php_operation('read',device_code=fixture['device_code'])['revoked'] is True
+                checks['device_code_revocation_replay']=True
+                issued=issue();read=php_operation('read',device_code=issued['device_code'])
+                assert read=={'client_id':fixture['client_id'],'user_code':issued['user_code'],'scopes':['*'],'revoked':False,'entity_readable':True}
+                checks['rust_issued_device_php_repository_readable']=True
+                status,body,_=poll(issued['device_code'],fixture['other_id']);assert status==400 and body['hint']=='Device code was not issued to this client'
+                php_operation('approve',device_code=issued['device_code'],user_id=fixture['user_id'])
+                status,tokens,_=poll(issued['device_code']);assert status==200,'PHP approval of Rust-issued device failed'
+                assert php_operation('validate',access_token=tokens['access_token'])=={'user_id':fixture['user_id'],'scopes':[]}
+                checks['rust_device_php_approval_and_token_validation']=True
+                denied=issue();php_operation('deny',device_code=denied['device_code'],user_id=fixture['user_id'])
+                status,body,_=poll(denied['device_code']);assert status==401 and body['error']=='access_denied' and 'hint' not in body
+                checks['php_denied_device_rejected']=True
+                expired=issue()
+                with sqlite3.connect(candidate_db) as db:db.execute("UPDATE oauth_device_codes SET expires_at=datetime('now','-1 second') WHERE id=?",(expired['device_code'],))
+                status,body,_=poll(expired['device_code']);assert status==400 and body['error']=='expired_token' and body['hint']=='device_code'
+                checks['expired_device_rejected']=True
+                with sqlite3.connect(reference_db) as db:
+                    assert db.execute('SELECT revoked,last_polled_at FROM oauth_device_codes WHERE id=?',(fixture['device_code'],)).fetchone()==(0,None)
+                checks['source_database_unchanged']=True
+                record={'upstream_commit':'3516c776a1fcbd83d234efc007e3a49807d6ed91','candidate_sha256':hashlib.sha256(binary.read_bytes()).hexdigest(),'php_version':command([php,'-r','echo PHP_VERSION;']).decode().strip(),'checks':checks,'passed':all(checks.values())}
+                if args.output:args.output.write_text(json.dumps(record,indent=2)+'\n')
+                print(json.dumps(record))
+            finally:
+                process.terminate()
+                try:process.wait(timeout=5)
+                except subprocess.TimeoutExpired:process.kill();process.wait()
+
+if __name__=='__main__':main()