Fixed some bugs in authtokens.

includes/IslandoraTuque.inc

@@ -64,7 +64,7 @@ class IslandoraTuque {
       global $user;
     }
 
-    if (!isset($user) || $user->uid == 0) {
+    if ($user->uid == 0) {
       $user_string = 'anonymous';
       $pass_string = 'anonymous';
     }

includes/islandora_authtokens.inc

@@ -23,7 +23,9 @@ define('TOKEN_TIMEOUT', 300);
  *   Defaults to 1.
  *   The number of uses the token should be used for.  There are
  *   times when this should be greater than 1: ie. Djatoka needs
- *   to make two calls.
+ *   to make two calls. This is the number of times it can be called
+ *   from different php sessions, not in the run of a program. (it is
+ *   statically cached).
  *
  * @return string
  *   The generated authentication token.
@@ -68,6 +70,12 @@ function islandora_get_object_token($pid, $dsid, $uses = 1) {
  *   FALSE otherwise
  */
 function islandora_validate_object_token($pid, $dsid, $token) {
+  static $accounts = array();
+
+  if(!empty($accounts[$pid][$dsid][$token])) {
+    return $accounts[$pid][$dsid][$token];
+  }
+
   // Check for database token.
   $time = time();
   $query = db_select('islandora_authtokens', 'tokens');
@@ -104,11 +112,13 @@ function islandora_validate_object_token($pid, $dsid, $token) {
       ->execute();
     }
     unset($result[0]->remaining_uses);
-    return $result[0];
+    $accounts[$pid][$dsid][$token] = $result[0];
   }
   else {
-    return FALSE;
+    $accounts[$pid][$dsid][$token] = FALSE;
   }
+
+  return $accounts[$pid][$dsid][$token];
 }
 
 /**

islandora.info

@@ -10,4 +10,6 @@ files[] = includes/MimeDetect.inc
 files[] = includes/DublinCore.inc
 files[] = includes/IslandoraTuque.inc
 files[] = includes/IslandoraTuqueWrapper.inc
+files[] = tests/islandora_web_test_case.inc
+files[] = tests/islandora_authtokens.test
 php = 5.3

islandora.module

@@ -342,55 +342,41 @@ function islandora_object_access_callback($perm, $object = NULL) {
  * @param FedoraDatastream $datastream
  *   The datastream to test, if NULL given the datastream doesn't exist
  *   or is inaccessible.
+ * @param StdObject $account
+ *   The account to test permissions as or NULL for current user.
  *
  * @return boolean
  *   TRUE if the user is allowed to access this object, FALSE otherwise.
  */
-function islandora_object_datastream_access_callback($perm, $object = NULL, $datastream = NULL) {
+function islandora_object_datastream_access_callback($perm, $object = NULL, $datastream = NULL, $account = NULL) {
   module_load_include('inc', 'islandora', 'includes/utilities');
-  return user_access($perm) && is_object($object) && islandora_namespace_accessible($object->id) && is_object($datastream);
+  return user_access($perm, $account) && is_object($object) && islandora_namespace_accessible($object->id) && is_object($datastream);
 }
 
 /**
- * Checks whether the user who added the token can access the given object and datastream with
+ * Checks whether the user can access the given object and datastream with
- * the given permission.
+ * the given permission. This function will validate and use a token if one
+ * is provided in the _GET array.
  *
  * Checks for object existance, accessiblitly, namespace permissions,
  * and user permissions
  *
- * @see islandora_object_load() To find potential solutions to enable page
+ * @see islandora_object_datastream_tokened_access_callback()
- *   not found errors.
- *
- * @param string $perm
- *   The user permission to test for.
- * @param FedoraObject $object
- *   The object to test, if NULL given the object doesn't exist or is
- *   inaccessible.
- * @param FedoraDatastream $datastream
- *   The datastream to test, if NULL given the datastream doesn't exist
- *   or is inaccessible.
- *
- * @return boolean
- *   TRUE if the user is allowed to access this object.
- *   TRUE if the user who created the token is allowed to access the object
- *   FALSE otherwise
  */
 function islandora_object_datastream_tokened_access_callback($perm, $object = NULL, $datastream = NULL) {
   module_load_include('inc', 'islandora', 'includes/utilities');
-  $drupal_access = islandora_object_datastream_access_callback($perm, $object, $datastream);
+
-  $token_access = FALSE;
+  $token_account = NULL;
-  if($drupal_access) {
-    return $drupal_access;
-  }
-  if (array_key_exists('token', $_GET)) {
   $token = filter_input(INPUT_GET, 'token', FILTER_SANITIZE_STRING);
-    $token_user = islandora_validate_object_token($object->id, $datastream->id, $token);
+
-    if (isset($token_user)) {
+  if ($token) {
-      $token_account = user_load(array('uid' => $token_user->uid));
+    $user = islandora_validate_object_token($object->id, $datastream->id, $token);
-      $token_access = user_access($perm, $token_account);
+    if ($user) {
+      $token_account = user_load($user->uid);
     }
   }
-  return $token_access;
+
+  return islandora_object_datastream_access_callback($perm, $object, $datastream, $token_account);
 }
 
 /**
@@ -545,6 +531,12 @@ function islandora_default_islandora_view_object($object) {
  *  Just a wrapper around fetchings the IslandoraTuque object, with some very
  *  basic error logging.
  *
+ * @param $user
+ *   The user to connect as.
+ *
+ * @param $url
+ *   The URL to connect to.
+ *
  * @return IslandoraTuque
  *   A IslandoraTuque instance
  */
@@ -624,7 +616,8 @@ function islandora_tokened_object_load($object_id, $map) {
     if ($token) {
       module_load_include('inc', 'islandora', 'includes/islandora_authtokens');
       $token_user = islandora_validate_object_token($object_id, $map[4], $token);
-      islandora_get_tuque_connection($user = $token_user);
+      $token_user = $token_user ? user_load($token_user->uid) : NULL;
+      islandora_get_tuque_connection($token_user);
     }
   }
   return islandora_object_load($object_id);

tests/islandora_authtokens.test

@@ -0,0 +1,94 @@
+<?php
+
+class IslandoraAuthtokensTestCase extends IslandoraWebTestCase {
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Islandora Authorization Tokens',
+      'description' => 'Ensure the correct functionality of the tokens to pass authorization to Djatoka in Islandora.',
+      'group' => 'Islandora',
+    );
+  }
+
+  public function setUp() {
+    parent::setUp(array('islandora'));
+  }
+
+  public function testRedeemInvalidToken() {
+    module_load_include('inc', 'islandora', 'includes/islandora_authtokens');
+
+    // get a token
+    $token = islandora_get_object_token('test:pid', 'woot', 1);
+    $this->assertTrue($token, 'Token was generated correctly.', 'Unit Tests');
+
+    // redeem a token that doesn't exist with real pid and dsid
+    $account = islandora_validate_object_token('test:pid', 'woot', 'foo');
+    $this->assertFalse($account, 'Redeeming an token that doesn\'t exist returns FALSE', 'Unit Tests');
+  }
+
+  public function testRedeemValidToken() {
+    module_load_include('inc', 'islandora', 'includes/islandora_authtokens');
+
+    // change the current user
+    global $user;
+    $user_backup = $user;
+    $test_account = $this->drupalCreateUser();
+    $user = $test_account;
+
+    $token = islandora_get_object_token('test:pid', 'woot', 1);
+
+    // logout again
+    $user = $user_backup;
+
+    $token_account = islandora_validate_object_token('test:pid', 'woot', $token);
+
+    $this->assertEqual($token_account->uid, $test_account->uid, 'UID from token is correct', 'Unit Tests');
+    $this->assertEqual($token_account->pass, $test_account->pass, 'Pass from token is correct', 'Unit Tests');
+    $this->assertEqual($token_account->name, $test_account->name, 'Name from token is correct', 'Unit Tests');
+  }
+
+  public function testTokenedViewDatastreamWithoutXacml() {
+    // ingest the fixture
+    $fixture_path = drupal_get_path('module', 'islandora') . '/tests/fixtures/bug.jp2';
+    $tuque = islandora_get_tuque_connection();
+    $newpid = "{$this->randomName()}:{$this->randomName()}";
+    $fixture_object = $tuque->repository->constructObject($newpid);
+    $fixture_datastream = $fixture_object->constructDatastream('JP2');
+    $fixture_datastream->setContentFromFile($fixture_path, TRUE);
+    $fixture_object->ingestDatastream($fixture_datastream);
+    $tuque->repository->ingestObject($fixture_object);
+
+    $this->drupalGet("islandora/object/{$newpid}/datastream/JP2/view");
+    $this->assertResponse(403, 'Page not found as anonymous');
+
+    $account = $this->drupalCreateUser(array(FEDORA_VIEW_OBJECTS));
+    $this->drupalLogin($account);
+
+    $this->drupalGet("islandora/object/{$newpid}/datastream/JP2/view");
+    $this->assertResponse(200, 'Page loaded as the authorized user');
+
+    // do some voodoo to get a token as the user we are connecting as
+    // to do this we need to change the user we are logged in as
+    module_load_include('inc', 'islandora', 'includes/islandora_authtokens');
+    global $user;
+    $backup = $user;
+    $user = $account;
+    $token = islandora_get_object_token($newpid, 'JP2', 1);
+    $user = $backup;
+
+    $this->drupalLogout();
+
+    $this->drupalGet("islandora/object/{$newpid}/datastream/JP2/view", array('query' => array('token' => $token)));
+    $this->assertResponse(200, 'Page loaded with the token');
+
+    $this->drupalGet("islandora/object/{$newpid}/datastream/JP2/view", array('query' => array('token' => $token)));
+    $this->assertResponse(403, 'Token is unable to be reused');
+
+    // delete fixture object
+    $tuque->repository->purgeObject($newpid);
+  }
+
+  public function testTokenedViewDatastreamWithXacml() {
+    // we need to add this test.
+  }
+}

tests/islandora_web_test_case.inc

@@ -0,0 +1,36 @@
+<?php
+
+class IslandoraWebTestCase extends DrupalWebTestCase {
+
+  public function setUp() {
+    $args = func_get_args();
+    call_user_func_array(array('parent', 'setUp'), $args);
+
+    $islandora_path = drupal_get_path('module', 'islandora');
+    $this->config_info = parse_ini_file("$islandora_path/tests/test_config.ini");
+    $connection_info = Database::getConnectionInfo('default');
+
+    $this->original_drupal_fiter = file_get_contents($this->config_info['filter_drupal_file']);
+
+    $drupal_filter_dom = new DomDocument();
+    $drupal_filter_dom->loadXML($this->original_drupal_fiter);
+    $drupal_filter_xpath = new DOMXPath($drupal_filter_dom);
+
+    $server = $connection_info['default']['host'];
+    $dbname = $connection_info['default']['database'];
+    $user = $connection_info['default']['username'];
+    $password = $connection_info['default']['password'];
+    $port = $connection_info['default']['port'] ? $connection_info['default']['port'] : '3306';
+    $prefix = $connection_info['default']['prefix']['default'];
+
+    $results = $drupal_filter_xpath->query("/FilterDrupal_Connection/connection[@server='$server' and @dbname='$dbname' and @user='$user' and @password='$password' and @port='$port']/sql");
+    $results->item(0)->nodeValue = "SELECT DISTINCT u.uid AS userid, u.name AS Name, u.pass AS Pass, r.name AS Role FROM ({$prefix}users u LEFT JOIN {$prefix}users_roles ON u.uid={$prefix}users_roles.uid) LEFT JOIN {$prefix}role r ON r.rid={$prefix}users_roles.rid WHERE u.name=? AND u.pass=?;";
+
+    file_put_contents($this->config_info['filter_drupal_file'], $drupal_filter_dom->saveXML());
+  }
+
+  public function tearDown() {
+    file_put_contents($this->config_info['filter_drupal_file'], $this->original_drupal_fiter);
+    parent::tearDown();
+  }
+}

tests/test_config.ini

@@ -0,0 +1,4 @@
+[fedora]
+filter_drupal_file = "/usr/local/fedora/server/config/filter-drupal.xml"
+admin_user = "fedoraAdmin"
+admin_pass = "fedoraAdmin"