<commit_before>/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
"use strict";

var expect = require("chai").expect;
var supertest = require("supertest");
var sinon = require("sinon");

var loop = require("../loop");
var app = loop.app;
var apiRouter = loop.apiRouter;
var apiPrefix = loop.apiPrefix;
var fxa = require("../loop/fxa");
var user = "<EMAIL>";

describe("fxa authentication", function() {
  var sandbox;

  beforeEach(function() {
    sandbox = sinon.sandbox.create();
  });

  afterEach(function() {
    sandbox.restore();
  });

  describe('middleware', function() {
    var jsonReq, expectedAssertion;

    // Create a route with the auth middleware installed.
    apiRouter.post('/with-middleware',
      fxa.getMiddleware("audience", function(req, res, assertion, next) {
        req.user = assertion.email;
        next();
      }), function(req, res) {
      res.status(200).json(req.user);
    });

    beforeEach(function() {
      jsonReq = supertest(app)
        .post(apiPrefix + '/with-middleware');

      expectedAssertion = "BID-ASSERTION";

      // Mock the calls to the external BrowserID verifier.
      sandbox.stub(fxa, "verifyAssertion",
        function(assertion, audience, trustedIssuers, cb){
          if (assertion === expectedAssertion) {
            cb(null, {email: user});
          } else {
            cb("error");
          }
        });
    });

    it("should require user authentication", function(done) {
      jsonReq
        .expect(401)
        .end(function(err, res) {
          if (err) throw err;
          expect(res.headers['www-authenticate']).to.eql('BrowserID');
          done();
        });
    });

    it("should reject invalid browserid assertions", function(done) {
      // Mock the calls to the external BrowserID verifier.
      jsonReq
        .set('Authorization', 'BrowserID ' + "invalid-assertion")
        .expect(401)
        .end(done);
    });

    it("should accept valid browserid assertions", function(done) {
      jsonReq
        .set('Authorization', 'BrowserID ' + expectedAssertion)
        .expect(200)
        .end(function(err) {
          if (err) throw err;
          done();
        });
    });

    it("should set an 'user' property on the request object", function(done) {
      jsonReq
        .set('Authorization', 'BrowserID ' + expectedAssertion)
        .expect(200)
        .end(function(err, res) {
          if (err) throw err;
          expect(res.body).eql("<EMAIL>");
          done();
        });
    });
  });

  describe('#verifyAssertion', function() {
    var audience, assertion;
    beforeEach(function() {<commit_msg>Add a test to make sure we log the error on the www-authenticate header.<commit_after>/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
"use strict";

var expect = require("chai").expect;
var supertest = require("supertest");
var sinon = require("sinon");

var loop = require("../loop");
var app = loop.app;
var apiRouter = loop.apiRouter;
var apiPrefix = loop.apiPrefix;
var fxa = require("../loop/fxa");
var user = "<EMAIL>";

describe("fxa authentication", function() {
  var sandbox;

  beforeEach(function() {
    sandbox = sinon.sandbox.create();
  });

  afterEach(function() {
    sandbox.restore();
  });

  describe('middleware', function() {
    var jsonReq, expectedAssertion;

    // Create a route with the auth middleware installed.
    apiRouter.post('/with-middleware',
      fxa.getMiddleware("audience", function(req, res, assertion, next) {
        req.user = assertion.email;
        next();
      }), function(req, res) {
      res.status(200).json(req.user);
    });

    beforeEach(function() {
      jsonReq = supertest(app)
        .post(apiPrefix + '/with-middleware');

      expectedAssertion = "BID-ASSERTION";

      // Mock the calls to the external BrowserID verifier.
      sandbox.stub(fxa, "verifyAssertion",
        function(assertion, audience, trustedIssuers, cb){
          if (assertion === expectedAssertion) {
            cb(null, {email: user});
          } else {
            cb("invalid assertion");
          }
        });
    });

    it("should require user authentication", function(done) {
      jsonReq
        .expect(401)
        .end(function(err, res) {
          if (err) throw err;
          expect(res.headers['www-authenticate']).to.eql('BrowserID');
          done();
        });
    });

    it("should reject invalid browserid assertions", function(done) {
      // Mock the calls to the external BrowserID verifier.
      jsonReq
        .set('Authorization', 'BrowserID ' + "invalid-assertion")
        .expect(401)
        .end(function(err, res) {
          if (err) throw err;
          expect(res.headers['www-authenticate'])
            .to.eql('BrowserID error="invalid assertion"');
          done();
        });
    });

    it("should accept valid browserid assertions", function(done) {
      jsonReq
        .set('Authorization', 'BrowserID ' + expectedAssertion)
        .expect(200)
        .end(function(err) {
          if (err) throw err;
          done();
        });
    });

    it("should set an 'user' property on the request object", function(done) {
      jsonReq
        .set('Authorization', 'BrowserID ' + expectedAssertion)
        .expect(200)
        .end(function(err, res) {
          if (err) throw err;
          expect(res.body).eql("<EMAIL>");
          done();
        });
    });
  });

  describe('#verifyAssertion', function() {
    var audience, assertion;
    beforeEach(function() {
{'fraction_non_alphanumeric': 0.14486542088119322, 'fraction_numerical': 0.006514657980456026, 'mean_word_length': 2.4664289958407606, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '717676', 'n_tokens_mistral': 1752, 'n_tokens_neox': 1685, 'n_words': 442}