# Path: job_runner/apps/job_runner/auth.py
# def validate_hmac(request):
#     """
#     Validate the HMAC of an incoming request.
# 
#     :param request:
#         The incoming request object.
# 
#     :return:
#         A ``bool`` indicating if the request is valid.
# 
#     This will test the ``Authentication`` header for valid keys. The following
#     format is expected::
# 
#         Authorization: ApiKey api_key:hmac_sha1
# 
#     ``public_key``
#         Is the public key as stored in the ApiKey model.
# 
#     ``hmac_sha1``
#         The HMAC-SHA1 generated over the uppercased request method + full
#         request path (path + query string, if applicable) + request body,
#         if applicable.
# 
#     """
#     auth_header = request.META.get('HTTP_AUTHORIZATION', '')
#     api_key_match = re.match(r'^ApiKey (.*?):(.*?)$', auth_header)
# 
#     if not api_key_match:
#         logger.error('api key mismatch')
#         return False
# 
#     try:
#         worker = Worker.objects.get(api_key=api_key_match.group(1))
#     except Worker.DoesNotExist:
#         logger.error('worker does not exist')
#         return False
# 
#     hmac_message = '{request_method}{full_path}{request_body}'.format(
#         request_method=request.method,
#         full_path=request.get_full_path(),
#         request_body=request.raw_post_data,
#     )
# 
#     expected_hmac = hmac.new(
#         str(worker.secret), hmac_message, hashlib.sha1)
# 
#     if expected_hmac.hexdigest() == api_key_match.group(2):
#         return True
# 
#     logger.error('hmac mismatch')
# 
#     return False


from django.test import TestCase
from mock import Mock, patch
from job_runner.apps.job_runner.auth import validate_hmac
        request.method = 'POST'
        request.META = {
            'HTTP_AUTHORIZATION': (
                'ApiKey api_user:9bfd7ed2a963182c4005c851f5f862cc97607f7b'),
        }
        request.get_full_path.return_value = 'full_request_path'
        request.raw_post_data = 'raw_post_data'

        api_user = Worker.objects.get.return_value
        api_user.secret = 'foobar'

        self.assertTrue(validate_hmac(request))

    @patch('job_runner.apps.job_runner.auth.Worker')
    def test_validate_hmac_invalid_api_key(self, Worker):
        """
        Test :func:`.validate_hmac` with invalid API key.
        """
        request = Mock()
        request.method = 'GET'
        request.META = {
            'HTTP_AUTHORIZATION': (
                'ApiKey api_user:9bfd7ed2a963182c4005c851f5f862cc97607f7b'),
        }
        request.get_full_path.return_value = 'full_request_path'
        request.raw_post_data = 'raw_post_data'

        api_user = Worker.objects.get.return_value
        api_user.secret = 'foobar'


# Path: job_runner/apps/job_runner/auth.py
# def validate_hmac(request):
#     """
#     Validate the HMAC of an incoming request.
# 
#     :param request:
#         The incoming request object.
# 
#     :return:
#         A ``bool`` indicating if the request is valid.
# 
#     This will test the ``Authentication`` header for valid keys. The following
#     format is expected::
# 
#         Authorization: ApiKey api_key:hmac_sha1
# 
#     ``public_key``
#         Is the public key as stored in the ApiKey model.
# 
#     ``hmac_sha1``
#         The HMAC-SHA1 generated over the uppercased request method + full
#         request path (path + query string, if applicable) + request body,
#         if applicable.
# 
#     """
#     auth_header = request.META.get('HTTP_AUTHORIZATION', '')
#     api_key_match = re.match(r'^ApiKey (.*?):(.*?)$', auth_header)
# 
#     if not api_key_match:
#         logger.error('api key mismatch')
#         return False
# 
#     try:
#         worker = Worker.objects.get(api_key=api_key_match.group(1))
#     except Worker.DoesNotExist:
#         logger.error('worker does not exist')
#         return False
# 
#     hmac_message = '{request_method}{full_path}{request_body}'.format(
#         request_method=request.method,
#         full_path=request.get_full_path(),
#         request_body=request.raw_post_data,
#     )
# 
#     expected_hmac = hmac.new(
#         str(worker.secret), hmac_message, hashlib.sha1)
# 
#     if expected_hmac.hexdigest() == api_key_match.group(2):
#         return True
# 
#     logger.error('hmac mismatch')
# 
#     return False


# Path: job_runner/apps/job_runner/tests/unit/test_auth.py
from django.test import TestCase
from mock import Mock, patch
from job_runner.apps.job_runner.auth import validate_hmac

        request.method = 'POST'
        request.META = {
            'HTTP_AUTHORIZATION': (
                'ApiKey api_user:9bfd7ed2a963182c4005c851f5f862cc97607f7b'),
        }
        request.get_full_path.return_value = 'full_request_path'
        request.raw_post_data = 'raw_post_data'

        api_user = Worker.objects.get.return_value
        api_user.secret = 'foobar'

        self.assertTrue(validate_hmac(request))

    @patch('job_runner.apps.job_runner.auth.Worker')
    def test_validate_hmac_invalid_api_key(self, Worker):
        """
        Test :func:`.validate_hmac` with invalid API key.
        """
        request = Mock()
        request.method = 'GET'
        request.META = {
            'HTTP_AUTHORIZATION': (
                'ApiKey api_user:9bfd7ed2a963182c4005c851f5f862cc97607f7b'),
        }
        request.get_full_path.return_value = 'full_request_path'
        request.raw_post_data = 'raw_post_data'

        api_user = Worker.objects.get.return_value
        api_user.secret = 'foobar'


        self.assertFalse(validate_hmac(request))