# Path: tokenserver/verifiers.py
# class LocalBrowserIdVerifier(browserid.verifiers.local.LocalVerifier):
#     implements(IBrowserIdVerifier)
# 
#     def __init__(self, trusted_issuers=None, allowed_issuers=None, **kwargs):
#         """LocalVerifier constructor, with the following extra config options:
# 
#         :param ssl_certificate: The path to an optional ssl certificate to
#             use when doing SSL requests with the BrowserID server.
#             Set to True (the default) to use default certificate authorities.
#             Set to False to disable SSL verification.
#         """
#         if isinstance(trusted_issuers, basestring):
#             trusted_issuers = trusted_issuers.split()
#         self.trusted_issuers = trusted_issuers
#         if trusted_issuers is not None:
#             kwargs["trusted_secondaries"] = trusted_issuers
#         if isinstance(allowed_issuers, basestring):
#             allowed_issuers = allowed_issuers.split()
#         self.allowed_issuers = allowed_issuers
#         if "ssl_certificate" in kwargs:
#             verify = kwargs["ssl_certificate"]
#             kwargs.pop("ssl_certificate")
#             if not verify:
#                 self._emit_warning()
#         else:
#             verify = None
#         kwargs["supportdocs"] = SupportDocumentManager(verify=verify)
#         # Disable warning about evolving data formats, it's out of date.
#         kwargs.setdefault("warning", False)
#         super(LocalBrowserIdVerifier, self).__init__(**kwargs)
# 
#     def _emit_warning():
#         """Emit a scary warning to discourage unverified SSL access."""
#         msg = "browserid.ssl_certificate=False disables server's certificate"\
#               "validation and poses a security risk. You should pass the path"\
#               "to your self-signed certificate(s) instead. "\
#               "For more information on the ssl_certificate parameter, see "\
#               "http://docs.python-requests.org/en/latest/user/advanced/"\
#               "#ssl-cert-verification"
#         warnings.warn(msg, RuntimeWarning, stacklevel=2)
# 
#     def verify(self, assertion, audience=None):
#         data = super(LocalBrowserIdVerifier, self).verify(assertion, audience)
#         if self.allowed_issuers is not None:
#             issuer = data.get('issuer')
#             if issuer not in self.allowed_issuers:
#                 raise InvalidIssuerError("Issuer not allowed: %s" % (issuer,))
#         return data
# 
# class IBrowserIdVerifier(Interface):
#     pass


import unittest
import browserid.errors
from pyramid.config import Configurator
from tokenserver.verifiers import LocalBrowserIdVerifier, IBrowserIdVerifier
from browserid.tests.support import (make_assertion,
                                     patched_supportdoc_fetching)
        "tokenserver.secrets.secrets":
            "bruce-let-the-dogs-out",
    }

    def _make_config(self, settings={}):
        all_settings = self.DEFAULT_SETTINGS.copy()
        all_settings.update(settings)
        config = Configurator(settings=all_settings)
        config.include("tokenserver")
        config.commit()
        return config

    def test_verifier_config_loading_defaults(self):
        config = self._make_config()
        verifier = config.registry.getUtility(IBrowserIdVerifier)
        self.assertTrue(isinstance(verifier, LocalBrowserIdVerifier))
        self.assertEquals(verifier.audiences, None)
        self.assertEquals(verifier.trusted_issuers, None)
        self.assertEquals(verifier.allowed_issuers, None)

    def test_verifier_config_loading_values(self):
        config = self._make_config({  # noqa; indentation below is non-standard
            "browserid.audiences":
                "https://testmytoken.com",
            "browserid.trusted_issuers":
                "example.com trustyidp.org",
            "browserid.allowed_issuers":
                "example.com trustyidp.org\nmockmyid.com",
        })
        verifier = config.registry.getUtility(IBrowserIdVerifier)

# Path: tokenserver/verifiers.py
# class LocalBrowserIdVerifier(browserid.verifiers.local.LocalVerifier):
#     implements(IBrowserIdVerifier)
# 
#     def __init__(self, trusted_issuers=None, allowed_issuers=None, **kwargs):
#         """LocalVerifier constructor, with the following extra config options:
# 
#         :param ssl_certificate: The path to an optional ssl certificate to
#             use when doing SSL requests with the BrowserID server.
#             Set to True (the default) to use default certificate authorities.
#             Set to False to disable SSL verification.
#         """
#         if isinstance(trusted_issuers, basestring):
#             trusted_issuers = trusted_issuers.split()
#         self.trusted_issuers = trusted_issuers
#         if trusted_issuers is not None:
#             kwargs["trusted_secondaries"] = trusted_issuers
#         if isinstance(allowed_issuers, basestring):
#             allowed_issuers = allowed_issuers.split()
#         self.allowed_issuers = allowed_issuers
#         if "ssl_certificate" in kwargs:
#             verify = kwargs["ssl_certificate"]
#             kwargs.pop("ssl_certificate")
#             if not verify:
#                 self._emit_warning()
#         else:
#             verify = None
#         kwargs["supportdocs"] = SupportDocumentManager(verify=verify)
#         # Disable warning about evolving data formats, it's out of date.
#         kwargs.setdefault("warning", False)
#         super(LocalBrowserIdVerifier, self).__init__(**kwargs)
# 
#     def _emit_warning():
#         """Emit a scary warning to discourage unverified SSL access."""
#         msg = "browserid.ssl_certificate=False disables server's certificate"\
#               "validation and poses a security risk. You should pass the path"\
#               "to your self-signed certificate(s) instead. "\
#               "For more information on the ssl_certificate parameter, see "\
#               "http://docs.python-requests.org/en/latest/user/advanced/"\
#               "#ssl-cert-verification"
#         warnings.warn(msg, RuntimeWarning, stacklevel=2)
# 
#     def verify(self, assertion, audience=None):
#         data = super(LocalBrowserIdVerifier, self).verify(assertion, audience)
#         if self.allowed_issuers is not None:
#             issuer = data.get('issuer')
#             if issuer not in self.allowed_issuers:
#                 raise InvalidIssuerError("Issuer not allowed: %s" % (issuer,))
#         return data
# 
# class IBrowserIdVerifier(Interface):
#     pass


# Path: tokenserver/tests/test_local_browserid_verifier.py
import unittest
import browserid.errors
from pyramid.config import Configurator
from tokenserver.verifiers import LocalBrowserIdVerifier, IBrowserIdVerifier
from browserid.tests.support import (make_assertion,
                                     patched_supportdoc_fetching)

        "tokenserver.secrets.secrets":
            "bruce-let-the-dogs-out",
    }

    def _make_config(self, settings={}):
        all_settings = self.DEFAULT_SETTINGS.copy()
        all_settings.update(settings)
        config = Configurator(settings=all_settings)
        config.include("tokenserver")
        config.commit()
        return config

    def test_verifier_config_loading_defaults(self):
        config = self._make_config()
        verifier = config.registry.getUtility(IBrowserIdVerifier)
        self.assertTrue(isinstance(verifier, LocalBrowserIdVerifier))
        self.assertEquals(verifier.audiences, None)
        self.assertEquals(verifier.trusted_issuers, None)
        self.assertEquals(verifier.allowed_issuers, None)

    def test_verifier_config_loading_values(self):
        config = self._make_config({  # noqa; indentation below is non-standard
            "browserid.audiences":
                "https://testmytoken.com",
            "browserid.trusted_issuers":
                "example.com trustyidp.org",
            "browserid.allowed_issuers":
                "example.com trustyidp.org\nmockmyid.com",
        })
        verifier = config.registry.getUtility(IBrowserIdVerifier)

        self.assertTrue(isinstance(verifier, LocalBrowserIdVerifier))