Merge branch 'master' of https://github.com/scitokens/scitokens-cpp into scitokens_async

Author: djw8605

src/scitokens_internal.h

@@ -690,7 +690,7 @@ class Enforcer {
             m_validator.verify(scitoken, time(NULL) + 20);
             return true;
         } catch (std::runtime_error &) {
-            return false;
+            throw;
         }
     }
 

test/CMakeLists.txt

@@ -2,8 +2,8 @@
 add_executable(scitokens-gtest main.cpp)
 if( NOT SCITOKENS_EXTERNAL_GTEST )
     add_dependencies(scitokens-gtest gtest)
+    include_directories("${PROJECT_SOURCE_DIR}/vendor/gtest/googletest/include")
 endif()
-include_directories("${PROJECT_SOURCE_DIR}/vendor/gtest/googletest/include")
 
 if(SCITOKENS_EXTERNAL_GTEST)
     set(LIBGTEST "gtest")

test/main.cpp

@@ -252,6 +252,101 @@ TEST_F(SerializeTest, FailVerifyATJWTTest) {
     scitoken_set_deserialize_profile(m_read_token.get(), SciTokenProfile::AT_JWT);
     rv = scitoken_deserialize_v2(token_value, m_read_token.get(), nullptr, &err_msg);
     ASSERT_FALSE(rv == 0);
+}
+
+TEST_F(SerializeTest, EnforcerTest) {
+    /*
+    * Test that the enforcer works and returns an err_msg
+    */
+    char *err_msg = nullptr;
+
+    auto rv = scitoken_set_claim_string(m_token.get(), "aud",
+                "https://demo.scitokens.org/", &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    std::vector<const char *> audiences_array;
+    audiences_array.push_back("https://demo.scitokens.org/");
+    audiences_array.push_back(nullptr);
+
+    auto enforcer = enforcer_create("https://demo.scitokens.org/gtest", &audiences_array[0], &err_msg);
+    ASSERT_TRUE(enforcer != nullptr);
+    
+    Acl acl;
+    acl.authz = "read";
+    acl.resource = "/stuff";
+
+    rv = scitoken_set_claim_string(m_token.get(), "scope",
+                "read:/blah", &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    rv = scitoken_set_claim_string(m_token.get(), "ver",
+                "scitoken:2.0", &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    char *token_value = nullptr;
+    rv = scitoken_serialize(m_token.get(), &token_value, &err_msg);
+    ASSERT_TRUE(rv == 0);
+    std::unique_ptr<char, decltype(&free)> token_value_ptr(token_value, free);
+
+    rv = scitoken_deserialize_v2(token_value, m_read_token.get(), nullptr, &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    rv = enforcer_test(enforcer, m_read_token.get(), &acl, &err_msg);
+    ASSERT_STREQ(err_msg, "token verification failed: 'scope' claim verification failed.");
+    ASSERT_TRUE(rv == -1) << err_msg;
+
+}
+
+TEST_F(SerializeTest, EnforcerScopeTest) {
+    char *err_msg = nullptr;
+
+    auto rv = scitoken_set_claim_string(m_token.get(), "aud",
+                "https://demo.scitokens.org/", &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    std::vector<const char *> audiences_array;
+    audiences_array.push_back("https://demo.scitokens.org/");
+    audiences_array.push_back(nullptr);
+
+    auto enforcer = enforcer_create("https://demo.scitokens.org/gtest", &audiences_array[0], &err_msg);
+    ASSERT_TRUE(enforcer != nullptr);
+
+    scitoken_set_serialize_profile(m_token.get(), SciTokenProfile::WLCG_1_0);
+    
+    rv = scitoken_set_claim_string(m_token.get(), "scope",
+                "storage.modify:/ storage.read:/ openid offline_access", &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    char *token_value = nullptr;
+    rv = scitoken_serialize(m_token.get(), &token_value, &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    rv = scitoken_deserialize_v2(token_value, m_read_token.get(), nullptr, &err_msg);
+    ASSERT_TRUE(rv == 0);
+
+    Acl *acls;
+    enforcer_generate_acls(enforcer, m_read_token.get(), &acls, &err_msg);
+    ASSERT_TRUE(acls != nullptr);
+    int idx = 0;
+    bool found_read = false;
+    bool found_write = false;
+    while (acls[idx].resource && acls[idx++].authz) {
+        auto resource = acls[idx-1].resource;
+        auto authz = acls[idx-1].authz;
+        if (strcmp(authz, "read") == 0) {
+            found_read = true;
+            ASSERT_STREQ(resource, "/");
+        } else if (strcmp(authz, "write") == 0) {
+            found_write = true;
+            ASSERT_STREQ(resource, "/");
+        }
+    }
+    ASSERT_TRUE(found_read);
+    ASSERT_TRUE(found_write);
+
+
+
+
 }
 
 }