commit ed9223c7e5f7b437b2765211f3201a3450004409
Author: Sofia Papagiannaki <spapagian@grnet.gr>
Date:   Fri Dec 20 19:14:41 2013 +0200

    astakos oa2: Handle failures due to too long redirect urls
    
    Change database field to TextField in order to avoid restrictions on the
    redirect url lengths
    Update tests
    
    This fix introduces a database migration of the oa2 app
    
    Refs: #4804

diff --git a/snf-astakos-app/astakos/oa2/migrations/0004_auto__chg_field_redirecturl_url__del_unique_redirecturl_url__chg_field.py b/snf-astakos-app/astakos/oa2/migrations/0004_auto__chg_field_redirecturl_url__del_unique_redirecturl_url__chg_field.py
new file mode 100644
index 0000000..d9f7c68
--- /dev/null
+++ b/snf-astakos-app/astakos/oa2/migrations/0004_auto__chg_field_redirecturl_url__del_unique_redirecturl_url__chg_field.py
@@ -0,0 +1,171 @@
+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Removing unique constraint on 'RedirectUrl', fields ['url']
+        db.delete_unique('oa2_redirecturl', ['url'])
+
+
+        # Changing field 'RedirectUrl.url'
+        db.alter_column('oa2_redirecturl', 'url', self.gf('django.db.models.fields.TextField')())
+
+        # Changing field 'AuthorizationCode.redirect_uri'
+        db.alter_column('oa2_authorizationcode', 'redirect_uri', self.gf('django.db.models.fields.TextField')(null=True))
+
+        # Changing field 'Token.redirect_uri'
+        db.alter_column('oa2_token', 'redirect_uri', self.gf('django.db.models.fields.TextField')())
+
+    def backwards(self, orm):
+
+        # Changing field 'RedirectUrl.url'
+        db.alter_column('oa2_redirecturl', 'url', self.gf('django.db.models.fields.URLField')(max_length=200, unique=True))
+        # Adding unique constraint on 'RedirectUrl', fields ['url']
+        db.create_unique('oa2_redirecturl', ['url'])
+
+
+        # Changing field 'AuthorizationCode.redirect_uri'
+        db.alter_column('oa2_authorizationcode', 'redirect_uri', self.gf('django.db.models.fields.CharField')(max_length=255, null=True))
+
+        # Changing field 'Token.redirect_uri'
+        db.alter_column('oa2_token', 'redirect_uri', self.gf('django.db.models.fields.CharField')(max_length=255))
+
+    models = {
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        'auth.user': {
+            'Meta': {'object_name': 'User'},
+            'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+            'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+            'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        },
+        'im.astakosuser': {
+            'Meta': {'object_name': 'AstakosUser', '_ormbases': ['auth.User']},
+            'accepted_email': ('django.db.models.fields.EmailField', [], {'default': 'None', 'max_length': '75', 'null': 'True', 'blank': 'True'}),
+            'accepted_policy': ('django.db.models.fields.CharField', [], {'default': 'None', 'max_length': '255', 'null': 'True', 'blank': 'True'}),
+            'activation_sent': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'blank': 'True'}),
+            'affiliation': ('django.db.models.fields.CharField', [], {'max_length': '255', 'null': 'True', 'blank': 'True'}),
+            'auth_token': ('django.db.models.fields.CharField', [], {'max_length': '64', 'unique': 'True', 'null': 'True', 'blank': 'True'}),
+            'auth_token_created': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'auth_token_expires': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'date_signed_terms': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'blank': 'True'}),
+            'deactivated_at': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'blank': 'True'}),
+            'deactivated_reason': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True'}),
+            'disturbed_quota': ('django.db.models.fields.BooleanField', [], {'default': 'False', 'db_index': 'True'}),
+            'email_verified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'has_credits': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'has_signed_terms': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'invitations': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+            'is_rejected': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_verified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'level': ('django.db.models.fields.IntegerField', [], {'default': '4'}),
+            'moderated': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'moderated_at': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'}),
+            'moderated_data': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True', 'blank': 'True'}),
+            'policy': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['im.Resource']", 'null': 'True', 'through': "orm['im.AstakosUserQuota']", 'symmetrical': 'False'}),
+            'rejected_reason': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'updated': ('django.db.models.fields.DateTimeField', [], {}),
+            'user_ptr': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['auth.User']", 'unique': 'True', 'primary_key': 'True'}),
+            'uuid': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '255'}),
+            'verification_code': ('django.db.models.fields.CharField', [], {'max_length': '255', 'unique': 'True', 'null': 'True'}),
+            'verified_at': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'blank': 'True'})
+        },
+        'im.astakosuserquota': {
+            'Meta': {'unique_together': "(('resource', 'user'),)", 'object_name': 'AstakosUserQuota'},
+            'capacity': ('django.db.models.fields.BigIntegerField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'resource': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['im.Resource']"}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['im.AstakosUser']"})
+        },
+        'im.resource': {
+            'Meta': {'object_name': 'Resource'},
+            'api_visible': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'desc': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '255'}),
+            'service_origin': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+            'service_type': ('django.db.models.fields.CharField', [], {'max_length': '255'}),
+            'ui_visible': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'unit': ('django.db.models.fields.CharField', [], {'max_length': '255', 'null': 'True'}),
+            'uplimit': ('django.db.models.fields.BigIntegerField', [], {'default': '0'})
+        },
+        'oa2.authorizationcode': {
+            'Meta': {'object_name': 'AuthorizationCode'},
+            'access_token': ('django.db.models.fields.CharField', [], {'default': "'online'", 'max_length': '100'}),
+            'client': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['oa2.Client']", 'on_delete': 'models.PROTECT'}),
+            'code': ('django.db.models.fields.TextField', [], {}),
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime(2013, 12, 20, 0, 0)'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'redirect_uri': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True'}),
+            'scope': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True'}),
+            'state': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True'}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['im.AstakosUser']", 'on_delete': 'models.PROTECT'})
+        },
+        'oa2.client': {
+            'Meta': {'object_name': 'Client'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'identifier': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '255'}),
+            'is_trusted': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'secret': ('django.db.models.fields.CharField', [], {'default': 'None', 'max_length': '255', 'null': 'True'}),
+            'type': ('django.db.models.fields.CharField', [], {'default': "'confidential'", 'max_length': '100'}),
+            'url': ('django.db.models.fields.CharField', [], {'max_length': '255'})
+        },
+        'oa2.redirecturl': {
+            'Meta': {'ordering': "('is_default',)", 'unique_together': "(('client', 'url'),)", 'object_name': 'RedirectUrl'},
+            'client': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['oa2.Client']", 'on_delete': 'models.PROTECT'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_default': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'url': ('django.db.models.fields.TextField', [], {})
+        },
+        'oa2.token': {
+            'Meta': {'object_name': 'Token'},
+            'access_token': ('django.db.models.fields.CharField', [], {'default': "'online'", 'max_length': '100'}),
+            'client': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['oa2.Client']", 'on_delete': 'models.PROTECT'}),
+            'code': ('django.db.models.fields.TextField', [], {}),
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime(2013, 12, 20, 0, 0)'}),
+            'expires_at': ('django.db.models.fields.DateTimeField', [], {}),
+            'grant_type': ('django.db.models.fields.CharField', [], {'default': "'authorization_code'", 'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'redirect_uri': ('django.db.models.fields.TextField', [], {}),
+            'scope': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True'}),
+            'state': ('django.db.models.fields.TextField', [], {'default': 'None', 'null': 'True'}),
+            'token_type': ('django.db.models.fields.CharField', [], {'default': "'Bearer'", 'max_length': '100'}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['im.AstakosUser']", 'on_delete': 'models.PROTECT'})
+        }
+    }
+
+    complete_apps = ['oa2']
\ No newline at end of file
diff --git a/snf-astakos-app/astakos/oa2/models.py b/snf-astakos-app/astakos/oa2/models.py
index d1e61a3..44a8e1d 100644
--- a/snf-astakos-app/astakos/oa2/models.py
+++ b/snf-astakos-app/astakos/oa2/models.py
@@ -58,7 +58,7 @@ ACCESS_TOKEN_TYPES = (('online', _('Online token')),
 class RedirectUrl(models.Model):
     client = models.ForeignKey('oa2.Client', on_delete=models.PROTECT)
     is_default = models.BooleanField(default=True)
-    url = models.URLField(unique=True)
+    url = models.TextField()
 
     class Meta:
         ordering = ('is_default', )
@@ -100,7 +100,7 @@ class Client(models.Model):
 class AuthorizationCode(models.Model):
     user = models.ForeignKey('im.AstakosUser', on_delete=models.PROTECT)
     code = models.TextField()
-    redirect_uri = models.CharField(max_length=255, null=True, default=None)
+    redirect_uri = models.TextField(null=True, default=None)
     client = models.ForeignKey('oa2.Client', on_delete=models.PROTECT)
     scope = models.TextField(null=True, default=None)
     created_at = models.DateTimeField(default=datetime.datetime.now())
@@ -138,7 +138,7 @@ class Token(models.Model):
 
     # authorization fields
     user = models.ForeignKey('im.AstakosUser', on_delete=models.PROTECT)
-    redirect_uri = models.CharField(max_length=255)
+    redirect_uri = models.TextField()
     client = models.ForeignKey('oa2.Client', on_delete=models.PROTECT)
     scope = models.TextField(null=True, default=None)
     access_token = models.CharField(max_length=100, choices=ACCESS_TOKEN_TYPES,
diff --git a/snf-astakos-app/astakos/oa2/tests/djangobackend.py b/snf-astakos-app/astakos/oa2/tests/djangobackend.py
index e3a27ed..c527396 100644
--- a/snf-astakos-app/astakos/oa2/tests/djangobackend.py
+++ b/snf-astakos-app/astakos/oa2/tests/djangobackend.py
@@ -377,7 +377,15 @@ class TestOA2(TestCase, URLAssertionsMixin):
         self.assertEqual(code4.state, 'csrfstate')
         self.assertEqual(code4.redirect_uri, self.client3_redirect_uri)
 
-        params['redirect_uri'] = '%s/more' % self.client3_redirect_uri
+        # redirect uri startswith the client's registered redirect url
+        params['redirect_uri'] = '%smore' % self.client3_redirect_uri
+        self.client.set_credentials('client3', 'secret')
+        r = self.client.authorize_code('client3', urlparams=params)
+        self.assertEqual(r.status_code, 400)
+
+        # redirect uri descendant
+        redirect_uri = '%s/more' % self.client3_redirect_uri
+        params['redirect_uri'] = redirect_uri
         self.client.set_credentials('client3', 'secret')
         r = self.client.authorize_code('client3', urlparams=params)
         self.assertEqual(r.status_code, 302)
@@ -389,13 +397,33 @@ class TestOA2(TestCase, URLAssertionsMixin):
         self.assertParamEqual(redirect5, "state", 'csrfstate')
         self.assertNoParam(redirect5, "extra_param")
         self.assertHost(redirect5, "server3.com")
-        self.assertPath(redirect5, "/handle_code/more")
+        self.assertPath(redirect5, urlparse.urlparse(redirect_uri).path)
 
-        code4 = AuthorizationCode.objects.get(code=redirect5.params['code'][0])
-        self.assertEqual(code4.state, 'csrfstate')
-        self.assertEqual(code4.redirect_uri,
+        code5 = AuthorizationCode.objects.get(code=redirect5.params['code'][0])
+        self.assertEqual(code5.state, 'csrfstate')
+        self.assertEqual(code5.redirect_uri,
                          '%s/more' % self.client3_redirect_uri)
 
+        # too long redirect uri
+        redirect_uri = '%s/%s' % (self.client3_redirect_uri, 'a'*2000)
+        params['redirect_uri'] = redirect_uri
+        self.client.set_credentials('client3', 'secret')
+        r = self.client.authorize_code('client3', urlparams=params)
+        self.assertEqual(r.status_code, 302)
+        self.assertCount(AuthorizationCode, 6)
+
+        # redirect is valid
+        redirect6 = self.get_redirect_url(r)
+        self.assertParam(redirect6, "code")
+        self.assertParamEqual(redirect6, "state", 'csrfstate')
+        self.assertNoParam(redirect6, "extra_param")
+        self.assertHost(redirect6, "server3.com")
+        self.assertPath(redirect6, urlparse.urlparse(redirect_uri).path)
+
+        code6 = AuthorizationCode.objects.get(code=redirect6.params['code'][0])
+        self.assertEqual(code6.state, 'csrfstate')
+        self.assertEqual(code6.redirect_uri, redirect_uri)
+
     def test_get_token(self):
         # invalid method
         r = self.client.get(self.client.token_url)
@@ -483,3 +511,23 @@ class TestOA2(TestCase, URLAssertionsMixin):
                     'scope': self.client3_redirect_uri,
                     'state': None}
         self.assert_access_token_response(r, expected)
+
+        # generate authorization code with too long redirect_uri
+        redirect_uri = '%s/%s' % (self.client3_redirect_uri, 'a'*2000)
+        params = {'redirect_uri': redirect_uri}
+        r = self.client.authorize_code('client3', urlparams=params)
+        self.assertCount(AuthorizationCode, 1)
+        redirect = self.get_redirect_url(r)
+        code_instance = AuthorizationCode.objects.get(
+            code=redirect.params['code'][0])
+
+        # valid request
+        self.client.set_credentials('client3', 'secret')
+        r = self.client.access_token(code_instance.code,
+                                     redirect_uri=redirect_uri)
+        self.assertCount(AuthorizationCode, 0)  # assert code is consumed
+        self.assertCount(Token, 2)
+        expected = {'redirect_uri': redirect_uri,
+                    'scope': redirect_uri,
+                    'state': None}
+        self.assert_access_token_response(r, expected)
