chrome/browser/chromeos/settings/device_oauth2_token_service_unittest.cc - platform/external/chromium_org - Git at Google

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"

 #include "base/message_loop/message_loop.h"
 #include "base/prefs/testing_pref_service.h"
 #include "base/run_loop.h"
 #include "chrome/browser/chromeos/settings/token_encryptor.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/scoped_testing_local_state.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chromeos/cryptohome/system_salt_getter.h"
 #include "chromeos/dbus/fake_dbus_thread_manager.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/test/test_browser_thread.h"
 #include "google_apis/gaia/gaia_oauth_client.h"
 #include "google_apis/gaia/oauth2_token_service_test_util.h"
 #include "net/http/http_status_code.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 #include "net/url_request/url_fetcher_delegate.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"

 using ::testing::_;
 using ::testing::AnyNumber;
 using ::testing::Return;
 using ::testing::ReturnArg;
 using ::testing::StrEq;
 using ::testing::StrictMock;

 namespace chromeos {

 static const int kOAuthTokenServiceUrlFetcherId = 0;
 static const int kValidatorUrlFetcherId = gaia::GaiaOAuthClient::kUrlFetcherId;

 class TestDeviceOAuth2TokenService : public DeviceOAuth2TokenService {
  public:
   explicit TestDeviceOAuth2TokenService(net::URLRequestContextGetter* getter,
                                         PrefService* local_state,
                                         TokenEncryptor* token_encryptor)
       : DeviceOAuth2TokenService(getter,
                                  local_state,
                                  token_encryptor) {
   }
   void SetRobotAccountIdPolicyValue(const std::string& id) {
     robot_account_id_ = id;
   }

   // Skip calling into the policy subsystem and return our test value.
   virtual std::string GetRobotAccountId() OVERRIDE {
     return robot_account_id_;
   }

  private:
   std::string robot_account_id_;
   DISALLOW_COPY_AND_ASSIGN(TestDeviceOAuth2TokenService);
 };

 class MockTokenEncryptor : public TokenEncryptor {
  public:
   MOCK_METHOD1(EncryptWithSystemSalt, std::string(const std::string&));
   MOCK_METHOD1(DecryptWithSystemSalt, std::string(const std::string&));
 };

 class DeviceOAuth2TokenServiceTest : public testing::Test {
  public:
   DeviceOAuth2TokenServiceTest()
       : ui_thread_(content::BrowserThread::UI, &message_loop_),
         scoped_testing_local_state_(TestingBrowserProcess::GetGlobal()),
         request_context_getter_(new net::TestURLRequestContextGetter(
             message_loop_.message_loop_proxy())),
         mock_token_encryptor_(new StrictMock<MockTokenEncryptor>),
         oauth2_service_(request_context_getter_.get(),
                         scoped_testing_local_state_.Get(),
                         mock_token_encryptor_) {
     oauth2_service_.max_refresh_token_validation_retries_ = 0;
     oauth2_service_.set_max_authorization_token_fetch_retries_for_testing(0);
   }
   virtual ~DeviceOAuth2TokenServiceTest() {}

   // Most tests just want a noop crypto impl with a dummy refresh token value in
   // Local State (if the value is an empty string, it will be ignored).
   void SetUpDefaultValues() {
     SetDeviceRefreshTokenInLocalState("device_refresh_token_4_test");
     oauth2_service_.SetRobotAccountIdPolicyValue("service_acct@g.com");
     AssertConsumerTokensAndErrors(0, 0);

     // Returns the input token as-is.
     EXPECT_CALL(*mock_token_encryptor_, DecryptWithSystemSalt(_))
         .WillRepeatedly(ReturnArg<0>());
   }

   scoped_ptr<OAuth2TokenService::Request> StartTokenRequest() {
     return oauth2_service_.StartRequest(oauth2_service_.GetRobotAccountId(),
                                         std::set<std::string>(),
                                         &consumer_);
   }

   virtual void SetUp() OVERRIDE {
     // TODO(xiyuan): Remove this when cleaning up the system salt load temp fix.
     scoped_ptr<FakeDBusThreadManager> fake_dbus_thread_manager(
         new FakeDBusThreadManager);
     DBusThreadManager::InitializeForTesting(fake_dbus_thread_manager.release());
     SystemSaltGetter::Initialize();
   }

   virtual void TearDown() OVERRIDE {
     SystemSaltGetter::Shutdown();
     DBusThreadManager::Shutdown();
     base::RunLoop().RunUntilIdle();
   }

   // Utility method to set a value in Local State for the device refresh token
   // (it must have a non-empty value or it won't be used).
   void SetDeviceRefreshTokenInLocalState(const std::string& refresh_token) {
     scoped_testing_local_state_.Get()->SetManagedPref(
         prefs::kDeviceRobotAnyApiRefreshToken,
         Value::CreateStringValue(refresh_token));
   }

   std::string GetValidTokenInfoResponse(const std::string email) {
     return "{ \"email\": \"" + email + "\","
            "  \"user_id\": \"1234567890\" }";
   }

   // A utility method to return fake URL results, for testing the refresh token
   // validation logic.  For a successful validation attempt, this method will be
   // called three times for the steps listed below (steps 1 and 2 happen in
   // parallel).
   //
   // Step 1a: fetch the access token for the tokeninfo API.
   // Step 1b: call the tokeninfo API.
   // Step 2:  Fetch the access token for the requested scope
   //          (in this case, cloudprint).
   void ReturnOAuthUrlFetchResults(int fetcher_id,
                                   net::HttpStatusCode response_code,
                                   const std::string&  response_string);

   void AssertConsumerTokensAndErrors(int num_tokens, int num_errors);

  protected:
   base::MessageLoop message_loop_;
   content::TestBrowserThread ui_thread_;
   ScopedTestingLocalState scoped_testing_local_state_;
   scoped_refptr<net::TestURLRequestContextGetter> request_context_getter_;
   net::TestURLFetcherFactory factory_;
   // Owned by oauth2_service_.
   StrictMock<MockTokenEncryptor>* mock_token_encryptor_;
   TestDeviceOAuth2TokenService oauth2_service_;
   TestingOAuth2TokenServiceConsumer consumer_;
 };

 void DeviceOAuth2TokenServiceTest::ReturnOAuthUrlFetchResults(
     int fetcher_id,
     net::HttpStatusCode response_code,
     const std::string&  response_string) {

   net::TestURLFetcher* fetcher = factory_.GetFetcherByID(fetcher_id);
   ASSERT_TRUE(fetcher);
   fetcher->set_response_code(response_code);
   fetcher->SetResponseString(response_string);
   fetcher->delegate()->OnURLFetchComplete(fetcher);
 }

 void DeviceOAuth2TokenServiceTest::AssertConsumerTokensAndErrors(
     int num_tokens,
     int num_errors) {
   ASSERT_EQ(num_tokens, consumer_.number_of_successful_tokens_);
   ASSERT_EQ(num_errors, consumer_.number_of_errors_);
 }

 TEST_F(DeviceOAuth2TokenServiceTest, SaveEncryptedToken) {
   EXPECT_CALL(*mock_token_encryptor_, DecryptWithSystemSalt(StrEq("")))
       .Times(1)
       .WillOnce(Return(""));
   EXPECT_CALL(*mock_token_encryptor_,
               EncryptWithSystemSalt(StrEq("test-token")))
       .Times(1)
       .WillOnce(Return("encrypted"));
   EXPECT_CALL(*mock_token_encryptor_,
               DecryptWithSystemSalt(StrEq("encrypted")))
       .Times(1)
       .WillOnce(Return("test-token"));

   ASSERT_EQ("", oauth2_service_.GetRefreshToken(
                     oauth2_service_.GetRobotAccountId()));
   oauth2_service_.SetAndSaveRefreshToken("test-token");
   ASSERT_EQ("test-token", oauth2_service_.GetRefreshToken(
                               oauth2_service_.GetRobotAccountId()));

   // This call won't invoke decrypt again, since the value is cached.
   ASSERT_EQ("test-token", oauth2_service_.GetRefreshToken(
                               oauth2_service_.GetRobotAccountId()));
 }

 TEST_F(DeviceOAuth2TokenServiceTest, RefreshTokenValidation_Success) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("tokeninfo_access_token", 3600));

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenInfoResponse("service_acct@g.com"));

   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("scoped_access_token", 3600));

   AssertConsumerTokensAndErrors(1, 0);

   EXPECT_EQ("scoped_access_token", consumer_.last_token_);
 }

 TEST_F(DeviceOAuth2TokenServiceTest,
        RefreshTokenValidation_Failure_TokenInfoAccessTokenHttpError) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_UNAUTHORIZED,
       "");

   // TokenInfo API call skipped (error returned in previous step).

   // CloudPrint access token fetch is successful, but consumer still given error
   // due to bad refresh token.
   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("ignored_scoped_access_token", 3600));

   AssertConsumerTokensAndErrors(0, 1);
 }

 TEST_F(DeviceOAuth2TokenServiceTest,
        RefreshTokenValidation_Failure_TokenInfoAccessTokenInvalidResponse) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       "invalid response");

   // TokenInfo API call skipped (error returned in previous step).

   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("ignored_scoped_access_token", 3600));

   // CloudPrint access token fetch is successful, but consumer still given error
   // due to bad refresh token.
   AssertConsumerTokensAndErrors(0, 1);
 }

 TEST_F(DeviceOAuth2TokenServiceTest,
        RefreshTokenValidation_Failure_TokenInfoApiCallHttpError) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("tokeninfo_access_token", 3600));

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_INTERNAL_SERVER_ERROR,
       "");

   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("ignored_scoped_access_token", 3600));

   // CloudPrint access token fetch is successful, but consumer still given error
   // due to bad refresh token.
   AssertConsumerTokensAndErrors(0, 1);
 }

 TEST_F(DeviceOAuth2TokenServiceTest,
        RefreshTokenValidation_Failure_TokenInfoApiCallInvalidResponse) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("tokeninfo_access_token", 3600));

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       "invalid response");

   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("ignored_scoped_access_token", 3600));

   // CloudPrint access token fetch is successful, but consumer still given error
   // due to bad refresh token.
   AssertConsumerTokensAndErrors(0, 1);
 }

 TEST_F(DeviceOAuth2TokenServiceTest,
        RefreshTokenValidation_Failure_CloudPrintAccessTokenHttpError) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("tokeninfo_access_token", 3600));

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenInfoResponse("service_acct@g.com"));

   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_BAD_REQUEST,
       "");

   AssertConsumerTokensAndErrors(0, 1);
 }

 TEST_F(DeviceOAuth2TokenServiceTest,
        RefreshTokenValidation_Failure_CloudPrintAccessTokenInvalidResponse) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("tokeninfo_access_token", 3600));

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenInfoResponse("service_acct@g.com"));

   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       "invalid request");

   AssertConsumerTokensAndErrors(0, 1);
 }

 TEST_F(DeviceOAuth2TokenServiceTest, RefreshTokenValidation_Failure_BadOwner) {
   SetUpDefaultValues();
   scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

   oauth2_service_.SetRobotAccountIdPolicyValue("WRONG_service_acct@g.com");

   // The requested token comes in before any of the validation calls complete,
   // but the consumer still gets an error, since the results don't get returned
   // until validation is over.
   ReturnOAuthUrlFetchResults(
       kOAuthTokenServiceUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("ignored_scoped_access_token", 3600));
   AssertConsumerTokensAndErrors(0, 0);

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenResponse("tokeninfo_access_token", 3600));
   AssertConsumerTokensAndErrors(0, 0);

   ReturnOAuthUrlFetchResults(
       kValidatorUrlFetcherId,
       net::HTTP_OK,
       GetValidTokenInfoResponse("service_acct@g.com"));

   // All fetches were successful, but consumer still given error since
   // the token owner doesn't match the policy value.
   AssertConsumerTokensAndErrors(0, 1);
 }

 }  // namespace chromeos
	// Copyright 2013 The Chromium Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"

	#include "base/message_loop/message_loop.h"
	#include "base/prefs/testing_pref_service.h"
	#include "base/run_loop.h"
	#include "chrome/browser/chromeos/settings/token_encryptor.h"
	#include "chrome/common/pref_names.h"
	#include "chrome/test/base/scoped_testing_local_state.h"
	#include "chrome/test/base/testing_browser_process.h"
	#include "chromeos/cryptohome/system_salt_getter.h"
	#include "chromeos/dbus/fake_dbus_thread_manager.h"
	#include "content/public/browser/browser_thread.h"
	#include "content/public/test/test_browser_thread.h"
	#include "google_apis/gaia/gaia_oauth_client.h"
	#include "google_apis/gaia/oauth2_token_service_test_util.h"
	#include "net/http/http_status_code.h"
	#include "net/url_request/test_url_fetcher_factory.h"
	#include "net/url_request/url_fetcher_delegate.h"
	#include "net/url_request/url_request_test_util.h"
	#include "testing/gmock/include/gmock/gmock.h"
	#include "testing/gtest/include/gtest/gtest.h"

	using ::testing::_;
	using ::testing::AnyNumber;
	using ::testing::Return;
	using ::testing::ReturnArg;
	using ::testing::StrEq;
	using ::testing::StrictMock;

	namespace chromeos {

	static const int kOAuthTokenServiceUrlFetcherId = 0;
	static const int kValidatorUrlFetcherId = gaia::GaiaOAuthClient::kUrlFetcherId;

	class TestDeviceOAuth2TokenService : public DeviceOAuth2TokenService {
	public:
	explicit TestDeviceOAuth2TokenService(net::URLRequestContextGetter* getter,
	PrefService* local_state,
	TokenEncryptor* token_encryptor)
	: DeviceOAuth2TokenService(getter,
	local_state,
	token_encryptor) {
	}
	void SetRobotAccountIdPolicyValue(const std::string& id) {
	robot_account_id_ = id;
	}

	// Skip calling into the policy subsystem and return our test value.
	virtual std::string GetRobotAccountId() OVERRIDE {
	return robot_account_id_;
	}

	private:
	std::string robot_account_id_;
	DISALLOW_COPY_AND_ASSIGN(TestDeviceOAuth2TokenService);
	};

	class MockTokenEncryptor : public TokenEncryptor {
	public:
	MOCK_METHOD1(EncryptWithSystemSalt, std::string(const std::string&));
	MOCK_METHOD1(DecryptWithSystemSalt, std::string(const std::string&));
	};

	class DeviceOAuth2TokenServiceTest : public testing::Test {
	public:
	DeviceOAuth2TokenServiceTest()
	: ui_thread_(content::BrowserThread::UI, &message_loop_),
	scoped_testing_local_state_(TestingBrowserProcess::GetGlobal()),
	request_context_getter_(new net::TestURLRequestContextGetter(
	message_loop_.message_loop_proxy())),
	mock_token_encryptor_(new StrictMock<MockTokenEncryptor>),
	oauth2_service_(request_context_getter_.get(),
	scoped_testing_local_state_.Get(),
	mock_token_encryptor_) {
	oauth2_service_.max_refresh_token_validation_retries_ = 0;
	oauth2_service_.set_max_authorization_token_fetch_retries_for_testing(0);
	}
	virtual ~DeviceOAuth2TokenServiceTest() {}

	// Most tests just want a noop crypto impl with a dummy refresh token value in
	// Local State (if the value is an empty string, it will be ignored).
	void SetUpDefaultValues() {
	SetDeviceRefreshTokenInLocalState("device_refresh_token_4_test");
	oauth2_service_.SetRobotAccountIdPolicyValue("service_acct@g.com");
	AssertConsumerTokensAndErrors(0, 0);

	// Returns the input token as-is.
	EXPECT_CALL(*mock_token_encryptor_, DecryptWithSystemSalt(_))
	.WillRepeatedly(ReturnArg<0>());
	}

	scoped_ptr<OAuth2TokenService::Request> StartTokenRequest() {
	return oauth2_service_.StartRequest(oauth2_service_.GetRobotAccountId(),
	std::set<std::string>(),
	&consumer_);
	}

	virtual void SetUp() OVERRIDE {
	// TODO(xiyuan): Remove this when cleaning up the system salt load temp fix.
	scoped_ptr<FakeDBusThreadManager> fake_dbus_thread_manager(
	new FakeDBusThreadManager);
	DBusThreadManager::InitializeForTesting(fake_dbus_thread_manager.release());
	SystemSaltGetter::Initialize();
	}

	virtual void TearDown() OVERRIDE {
	SystemSaltGetter::Shutdown();
	DBusThreadManager::Shutdown();
	base::RunLoop().RunUntilIdle();
	}

	// Utility method to set a value in Local State for the device refresh token
	// (it must have a non-empty value or it won't be used).
	void SetDeviceRefreshTokenInLocalState(const std::string& refresh_token) {
	scoped_testing_local_state_.Get()->SetManagedPref(
	prefs::kDeviceRobotAnyApiRefreshToken,
	Value::CreateStringValue(refresh_token));
	}

	std::string GetValidTokenInfoResponse(const std::string email) {
	return "{ \"email\": \"" + email + "\","
	" \"user_id\": \"1234567890\" }";
	}

	// A utility method to return fake URL results, for testing the refresh token
	// validation logic. For a successful validation attempt, this method will be
	// called three times for the steps listed below (steps 1 and 2 happen in
	// parallel).
	//
	// Step 1a: fetch the access token for the tokeninfo API.
	// Step 1b: call the tokeninfo API.
	// Step 2: Fetch the access token for the requested scope
	// (in this case, cloudprint).
	void ReturnOAuthUrlFetchResults(int fetcher_id,
	net::HttpStatusCode response_code,
	const std::string& response_string);

	void AssertConsumerTokensAndErrors(int num_tokens, int num_errors);

	protected:
	base::MessageLoop message_loop_;
	content::TestBrowserThread ui_thread_;
	ScopedTestingLocalState scoped_testing_local_state_;
	scoped_refptr<net::TestURLRequestContextGetter> request_context_getter_;
	net::TestURLFetcherFactory factory_;
	// Owned by oauth2_service_.
	StrictMock<MockTokenEncryptor>* mock_token_encryptor_;
	TestDeviceOAuth2TokenService oauth2_service_;
	TestingOAuth2TokenServiceConsumer consumer_;
	};

	void DeviceOAuth2TokenServiceTest::ReturnOAuthUrlFetchResults(
	int fetcher_id,
	net::HttpStatusCode response_code,
	const std::string& response_string) {

	net::TestURLFetcher* fetcher = factory_.GetFetcherByID(fetcher_id);
	ASSERT_TRUE(fetcher);
	fetcher->set_response_code(response_code);
	fetcher->SetResponseString(response_string);
	fetcher->delegate()->OnURLFetchComplete(fetcher);
	}

	void DeviceOAuth2TokenServiceTest::AssertConsumerTokensAndErrors(
	int num_tokens,
	int num_errors) {
	ASSERT_EQ(num_tokens, consumer_.number_of_successful_tokens_);
	ASSERT_EQ(num_errors, consumer_.number_of_errors_);
	}

	TEST_F(DeviceOAuth2TokenServiceTest, SaveEncryptedToken) {
	EXPECT_CALL(*mock_token_encryptor_, DecryptWithSystemSalt(StrEq("")))
	.Times(1)
	.WillOnce(Return(""));
	EXPECT_CALL(*mock_token_encryptor_,
	EncryptWithSystemSalt(StrEq("test-token")))
	.Times(1)
	.WillOnce(Return("encrypted"));
	EXPECT_CALL(*mock_token_encryptor_,
	DecryptWithSystemSalt(StrEq("encrypted")))
	.Times(1)
	.WillOnce(Return("test-token"));

	ASSERT_EQ("", oauth2_service_.GetRefreshToken(
	oauth2_service_.GetRobotAccountId()));
	oauth2_service_.SetAndSaveRefreshToken("test-token");
	ASSERT_EQ("test-token", oauth2_service_.GetRefreshToken(
	oauth2_service_.GetRobotAccountId()));

	// This call won't invoke decrypt again, since the value is cached.
	ASSERT_EQ("test-token", oauth2_service_.GetRefreshToken(
	oauth2_service_.GetRobotAccountId()));
	}

	TEST_F(DeviceOAuth2TokenServiceTest, RefreshTokenValidation_Success) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("tokeninfo_access_token", 3600));

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenInfoResponse("service_acct@g.com"));

	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("scoped_access_token", 3600));

	AssertConsumerTokensAndErrors(1, 0);

	EXPECT_EQ("scoped_access_token", consumer_.last_token_);
	}

	TEST_F(DeviceOAuth2TokenServiceTest,
	RefreshTokenValidation_Failure_TokenInfoAccessTokenHttpError) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_UNAUTHORIZED,
	"");

	// TokenInfo API call skipped (error returned in previous step).

	// CloudPrint access token fetch is successful, but consumer still given error
	// due to bad refresh token.
	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("ignored_scoped_access_token", 3600));

	AssertConsumerTokensAndErrors(0, 1);
	}

	TEST_F(DeviceOAuth2TokenServiceTest,
	RefreshTokenValidation_Failure_TokenInfoAccessTokenInvalidResponse) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	"invalid response");

	// TokenInfo API call skipped (error returned in previous step).

	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("ignored_scoped_access_token", 3600));

	// CloudPrint access token fetch is successful, but consumer still given error
	// due to bad refresh token.
	AssertConsumerTokensAndErrors(0, 1);
	}

	TEST_F(DeviceOAuth2TokenServiceTest,
	RefreshTokenValidation_Failure_TokenInfoApiCallHttpError) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("tokeninfo_access_token", 3600));

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_INTERNAL_SERVER_ERROR,
	"");

	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("ignored_scoped_access_token", 3600));

	// CloudPrint access token fetch is successful, but consumer still given error
	// due to bad refresh token.
	AssertConsumerTokensAndErrors(0, 1);
	}

	TEST_F(DeviceOAuth2TokenServiceTest,
	RefreshTokenValidation_Failure_TokenInfoApiCallInvalidResponse) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("tokeninfo_access_token", 3600));

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	"invalid response");

	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("ignored_scoped_access_token", 3600));

	// CloudPrint access token fetch is successful, but consumer still given error
	// due to bad refresh token.
	AssertConsumerTokensAndErrors(0, 1);
	}

	TEST_F(DeviceOAuth2TokenServiceTest,
	RefreshTokenValidation_Failure_CloudPrintAccessTokenHttpError) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("tokeninfo_access_token", 3600));

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenInfoResponse("service_acct@g.com"));

	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_BAD_REQUEST,
	"");

	AssertConsumerTokensAndErrors(0, 1);
	}

	TEST_F(DeviceOAuth2TokenServiceTest,
	RefreshTokenValidation_Failure_CloudPrintAccessTokenInvalidResponse) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("tokeninfo_access_token", 3600));

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenInfoResponse("service_acct@g.com"));

	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	"invalid request");

	AssertConsumerTokensAndErrors(0, 1);
	}

	TEST_F(DeviceOAuth2TokenServiceTest, RefreshTokenValidation_Failure_BadOwner) {
	SetUpDefaultValues();
	scoped_ptr<OAuth2TokenService::Request> request = StartTokenRequest();

	oauth2_service_.SetRobotAccountIdPolicyValue("WRONG_service_acct@g.com");

	// The requested token comes in before any of the validation calls complete,
	// but the consumer still gets an error, since the results don't get returned
	// until validation is over.
	ReturnOAuthUrlFetchResults(
	kOAuthTokenServiceUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("ignored_scoped_access_token", 3600));
	AssertConsumerTokensAndErrors(0, 0);

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenResponse("tokeninfo_access_token", 3600));
	AssertConsumerTokensAndErrors(0, 0);

	ReturnOAuthUrlFetchResults(
	kValidatorUrlFetcherId,
	net::HTTP_OK,
	GetValidTokenInfoResponse("service_acct@g.com"));

	// All fetches were successful, but consumer still given error since
	// the token owner doesn't match the policy value.
	AssertConsumerTokensAndErrors(0, 1);
	}

	} // namespace chromeos