Merge branch 'master' into osb214-for-merge

api.go

@@ -294,7 +294,7 @@ func (h serviceBrokerHandler) update(w http.ResponseWriter, req *http.Request) {
  }
  h.respond(w, statusCode, UpdateResponse{
  OperationData: updateServiceSpec.OperationData,
- DashboardURL:  updateServiceSpec.DashboardURL,
+ DashboardURL: updateServiceSpec.DashboardURL,
  })
 }
 

api_test.go

@@ -463,7 +463,7 @@ var _ = Describe("Service Broker API", func() {
  fakeServiceBroker.DashboardURL = "some-dashboard-url"
  })
 
- It("returns json with dasboard URL", func() {
+ It("returns json with dashboard URL", func() {
  response := makeInstanceProvisioningRequest(instanceID, provisionDetails, "")
  Expect(response.Body).To(MatchJSON(fixture("provisioning_with_dashboard.json")))
  })
@@ -942,6 +942,18 @@ var _ = Describe("Service Broker API", func() {
  })
  })
  })
+
+ Context("when the broker returns a dashboard URL", func() {
+ BeforeEach(func() {
+ fakeServiceBroker.DashboardURL = "some-dashboard-url"
+ })
+
+ It("returns json with dashboard URL", func() {
+ response := makeInstanceUpdateRequest(instanceID, details, "", "2.14")
+ Expect(response.Body).To(MatchJSON(fixture("updating_with_dashboard.json")))
+ })
+ })
+
  })
 
  Context("when the broker indicates that it needs async support", func() {

auth/auth.go

@@ -15,18 +15,21 @@
 
 package auth
 
-import "net/http"
+import (
+ "crypto/sha256"
+ "crypto/subtle"
+ "net/http"
+)
 
 type Wrapper struct {
- username string
- password string
+ username []byte
+ password []byte
 }
 
 func NewWrapper(username, password string) *Wrapper {
- return &Wrapper{
- username: username,
- password: password,
- }
+ u := sha256.Sum256([]byte(username))
+ p := sha256.Sum256([]byte(password))
+ return &Wrapper{username: u[:], password: p[:]}
 }
 
 const notAuthorized = "Not Authorized"
@@ -55,5 +58,9 @@ func (wrapper *Wrapper) WrapFunc(handlerFunc http.HandlerFunc) http.HandlerFunc
 
 func authorized(wrapper *Wrapper, r *http.Request) bool {
  username, password, isOk := r.BasicAuth()
- return isOk && username == wrapper.username && password == wrapper.password
+ u := sha256.Sum256([]byte(username))
+ p := sha256.Sum256([]byte(password))
+ return isOk &&
+ subtle.ConstantTimeCompare(wrapper.username, u[:]) == 1 &&
+ subtle.ConstantTimeCompare(wrapper.password, p[:]) == 1
 }

fakes/fake_service_broker.go

@@ -230,7 +230,7 @@ func (fakeBroker *FakeServiceBroker) Update(context context.Context, instanceID
  fakeBroker.UpdateDetails = details
  fakeBroker.UpdatedInstanceIDs = append(fakeBroker.UpdatedInstanceIDs, instanceID)
  fakeBroker.AsyncAllowed = asyncAllowed
- return brokerapi.UpdateServiceSpec{IsAsync: fakeBroker.ShouldReturnAsync, OperationData: fakeBroker.OperationDataToReturn}, nil
+ return brokerapi.UpdateServiceSpec{IsAsync: fakeBroker.ShouldReturnAsync, OperationData: fakeBroker.OperationDataToReturn, DashboardURL: fakeBroker.DashboardURL}, nil
 }
 
 func (fakeBroker *FakeServiceBroker) GetInstance(context context.Context, instanceID string) (brokerapi.GetInstanceDetailsSpec, error) {

fixtures/updating_with_dashboard.json

@@ -0,0 +1,3 @@
+{
+ "dashboard_url": "some-dashboard-url"
+}

response.go

@@ -39,6 +39,7 @@ type GetInstanceResponse struct {
 }
 
 type UpdateResponse struct {
+ DashboardURL string `json:"dashboard_url,omitempty"`
  OperationData string `json:"operation,omitempty"`
  DashboardURL string `json:"dashboard_url,omitempty"`
 }

response_test.go

@@ -60,6 +60,30 @@ var _ = Describe("Provisioning Response", func() {
  })
 })
 
+var _ = Describe("Update Response", func() {
+ Describe("JSON encoding", func() {
+ Context("when the dashboard URL is not present", func() {
+ It("does not return it in the JSON", func() {
+ updateResponse := brokerapi.UpdateResponse{}
+ jsonString := `{}`
+
+ Expect(json.Marshal(updateResponse)).To(MatchJSON(jsonString))
+ })
+ })
+
+ Context("when the dashboard URL is present", func() {
+ It("returns it in the JSON", func() {
+ updateResponse := brokerapi.UpdateResponse{
+ DashboardURL: "http://example.com/broker_updated",
+ }
+ jsonString := `{"dashboard_url":"http://example.com/broker_updated"}`
+
+ Expect(json.Marshal(updateResponse)).To(MatchJSON(jsonString))
+ })
+ })
+ })
+})
+
 var _ = Describe("Binding Response", func() {
  Describe("JSON encoding", func() {
  It("has a credentials object", func() {

service_broker.go

@@ -117,6 +117,7 @@ type UnbindDetails struct {
 
 type UpdateServiceSpec struct {
  IsAsync bool
+ DashboardURL string
  OperationData string
  DashboardURL string
 }