From ef591b03aea3388783b230530e00a7e10d377705 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C4=93teris=20Caune?= <cuu508@gmail.com>
Date: Wed, 30 Aug 2017 17:25:13 +0300
Subject: [PATCH] Fetch HipChat's capabilities document

---
 hc/api/models.py                   |  3 ++-
 hc/api/tests/test_channel_model.py | 20 +++++++++++++++++---
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/hc/api/models.py b/hc/api/models.py
index 5c4084cb..772f9095 100644
--- a/hc/api/models.py
+++ b/hc/api/models.py
@@ -388,7 +388,8 @@ class Channel(models.Model):
         if time.time() < doc.get("expires_at", 0):
             return  # Current access token is still valid
 
-        url = "https://api.hipchat.com/v2/oauth/token"
+        endpoints = requests.get(doc["capabilitiesUrl"])
+        url = endpoints.json()["capabilities"]["oauth2Provider"]["tokenUrl"]
         auth = (doc["oauthId"], doc["oauthSecret"])
         r = requests.post(url, auth=auth, data={
             "grant_type": "client_credentials",
diff --git a/hc/api/tests/test_channel_model.py b/hc/api/tests/test_channel_model.py
index 6f5c6130..5c228496 100644
--- a/hc/api/tests/test_channel_model.py
+++ b/hc/api/tests/test_channel_model.py
@@ -8,14 +8,28 @@ from mock import patch
 class ChannelModelTestCase(BaseTestCase):
 
     @patch("hc.api.models.requests.post")
-    def test_it_refreshes_hipchat_access_token(self, mock_post):
+    @patch("hc.api.models.requests.get")
+    def test_it_refreshes_hipchat_access_token(self, mock_get, mock_post):
+        mock_get.return_value.json.return_value = {
+            "capabilities": {
+                "oauth2Provider": {"tokenUrl": "http://example.org"}
+            }
+        }
         mock_post.return_value.json.return_value = {"expires_in": 100}
 
         channel = Channel(kind="hipchat", user=self.alice, value=json.dumps({
             "oauthId": "foo",
-            "oauthSecret": "bar"
+            "oauthSecret": "bar",
+            "capabilitiesUrl": "http://example.org/capabilities.json"
         }))
 
         channel.refresh_hipchat_access_token()
-        self.assertTrue(mock_post.return_value.json.called)
+        # It should fetch the remote capabilities document
+        mock_get.assert_called()
+
+        # It should request a token using a correct tokenUrl
+        mock_post.assert_called()
+        args, kwargs = mock_post.call_args
+        self.assertEqual(args[0], "http://example.org")
+
         self.assertTrue("expires_at" in channel.value)