From eb83851bb7aed11e99e606cd8d960132a35998e3 Mon Sep 17 00:00:00 2001
From: Sandro Santilli <strk@keybit.net>
Date: Mon, 17 Jun 2013 17:24:09 +0200
Subject: [PATCH] Fix database authentication with multi-table layergroups

---
 NEWS.md                       |   1 +
 lib/cartodb/server_options.js |   2 +-
 test/acceptance/multilayer.js | 118 ++++++++++++++++++++++++++++++++++
 3 files changed, 120 insertions(+), 1 deletion(-)

diff --git a/NEWS.md b/NEWS.md
index 65c50384..eb630b09 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,6 +1,7 @@
 1.3.1
 ------
 * Fix deadlock on new style creation
+* Fix database authentication with multi-table layergroups
 
 1.3.0
 ------
diff --git a/lib/cartodb/server_options.js b/lib/cartodb/server_options.js
index 6693ece7..80c2521d 100644
--- a/lib/cartodb/server_options.js
+++ b/lib/cartodb/server_options.js
@@ -341,7 +341,7 @@ module.exports = function(){
 
         req.params.processXML = function(req, xml, callback) {
           var dbuser = req.dbuser ? req.dbuser : global.settings.postgres.user;
-          if ( ! me.rx_dbuser ) me.rx_dbuser = /(<Parameter name="user"><!\[CDATA\[)[^\]]*(]]><\/Parameter>)/;
+          if ( ! me.rx_dbuser ) me.rx_dbuser = /(<Parameter name="user"><!\[CDATA\[)[^\]]*(]]><\/Parameter>)/g;
           xml = xml.replace(me.rx_dbuser, "$1" + dbuser + "$2");
           callback(null, xml);
         }
diff --git a/test/acceptance/multilayer.js b/test/acceptance/multilayer.js
index 4bd08e8d..993708d0 100644
--- a/test/acceptance/multilayer.js
+++ b/test/acceptance/multilayer.js
@@ -456,6 +456,124 @@ suite('multilayer', function() {
       });
     });
 
+    test("layergroup with 2 private-table layers", function(done) {
+
+      var layergroup =  {
+        version: '1.0.0',
+        layers: [
+           { options: {
+               sql: 'select * from test_table_private_1 where cartodb_id=1',
+               cartocss: '#layer { marker-fill:red; marker-width:32; marker-allow-overlap:true; }', 
+               cartocss_version: '2.1.1',
+               interactivity: 'cartodb_id'
+             } },
+           { options: {
+               sql: 'select * from test_table_private_1 where cartodb_id=2',
+               cartocss: '#layer { marker-fill:blue; marker-allow-overlap:true; }', 
+               cartocss_version: '2.1.1',
+               interactivity: 'cartodb_id'
+             } }
+        ]
+      };
+
+      var expected_token = "50cb56d0ebe9142ca4ed97bc8dac3ee1";
+      Step(
+        function do_post()
+        {
+          var next = this;
+          assert.response(server, {
+              url: '/tiles/layergroup?map_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(layergroup)
+          }, {}, function(res) {
+              assert.equal(res.statusCode, 200, res.body);
+              var parsedBody = JSON.parse(res.body);
+              var expectedBody = { layergroupid: expected_token };
+              // check last modified
+              var qTables = JSON.stringify({
+                'q': 'SELECT CDB_QueryTables($windshaft$'
+                    + layergroup.layers[0].options.sql + ';'
+                    + layergroup.layers[1].options.sql 
+                    + '$windshaft$)'
+              });
+              assert.equal(parsedBody.last_updated, expected_last_updated);
+              if ( expected_token ) {
+                assert.equal(parsedBody.layergroupid, expected_token + ':' + expected_last_updated_epoch);
+              }
+              else expected_token = parsedBody.layergroupid;
+              next(null, res);
+          });
+        },
+        function do_get_tile(err)
+        {
+          if ( err ) throw err;
+          var next = this;
+          assert.response(server, {
+              url: '/tiles/layergroup/' + expected_token + ':cb0/0/0/0.png?map_key=1234',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }, {}, function(res) {
+              assert.equal(res.statusCode, 200, res.body);
+              assert.equal(res.headers['content-type'], "image/png");
+
+              // Check X-Cache-Channel
+              var cc = res.headers['x-cache-channel'];
+              assert.ok(cc); 
+              var dbname = 'cartodb_test_user_1_db'
+              assert.equal(cc.substring(0, dbname.length), dbname);
+              next(err);
+          });
+        },
+        function do_get_grid_layer0(err)
+        {
+          if ( err ) throw err;
+          var next = this;
+          assert.response(server, {
+              url: '/tiles/layergroup/' + expected_token
+                 + '/0/0/0/0.grid.json?map_key=1234',
+              headers: {host: 'localhost' },
+              method: 'GET'
+          }, {}, function(res) {
+              assert.equal(res.statusCode, 200, res.body);
+              next(err);
+          });
+        },
+        function do_get_grid_layer1(err)
+        {
+          if ( err ) throw err;
+          var next = this;
+          assert.response(server, {
+              url: '/tiles/layergroup/' + expected_token
+                 + '/1/0/0/0.grid.json?map_key=1234',
+              headers: {host: 'localhost' },
+              method: 'GET'
+          }, {}, function(res) {
+              assert.equal(res.statusCode, 200, res.body);
+              assert.equal(res.headers['content-type'], "text/javascript; charset=utf-8; charset=utf-8");
+              next(err);
+          });
+        },
+        function finish(err) {
+          var errors = [];
+          if ( err ) {
+            errors.push(err.message);
+            console.log("Error: " + err);
+          }
+          redis_client.keys("map_style|cartodb_test_user_1_db|~" + expected_token, function(err, matches) {
+              if ( err ) errors.push(err.message);
+              assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
+              redis_client.del(matches, function(err) {
+                if ( err ) errors.push(err.message);
+                if ( errors.length ) done(new Error(errors));
+                else done(null);
+              });
+          });
+        }
+      );
+    });
+
     suiteTeardown(function(done) {
 
         // This test will add map_style records, like