Release 1.7.0

Doing so basically removes the need to include the template identifier
in the surrogate keys of the responses for resources fetched via
the instance whenever template is updated. See #105

NEWS.md

@@ -1,3 +1,25 @@
+1.7.0 -- 2014-02-11
+-------------------
+
+New features:
+
+ * Add support for torque tiles (#112)
+ * Add attributes service (#118)
+ * Implement Unified Map API (#126)
+ * Make endpoints configurable (#127)
+
+Enhancements:
+
+ * Allow specifying fixed sqlapi host address (#117)
+ * Include template hash in template instance response, to keep caches
+   of different instances separated (#105)
+
+Bug fixes:
+
+ * Allow space padding in template variables usage (#129)
+ * Allow passing numbers as values for numeric template variables (#130)
+
+
 1.6.3 -- 2014-01-30
 -------------------
 

config/environments/development.js.example

@@ -5,6 +5,22 @@ var config = {
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '^(.*)\\.localhost'
+
+    // Base URLs for the APIs
+    //
+    // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    // 
+    // Base url for the Templated Maps API
+    // "/maps/named" is the new API,
+    // "/tiles/template" is for compatibility with versions up to 1.6.x
+    ,base_url_templated: '(?:/maps/named|/tiles/template)'
+    // Base url for the Detached Maps API
+    // "maps" is the the new API,
+    // "tiles/layergroup" is for compatibility with versions up to 1.6.x
+    ,base_url_detached: '(?:/maps|/tiles/layergroup)'
+    // Base url for the Inline Maps and Table Maps API
+    ,base_url_legacy: '/tiles/:table'
+
     // Maximum number of connections for one process
     // 128 is a good value with a limit of 1024 open file descriptors
     ,maxConnections:128
@@ -64,8 +80,15 @@ var config = {
     }
     ,sqlapi: {
         protocol: 'http',
-        domain: 'localhost.lan',
+        // If "host" is given, it will be used
+        // to connect to the SQL-API without a
+        // DNS lookup
+        host: '127.0.0.1',
         port: 8080,
+        // The "domain" part will be appended to 
+        // the cartodb username and passed to
+        // SQL-API requests in the Host HTTP header
+        domain: 'localhost.lan',
         version: 'v1'
     }
     ,varnish: {

config/environments/production.js.example

@@ -5,6 +5,22 @@ var config = {
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '^(.*)\\.cartodb\\.com$'
+
+    // Base URLs for the APIs
+    //
+    // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    // 
+    // Base url for the Templated Maps API
+    // "/maps/named" is the new API,
+    // "/tiles/template" is for compatibility with versions up to 1.6.x
+    ,base_url_templated: '(?:/maps/named|/tiles/template)'
+    // Base url for the Detached Maps API
+    // "maps" is the the new API,
+    // "tiles/layergroup" is for compatibility with versions up to 1.6.x
+    ,base_url_detached: '(?:/maps|/tiles/layergroup)'
+    // Base url for the Inline Maps and Table Maps API
+    ,base_url_legacy: '/tiles/:table'
+
     // Maximum number of connections for one process
     // 128 is a good value with a limit of 1024 open file descriptors
     ,maxConnections:128
@@ -58,8 +74,15 @@ var config = {
     }
     ,sqlapi: {
         protocol: 'https',
-        domain: 'cartodb.com',
+        // If "host" is given, it will be used
+        // to connect to the SQL-API without a
+        // DNS lookup
+        //host: '127.0.0.1',
         port: 8080,
+        // The "domain" part will be appended to 
+        // the cartodb username and passed to
+        // SQL-API requests in the Host HTTP header
+        domain: 'cartodb.com',
         version: 'v2'
     }
     ,varnish: {

config/environments/staging.js.example

@@ -5,6 +5,22 @@ var config = {
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '^(.*)\\.cartodb\\.com$'
+
+    // Base URLs for the APIs
+    //
+    // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    // 
+    // Base url for the Templated Maps API
+    // "/api/v1/maps/named" is the new API,
+    // "/tiles/template" is for compatibility with versions up to 1.6.x
+    ,base_url_templated: '(?:/api/v1/maps/named|/tiles/template)'
+    // Base url for the Detached Maps API
+    // "/api/v1/maps" is the the new API,
+    // "/tiles/layergroup" is for compatibility with versions up to 1.6.x
+    ,base_url_detached: '(?:/api/v1/maps|/tiles/layergroup)'
+    // Base url for the Inline Maps and Table Maps API
+    ,base_url_legacy: '/tiles/:table'
+
     // Maximum number of connections for one process
     // 128 is a good value with a limit of 1024 open file descriptors
     ,maxConnections:128
@@ -58,8 +74,15 @@ var config = {
     }
     ,sqlapi: {
         protocol: 'https',
-        domain: 'cartodb.com',
+        // If "host" is given, it will be used
+        // to connect to the SQL-API without a
+        // DNS lookup
+        //host: '127.0.0.1',
         port: 8080,
+        // The "domain" part will be appended to 
+        // the cartodb username and passed to
+        // SQL-API requests in the Host HTTP header
+        domain: 'cartodb.com',
         version: 'v2'
     }
     ,varnish: {

config/environments/test.js.example

@@ -5,6 +5,22 @@ var config = {
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '(.*)'
+
+    // Base URLs for the APIs
+    //
+    // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    // 
+    // Base url for the Templated Maps API
+    // "/maps/named" is the new API,
+    // "/tiles/template" is for compatibility with versions up to 1.6.x
+    ,base_url_templated: '(?:/maps/named|/tiles/template)'
+    // Base url for the Detached Maps API
+    // "maps" is the the new API,
+    // "tiles/layergroup" is for compatibility with versions up to 1.6.x
+    ,base_url_detached: '(?:/maps|/tiles/layergroup)'
+    // Base url for the Inline Maps and Table Maps API
+    ,base_url_legacy: '/tiles/:table'
+
     // Maximum number of connections for one process
     // 128 is a good value with a limit of 1024 open file descriptors
     ,maxConnections:128
@@ -58,10 +74,17 @@ var config = {
     }
     ,sqlapi: {
         protocol: 'http',
-        domain: '',
+        // If "host" is given, it will be used
+        // to connect to the SQL-API without a
+        // DNS lookup
+        host: '127.0.0.1',
+        port: 1080,
+        // The "domain" part will be appended to 
+        // the cartodb username and passed to
+        // SQL-API requests in the Host HTTP header
+        domain: 'donot_look_this_up',
         // This port will be used by "make check" for testing purposes
         // It must be available
-        port: 1080,
         version: 'v1'
     }
     ,varnish: {

lib/cartodb/cartodb_windshaft.js

@@ -10,6 +10,7 @@ var _ = require('underscore')
     , Cache = require('./cache_validator');
 
 var CartodbWindshaft = function(serverOptions) {
+   var debug = global.environment.environment === 'development';
 
     if(serverOptions.cache_enabled) {
         console.log("cache invalidation enabled, varnish on ", serverOptions.varnish_host, ' ', serverOptions.varnish_port);
@@ -22,7 +23,7 @@ var CartodbWindshaft = function(serverOptions) {
 
     serverOptions.beforeStateChange = function(req, callback) {
         var err = null;
-        if ( ! req.params.hasOwnProperty('dbuser') ) {
+        if ( ! req.params.hasOwnProperty('_authorizedByApiKey') ) {
           err = new Error("map state cannot be changed by unauthenticated request!");
         }
         callback(err, req);
@@ -69,7 +70,7 @@ var CartodbWindshaft = function(serverOptions) {
             },
             function(err, data){
                 if (err){
-                    ws.sendError(res, {error: err.message}, 500, 'GET INFOWINDOW');
+                    ws.sendError(res, {error: err.message}, 500, 'GET INFOWINDOW', err);
                     //res.send({error: err.message}, 500);
                 } else {
                     res.send({infowindow: data}, 200);
@@ -90,7 +91,7 @@ var CartodbWindshaft = function(serverOptions) {
             },
             function(err, data){
                 if (err){
-                    ws.sendError(res, {error: err.message}, 500, 'GET MAP_METADATA');
+                    ws.sendError(res, {error: err.message}, 500, 'GET MAP_METADATA', err);
                     //res.send(err.message, 500);
                 } else {
                     res.send({map_metadata: data}, 200);
@@ -111,7 +112,7 @@ var CartodbWindshaft = function(serverOptions) {
             },
             function sendResponse(err, data){
                 if (err){
-                    ws.sendError(res, {error: err.message}, 500, 'DELETE CACHE');
+                    ws.sendError(res, {error: err.message}, 500, 'DELETE CACHE', err);
                     //res.send(500);
                 } else {
                     res.send({status: 'ok'}, 200);
@@ -126,7 +127,11 @@ var CartodbWindshaft = function(serverOptions) {
         return serverOptions.userByReq(req);
     }
 
-    var template_baseurl = serverOptions.base_url_notable + '/template';
+    // This is for Templated maps
+    //
+    // "named" is the official, "template" is for backward compatibility up to 1.6.x
+    //
+    var template_baseurl = global.environment.base_url_templated || '(?:/maps/named|/tiles/template)';
 
     // Add a template
     ws.post(template_baseurl, function(req, res) {
@@ -163,7 +168,7 @@ var CartodbWindshaft = function(serverOptions) {
                 if ( ! _.isUndefined(err.http_status) ) {
                   statusCode = err.http_status;
                 }
-                ws.sendError(res, response, statusCode, 'POST TEMPLATE', err.message);
+                ws.sendError(res, response, statusCode, 'POST TEMPLATE', err);
             } else {
               res.send(response, 200);
             }
@@ -216,7 +221,7 @@ var CartodbWindshaft = function(serverOptions) {
                 if ( ! _.isUndefined(err.http_status) ) {
                   statusCode = err.http_status;
                 }
-                ws.sendError(res, response, statusCode, 'PUT TEMPLATE', err.message);
+                ws.sendError(res, response, statusCode, 'PUT TEMPLATE', err);
             } else {
               res.send(response, 200);
             }
@@ -274,7 +279,7 @@ var CartodbWindshaft = function(serverOptions) {
                 if ( ! _.isUndefined(err.http_status) ) {
                   statusCode = err.http_status;
                 }
-                ws.sendError(res, response, statusCode, 'GET TEMPLATE', err.message);
+                ws.sendError(res, response, statusCode, 'GET TEMPLATE', err);
             } else {
               res.send(response, 200);
             }
@@ -324,7 +329,7 @@ var CartodbWindshaft = function(serverOptions) {
                 if ( ! _.isUndefined(err.http_status) ) {
                   statusCode = err.http_status;
                 }
-                ws.sendError(res, response, statusCode, 'DELETE TEMPLATE', err.message);
+                ws.sendError(res, response, statusCode, 'DELETE TEMPLATE', err);
             } else {
               res.send('', 204);
             }
@@ -364,7 +369,7 @@ var CartodbWindshaft = function(serverOptions) {
                 if ( ! _.isUndefined(err.http_status) ) {
                   statusCode = err.http_status;
                 }
-                ws.sendError(res, response, statusCode, 'GET TEMPLATE LIST', err.message);
+                ws.sendError(res, response, statusCode, 'GET TEMPLATE LIST', err);
             } else {
               res.send(response, statusCode);
             }
@@ -479,7 +484,8 @@ var CartodbWindshaft = function(serverOptions) {
           if ( err ) throw err;
           //console.log("Response from createLayergroup: "); console.dir(response);
           // Add the signature part to the token!
-          response.layergroupid = cdbuser + '@' + response.layergroupid;
+          var tplhash = templateMaps.fingerPrint(template).substring(0,8);
+          response.layergroupid = cdbuser + '@' + tplhash + '@' + response.layergroupid;
           return response;
         },
         callback
@@ -493,7 +499,10 @@ var CartodbWindshaft = function(serverOptions) {
             if ( ! _.isUndefined(err.http_status) ) {
               statusCode = err.http_status;
             }
-            ws.sendError(res, response, statusCode, 'POST INSTANCE TEMPLATE', err.message);
+            if(debug) {
+              response.stack = err.stack;
+            }
+            ws.sendError(res, response, statusCode, 'POST INSTANCE TEMPLATE', err);
         } else {
           res.send(response, 200);
         }

lib/cartodb/server_options.js

@@ -10,7 +10,11 @@ var   _          = require('underscore')
 
 // This is for backward compatibility with 1.3.3
 if ( _.isUndefined(global.environment.sqlapi.domain) ) {
-  global.environment.sqlapi.domain = global.environment.sqlapi.host;
+  // Only use "host" as "domain" if it contains alphanumeric characters
+  var host = global.environment.sqlapi.host;
+  if ( host && host.match(/[a-zA-Z]/) ) {
+    global.environment.sqlapi.domain = host;
+  }
 }
 
 module.exports = function(){
@@ -22,9 +26,24 @@ module.exports = function(){
     });
 
     var me = {
-        base_url: '/tiles/:table',
-        base_url_notable: '/tiles',
+        // This is for inline maps and table maps
+        base_url: global.environment.base_url_legacy || '/tiles/:table',
+
+        /// @deprecated with Windshaft-0.17.0
+        ///base_url_notable: '/tiles',
+
+        // This is for Detached maps
+        //
+        // "maps" is the official, while
+        // "tiles/layergroup" is for backward compatibility up to 1.6.x
+        //
+        base_url_mapconfig: global.environment.base_url_detached || '(?:/maps|/tiles/layergroup)',
+
         grainstore: {
+          map: {
+            // TODO: allow to specify in configuration
+            srid: 3857
+          },
           datasource: global.environment.postgres,
           cachedir: global.environment.millstone.cache_basedir,
           mapnik_version: global.environment.mapnik_version || mapnik.versions.mapnik,
@@ -68,9 +87,13 @@ module.exports = function(){
       var api = global.environment.sqlapi;
 
       // build up api string
-      var sqlapi = api.protocol + '://' + username;
-      if ( api.domain ) sqlapi += '.' + api.domain;
-      sqlapi += ':' + api.port + '/api/' + api.version + '/sql'
+      var sqlapihostname = username;
+      if ( api.domain ) sqlapihostname += '.' + api.domain;
+
+      var sqlapi = api.protocol + '://';
+      if ( api.host && api.host != api.domain ) sqlapi += api.host;
+      else sqlapi += sqlapihostname;
+      sqlapi += ':' + api.port + '/api/' + api.version + '/sql';
 
       var qs  = { q: sql }
 
@@ -85,8 +108,11 @@ module.exports = function(){
       // TODO: use "host" header to allow IP based specification
       //       of sqlapi address (and avoid a DNS lookup)
       //
-      request.post({url:sqlapi, body:qs, json:true},
-        function(err, res, body){
+      request.post({
+          url:sqlapi, body:qs, json:true,
+          headers:{host: sqlapihostname}
+        }, function(err, res, body)
+      {
           if (err){
             console.log('ERROR connecting to SQL API on ' + sqlapi + ': ' + err);
             callback(err);
@@ -402,7 +428,7 @@ module.exports = function(){
             if ( data ) _.extend(params, {dbhost:data});
             cartoData.getUserDBName(dbowner, this);
         },
-        function getGeometryType(err, data){
+        function extendParams(err, data){
             if (err) throw err;
             if ( data ) _.extend(params, {dbname:data});
             return null;
@@ -501,6 +527,8 @@ console.log("Checking authorization from signer " + signer + " for resource " +
                   return;
                 }
 
+                _.extend(req.params, { _authorizedByApiKey: true });
+
                 // authorized by api key, login as the given username and stop
                 that.setDBAuth(user, req.params, function(err) {
                   callback(err, true); // authorized (or error)
@@ -585,9 +613,12 @@ console.log("Checking authorization from signer " + signer + " for resource " +
           if ( tksplit.length > 1 ) req.params.cache_buster= tksplit[1];
           tksplit = req.params.token.split('@');
           if ( tksplit.length > 1 ) {
-            req.params.signer = this.userByReq(req);
-            if ( tksplit[0] ) req.params.signer = tksplit[0];
-            req.params.token = tksplit[1];
+            req.params.signer = tksplit.shift();
+            if ( ! req.params.signer ) req.params.signer = this.userByReq(req);
+            if ( tksplit.length > 1 ) {
+              var template_hash = tksplit.shift(); // unused
+            }
+            req.params.token = tksplit.shift(); 
             //console.log("Request for token " + req.params.token + " with signature from " + req.params.signer);
           }
         }
@@ -619,17 +650,26 @@ console.log("Checking authorization from signer " + signer + " for resource " +
                 that.setDBConn(user, req.params, this);
             },
             function getGeometryType(err){
-                if (req.profiler) req.profiler.done('cartoData.getDatabase');
+                if (req.profiler) req.profiler.done('setDBConn');
                 if (err) throw err;
                 cartoData.getTableGeometryType(req.params.dbname, req.params.table, this);
             },
             function finishSetup(err, data){
-                if (req.profiler) req.profiler.done('cartoData.getGeometryType');
+                if (req.profiler) req.profiler.done('cartoData.getTableGeometryType');
                 if ( err ) { callback(err, req); return; }
 
                 if (!_.isNull(data))
                     _.extend(req.params, {geom_type: data});
 
+                // Add default database connection parameters
+                // if none given
+                _.defaults(req.params, {
+                  dbuser: global.environment.postgres.user,
+                  dbpassword: global.environment.postgres.password,
+                  dbhost: global.environment.postgres.host,
+                  dbport: global.environment.postgres.port
+                });
+
                 that.addCacheChannel(req, function(err) {
                   if (req.profiler) req.profiler.done('addCacheChannel');
                   callback(err, req);

lib/cartodb/signed_maps.js

@@ -85,28 +85,59 @@ o._redisCmd = function(redisFunc, redisArgs, callback) {
   );
 };
 
+o._getAuthMethod = function(auth) {
+  return auth.method || 'open';
+};
+
 //--------------- PUBLIC API -------------------------------------
 
-// Check if the given certificate authorizes waiver of "auth"
-o.authorizedByCert = function(cert, auth) {
+/// Check formal validity of a certificate
+//
+/// Return an Error instance if invalid, null otherwise
+///
+o.checkInvalidCertificate = function(cert) {
   //console.log("Checking cert: "); console.dir(cert);
   if ( cert.version !== "0.0.1" ) {
-    throw new Error("Unsupported certificate version " + cert.version);
+    return new Error("Unsupported certificate version " + cert.version);
   }
 
   if ( ! cert.auth ) {
-    throw new Error("No certificate authorization");
+console.log("Cert is : "); console.dir(cert);
+    return new Error("No certificate authorization");
   }
 
-  if ( ! cert.auth.method ) {
-    throw new Error("No certificate authorization method");
+  var method = this._getAuthMethod(cert.auth);
+
+  switch ( method ) {
+    case 'open':
+      break;
+    case 'token':
+      if ( ! _.isArray(cert.auth.valid_tokens) )
+        return new Error("Invalid 'token' authentication: missing valid_tokens");
+      if ( ! cert.auth.valid_tokens.length )
+        return new Error("Invalid 'token' authentication: no valid_tokens");
+      break;
+    default:
+      return new Error("Unsupported authentication method: " + cert.auth.method);
+      break;
   }
 
+  return null; // all valid
+}
+
+// Check if the given certificate authorizes waiver of "auth"
+o.authorizedByCert = function(cert, auth) {
+
+  var err = this.checkInvalidCertificate(cert);
+  if ( err ) throw err;
+
+  var method = this._getAuthMethod(cert.auth);
+
   // Open authentication certificates are always authorized
-  if ( cert.auth.method === 'open' ) return true;
+  if ( method === 'open' ) return true;
 
   // Token based authentication requires valid token
-  if ( cert.auth.method === 'token' ) {
+  if ( method === 'token' ) {
     var found = cert.auth.valid_tokens.indexOf(auth);
     //if ( found !== -1 ) {
       //console.log("Token " + auth + " is found at position " + found + " in valid tokens " + cert.auth.valid_tokens);

lib/cartodb/template_maps.js

@@ -143,6 +143,11 @@ o._checkInvalidTemplate = function(template) {
     }
   };
 
+  // Check certificate validity
+  var cert = this.getTemplateCertificate(template);
+  var err = this.signed_maps.checkInvalidCertificate(cert);
+  if ( err ) return err;
+
   // TODO: run more checks over template format ?
 };
 
@@ -529,7 +534,7 @@ o._replaceVars = function(str, params) {
   if ( ! params._re ) {
     params._re = {};
     for (var k in params) {
-      params._re[k] = RegExp("<%= " + k + " %>", "g");
+      params._re[k] = RegExp("<%=\\s*" + k + "\\s*%>", "g");
     }
   }
   for (var k in params) str = str.replace(params._re[k], params[k]);
@@ -552,7 +557,7 @@ o.instance = function(template, params) {
     }
     else if ( type === 'number' ) {
       // check it's a number
-      if ( ! val.match(this._reNumber) ) {
+      if ( typeof(val) !== 'number' && ! val.match(this._reNumber) ) {
         throw new Error("Invalid number value for template parameter '"
           + k + "': " + val);
       }
@@ -576,11 +581,19 @@ o.instance = function(template, params) {
   var layergroup = JSON.parse(JSON.stringify(template.layergroup));
   for (var i=0; i<layergroup.layers.length; ++i) {
     var lyropt = layergroup.layers[i].options;
-    lyropt.cartocss = this._replaceVars(lyropt.cartocss, all_params);
-    lyropt.sql = this._replaceVars(lyropt.sql, all_params);
+    if ( lyropt.cartocss ) lyropt.cartocss = this._replaceVars(lyropt.cartocss, all_params);
+    if ( lyropt.sql) lyropt.sql = this._replaceVars(lyropt.sql, all_params);
     // Anything else ?
   }
   return layergroup;
 };
 
+// Return a fingerPrint of the object
+o.fingerPrint = function(template) {
+  return crypto.createHash('md5')
+    .update(JSON.stringify(template))
+    .digest('hex')
+  ;
+};
+
 module.exports = TemplateMaps;

npm-shrinkwrap.json

@@ -1,6 +1,6 @@
 {
   "name": "windshaft-cartodb",
-  "version": "1.6.3",
+  "version": "1.7.0",
   "dependencies": {
     "node-varnish": {
       "version": "0.1.1"
@@ -9,44 +9,16 @@
       "version": "1.3.3"
     },
     "windshaft": {
-      "version": "0.15.1",
+      "version": "0.17.1",
       "dependencies": {
         "grainstore": {
-          "version": "0.16.0",
+          "version": "0.17.1",
           "dependencies": {
-            "carto": {
-              "version": "0.9.5-cdb2",
-              "from": "http://github.com/CartoDB/carto/tarball/0.9.5-cdb2",
-              "dependencies": {
-                "underscore": {
-                  "version": "1.4.4"
-                },
-                "xml2js": {
-                  "version": "0.2.8",
-                  "dependencies": {
-                    "sax": {
-                      "version": "0.5.8"
-                    }
-                  }
-                },
-                "optimist": {
-                  "version": "0.6.0",
-                  "dependencies": {
-                    "wordwrap": {
-                      "version": "0.0.2"
-                    },
-                    "minimist": {
-                      "version": "0.0.5"
-                    }
-                  }
-                }
-              }
-            },
             "mapnik-reference": {
               "version": "5.0.7"
             },
             "millstone": {
-              "version": "0.6.8",
+              "version": "0.6.11",
               "dependencies": {
                 "underscore": {
                   "version": "1.5.2"
@@ -61,7 +33,7 @@
                       "version": "5.0.0"
                     },
                     "forever-agent": {
-                      "version": "0.5.0"
+                      "version": "0.5.2"
                     },
                     "tunnel-agent": {
                       "version": "0.3.0"
@@ -128,7 +100,7 @@
                   }
                 },
                 "srs": {
-                  "version": "0.3.9"
+                  "version": "0.3.10"
                 },
                 "zipfile": {
                   "version": "0.4.3"
@@ -257,7 +229,7 @@
                               }
                             },
                             "deep-extend": {
-                              "version": "0.2.6"
+                              "version": "0.2.8"
                             },
                             "ini": {
                               "version": "1.1.0"
@@ -278,13 +250,13 @@
                   "version": "0.3.5"
                 },
                 "optimist": {
-                  "version": "0.6.0",
+                  "version": "0.6.1",
                   "dependencies": {
                     "wordwrap": {
                       "version": "0.0.2"
                     },
                     "minimist": {
-                      "version": "0.0.5"
+                      "version": "0.0.7"
                     }
                   }
                 }
@@ -349,6 +321,59 @@
         },
         "lru-cache": {
           "version": "2.3.1"
+        },
+        "carto": {
+          "version": "0.9.5-cdb2",
+          "from": "http://github.com/CartoDB/carto/tarball/0.9.5-cdb2",
+          "dependencies": {
+            "underscore": {
+              "version": "1.4.4"
+            },
+            "mapnik-reference": {
+              "version": "5.0.7"
+            },
+            "xml2js": {
+              "version": "0.2.8",
+              "dependencies": {
+                "sax": {
+                  "version": "0.5.8"
+                }
+              }
+            },
+            "optimist": {
+              "version": "0.6.1",
+              "dependencies": {
+                "wordwrap": {
+                  "version": "0.0.2"
+                },
+                "minimist": {
+                  "version": "0.0.7"
+                }
+              }
+            }
+          }
+        },
+        "underscore.string": {
+          "version": "1.1.6",
+          "dependencies": {
+            "underscore": {
+              "version": "1.1.7"
+            }
+          }
+        },
+        "pg": {
+          "version": "2.6.2",
+          "dependencies": {
+            "generic-pool": {
+              "version": "2.0.3"
+            },
+            "buffer-writer": {
+              "version": "1.0.0"
+            }
+          }
+        },
+        "torque.js": {
+          "version": "2.2.00"
         }
       }
     },
@@ -386,12 +411,12 @@
     "semver": {
       "version": "1.1.4"
     },
-    "redis": {
-      "version": "0.8.6"
-    },
     "strftime": {
       "version": "0.6.2"
     },
+    "redis": {
+      "version": "0.8.6"
+    },
     "mocha": {
       "version": "1.14.0",
       "dependencies": {

package.json

@@ -1,7 +1,7 @@
 {
     "private": true,
     "name": "windshaft-cartodb",
-    "version": "1.6.3",
+    "version": "1.7.0",
     "description": "A map tile server for CartoDB",
     "keywords": [
       "cartodb"
@@ -24,7 +24,7 @@
     "dependencies": {
         "node-varnish": "0.1.1",
         "underscore"  : "~1.3.3",
-        "windshaft"  : "~0.15.1",
+        "windshaft"  : "~0.17.1",
         "step": "0.0.x",
         "request": "2.9.202",
         "cartodb-redis": "~0.3.0",

test/acceptance/multilayer.js

@@ -58,7 +58,7 @@ suite('multilayer', function() {
         ]
       };
 
-      var expected_token = "e34dd7e235138a062f8ba7ad051aa3a7";
+      var expected_token; // = "e34dd7e235138a062f8ba7ad051aa3a7";
       Step(
         function do_post()
         {
@@ -83,7 +83,7 @@ suite('multilayer', function() {
               if ( expected_token ) {
                 assert.equal(parsedBody.layergroupid, expected_token + ':' + expected_last_updated_epoch);
               }
-              else expected_token = parsedBody.layergroupid;
+              else expected_token = parsedBody.layergroupid.split(':')[0];
               next(null, res);
           });
         },
@@ -164,7 +164,7 @@ suite('multilayer', function() {
             errors.push(err.message);
             console.log("Error: " + err);
           }
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               if ( err ) errors.push(err.message);
               assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
               redis_client.del(matches, function(err) {
@@ -193,7 +193,7 @@ suite('multilayer', function() {
         ]
       };
 
-      var expected_token  = "6d8e4ad5458e2d25cf0eef38e38717a6";
+      var expected_token; //  = "6d8e4ad5458e2d25cf0eef38e38717a6";
       Step(
         function do_post()
         {
@@ -217,7 +217,7 @@ suite('multilayer', function() {
               if ( expected_token ) {
                 assert.equal(parsedBody.layergroupid, expected_token + ':' + expected_last_updated_epoch);
               }
-              else expected_token = parsedBody.layergroupid;
+              else expected_token = parsedBody.layergroupid.split(':')[0];
               next(null, res);
           });
         },
@@ -329,7 +329,7 @@ suite('multilayer', function() {
             errors.push(err.message);
             console.log("Error: " + err);
           }
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               if ( err ) errors.push(err.message);
               assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
               redis_client.del(matches, function(err) {
@@ -425,7 +425,7 @@ suite('multilayer', function() {
           var next = this;
           // trip epoch
           expected_token = expected_token.split(':')[0];
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               redis_client.del(matches, next);
           });
         },
@@ -517,7 +517,7 @@ suite('multilayer', function() {
         ]
       };
 
-      var expected_token = "b4ed64d93a411a59f330ab3d798e4009";
+      var expected_token; // = "b4ed64d93a411a59f330ab3d798e4009";
       Step(
         function do_post()
         {
@@ -542,7 +542,7 @@ suite('multilayer', function() {
               if ( expected_token ) {
                 assert.equal(parsedBody.layergroupid, expected_token + ':' + expected_last_updated_epoch);
               }
-              else expected_token = parsedBody.layergroupid;
+              else expected_token = parsedBody.layergroupid.split(':')[0];
               next(null, res);
           });
         },
@@ -650,7 +650,7 @@ suite('multilayer', function() {
             errors.push(err.message);
             console.log("Error: " + err);
           }
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               if ( err ) errors.push(err.message);
               assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
               redis_client.del(matches, function(err) {
@@ -805,7 +805,7 @@ suite('multilayer', function() {
             errors.push(err.message);
             console.log("Error: " + err);
           }
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               if ( err ) errors.push(err.message);
               assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
               redis_client.del(matches, function(err) {
@@ -880,7 +880,7 @@ suite('multilayer', function() {
           if ( err ) errors.push(err.message);
           if ( ! expected_token ) return null;
           var next = this;
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               if ( err ) errors.push(err.message);
               assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
               redis_client.del(matches, function(err) {
@@ -947,7 +947,7 @@ suite('multilayer', function() {
           if ( err ) errors.push(err.message);
           if ( ! expected_token ) return null;
           var next = this;
-          redis_client.keys("map_style|test_cartodb_user_1_db|~" + expected_token, function(err, matches) {
+          redis_client.keys("map_cfg|" + expected_token, function(err, matches) {
               if ( err ) errors.push(err.message);
               assert.equal(matches.length, 1, "Missing expected token " + expected_token + " from redis: " + matches);
               redis_client.del(matches, function(err) {
@@ -964,6 +964,46 @@ suite('multilayer', function() {
       );
     });
 
+    // See https://github.com/CartoDB/Windshaft-cartodb/issues/133
+    test("MapConfig with mapnik layer and no cartocss", function(done) {
+
+      var layergroup =  {
+        version: '1.0.0',
+        layers: [
+           { options: {
+               sql: 'select cartodb_id, ST_Translate(the_geom_webmercator, 5e6, 0) as the_geom_webmercator from test_table limit 2',
+               interactivity: 'cartodb_id'
+             } }
+        ]
+      };
+
+      Step(
+        function do_post()
+        {
+          var next = this;
+          assert.response(server, {
+              url: '/tiles/layergroup',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(layergroup)
+          }, {}, function(res, err) { next(err, res); });
+        },
+        function check_post(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 400, res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.errors, 'Missing "errors" in response: ' + JSON.stringify(parsed));
+          assert.equal(parsed.errors.length, 1);
+          var msg = parsed.errors[0];
+          assert.equal(msg, 'Missing cartocss for layer 0 options');
+          return null;
+        },
+        function finish(err) {
+          done(err);
+        }
+      );
+    });
+
 
     suiteTeardown(function(done) {
 

test/acceptance/server.js

@@ -1126,6 +1126,37 @@ suite('server', function() {
         );
     });
 
+    test("passes hostname header to sqlapi", function(done){
+        var qo = {
+          sql: "SELECT * from gadm4",
+          map_key: 1234
+        };
+        var sqlapi;
+        Step(
+          function sendRequest(err) {
+            var next = this;
+            assert.response(server, {
+                headers: {host: 'localhost'},
+                url: '/tiles/gadm4/6/31/24.png?' + querystring.stringify(qo),
+                method: 'GET'
+            },{}, function(res) { next(null, res); });
+          },
+          function checkResponse(err, res) {
+            if ( err ) throw err;
+            assert.equal(res.statusCode, 200, res.statusCode + ': ' + res.body);
+            var last_request = sqlapi_server.getLastRequest();
+            assert.ok(last_request);
+            var host = last_request.headers['host'];
+            assert.ok(host);
+            assert.equal(host, 'localhost.donot_look_this_up');
+            return null;
+          },
+          function finish(err) {
+            done(err);
+          }
+        );
+    });
+
     test("requests to skip cache on sqlapi error", function(done){
         var qo = {
           sql: "SELECT g.cartodb_id, g.codineprov, t.the_geom_webmercator "

test/acceptance/templates.js

@@ -131,6 +131,153 @@ suite('template_api', function() {
       );
     });
 
+    // See https://github.com/CartoDB/Windshaft-cartodb/issues/128
+    test("cannot create template with auth='token' and no valid tokens", function(done) {
+      var tpl_id;
+      Step(
+        function postTemplate1()
+        {
+          // clone the valid one, and give it another name
+          var broken_template = JSON.parse(JSON.stringify(template_acceptance1));
+          broken_template.name = 'broken1';
+          // Set auth='token' and specify no tokens
+          broken_template.auth.method = 'token';
+          delete broken_template.auth.tokens;
+          var post_request_1 = {
+              url: '/tiles/template?api_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(broken_template)
+          }
+          var next = this;
+          assert.response(server, post_request_1, {},
+            function(res) { next(null, res); });
+        },
+        function checkFailure1(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 400, res.body);
+          var parsedBody = JSON.parse(res.body);
+          assert.ok(parsedBody.hasOwnProperty('error'), res.body);
+          var re = RegExp(/invalid.*authentication.*missing/i);
+          assert.ok(parsedBody.error.match(re),
+            'Error for invalid authentication does not match ' + re + ': ' + parsedBody.error);
+          return null;
+        },
+        function postTemplate2(err)
+        {
+          if ( err ) throw err;
+          // clone the valid one and rename it
+          var broken_template = JSON.parse(JSON.stringify(template_acceptance1));
+          broken_template.name = 'broken1';
+          // Set auth='token' and specify no tokens
+          broken_template.auth.method = 'token';
+          broken_template.auth.tokens = [];
+          var post_request_1 = {
+              url: '/tiles/template?api_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(broken_template)
+          }
+          var next = this;
+          assert.response(server, post_request_1, {},
+            function(res) { next(null, res); });
+        },
+        function checkFailure2(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 400, res.body);
+          var parsedBody = JSON.parse(res.body);
+          assert.ok(parsedBody.hasOwnProperty('error'), res.body);
+          var re = RegExp(/invalid.*authentication.*missing/i);
+          assert.ok(parsedBody.error.match(re),
+            'Error for invalid authentication does not match ' + re + ': ' + parsedBody.error);
+          return null;
+        },
+        function postTemplateValid(err)
+        {
+          if ( err ) throw err;
+          // clone the valid one and rename it
+          var broken_template = JSON.parse(JSON.stringify(template_acceptance1));
+          broken_template.name = 'broken1';
+          var post_request_1 = {
+              url: '/tiles/template?api_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(broken_template)
+          }
+          var next = this;
+          assert.response(server, post_request_1, {},
+            function(res) { next(null, res); });
+        },
+        function putTemplateInvalid(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('template_id'),
+            "Missing 'template_id' from response body: " + res.body);
+          tpl_id = parsed.template_id;
+          // clone the valid one and rename it
+          var broken_template = JSON.parse(JSON.stringify(template_acceptance1));
+          broken_template.name = 'broken1';
+          // Set auth='token' and specify no tokens
+          broken_template.auth.method = 'token';
+          broken_template.auth.tokens = [];
+          var put_request_1 = {
+              url: '/tiles/template/' + tpl_id + '/?api_key=1234',
+              method: 'PUT',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(broken_template)
+          }
+          var next = this;
+          assert.response(server, put_request_1, {},
+            function(res) { next(null, res); });
+        },
+        function deleteTemplate(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 400, res.statusCode + ": " + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          var re = RegExp(/invalid.*authentication.*missing/i);
+          assert.ok(parsed.error.match(re),
+            'Error for invalid authentication on PUT does not match ' +
+            re + ': ' + parsed.error);
+          var del_request = {
+              url: '/tiles/template/' + tpl_id + '?api_key=1234', 
+              method: 'DELETE',
+              headers: {host: 'localhost'}
+          }
+          var next = this;
+          assert.response(server, del_request, {},
+            function(res, err) { next(err, res); });
+        },
+        function checkDelete(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 204, res.statusCode + ': ' + res.body);
+          assert.ok(!res.body, 'Unexpected body in DELETE /template response');
+          return null;
+        },
+        function finish(err) {
+          var errors = [];
+          if ( err ) errors.push(err);
+          redis_client.keys("map_*|localhost", function(err, keys) {
+              if ( err ) errors.push(err.message);
+              var todrop = _.map(keys, function(m) {
+                if ( m.match(/^map_(tpl|crt)|/) )
+                  return m;
+              });
+              if ( todrop.length )
+                errors.push(new Error("Unexpected keys in redis: " + todrop));
+              if ( errors.length ) done(new Error(errors.join(',')));
+              else done();
+          });
+        }
+      );
+    });
+
     test("instance endpoint should return CORS headers", function(done){
       Step(function postTemplate1(err, res) {
           var next = this;
@@ -803,6 +950,396 @@ suite('template_api', function() {
       );
     });
 
+    test("can instanciate a template with torque layer by id", function(done) {
+
+      // This map fetches data from a private table
+      var template =  {
+          version: '0.0.1',
+          name: 'acceptance1',
+          auth: { method: 'token', valid_tokens: ['valid1','valid2'] },
+          layergroup:  {
+            version: '1.1.0',
+            layers: [
+               { type: 'torque', options: {
+                   sql: "select * from test_table_private_1 LIMIT 0",
+                   cartocss: "Map { -torque-frame-count:1; -torque-resolution:1; -torque-aggregation-function:'count(*)'; -torque-time-attribute:'updated_at'; }"
+                 } }
+            ]
+          }
+      };
+
+      var template_params = {};
+
+      var errors = [];
+      var expected_failure = false;
+      var tpl_id;
+      var layergroupid;
+      Step(
+        function postTemplate(err, res)
+        {
+          var next = this;
+          var post_request = {
+              url: '/tiles/template?api_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template)
+          }
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function instanciateNoAuth(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('template_id'),
+            "Missing 'template_id' from response body: " + res.body);
+          tpl_id = parsed.template_id;
+          var post_request = {
+              url: '/tiles/template/' + tpl_id,
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_params)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function instanciateAuth(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 401,
+            'Unexpected success instanciating template with no auth: '
+            + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          assert.ok(parsed.error.match(/unauthorized/i),
+            'Unexpected error for unauthorized instance : ' + parsed.error);
+          var post_request = {
+              url: '/tiles/template/' + tpl_id + '?auth_token=valid2',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_params)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function fetchTileNoAuth(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200,
+            'Instantiating template: ' + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('layergroupid'),
+            "Missing 'layergroupid' from response body: " + res.body);
+          layergroupid = parsed.layergroupid;
+          assert.ok(layergroupid.match(/^localhost@/),
+            "Returned layergroupid does not start with signer name: "
+            + layergroupid);
+          assert.ok(parsed.hasOwnProperty('last_updated'),
+            "Missing 'last_updated' from response body: " + res.body);
+          // TODO: check value of last_updated ?
+          var get_request = {
+              url: '/tiles/layergroup/' + layergroupid + ':cb0/0/0/0/0.json.torque',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }
+          var next = this;
+          assert.response(server, get_request, {},
+            function(res) { next(null, res); });
+        },
+        function fetchTileAuth(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 401,
+            'Fetching tile with no auth: ' + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          assert.ok(parsed.error.match(/permission denied/i),
+            'Unexpected error for unauthorized instance '
+            + '(expected /permission denied): ' + parsed.error);
+          var get_request = {
+              url: '/tiles/layergroup/' + layergroupid + ':cb1/0/0/0/0.json.torque?auth_token=valid1',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }
+          var next = this;
+          assert.response(server, get_request, {},
+            function(res) { next(null, res); });
+        },
+        function checkTile(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, 
+            'Unexpected error for authorized instance: '
+            + res.statusCode + ' -- ' + res.body);
+          assert.equal(res.headers['content-type'], "application/json; charset=utf-8");
+          return null;
+        },
+        function deleteTemplate(err)
+        {
+          if ( err ) throw err;
+          var del_request = {
+              url: '/tiles/template/' + tpl_id + '?api_key=1234', 
+              method: 'DELETE',
+              headers: {host: 'localhost'}
+          }
+          var next = this;
+          assert.response(server, del_request, {},
+            function(res) { next(null, res); });
+        },
+        function fetchTileDeleted(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 204,
+            'Deleting template: ' + res.statusCode + ':' + res.body);
+          var get_request = {
+              url: '/tiles/layergroup/' + layergroupid + ':cb2/0/0/0/0.json.torque?auth_token=valid1',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }
+          var next = this;
+          assert.response(server, get_request, {},
+            function(res) { next(null, res); });
+        },
+        function checkTileDeleted(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 401, 
+            'Unexpected statusCode fetch tile after signature revokal: '
+            + res.statusCode + ':' + res.body); 
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          assert.ok(parsed.error.match(/permission denied/i),
+            'Unexpected error for unauthorized access : ' + parsed.error);
+          return null;
+        },
+        function finish(err) {
+          if ( err ) errors.push(err);
+          redis_client.keys("map_*|localhost", function(err, keys) {
+              if ( err ) errors.push(err.message);
+              var todrop = _.map(keys, function(m) {
+                if ( m.match(/^map_(tpl|crt)|/) )
+                  return m;
+              });
+              if ( todrop.length ) {
+                errors.push(new Error("Unexpected keys in redis: " + todrop));
+                redis_client.del(todrop, function(err) {
+                  if ( err ) errors.push(err.message);
+                  if ( errors.length ) {
+                    done(new Error(errors));
+                  }
+                  else done(null);
+                });
+              } else {
+                  if ( errors.length ) {
+                    done(new Error(errors));
+                  }
+                  else done(null);
+              }
+          });
+        }
+      );
+    });
+
+    test("can instanciate a template with attribute service by id", function(done) {
+
+      // This map fetches data from a private table
+      var template =  {
+          version: '0.0.1',
+          name: 'acceptance1',
+          auth: { method: 'token', valid_tokens: ['valid1','valid2'] },
+          layergroup:  {
+            version: '1.1.0',
+            layers: [
+               { options: {
+                   sql: "select * from test_table_private_1 where cartodb_id in ( 5,6 )",
+                   cartocss: '#layer { marker-fill:blue; marker-allow-overlap:true; }', 
+                   cartocss_version: '2.0.2',
+                   attributes: { id:'cartodb_id', columns: ['name', 'address'] }
+                 } }
+            ]
+          }
+      };
+
+      var template_params = {};
+
+      var errors = [];
+      var expected_failure = false;
+      var tpl_id;
+      var layergroupid;
+      Step(
+        function postTemplate(err, res)
+        {
+          var next = this;
+          var post_request = {
+              url: '/tiles/template?api_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template)
+          }
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function instanciateNoAuth(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('template_id'),
+            "Missing 'template_id' from response body: " + res.body);
+          tpl_id = parsed.template_id;
+          var post_request = {
+              url: '/tiles/template/' + tpl_id,
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_params)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function instanciateAuth(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 401,
+            'Unexpected success instanciating template with no auth: '
+            + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          assert.ok(parsed.error.match(/unauthorized/i),
+            'Unexpected error for unauthorized instance : ' + parsed.error);
+          var post_request = {
+              url: '/tiles/template/' + tpl_id + '?auth_token=valid2',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_params)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res, err) { next(null, res); });
+        },
+        function fetchAttributeNoAuth(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200,
+            'Instantiating template: ' + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('layergroupid'),
+            "Missing 'layergroupid' from response body: " + res.body);
+          layergroupid = parsed.layergroupid;
+          assert.ok(layergroupid.match(/^localhost@/),
+            "Returned layergroupid does not start with signer name: "
+            + layergroupid);
+          assert.ok(parsed.hasOwnProperty('last_updated'),
+            "Missing 'last_updated' from response body: " + res.body);
+          // TODO: check value of last_updated ?
+          var get_request = {
+              url: '/tiles/layergroup/' + layergroupid + ':cb0/0/attributes/5',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }
+          var next = this;
+          assert.response(server, get_request, {},
+            function(res) { next(null, res); });
+        },
+        function fetchAttributeAuth(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 401,
+            'Fetching tile with no auth: ' + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          assert.ok(parsed.error.match(/permission denied/i),
+            'Unexpected error for unauthorized getAttributes '
+            + '(expected /permission denied/): ' + parsed.error);
+          var get_request = {
+              url: '/tiles/layergroup/' + layergroupid + ':cb1/0/attributes/5?auth_token=valid2',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }
+          var next = this;
+          assert.response(server, get_request, {},
+            function(res) { next(null, res); });
+        },
+        function checkAttribute(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, 
+            'Unexpected error for authorized getAttributes: '
+            + res.statusCode + ' -- ' + res.body);
+          assert.equal(res.headers['content-type'], "application/json; charset=utf-8");
+          return null;
+        },
+        function deleteTemplate(err)
+        {
+          if ( err ) throw err;
+          var del_request = {
+              url: '/tiles/template/' + tpl_id + '?api_key=1234', 
+              method: 'DELETE',
+              headers: {host: 'localhost'}
+          }
+          var next = this;
+          assert.response(server, del_request, {},
+            function(res) { next(null, res); });
+        },
+        function fetchAttrDeleted(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 204,
+            'Deleting template: ' + res.statusCode + ':' + res.body);
+          var get_request = {
+              url: '/tiles/layergroup/' + layergroupid + ':cb2/0/attributes/5?auth_token=valid2',
+              method: 'GET',
+              headers: {host: 'localhost' },
+              encoding: 'binary'
+          }
+          var next = this;
+          assert.response(server, get_request, {},
+            function(res) { next(null, res); });
+        },
+        function checkTileDeleted(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 401, 
+            'Unexpected statusCode fetch tile after signature revokal: '
+            + res.statusCode + ':' + res.body); 
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('error'),
+            "Missing 'error' from response body: " + res.body);
+          assert.ok(parsed.error.match(/permission denied/i),
+            'Unexpected error for unauthorized access : ' + parsed.error);
+          return null;
+        },
+        function finish(err) {
+          if ( err ) errors.push(err);
+          redis_client.keys("map_*|localhost", function(err, keys) {
+              if ( err ) errors.push(err.message);
+              var todrop = _.map(keys, function(m) {
+                if ( m.match(/^map_(tpl|crt)|/) )
+                  return m;
+              });
+              if ( todrop.length ) {
+                errors.push(new Error("Unexpected keys in redis: " + todrop));
+                redis_client.del(todrop, function(err) {
+                  if ( err ) errors.push(err.message);
+                  if ( errors.length ) {
+                    done(new Error(errors));
+                  }
+                  else done(null);
+                });
+              } else {
+                  if ( errors.length ) {
+                    done(new Error(errors));
+                  }
+                  else done(null);
+              }
+          });
+        }
+      );
+    });
+
     test("can instanciate a template by id with open auth", function(done) {
 
       // This map fetches data from a private table
@@ -1004,13 +1541,14 @@ suite('template_api', function() {
           assert.equal(res.statusCode, 200,
             'Unexpected success instanciating template with no auth: '
             + res.statusCode + ': ' + res.body);
-          done();
+          return null;
+        },
+        function finish(err) {
+          done(err);
         }
       );
     });
 
-
-
     test("template instantiation raises mapviews counter", function(done) {
       var layergroup =  {
         stat_tag: 'random_tag',
@@ -1119,6 +1657,147 @@ suite('template_api', function() {
       );
     });
 
+    test("instance map token changes with templates certificate changes", function(done) {
+
+      // This map fetches data from a private table
+      var template_acceptance2 =  {
+          version: '0.0.1',
+          name: 'acceptance2',
+          auth: { method: 'token', valid_tokens: ['valid1','valid2'] },
+          layergroup:  {
+            version: '1.0.0',
+            layers: [
+               { options: {
+                   sql: "select * from test_table_private_1 LIMIT 0",
+                   cartocss: '#layer { marker-fill:blue; marker-allow-overlap:true; }', 
+                   cartocss_version: '2.0.2',
+                   interactivity: 'cartodb_id'
+                 } }
+            ]
+          }
+      };
+
+      var template_params = {};
+
+      var errors = [];
+      var expected_failure = false;
+      var tpl_id;
+      var layergroupid;
+      Step(
+        function postTemplate(err, res)
+        {
+          var next = this;
+          var post_request = {
+              url: '/tiles/template?api_key=1234',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_acceptance2)
+          }
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function instance1(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('template_id'),
+            "Missing 'template_id' from response body: " + res.body);
+          tpl_id = parsed.template_id;
+          var post_request = {
+              url: '/tiles/template/' + tpl_id + '?auth_token=valid2',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_params)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res, err) { next(err, res); });
+        },
+        function checkInstance1(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200,
+            'Instantiating template: ' + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('layergroupid'),
+            "Missing 'layergroupid' from response body: " + res.body);
+          layergroupid = parsed.layergroupid;
+          return null;
+        },
+        function updateTemplate(err, res)
+        {
+          if ( err ) throw err;
+          // clone the valid one and rename it
+          var changedTemplate = JSON.parse(JSON.stringify(template_acceptance2));
+          changedTemplate.auth.method = 'open';
+          var post_request = {
+              url: '/tiles/template/' + tpl_id + '/?api_key=1234',
+              method: 'PUT',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(changedTemplate)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res) { next(null, res); });
+        },
+        function instance2(err, res)
+        {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200, res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('template_id'),
+            "Missing 'template_id' from response body: " + res.body);
+          assert.equal(tpl_id, parsed.template_id);
+          var post_request = {
+              url: '/tiles/template/' + tpl_id + '?auth_token=valid2',
+              method: 'POST',
+              headers: {host: 'localhost', 'Content-Type': 'application/json' },
+              data: JSON.stringify(template_params)
+          }
+          var next = this;
+          assert.response(server, post_request, {},
+            function(res, err) { next(err, res); });
+        },
+        function checkInstance2(err, res) {
+          if ( err ) throw err;
+          assert.equal(res.statusCode, 200,
+            'Instantiating template: ' + res.statusCode + ': ' + res.body);
+          var parsed = JSON.parse(res.body);
+          assert.ok(parsed.hasOwnProperty('layergroupid'),
+            "Missing 'layergroupid' from response body: " + res.body);
+          assert.ok(layergroupid != parsed.layergroupid);
+          return null;
+        },
+        function finish(err) {
+          if ( err ) errors.push(err);
+          redis_client.keys("map_*|localhost", function(err, keys) {
+              if ( err ) errors.push(err.message);
+              var todrop = _.map(keys, function(m) {
+                if ( m.match(/^map_(tpl|crt)|/) )
+                  return m;
+              });
+              if ( todrop.length != 2 ) {
+                errors.push(new Error("Unexpected keys in redis: " + todrop));
+              } else {
+                if ( todrop.indexOf('map_tpl|localhost') == -1 ) {
+                  errors.push(new Error("Missing 'map_tpl|localhost' key in redis"));
+                }
+                if ( todrop.indexOf('map_crt|localhost') == -1 ) {
+                  errors.push(new Error("Missing 'map_crt|localhost' key in redis"));
+                }
+              }
+              redis_client.del(todrop, function(err) {
+                if ( err ) errors.push(err.message);
+                if ( errors.length ) {
+                  done(new Error(errors));
+                }
+                else done(null);
+              });
+          });
+        }
+      );
+    });
+
     suiteTeardown(function(done) {
 
         // This test will add map_style records, like

test/support/SQLAPIEmu.js

@@ -6,10 +6,14 @@ var o = function(port, cb) {
 
   this.queries = [];
   var that = this;
+  this.requests = [];
 
   this.sqlapi_server = http.createServer(function(req,res) {
       //console.log("server got request with method " + req.method);
       var query;
+
+      that.requests.push(req);
+
       if ( req.method == 'GET' ) {
         query = url.parse(req.url, true).query;
         that.handleQuery(query, res);
@@ -68,5 +72,9 @@ o.prototype.close = function(cb) {
   this.sqlapi_server.close(cb);
 };
 
+o.prototype.getLastRequest = function() {
+  return this.requests.pop();
+};
+
 module.exports = o;
 

test/support/sql/windshaft.test.sql

@@ -174,5 +174,6 @@ CREATE TABLE test_table_private_1 (
     CONSTRAINT enforce_srid_the_geom CHECK ((st_srid(the_geom) = 4326)),
     CONSTRAINT enforce_srid_the_geom_webmercator CHECK ((st_srid(the_geom_webmercator) = 3857))
 );
+INSERT INTO test_table_private_1 SELECT * from test_table;
 
 GRANT ALL ON TABLE test_table_private_1 TO :TESTUSER;

test/unit/cartodb/req2params.test.js

@@ -21,7 +21,7 @@ suite('req2params', function() {
           assert.ok(req.hasOwnProperty('params'), 'request has params');
           assert.ok(req.params.hasOwnProperty('interactivity'), 'request params have interactivity');
           assert.equal(req.params.dbname, 'test_cartodb_user_1_db', 'could forge dbname: '+ req.params.dbname);
-          assert.ok(!req.params.hasOwnProperty('dbuser'), 'could inject dbuser ('+req.params.dbuser+')');
+          assert.ok(req.params.dbuser === 'testpublicuser', 'could inject dbuser ('+req.params.dbuser+')');
           done();
       });
     });
@@ -37,7 +37,7 @@ suite('req2params', function() {
           // database_name for user "localhost" (see test/support/prepare_db.sh)
           assert.equal(req.params.dbname, 'test_cartodb_user_1_db');
           // unauthenticated request gets no dbuser
-          assert.ok(!req.params.hasOwnProperty('dbuser'), 'could inject dbuser ('+req.params.dbuser+')');
+          assert.ok(req.params.dbuser === 'testpublicuser', 'could inject dbuser ('+req.params.dbuser+')');
           done();
       });
     });
@@ -57,7 +57,7 @@ suite('req2params', function() {
  
           opts.req2params({headers: { host:'localhost' }, query: {map_key: '1235'} }, function(err, req) {
               // wrong key resets params to no user
-              assert.ok(!req.params.hasOwnProperty('dbuser'), 'could inject dbuser ('+req.params.dbuser+')');
+              assert.ok(req.params.dbuser === 'testpublicuser', 'could inject dbuser ('+req.params.dbuser+')');
               done();
           });
       });

test/unit/cartodb/signed_maps.test.js

@@ -81,5 +81,29 @@ suite('signed_maps', function() {
       );
     });
 
+    test('can validate certificates', function(done) {
+      var smap = new SignedMaps(redis_pool);
+      assert.ok(smap);
+      Step(
+        function invalidVersion() {
+          var cert = { version: '-1' };
+          var err = smap.checkInvalidCertificate(cert);
+          assert.ok(err);
+          assert.equal(err.message, "Unsupported certificate version -1");
+          return null;
+        },
+        function invalidTokenAuth() {
+          var cert = { version: '0.0.1', auth: { method:'token', valid_token:[] } };
+          var err = smap.checkInvalidCertificate(cert);
+          assert.ok(err);
+          assert.equal(err.message, "Invalid 'token' authentication: missing valid_tokens");
+          return null;
+        },
+        function finish(err) {
+          done(err);
+        }
+      );
+    });
+
     
 });

test/unit/cartodb/template_maps.test.js

@@ -147,6 +147,28 @@ suite('template_maps', function() {
       });
   });
 
+  // See http://github.com/CartoDB/Windshaft-cartodb/issues/128
+  test('does not accept template with invalid token auth (undefined tokens)',
+  function(done) {
+    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    assert.ok(tmap);
+    var tpl = { version:'0.0.1',
+      name: "invalid_auth1", placeholders: { },
+      auth: { method: 'token' }, layergroup: {} };
+    tmap.addTemplate('me', tpl, function(err) {
+        if ( ! err ) {
+          done(new Error("Unexpected success with invalid token auth (undefined tokens)"));
+        }
+        else if ( ! err.message.match(/invalid 'token' authentication/i) ) {
+          done(new Error("Unexpected error message with invalid token auth (undefined tokens): "
+            + err));
+        }
+        else {
+          done();
+        }
+      });
+  });
+
   test('add, get and delete a valid template', function(done) {
     var tmap = new TemplateMaps(redis_pool, signed_maps);
     assert.ok(tmap);
@@ -271,6 +293,7 @@ suite('template_maps', function() {
         assert.ok(err);
         tpl.name = 'first';
         tpl.auth.method = 'token';
+        tpl.auth.valid_tokens = [ 'tok1' ];
         tmap.updTemplate(owner, tpl_id, tpl, this);
       },
       function updateTemplateWithInvalid(err) {
@@ -314,17 +337,18 @@ suite('template_maps', function() {
           color: { type: "css_color", default: "#a0fF9A" },
           name: { type: "sql_literal", default: "test" },
           zoom: { type: "number", default: "0" },
+          test_number: { type: "number", default: 23 },
         },
         layergroup: {
           version: '1.0.0',
           global_cartocss_version: '2.0.2',
           layers: [
              { options: {
-                 sql: "select '<%= name %>' || id, g from t",
-                 cartocss: '#layer { marker-fill:<%= fill %>; }'
+                 sql: "select '<%=name %>' || id, g from t",
+                 cartocss: '#layer { marker-fill:<%= fill %>; marker-width: <%=test_number  %>; }'
                } },
              { options: {
-                 sql: "select fun('<%= name %>') g from x",
+                 sql: "select fun('<%=     name%>') g from x",
                  cartocss: '#layer { line-color:<%= color %>; marker-fill:<%= color %>; }'
                } },
              { options: {
@@ -339,7 +363,7 @@ suite('template_maps', function() {
 
     var lyr = inst.layers[0].options;
     assert.equal(lyr.sql, "select 'test' || id, g from t");
-    assert.equal(lyr.cartocss, '#layer { marker-fill:red; }');
+    assert.equal(lyr.cartocss, '#layer { marker-fill:red; marker-width: 23; }');
 
     lyr = inst.layers[1].options;
     assert.equal(lyr.sql, "select fun('test') g from x");
@@ -349,7 +373,7 @@ suite('template_maps', function() {
 
     lyr = inst.layers[0].options;
     assert.equal(lyr.sql, "select 'it''s dangerous' || id, g from t");
-    assert.equal(lyr.cartocss, '#layer { marker-fill:red; }');
+    assert.equal(lyr.cartocss, '#layer { marker-fill:red; marker-width: 23; }');
 
     lyr = inst.layers[1].options;
     assert.equal(lyr.sql, "select fun('it''s dangerous') g from x");