Add IssueAuthToken and unit tests to GaiaAuthenticator2.

GaiaAuthConsumer pure virtuals now optional since you can choose to not listen to ClientLogin subscriptions.
Renamed ClientLoginError to a general GaiaAuthError.
BUG=47093
TEST=Unit tests included

Review URL: http://codereview.chromium.org/2834042

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@51678 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 276 insertions, 81 deletions

diff --git a/chrome/common/net/gaia/gaia_auth_consumer.h b/chrome/common/net/gaia/gaia_auth_consumer.h
index 31302c7..b7b215c 100644
--- a/chrome/common/net/gaia/gaia_auth_consumer.h
+++ b/chrome/common/net/gaia/gaia_auth_consumer.h
@@ -36,15 +36,15 @@ class GaiaAuthConsumer {
     std::string data;  // Full contents of ClientLogin return.
   };
 
-  enum ClientLoginErrorCode {
+  enum GaiaAuthErrorCode {
     NETWORK_ERROR,
     REQUEST_CANCELED,
     TWO_FACTOR,  // Callers can treat this as a success.
     PERMISSION_DENIED
   };
 
-  struct ClientLoginError {
-    inline bool operator==(const ClientLoginError &b) const {
+  struct GaiaAuthError {
+    inline bool operator==(const GaiaAuthError &b) const {
       if (code != b.code) {
         return false;
       }
@@ -54,14 +54,20 @@ class GaiaAuthConsumer {
       return true;
     }
 
-    ClientLoginErrorCode code;
+    GaiaAuthErrorCode code;
     int network_error;  // This field is only valid if NETWORK_ERROR occured.
     std::string data;  // TODO(chron): Remove this field. Should preparse data.
   };
 
   virtual ~GaiaAuthConsumer() {}
-  virtual void OnClientLoginFailure(const ClientLoginError& error) = 0;
-  virtual void OnClientLoginSuccess(const ClientLoginResult& result) = 0;
+
+  virtual void OnClientLoginSuccess(const ClientLoginResult& result) {}
+  virtual void OnClientLoginFailure(const GaiaAuthError& error) {}
+
+  virtual void OnIssueAuthTokenSuccess(const std::string& service,
+                                       const std::string& auth_token) {}
+  virtual void OnIssueAuthTokenFailure(const std::string& service,
+                                       const GaiaAuthError& error) {}
 };
 
 #endif  // CHROME_COMMON_NET_GAIA_GAIA_AUTH_CONSUMER_H_
diff --git a/chrome/common/net/gaia/gaia_authenticator2.cc b/chrome/common/net/gaia/gaia_authenticator2.cc
index fd480f1..abc0efe 100644
--- a/chrome/common/net/gaia/gaia_authenticator2.cc
+++ b/chrome/common/net/gaia/gaia_authenticator2.cc
@@ -34,6 +34,12 @@ const char GaiaAuthenticator2::kClientLoginCaptchaFormat[] =
     "service=%s&"
     "logintoken=%s&"
     "logincaptcha=%s";
+// static
+const char GaiaAuthenticator2::kIssueAuthTokenFormat[] =
+    "SID=%s&"
+    "LSID=%s&"
+    "service=%s&"
+    "Session=true";
 
 // static
 const char GaiaAuthenticator2::kCookiePersistence[] = "true";
@@ -53,12 +59,6 @@ const char GaiaAuthenticator2::kClientLoginUrl[] =
     "https://www.google.com/accounts/ClientLogin";
 const char GaiaAuthenticator2::kIssueAuthTokenUrl[] =
     "https://www.google.com/accounts/IssueAuthToken";
-// TODO(chron): Fix this URL not to hardcode source
-// TODO(cmasone): make sure that using an http:// URL in the "continue"
-// parameter here doesn't open the system up to attack long-term.
-const char GaiaAuthenticator2::kTokenAuthUrl[] =
-    "https://www.google.com/accounts/TokenAuth?"
-        "continue=http://www.google.com/webhp&source=chromeos&auth=";
 
 GaiaAuthenticator2::GaiaAuthenticator2(GaiaAuthConsumer* consumer,
                                        const std::string& source,
@@ -67,7 +67,8 @@ GaiaAuthenticator2::GaiaAuthenticator2(GaiaAuthConsumer* consumer,
       getter_(getter),
       source_(source),
       client_login_gurl_(kClientLoginUrl),
-      fetch_pending_(false){}
+      issue_auth_token_gurl_(kIssueAuthTokenUrl),
+      fetch_pending_(false) {}
 
 GaiaAuthenticator2::~GaiaAuthenticator2() {}
 
@@ -81,15 +82,15 @@ void GaiaAuthenticator2::CancelRequest() {
 }
 
 // static
-URLFetcher* GaiaAuthenticator2::CreateClientLoginFetcher(
+URLFetcher* GaiaAuthenticator2::CreateGaiaFetcher(
     URLRequestContextGetter* getter,
     const std::string& body,
-    const GURL& client_login_gurl,
+    const GURL& gaia_gurl,
     URLFetcher::Delegate* delegate) {
 
   URLFetcher* to_return =
       URLFetcher::Create(0,
-                         client_login_gurl,
+                         gaia_gurl,
                          URLFetcher::POST,
                          delegate);
   to_return->set_request_context(getter);
@@ -98,7 +99,8 @@ URLFetcher* GaiaAuthenticator2::CreateClientLoginFetcher(
   return to_return;
 }
 
-std::string GaiaAuthenticator2::GenerateRequestBody(
+// static
+std::string GaiaAuthenticator2::MakeClientLoginBody(
     const std::string& username,
     const std::string& password,
     const std::string& source,
@@ -128,8 +130,19 @@ std::string GaiaAuthenticator2::GenerateRequestBody(
 
 }
 
-// Helper method that extracts tokens from a successful reply, and saves them
-// in the right fields.
+// static
+std::string GaiaAuthenticator2::MakeIssueAuthTokenBody(
+    const std::string& sid,
+    const std::string& lsid,
+    const char* const service) {
+
+  return StringPrintf(kIssueAuthTokenFormat,
+                      UrlEncodeString(sid).c_str(),
+                      UrlEncodeString(lsid).c_str(),
+                      service);
+}
+
+// Helper method that extracts tokens from a successful reply.
 // static
 void GaiaAuthenticator2::ParseClientLoginResponse(const std::string& data,
                                                   std::string* sid,
@@ -155,46 +168,53 @@ void GaiaAuthenticator2::ParseClientLoginResponse(const std::string& data,
 
 void GaiaAuthenticator2::StartClientLogin(const std::string& username,
                                           const std::string& password,
-                                          const char* service,
+                                          const char* const service,
                                           const std::string& login_token,
                                           const std::string& login_captcha) {
 
+  DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
+
   // This class is thread agnostic, so be sure to call this only on the
   // same thread each time.
-  LOG(INFO) << "Starting new ClientLogin fetch.";
+  LOG(INFO) << "Starting new ClientLogin fetch for:" << username;
 
   // Must outlive fetcher_.
-  request_body_ = GenerateRequestBody(username,
+  request_body_ = MakeClientLoginBody(username,
                                       password,
                                       source_,
                                       service,
                                       login_token,
                                       login_captcha);
-
-  fetcher_.reset(CreateClientLoginFetcher(getter_,
-                                          request_body_,
-                                          client_login_gurl_,
-                                          this));
+  fetcher_.reset(CreateGaiaFetcher(getter_,
+                                   request_body_,
+                                   client_login_gurl_,
+                                   this));
   fetch_pending_ = true;
   fetcher_->Start();
 }
 
-void GaiaAuthenticator2::OnClientLoginFetched(const std::string& data,
-                                              const URLRequestStatus& status,
-                                              int response_code) {
+void GaiaAuthenticator2::StartIssueAuthToken(const std::string& sid,
+                                             const std::string& lsid,
+                                             const char* const service) {
 
-  if (status.is_success() && response_code == RC_REQUEST_OK) {
-    LOG(INFO) << "ClientLogin successful!";
-    std::string sid;
-    std::string lsid;
-    std::string token;
-    ParseClientLoginResponse(data, &sid, &lsid, &token);
-    consumer_->OnClientLoginSuccess(
-        GaiaAuthConsumer::ClientLoginResult(sid, lsid, token, data));
-    return;
-  }
+  DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
+
+  LOG(INFO) << "Starting IssueAuthToken for: " << service;
+  requested_service_ = service;
+  request_body_ = MakeIssueAuthTokenBody(sid, lsid, service);
+  fetcher_.reset(CreateGaiaFetcher(getter_,
+                                   request_body_,
+                                   issue_auth_token_gurl_,
+                                   this));
+  fetch_pending_ = true;
+  fetcher_->Start();
+}
+
+GaiaAuthConsumer::GaiaAuthError GaiaAuthenticator2::GenerateAuthError(
+    const std::string& data,
+    const URLRequestStatus& status) {
 
-  GaiaAuthConsumer::ClientLoginError error;
+  GaiaAuthConsumer::GaiaAuthError error;
   error.data = data;
 
   if (!status.is_success()) {
@@ -214,7 +234,38 @@ void GaiaAuthenticator2::OnClientLoginFetched(const std::string& data,
     }
   }
 
-  consumer_->OnClientLoginFailure(error);
+  return error;
+}
+
+void GaiaAuthenticator2::OnClientLoginFetched(const std::string& data,
+                                              const URLRequestStatus& status,
+                                              int response_code) {
+
+  if (status.is_success() && response_code == RC_REQUEST_OK) {
+    LOG(INFO) << "ClientLogin successful!";
+    std::string sid;
+    std::string lsid;
+    std::string token;
+    ParseClientLoginResponse(data, &sid, &lsid, &token);
+    consumer_->OnClientLoginSuccess(
+        GaiaAuthConsumer::ClientLoginResult(sid, lsid, token, data));
+  } else {
+    consumer_->OnClientLoginFailure(GenerateAuthError(data, status));
+  }
+}
+
+void GaiaAuthenticator2::OnIssueAuthTokenFetched(
+    const std::string& data,
+    const URLRequestStatus& status,
+    int response_code) {
+  if (status.is_success() && response_code == RC_REQUEST_OK) {
+    // Only the bare token is returned in the body of this Gaia call
+    // without any padding.
+    consumer_->OnIssueAuthTokenSuccess(requested_service_, data);
+  } else {
+    consumer_->OnIssueAuthTokenFailure(requested_service_,
+        GenerateAuthError(data, status));
+  }
 }
 
 void GaiaAuthenticator2::OnURLFetchComplete(const URLFetcher* source,
@@ -226,9 +277,11 @@ void GaiaAuthenticator2::OnURLFetchComplete(const URLFetcher* source,
   fetch_pending_ = false;
   if (url == client_login_gurl_) {
     OnClientLoginFetched(data, status, response_code);
-    return;
+  } else if (url == issue_auth_token_gurl_) {
+    OnIssueAuthTokenFetched(data, status, response_code);
+  } else {
+    NOTREACHED();
   }
-  NOTREACHED();
 }
 
 // static
diff --git a/chrome/common/net/gaia/gaia_authenticator2.h b/chrome/common/net/gaia/gaia_authenticator2.h
index bbb3761..ac44efa 100644
--- a/chrome/common/net/gaia/gaia_authenticator2.h
+++ b/chrome/common/net/gaia/gaia_authenticator2.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/gtest_prod_util.h"
+#include "chrome/common/net/gaia/gaia_auth_consumer.h"
 #include "chrome/common/net/url_fetcher.h"
 #include "googleurl/src/gurl.h"
 
@@ -17,8 +18,10 @@
 // In the future, we will also issue auth tokens from this class.
 // This class should be used on a single thread, but it can be whichever thread
 // that you like.
+//
+// This class can handle one request at a time. To parallelize requests,
+// create multiple GaiaAuthenticator2's.
 
-class GaiaAuthConsumer;
 class GaiaAuthenticator2Test;
 
 class GaiaAuthenticator2 : public URLFetcher::Delegate {
@@ -30,8 +33,6 @@ class GaiaAuthenticator2 : public URLFetcher::Delegate {
   // The URLs for different calls in the Google Accounts programmatic login API.
   static const char kClientLoginUrl[];
   static const char kIssueAuthTokenUrl[];
-  static const char kTokenAuthUrl[];
-
 
   // Magic string indicating that, while a second factor is still
   // needed to complete authentication, the user provided the right password.
@@ -46,12 +47,20 @@ class GaiaAuthenticator2 : public URLFetcher::Delegate {
 
   // GaiaAuthConsumer will be called on the original thread
   // after results come back. This class is thread agnostic.
+  // You can't make more than request at a time.
   void StartClientLogin(const std::string& username,
                         const std::string& password,
                         const char* const service,
                         const std::string& login_token,
                         const std::string& login_captcha);
 
+  // GaiaAuthConsumer will be called on the original thread
+  // after results come back. This class is thread agnostic.
+  // You can't make more than one request at a time.
+  void StartIssueAuthToken(const std::string& sid,
+                           const std::string& lsid,
+                           const char* const service);
+
   // Implementation of URLFetcher::Delegate
   void OnURLFetchComplete(const URLFetcher* source,
                           const GURL& url,
@@ -75,41 +84,65 @@ class GaiaAuthenticator2 : public URLFetcher::Delegate {
   static const char kClientLoginFormat[];
   // The format of said POST body when CAPTCHA token & answer are specified.
   static const char kClientLoginCaptchaFormat[];
+  // The format of the POST body for IssueAuthToken.
+  static const char kIssueAuthTokenFormat[];
 
   // Process the results of a ClientLogin fetch.
   void OnClientLoginFetched(const std::string& data,
                             const URLRequestStatus& status,
                             int response_code);
 
+  void OnIssueAuthTokenFetched(const std::string& data,
+                               const URLRequestStatus& status,
+                               int response_code);
+
   // Tokenize the results of a ClientLogin fetch.
   static void ParseClientLoginResponse(const std::string& data,
                                        std::string* sid,
                                        std::string* lsid,
                                        std::string* token);
 
+  // From a URLFetcher result, generate an appropriate GaiaAuthError.
+  // From the API documentation, both IssueAuthToken and ClientLogin have
+  // the same error returns.
+  static GaiaAuthConsumer::GaiaAuthError GenerateAuthError(
+      const std::string& data,
+      const URLRequestStatus& status);
+
   // Is this a special case Gaia error for TwoFactor auth?
   static bool IsSecondFactorSuccess(const std::string& alleged_error);
 
   // Given parameters, create a ClientLogin request body.
-  static std::string GenerateRequestBody(const std::string& username,
+  static std::string MakeClientLoginBody(const std::string& username,
                                          const std::string& password,
                                          const std::string& source,
-                                         const char* service,
+                                         const char* const service,
                                          const std::string& login_token,
                                          const std::string& login_captcha);
+  // Supply the sid / lsid returned from ClientLogin in order to
+  // request a long lived auth token for a service.
+  static std::string MakeIssueAuthTokenBody(const std::string& sid,
+                                            const std::string& lsid,
+                                            const char* const service);
+
+  // Create a fetcher useable for making any Gaia request.
+  static URLFetcher* CreateGaiaFetcher(URLRequestContextGetter* getter,
+                                       const std::string& body,
+                                       const GURL& gaia_gurl_,
+                                       URLFetcher::Delegate* delegate);
 
-  // Create a fetcher useable for making a ClientLogin request.
-  static URLFetcher* CreateClientLoginFetcher(URLRequestContextGetter* getter,
-                                              const std::string& body,
-                                              const GURL& client_login_gurl_,
-                                              URLFetcher::Delegate* delegate);
 
+  // These fields are common to GaiaAuthenticator2, same every request
   GaiaAuthConsumer* const consumer_;
-  scoped_ptr<URLFetcher> fetcher_;
   URLRequestContextGetter* const getter_;
   std::string source_;
   const GURL client_login_gurl_;
+  const GURL issue_auth_token_gurl_;
+
+  // While a fetch is going on:
+  scoped_ptr<URLFetcher> fetcher_;
   std::string request_body_;
+  std::string requested_service_;  // Currently tracked for IssueAuthToken only
   bool fetch_pending_;
 
   friend class GaiaAuthenticator2Test;
diff --git a/chrome/common/net/gaia/gaia_authenticator2_unittest.cc b/chrome/common/net/gaia/gaia_authenticator2_unittest.cc
index 54d9211..4e4dc82 100644
--- a/chrome/common/net/gaia/gaia_authenticator2_unittest.cc
+++ b/chrome/common/net/gaia/gaia_authenticator2_unittest.cc
@@ -27,7 +27,8 @@ using ::testing::_;
 class GaiaAuthenticator2Test : public testing::Test {
  public:
   GaiaAuthenticator2Test()
-    : source_(GaiaAuthenticator2::kClientLoginUrl) {}
+    : client_login_source_(GaiaAuthenticator2::kClientLoginUrl),
+      issue_auth_token_source_(GaiaAuthenticator2::kIssueAuthTokenUrl) {}
 
   void RunParsingTest(const std::string& data,
                       const std::string& sid,
@@ -47,7 +48,8 @@ class GaiaAuthenticator2Test : public testing::Test {
   }
 
   ResponseCookies cookies_;
-  GURL source_;
+  GURL client_login_source_;
+  GURL issue_auth_token_source_;
   TestingProfile profile_;
 };
 
@@ -55,16 +57,21 @@ class MockGaiaConsumer : public GaiaAuthConsumer {
  public:
   MockGaiaConsumer() {}
   ~MockGaiaConsumer() {}
-  MOCK_METHOD1(OnClientLoginFailure, void(const ClientLoginError& error));
+
   MOCK_METHOD1(OnClientLoginSuccess, void(const ClientLoginResult& result));
+  MOCK_METHOD2(OnIssueAuthTokenSuccess, void(const std::string& service,
+      const std::string& token));
+  MOCK_METHOD1(OnClientLoginFailure, void(const GaiaAuthError& error));
+  MOCK_METHOD2(OnIssueAuthTokenFailure, void(const std::string& service,
+      const GaiaAuthError& error));
 };
 
 TEST_F(GaiaAuthenticator2Test, ErrorComparator) {
-  GaiaAuthConsumer::ClientLoginError expected_error;
+  GaiaAuthConsumer::GaiaAuthError expected_error;
   expected_error.code = GaiaAuthConsumer::NETWORK_ERROR;
   expected_error.network_error = -101;
 
-  GaiaAuthConsumer::ClientLoginError matching_error;
+  GaiaAuthConsumer::GaiaAuthError matching_error;
   matching_error.code = GaiaAuthConsumer::NETWORK_ERROR;
   matching_error.network_error = -101;
 
@@ -84,7 +91,7 @@ TEST_F(GaiaAuthenticator2Test, LoginNetFailure) {
   int error_no = net::ERR_CONNECTION_RESET;
   URLRequestStatus status(URLRequestStatus::FAILED, error_no);
 
-  GaiaAuthConsumer::ClientLoginError expected_error;
+  GaiaAuthConsumer::GaiaAuthError expected_error;
   expected_error.code = GaiaAuthConsumer::NETWORK_ERROR;
   expected_error.network_error = error_no;
 
@@ -95,7 +102,35 @@ TEST_F(GaiaAuthenticator2Test, LoginNetFailure) {
   GaiaAuthenticator2 auth(&consumer, std::string(),
       profile_.GetRequestContext());
 
-  auth.OnURLFetchComplete(NULL, source_, status, 0, cookies_, std::string());
+  auth.OnURLFetchComplete(NULL,
+                          client_login_source_,
+                          status,
+                          0,
+                          cookies_,
+                          std::string());
+}
+
+TEST_F(GaiaAuthenticator2Test, TokenNetFailure) {
+  int error_no = net::ERR_CONNECTION_RESET;
+  URLRequestStatus status(URLRequestStatus::FAILED, error_no);
+
+  GaiaAuthConsumer::GaiaAuthError expected_error;
+  expected_error.code = GaiaAuthConsumer::NETWORK_ERROR;
+  expected_error.network_error = error_no;
+
+  MockGaiaConsumer consumer;
+  EXPECT_CALL(consumer, OnIssueAuthTokenFailure(_, expected_error))
+      .Times(1);
+
+  GaiaAuthenticator2 auth(&consumer, std::string(),
+      profile_.GetRequestContext());
+
+  auth.OnURLFetchComplete(NULL,
+                          issue_auth_token_source_,
+                          status,
+                          0,
+                          cookies_,
+                          std::string());
 }
 
 
@@ -103,7 +138,7 @@ TEST_F(GaiaAuthenticator2Test, LoginDenied) {
   std::string data("Error: NO!");
   URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
 
-  GaiaAuthConsumer::ClientLoginError expected_error;
+  GaiaAuthConsumer::GaiaAuthError expected_error;
   expected_error.code = GaiaAuthConsumer::PERMISSION_DENIED;
 
   MockGaiaConsumer consumer;
@@ -112,7 +147,12 @@ TEST_F(GaiaAuthenticator2Test, LoginDenied) {
 
   GaiaAuthenticator2 auth(&consumer, std::string(),
       profile_.GetRequestContext());
-  auth.OnURLFetchComplete(NULL, source_, status, RC_FORBIDDEN, cookies_, data);
+  auth.OnURLFetchComplete(NULL,
+                          client_login_source_,
+                          status,
+                          RC_FORBIDDEN,
+                          cookies_,
+                          data);
 }
 
 TEST_F(GaiaAuthenticator2Test, ParseRequest) {
@@ -142,13 +182,29 @@ TEST_F(GaiaAuthenticator2Test, OnlineLogin) {
       profile_.GetRequestContext());
   URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
   auth.OnURLFetchComplete(NULL,
-                          source_,
+                          client_login_source_,
                           status,
                           RC_REQUEST_OK,
                           cookies_,
                           data);
 }
 
+TEST_F(GaiaAuthenticator2Test, WorkingIssueAuthToken) {
+  MockGaiaConsumer consumer;
+  EXPECT_CALL(consumer, OnIssueAuthTokenSuccess(_, "token"))
+      .Times(1);
+
+  GaiaAuthenticator2 auth(&consumer, std::string(),
+      profile_.GetRequestContext());
+  URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
+  auth.OnURLFetchComplete(NULL,
+                          issue_auth_token_source_,
+                          status,
+                          RC_REQUEST_OK,
+                          cookies_,
+                          "token");
+}
+
 TEST_F(GaiaAuthenticator2Test, CheckTwoFactorResponse) {
   std::string response =
       StringPrintf("Error=BadAuthentication\n%s\n",
@@ -166,7 +222,7 @@ TEST_F(GaiaAuthenticator2Test, TwoFactorLogin) {
       StringPrintf("Error=BadAuthentication\n%s\n",
                    GaiaAuthenticator2::kSecondFactor);
 
-  GaiaAuthConsumer::ClientLoginError error;
+  GaiaAuthConsumer::GaiaAuthError error;
   error.code = GaiaAuthConsumer::TWO_FACTOR;
 
   MockGaiaConsumer consumer;
@@ -177,7 +233,7 @@ TEST_F(GaiaAuthenticator2Test, TwoFactorLogin) {
       profile_.GetRequestContext());
   URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
   auth.OnURLFetchComplete(NULL,
-                          source_,
+                          client_login_source_,
                           status,
                           RC_FORBIDDEN,
                           cookies_,
@@ -227,7 +283,7 @@ TEST_F(GaiaAuthenticator2Test, FullLoginFailure) {
   URLFetcher::set_factory(NULL);
 }
 
-TEST_F(GaiaAuthenticator2Test, FetchPending) {
+TEST_F(GaiaAuthenticator2Test, ClientFetchPending) {
   MockGaiaConsumer consumer;
   EXPECT_CALL(consumer, OnClientLoginSuccess(_))
       .Times(1);
@@ -247,12 +303,58 @@ TEST_F(GaiaAuthenticator2Test, FetchPending) {
   URLFetcher::set_factory(NULL);
   EXPECT_TRUE(auth.HasPendingFetch());
   auth.OnURLFetchComplete(NULL,
-                          source_,
+                          client_login_source_,
                           URLRequestStatus(URLRequestStatus::SUCCESS, 0),
                           RC_REQUEST_OK,
                           cookies_,
-                          std::string());
+                          "SID=sid\nLSID=lsid\nAuth=auth\n");
+  EXPECT_FALSE(auth.HasPendingFetch());
+}
+
+TEST_F(GaiaAuthenticator2Test, FullTokenSuccess) {
+  MockGaiaConsumer consumer;
+  EXPECT_CALL(consumer, OnIssueAuthTokenSuccess("service", "token"))
+      .Times(1);
+
+  TestingProfile profile;
+  TestURLFetcherFactory factory;
+  URLFetcher::set_factory(&factory);
+
+  GaiaAuthenticator2 auth(&consumer, std::string(),
+      profile_.GetRequestContext());
+  auth.StartIssueAuthToken("sid", "lsid", "service");
+
+  URLFetcher::set_factory(NULL);
+  EXPECT_TRUE(auth.HasPendingFetch());
+  auth.OnURLFetchComplete(NULL,
+                          issue_auth_token_source_,
+                          URLRequestStatus(URLRequestStatus::SUCCESS, 0),
+                          RC_REQUEST_OK,
+                          cookies_,
+                          "token");
   EXPECT_FALSE(auth.HasPendingFetch());
 }
 
+TEST_F(GaiaAuthenticator2Test, FullTokenFailure) {
+  MockGaiaConsumer consumer;
+  EXPECT_CALL(consumer, OnIssueAuthTokenFailure("service", _))
+      .Times(1);
+
+  TestingProfile profile;
+  TestURLFetcherFactory factory;
+  URLFetcher::set_factory(&factory);
 
+  GaiaAuthenticator2 auth(&consumer, std::string(),
+      profile_.GetRequestContext());
+  auth.StartIssueAuthToken("sid", "lsid", "service");
+
+  URLFetcher::set_factory(NULL);
+  EXPECT_TRUE(auth.HasPendingFetch());
+  auth.OnURLFetchComplete(NULL,
+                          issue_auth_token_source_,
+                          URLRequestStatus(URLRequestStatus::SUCCESS, 0),
+                          RC_FORBIDDEN,
+                          cookies_,
+                          "");
+  EXPECT_FALSE(auth.HasPendingFetch());
+}
diff --git a/chrome/common/net/gaia/gaia_authenticator2_unittest.h b/chrome/common/net/gaia/gaia_authenticator2_unittest.h
index 6a2cf78..d392ee8 100644
--- a/chrome/common/net/gaia/gaia_authenticator2_unittest.h
+++ b/chrome/common/net/gaia/gaia_authenticator2_unittest.h
@@ -14,17 +14,17 @@
 #include "net/url_request/url_request_status.h"
 
 // Responds as though ClientLogin returned from the server.
-class MockClientLoginFetcher : public URLFetcher {
+class MockFetcher : public URLFetcher {
  public:
-  MockClientLoginFetcher(bool success,
-                         const GURL& url,
-                         URLFetcher::RequestType request_type,
-                         URLFetcher::Delegate* d)
+  MockFetcher(bool success,
+              const GURL& url,
+              URLFetcher::RequestType request_type,
+              URLFetcher::Delegate* d)
       : URLFetcher(url, request_type, d),
-        success_(success) {}
-  ~MockClientLoginFetcher() {}
+        success_(success),
+        url_(url) {}
+  ~MockFetcher() {}
   void Start() {
-    GURL source(GaiaAuthenticator2::kClientLoginUrl);
     URLRequestStatus::Status code;
     int http_code;
     if (success_) {
@@ -37,7 +37,7 @@ class MockClientLoginFetcher : public URLFetcher {
 
     URLRequestStatus status(code, 0);
     delegate()->OnURLFetchComplete(NULL,
-                                   source,
+                                   url_,
                                    status,
                                    http_code,
                                    ResponseCookies(),
@@ -45,7 +45,8 @@ class MockClientLoginFetcher : public URLFetcher {
   }
  private:
   bool success_;
-  DISALLOW_COPY_AND_ASSIGN(MockClientLoginFetcher);
+  GURL url_;
+  DISALLOW_COPY_AND_ASSIGN(MockFetcher);
 };
 
 class MockFactory : public URLFetcher::Factory {
@@ -57,7 +58,7 @@ class MockFactory : public URLFetcher::Factory {
                                const GURL& url,
                                URLFetcher::RequestType request_type,
                                URLFetcher::Delegate* d) {
-    return new MockClientLoginFetcher(success_, url, request_type, d);
+    return new MockFetcher(success_, url, request_type, d);
   }
   void set_success(bool success) {
     success_ = success;