Firesphere\HaveIBeenPwned\Tests\LoginHandlerTest::testDoLogin()

Complexity

Conditions	3
Paths	2

Size

Total Lines	82
Code Lines	48

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    public function testDoLogin()
    {
        $body = file_get_contents(__DIR__ . '/../fixtures/pwnd123.txt');
        // This sets up the mock client to respond to the request it gets
        // with an HTTP 200 containing your mock body.
        $mock = new MockHandler([
            new Response(200, [], $body),
            new Response(200, [], $body),
            new Response(200, [], $body),
            new Response(200, [], $body),
            new Response(200, [], $body),
        ]);

        $this->handler->getService()->setArgs(['handler' => $mock]);

        $form = MemberLoginForm::create(Controller::curr(), get_class($this->authenticator), 'LoginForm');
        /** @var HTTPRequest $request */
        $request = Injector::inst()->createWithArgs(HTTPRequest::class, ['GET', '/login']);
        $request->setSession(Injector::inst()->createWithArgs(Session::class, [['bla' => 'bla']]));
        $this->handler->setRequest($request);

        // Login allowed
        $response = $this->handler->doLogin(['Email' => 'test@test.com', 'Password' => '1234567890'], $form, $request);

        $this->assertEquals(302, $response->getStatusCode());
        $this->assertNotContains('lostpassword', $response->getHeader('location'));

        Config::modify()->set(HaveIBeenPwnedService::class, 'allow_pwnd', false);

        // Login with breached is not allowed
        $response = $this->handler->doLogin(['Email' => 'test@test.com', 'Password' => '1234567890'], $form, $request);

        $this->assertEquals(302, $response->getStatusCode());
        $this->assertContains('lostpassword', $response->getHeader('location'));
        /** @var Member $member */
        $member = Member::get()->byID($this->memberId);

        // Password should be properly expired
        $this->assertEquals('1970-01-01', $member->PasswordExpiry);
        // The password is now null, but can't be tested due to salting
        Injector::inst()->get(IdentityStore::class)->logOut();

        // Login with non-breached password
        $response = $this->handler->doLogin(['Email' => 'test@test.com', 'Password' => '12345678'], $form, $request);

        $this->assertEquals(302, $response->getStatusCode());
        $this->assertNotContains('lostpassword', $response->getHeader('location'));
        Injector::inst()->get(IdentityStore::class)->logOut();

        // Login with non-existing member
        $response = $this->handler->doLogin(
            ['Email' => 'do-not-exist@test.com', 'Password' => '1234567890'],
            $form,
            $request
        );

        $this->assertEquals(302, $response->getStatusCode());
        $this->assertContains('lostpassword', $response->getHeader('location'));

        $passwordForm = LostPasswordForm::create($this->handler, Authenticator::class, 'lostPasswordForm');

        $this->assertContains('You can read more here', $passwordForm->getMessage());

        // Default Admin is always allowed
        $admin = Environment::getEnv('SS_DEFAULT_ADMIN_USERNAME');

        $password = Environment::getEnv('SS_DEFAULT_ADMIN_PASSWORD');
        $this->assertEquals(302, $response->getStatusCode());

        $this->assertNotContains('lostpassword', $response->getHeader('location'));
        //don't run the test if default admin or password are missing
        $member = Security::getCurrentUser();
        if (!$admin || !$password) {
            $this->assertTrue(DefaultAdminService::isDefaultAdmin($member->Email));
            $this->markTestSkipped();
        } else {
            $response = $this->handler->doLogin(['Email' => $admin, 'Password' => $password], $form, $request);

            $this->assertEquals(302, $response->getStatusCode());
            $this->assertNotContains('lostpassword', $response->getHeader('location'));
            $member = Security::getCurrentUser();
            $this->assertTrue(DefaultAdminService::isDefaultAdmin($member->Email));
        }