1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
declare(strict_types=1); |
4
|
|
|
|
5
|
|
|
/* |
6
|
|
|
* The MIT License (MIT) |
7
|
|
|
* |
8
|
|
|
* Copyright (c) 2014-2018 Spomky-Labs |
9
|
|
|
* |
10
|
|
|
* This software may be modified and distributed under the terms |
11
|
|
|
* of the MIT license. See the LICENSE file for details. |
12
|
|
|
*/ |
13
|
|
|
|
14
|
|
|
namespace OAuth2Framework\Component\Server\ClientRegistrationEndpoint\Tests; |
15
|
|
|
|
16
|
|
|
use Interop\Http\Server\RequestHandlerInterface; |
17
|
|
|
use OAuth2Framework\Component\Server\BearerTokenType\BearerToken; |
18
|
|
|
use OAuth2Framework\Component\Server\ClientRegistrationEndpoint\InitialAccessToken; |
19
|
|
|
use OAuth2Framework\Component\Server\ClientRegistrationEndpoint\InitialAccessTokenId; |
20
|
|
|
use OAuth2Framework\Component\Server\ClientRegistrationEndpoint\InitialAccessTokenMiddleware; |
21
|
|
|
use OAuth2Framework\Component\Server\ClientRegistrationEndpoint\InitialAccessTokenRepository; |
22
|
|
|
use OAuth2Framework\Component\Server\Core\Response\OAuth2Exception; |
23
|
|
|
use OAuth2Framework\Component\Server\Core\UserAccount\UserAccountId; |
24
|
|
|
use PHPUnit\Framework\TestCase; |
25
|
|
|
use Prophecy\Argument; |
26
|
|
|
use Psr\Http\Message\ResponseInterface; |
27
|
|
|
use Psr\Http\Message\ServerRequestInterface; |
28
|
|
|
|
29
|
|
|
/** |
30
|
|
|
* @group InitialAccessTokenMiddleware |
31
|
|
|
*/ |
32
|
|
|
final class InitialAccessTokenMiddlewareTest extends TestCase |
33
|
|
|
{ |
34
|
|
|
/** |
35
|
|
|
* @test |
36
|
|
|
*/ |
37
|
|
|
public function theInitialAccessTokenIsMissing() |
38
|
|
|
{ |
39
|
|
|
$request = $this->prophesize(ServerRequestInterface::class); |
40
|
|
|
$request->getHeader('AUTHORIZATION')->willReturn([])->shouldBeCalled(); |
41
|
|
|
$handler = $this->prophesize(RequestHandlerInterface::class); |
42
|
|
|
|
43
|
|
|
try { |
44
|
|
|
$this->getMiddleware()->process($request->reveal(), $handler->reveal()); |
45
|
|
|
} catch (OAuth2Exception $e) { |
46
|
|
|
self::assertEquals(400, $e->getCode()); |
47
|
|
|
self::assertEquals([ |
48
|
|
|
'error' => 'invalid_request', |
49
|
|
|
'error_description' => 'Initial Access Token is missing or invalid.', |
50
|
|
|
], $e->getData()); |
51
|
|
|
} |
52
|
|
|
} |
53
|
|
|
|
54
|
|
|
/** |
55
|
|
|
* @test |
56
|
|
|
*/ |
57
|
|
|
public function theInitialAccessTokenIsNotKnown() |
58
|
|
|
{ |
59
|
|
|
$request = $this->prophesize(ServerRequestInterface::class); |
60
|
|
|
$request->getHeader('AUTHORIZATION')->willReturn([ |
61
|
|
|
'Bearer BAD_INITIAL_ACCESS_TOKEN_ID' |
62
|
|
|
])->shouldBeCalled(); |
63
|
|
|
$handler = $this->prophesize(RequestHandlerInterface::class); |
64
|
|
|
|
65
|
|
|
try { |
66
|
|
|
$this->getMiddleware()->process($request->reveal(), $handler->reveal()); |
67
|
|
|
} catch (OAuth2Exception $e) { |
68
|
|
|
self::assertEquals(400, $e->getCode()); |
69
|
|
|
self::assertEquals([ |
70
|
|
|
'error' => 'invalid_request', |
71
|
|
|
'error_description' => 'Initial Access Token is missing or invalid.', |
72
|
|
|
], $e->getData()); |
73
|
|
|
} |
74
|
|
|
} |
75
|
|
|
|
76
|
|
|
/** |
77
|
|
|
* @test |
78
|
|
|
*/ |
79
|
|
|
public function theInitialAccessTokenIsRevoked() |
80
|
|
|
{ |
81
|
|
|
$request = $this->prophesize(ServerRequestInterface::class); |
82
|
|
|
$request->getHeader('AUTHORIZATION')->willReturn([ |
83
|
|
|
'Bearer REVOKED_INITIAL_ACCESS_TOKEN_ID' |
84
|
|
|
])->shouldBeCalled(); |
85
|
|
|
$handler = $this->prophesize(RequestHandlerInterface::class); |
86
|
|
|
|
87
|
|
|
try { |
88
|
|
|
$this->getMiddleware()->process($request->reveal(), $handler->reveal()); |
89
|
|
|
} catch (OAuth2Exception $e) { |
90
|
|
|
self::assertEquals(400, $e->getCode()); |
91
|
|
|
self::assertEquals([ |
92
|
|
|
'error' => 'invalid_request', |
93
|
|
|
'error_description' => 'Initial Access Token is missing or invalid.', |
94
|
|
|
], $e->getData()); |
95
|
|
|
} |
96
|
|
|
} |
97
|
|
|
|
98
|
|
|
/** |
99
|
|
|
* @test |
100
|
|
|
*/ |
101
|
|
|
public function theInitialAccessTokenExpired() |
102
|
|
|
{ |
103
|
|
|
$request = $this->prophesize(ServerRequestInterface::class); |
104
|
|
|
$request->getHeader('AUTHORIZATION')->willReturn([ |
105
|
|
|
'Bearer EXPIRED_INITIAL_ACCESS_TOKEN_ID' |
106
|
|
|
])->shouldBeCalled(); |
107
|
|
|
$handler = $this->prophesize(RequestHandlerInterface::class); |
108
|
|
|
|
109
|
|
|
try { |
110
|
|
|
$this->getMiddleware()->process($request->reveal(), $handler->reveal()); |
111
|
|
|
} catch (OAuth2Exception $e) { |
112
|
|
|
self::assertEquals(400, $e->getCode()); |
113
|
|
|
self::assertEquals([ |
114
|
|
|
'error' => 'invalid_request', |
115
|
|
|
'error_description' => 'Initial Access Token expired.', |
116
|
|
|
], $e->getData()); |
117
|
|
|
} |
118
|
|
|
} |
119
|
|
|
|
120
|
|
|
/** |
121
|
|
|
* @test |
122
|
|
|
*/ |
123
|
|
|
public function theInitialAccessTokenIsValidAndAssociatedToTheRequest() |
124
|
|
|
{ |
125
|
|
|
$request = $this->prophesize(ServerRequestInterface::class); |
126
|
|
|
$response = $this->prophesize(ResponseInterface::class); |
127
|
|
|
$request->getHeader('AUTHORIZATION')->willReturn([ |
128
|
|
|
'Bearer INITIAL_ACCESS_TOKEN_ID' |
129
|
|
|
])->shouldBeCalled(); |
130
|
|
|
$request->withAttribute('initial_access_token', Argument::type(InitialAccessToken::class))->willReturn($request)->shouldBeCalled(); |
131
|
|
|
$handler = $this->prophesize(RequestHandlerInterface::class); |
132
|
|
|
$handler->handle(Argument::type(ServerRequestInterface::class))->willReturn($response->reveal())->shouldBeCalled(); |
133
|
|
|
|
134
|
|
|
$this->getMiddleware()->process($request->reveal(), $handler->reveal()); |
135
|
|
|
} |
136
|
|
|
|
137
|
|
|
/** |
138
|
|
|
* @var null|InitialAccessTokenMiddleware |
139
|
|
|
*/ |
140
|
|
|
private $middleware = null; |
141
|
|
|
|
142
|
|
|
/** |
143
|
|
|
* @return InitialAccessTokenMiddleware |
144
|
|
|
*/ |
145
|
|
|
private function getMiddleware(): InitialAccessTokenMiddleware |
146
|
|
|
{ |
147
|
|
|
if (null === $this->middleware) { |
148
|
|
|
$this->middleware = new InitialAccessTokenMiddleware( |
149
|
|
|
new BearerToken('Realm', true, false, false), |
150
|
|
|
$this->getRepository() |
151
|
|
|
); |
152
|
|
|
} |
153
|
|
|
|
154
|
|
|
return $this->middleware; |
155
|
|
|
} |
156
|
|
|
/** |
157
|
|
|
* @var null|InitialAccessTokenRepository |
158
|
|
|
*/ |
159
|
|
|
private $repository = null; |
160
|
|
|
|
161
|
|
|
/** |
162
|
|
|
* @return InitialAccessTokenRepository |
163
|
|
|
*/ |
164
|
|
|
private function getRepository(): InitialAccessTokenRepository |
165
|
|
|
{ |
166
|
|
|
if (null === $this->repository) { |
167
|
|
|
$repository = $this->prophesize(InitialAccessTokenRepository::class); |
168
|
|
|
$repository->find(Argument::type(InitialAccessTokenId::class))->will(function ($args){ |
169
|
|
|
switch($args[0]->getValue()) { |
170
|
|
|
case 'INITIAL_ACCESS_TOKEN_ID': |
171
|
|
|
$initialAccessToken = InitialAccessToken::createEmpty(); |
172
|
|
|
$initialAccessToken = $initialAccessToken->create( |
173
|
|
|
$args[0], |
174
|
|
|
UserAccountId::create('USER_ACCOUNT_ID'), |
175
|
|
|
new \DateTimeImmutable('now +1 day') |
176
|
|
|
); |
177
|
|
|
$initialAccessToken->eraseMessages(); |
178
|
|
|
|
179
|
|
|
return $initialAccessToken; |
180
|
|
|
case 'REVOKED_INITIAL_ACCESS_TOKEN_ID': |
181
|
|
|
$initialAccessToken = InitialAccessToken::createEmpty(); |
182
|
|
|
$initialAccessToken = $initialAccessToken->create( |
183
|
|
|
$args[0], |
184
|
|
|
UserAccountId::create('USER_ACCOUNT_ID'), |
185
|
|
|
new \DateTimeImmutable('now +1 day') |
186
|
|
|
); |
187
|
|
|
$initialAccessToken = $initialAccessToken->markAsRevoked(); |
188
|
|
|
$initialAccessToken->eraseMessages(); |
189
|
|
|
|
190
|
|
|
return $initialAccessToken; |
191
|
|
|
case 'EXPIRED_INITIAL_ACCESS_TOKEN_ID': |
192
|
|
|
$initialAccessToken = InitialAccessToken::createEmpty(); |
193
|
|
|
$initialAccessToken = $initialAccessToken->create( |
194
|
|
|
$args[0], |
195
|
|
|
UserAccountId::create('USER_ACCOUNT_ID'), |
196
|
|
|
new \DateTimeImmutable('now -1 day') |
197
|
|
|
); |
198
|
|
|
$initialAccessToken->eraseMessages(); |
199
|
|
|
|
200
|
|
|
return $initialAccessToken; |
201
|
|
|
case 'BAD_INITIAL_ACCESS_TOKEN_ID': |
202
|
|
|
default: |
203
|
|
|
return null; |
204
|
|
|
} |
205
|
|
|
}); |
206
|
|
|
|
207
|
|
|
$this->repository = $repository->reveal(); |
208
|
|
|
} |
209
|
|
|
|
210
|
|
|
return $this->repository; |
211
|
|
|
} |
212
|
|
|
} |
213
|
|
|
|