Completed
Push — master ( cfe17f...b2cc83 )
by Sam
02:44
created

CorsServiceTest::testHandleRequest()   A

Complexity

Conditions 1
Paths 1

Size

Total Lines 76
Code Lines 42

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 1
eloc 42
nc 1
nop 0
dl 0
loc 76
rs 9.248
c 0
b 0
f 0

How to fix   Long Method   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
2
3
namespace Nord\Lumen\Cors\Tests;
4
5
use Closure;
6
use Nord\Lumen\Cors\CorsService;
7
use Symfony\Component\HttpFoundation\Request;
8
use Symfony\Component\HttpFoundation\Response;
9
10
class CorsServiceTest extends \Codeception\Test\Unit
11
{
12
    use \Codeception\Specify;
13
14
    /**
15
     * @var \UnitTester
16
     */
17
    protected $tester;
18
19
    /**
20
     * @var CorsService
21
     */
22
    protected $service;
23
24
    /**
25
     * @var Request
26
     */
27
    protected $request;
28
29
    /**
30
     * @var Response
31
     */
32
    protected $response;
33
34
    /**
35
     * @var Closure
36
     */
37
    protected $closure;
38
39
    public function testServiceConfig()
40
    {
41
        $this->specify('service config max_age is less than zero', function () {
42
            new CorsService(['max_age' => -1]);
43
        }, ['throws' => 'InvalidArgumentException']);
44
    }
45
46
    public function testHandlePreflightRequest()
47
    {
48
        $this->service = new CorsService;
49
50
        $this->request = new Request;
51
52
        $this->specify('403 response if origin is not allowed', function () {
53
            $this->request->headers->set('Origin', 'http://foo.com');
54
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
55
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
56
57
            $response = $this->service->handlePreflightRequest($this->request);
58
59
            verify($response->getStatusCode())->equals(403);
60
        });
61
62
        $this->service = new CorsService([
63
            'allow_origins' => ['http://foo.com'],
64
        ]);
65
66
        $this->request = new Request;
67
68
        $this->specify('405 response if method is not allowed', function () {
69
            $this->request->headers->set('Origin', 'http://foo.com');
70
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
71
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
72
73
            $response = $this->service->handlePreflightRequest($this->request);
74
75
            verify($response->getStatusCode())->equals(405);
76
        });
77
78
        $this->service = new CorsService([
79
            'allow_origins' => ['http://foo.com'],
80
            'allow_methods' => ['post'],
81
        ]);
82
83
        $this->request = new Request;
84
85
        $this->specify('403 response if header is not allowed', function () {
86
            $this->request->headers->set('Origin', 'http://foo.com');
87
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
88
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
89
90
            $response = $this->service->handlePreflightRequest($this->request);
0 ignored issues
show
Unused Code introduced by
The assignment to $response is dead and can be removed.
Loading history...
91
        });
92
93
        $this->service = new CorsService([
94
            'allow_origins' => ['http://foo.com'],
95
            'allow_methods' => ['post'],
96
            'allow_headers' => ['accept', 'authorization', 'content-type'],
97
        ]);
98
99
        $this->request = new Request;
100
101
        $this->specify('200 response when origin, method and headers are allowed', function () {
102
            $this->request->headers->set('Origin', 'http://foo.com');
103
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
104
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
105
106
            $response = $this->service->handlePreflightRequest($this->request);
107
108
            verify($response->getStatusCode())->equals(200);
109
        });
110
111
        $this->service = new CorsService([
112
            'allow_origins' => ['*'],
113
        ]);
114
115
        $this->request = new Request;
116
117
        $this->specify('403 response when origin is not set', function () {
118
            $response = $this->service->handlePreflightRequest($this->request);
119
            
120
            verify($response->getStatusCode())->equals(403);
121
        });
122
123
        $this->service = new CorsService([
124
            'allow_origins' => ['*'],
125
            'allow_headers' => ['accept'],
126
        ]);
127
128
        $this->request = new Request;
129
130
        $this->specify('403 response exception when header is not set', function () {
131
            $this->request->headers->set('Origin', 'http://foo.com');
132
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, ');
133
134
            $response = $this->service->handlePreflightRequest($this->request);
135
136
            verify($response->getStatusCode())->equals(403);
137
        });
138
139
        $this->service = new CorsService([
140
            'allow_origins' => ['http://foo.com'],
141
            'allow_methods' => ['post'],
142
            'allow_headers' => ['accept', 'authorization', 'content-type'],
143
        ]);
144
145
        $this->request = new Request;
146
147
        $this->specify('response headers are set', function () {
148
            $this->request->headers->set('Origin', 'http://foo.com');
149
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
150
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
151
152
            $response = $this->service->handlePreflightRequest($this->request);
153
154
            verify($response->headers->get('Access-Control-Allow-Origin'))->equals('http://foo.com');
155
            verify($response->headers->get('Access-Control-Allow-Methods'))->equals('POST');
156
            verify($response->headers->get('Access-Control-Allow-Headers'))->equals('accept, authorization, content-type');
157
            verify($response->headers->has('Access-Control-Allow-Credentials'))->false();
158
            verify($response->headers->has('Access-Control-Max-Age'))->false();
159
        });
160
161
        $this->service = new CorsService([
162
            'allow_origins' => ['http://foo.com'],
163
            'allow_methods' => ['post'],
164
            'allow_headers' => ['accept', 'authorization', 'content-type'],
165
        ]);
166
167
        $this->request = new Request;
168
169
        $this->specify('regression test for issue #31', function () {
170
            $this->request->headers->set('Origin', 'http://foo.com');
171
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
172
            $this->request->headers->set('Access-Control-Request-Headers', 'accept,authorization, content-type');
173
174
            $response = $this->service->handlePreflightRequest($this->request);
175
176
            verify($response->headers->get('Access-Control-Allow-Origin'))->equals('http://foo.com');
177
            verify($response->headers->get('Access-Control-Allow-Methods'))->equals('POST');
178
            verify($response->headers->get('Access-Control-Allow-Headers'))->equals('accept, authorization, content-type');
179
            verify($response->headers->has('Access-Control-Allow-Credentials'))->false();
180
            verify($response->headers->has('Access-Control-Max-Age'))->false();
181
        });
182
183
        $this->service = new CorsService([
184
            'allow_origins'     => ['*'],
185
            'allow_methods'     => ['*'],
186
            'allow_headers'     => ['*'],
187
            'allow_credentials' => true,
188
        ]);
189
190
        $this->request = new Request;
191
192
        $this->specify('response credentials header is set', function () {
193
            $this->request->headers->set('Origin', 'http://foo.com');
194
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
195
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
196
197
            $response = $this->service->handlePreflightRequest($this->request);
198
199
            verify($response->headers->get('Access-Control-Allow-Credentials'))->equals('true');
200
        });
201
202
        $this->service = new CorsService([
203
            'allow_origins' => ['*'],
204
            'allow_methods' => ['*'],
205
            'allow_headers' => ['*'],
206
            'max_age'       => 3600,
207
        ]);
208
209
        $this->request = new Request;
210
211
        $this->specify('response max-age header is set', function () {
212
            $this->request->headers->set('Origin', 'http://foo.com');
213
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
214
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization, content-type');
215
216
            $response = $this->service->handlePreflightRequest($this->request);
217
218
            verify($response->headers->get('Access-Control-Max-Age'))->equals(3600);
219
        });
220
221
        $this->service = new CorsService([
222
            'allow_origins'      => ['http://foo.com'],
223
            'origin_not_allowed' => function () {
224
                return new Response('INVALID ORIGIN', 403);
225
            },
226
        ]);
227
228
        $this->request = new Request;
229
230
        $this->specify('response origin_not_allowed header is set', function () {
231
            $this->request->headers->set('Origin', 'http://bar.com');
232
233
            $response = $this->service->handlePreflightRequest($this->request);
234
235
            verify($response->getStatusCode())->equals(403);
236
            verify($response->getContent())->equals('INVALID ORIGIN');
237
        });
238
239
        $this->service = new CorsService([
240
            'allow_origins'      => ['*'],
241
            'allow_methods'      => ['GET'],
242
            'method_not_allowed' => function () {
243
                return new Response('INVALID METHOD', 403);
244
            },
245
        ]);
246
247
        $this->request = new Request;
248
249
        $this->specify('response method_not_allowed header is set', function () {
250
            $this->request->headers->set('Origin', 'http://foo.com');
251
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
252
253
            $response = $this->service->handlePreflightRequest($this->request);
254
255
            verify($response->getStatusCode())->equals(403);
256
            verify($response->getContent())->equals('INVALID METHOD');
257
        });
258
259
        $this->service = new CorsService([
260
            'allow_origins'      => ['*'],
261
            'allow_headers'      => ['accept'],
262
            'header_not_allowed' => function () {
263
                return new Response('INVALID HEADER', 403);
264
            },
265
        ]);
266
267
        $this->request = new Request;
268
269
        $this->specify('response header_not_allowed header is set', function () {
270
            $this->request->headers->set('Origin', 'http://foo.com');
271
            $this->request->headers->set('Access-Control-Request-Headers', 'accept, authorization');
272
273
            $response = $this->service->handlePreflightRequest($this->request);
274
275
            verify($response->getStatusCode())->equals(403);
276
            verify($response->getContent())->equals('INVALID HEADER');
277
        });
278
    }
279
280
    public function testHandleRequest()
281
    {
282
        $this->request = new Request;
283
284
        $this->response = new Response;
285
286
        $this->closure = function () {
287
            return new Response;
288
        };
289
290
        $this->service = new CorsService([
291
            'allow_origins' => ['*'],
292
        ]);
293
294
        $this->specify('response origin header is set', function () {
295
            $this->request->headers->set('Origin', 'http://foo.com');
296
297
            $response = $this->service->handleRequest($this->request, $this->closure);
298
299
            verify($response->headers->get('Access-Control-Allow-Origin'))->equals('http://foo.com');
300
        });
301
302
        $this->service = new CorsService([
303
            'allow_origins' => ['*'],
304
        ]);
305
306
        $this->specify('response vary header is set', function () {
307
            $this->request->headers->set('Origin', 'http://foo.com');
308
            $this->request->headers->set('Vary', 'Accept-Encoding');
309
310
            $response = $this->service->handleRequest($this->request, $this->closure);
311
312
            verify($response->headers->get('Vary'))->equals('Accept-Encoding, Origin');
313
        });
314
315
        $this->service = new CorsService([
316
            'allow_origins'     => ['*'],
317
            'allow_methods'     => ['*'],
318
            'allow_headers'     => ['*'],
319
            'allow_credentials' => true,
320
        ]);
321
322
        $this->specify('response credentials header is set', function () {
323
            $this->request->headers->set('Origin', 'http://foo.com');
324
325
            $response = $this->service->handleRequest($this->request, $this->closure);
326
327
            verify($response->headers->get('Access-Control-Allow-Credentials'))->equals('true');
328
        });
329
330
        $this->service = new CorsService([
331
            'allow_origins'  => ['*'],
332
            'allow_methods'  => ['*'],
333
            'allow_headers'  => ['*'],
334
            'expose_headers' => ['Accept', 'Authorization', 'Content-Type'],
335
        ]);
336
337
        $this->specify('response expose headers header is set', function () {
338
            $this->request->headers->set('Origin', 'http://foo.com');
339
340
            $response = $this->service->handleRequest($this->request, $this->closure);
341
342
            verify($response->headers->get('Access-Control-Expose-Headers'))->equals('accept, authorization, content-type');
343
        });
344
345
        $this->service = new CorsService([
346
            'allow_origins' => ['http://foo.com'],
347
        ]);
348
349
        $this->specify('response origin header is not set when origin is not allowed', function () {
350
            $this->request->headers->set('Origin', 'http://bar.com');
351
352
            $response = $this->service->handleRequest($this->request, $this->closure);
353
354
            verify($response->getStatusCode())->equals(200);
355
            verify($response->headers->get('Access-Control-Allow-Origin'))->equals(null);
356
        });
357
    }
358
359
    public function testIsCorsRequest()
360
    {
361
        $this->service = new CorsService;
362
363
        $this->request = new Request;
364
365
        $this->specify('cors request is recognized', function () {
366
            verify($this->service->isCorsRequest($this->request))->false();
367
368
            $this->request->headers->set('Origin', 'http://foo.com');
369
370
            verify($this->service->isCorsRequest($this->request))->true();
371
        });
372
    }
373
374
    public function testIsPreflightRequest()
375
    {
376
        $this->service = new CorsService;
377
378
        $this->request = new Request;
379
380
        $this->specify('preflight request is recognized', function () {
381
            verify($this->service->isPreflightRequest($this->request))->false();
382
383
            $this->request->setMethod('OPTIONS');
384
385
            verify($this->service->isPreflightRequest($this->request))->false();
386
387
            $this->request->headers->set('Access-Control-Request-Method', 'POST');
388
389
            verify($this->service->isPreflightRequest($this->request))->false();
390
391
            $this->request->headers->set('Origin', 'http://foo.com');
392
393
            verify($this->service->isPreflightRequest($this->request))->true();
394
        });
395
    }
396
}
397