Limoncello\Tests\Auth\Authorization\PolicyEnforcement\PolicyEnforcementTest

Complexity

Total Complexity

25

Size/Duplication

Total Lines	477
Duplicated Lines	38.57 %

Coupling/Cohesion

Components	1
Dependencies	15

Importance

Changes

0

<?php namespace Limoncello\Tests\Auth\Authorization\PolicyEnforcement;
class PolicyEnforcementTest extends TestCase
{
    /**
     * @var bool
     */
    public static $obligationCalled = false;

    /**
     * @var bool
     */
    public static $adviceCalled = false;

    /**
     * @var resource
     */
    private $logStream;

    /**
     * @var LoggerInterface
     */
    private $logger;

    /**
     * @var int|null
     */
    private $currentUserId;

    /**
     * @var string|null
     */
    private $currentUserRole;

    /**
     * @var bool
     */
    private $isWorkTime;

    /**
     * Test authorization of operation without any additional parameters (e.g. 'send message').
     */
    public function testAuthorizeOperationSuccess()
    {
        // set up environment variables (current user is not signed in and currently is work time)
        $this->currentUserId   = null;
        $this->currentUserRole = null;
        $this->isWorkTime      = true;
        $policyEnforcement     = $this->createPolicyEnforcementPoint();

        // send authorization request
        $authRequest = new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]);
        $this->assertTrue($policyEnforcement->authorize($authRequest));
    }

    /**
     * @return LoggerInterface
     */
    protected function getLogger()
    {
        return $this->logger;
    }

    /**
     * Test authorization of operation without any additional parameters (e.g. 'send message').
     */
    public function testAuthorizeOperationFail()
    {
        // set up environment variables (current user is not signed in and currently is not work time)
        $this->currentUserId   = null;
        $this->currentUserRole = null;
        $this->isWorkTime      = false;
        $policyEnforcement     = $this->createPolicyEnforcementPoint();

        // send authorization request
        $authRequest = new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]);
        $this->assertFalse($policyEnforcement->authorize($authRequest));
    }

    /**
     * Test authorization of operation on resource type (e.g. 'create comment').
     */
    public function testAuthorizeOperationOnResourceTypeSuccess()
    {
        // set up environment variables (current user is signed as member)
        $this->currentUserRole = 'member';
        $this->currentUserId   = 123;
        $policyEnforcement     = $this->createPolicyEnforcementPoint();

        // send authorization request
        $authRequest = new Request([
            RequestProperties::PARAM_OPERATION     => Comments::OPERATION_CREATE,
            RequestProperties::PARAM_RESOURCE_TYPE => Comments::RESOURCE_TYPE,
        ]);
        $this->assertTrue($policyEnforcement->authorize($authRequest));
        $this->assertTrue(static::$obligationCalled);
        $this->assertTrue(static::$adviceCalled);
    }

    /**
     * Test authorization of operation on resource type (e.g. 'create comment').
     */
    public function testAuthorizeOperationOnResourceTypeFail()
    {
        // set up environment variables (current user is not signed in)
        // check that non signed in user cannot create comments
        $this->currentUserRole = null;
        $this->currentUserId   = null;
        $policyEnforcement     = $this->createPolicyEnforcementPoint();

        // send authorization request
        $authRequest = new Request([
            RequestProperties::PARAM_OPERATION     => Comments::OPERATION_CREATE,
            RequestProperties::PARAM_RESOURCE_TYPE => Comments::RESOURCE_TYPE,
        ]);
        $this->assertFalse($policyEnforcement->authorize($authRequest));
    }

    /**
     * Test authorization of operation on specific resource (e.g. 'update comment with ID 123').
     */
    public function testAuthorizeOperationOnSpecificResourceAsMember()
    {
        // set up environment variables (current user is signed as member)
        $this->currentUserRole = 'member';
        $this->currentUserId   = 456;
        $policyEnforcement     = $this->createPolicyEnforcementPoint();

        // send authorization request
        $authRequest = new Request([
            RequestProperties::PARAM_OPERATION         => Comments::OPERATION_UPDATE,
            RequestProperties::PARAM_RESOURCE_TYPE     => Comments::RESOURCE_TYPE,
            RequestProperties::PARAM_RESOURCE_IDENTITY => 123, // <- ID 123 is owned
        ]);
        $this->assertTrue($policyEnforcement->authorize($authRequest));

        // send authorization request
        $authRequest = new Request([
            RequestProperties::PARAM_OPERATION         => Comments::OPERATION_UPDATE,
            RequestProperties::PARAM_RESOURCE_TYPE     => Comments::RESOURCE_TYPE,
            RequestProperties::PARAM_RESOURCE_IDENTITY => 1234, // <- ID 1234 is not owned
        ]);
        $this->assertFalse($policyEnforcement->authorize($authRequest));
    }

    /**
     * Test authorization of operation on specific resource (e.g. 'update comment with ID 123').
     */
    public function testAuthorizeOperationOnSpecificResourceAsAdmin()
    {
        // admin can edit any resource
        $this->currentUserRole = 'admin';
        $this->currentUserId   = 789;
        $policyEnforcement     = $this->createPolicyEnforcementPoint();
        $authRequest           = new Request([
            RequestProperties::PARAM_OPERATION         => Comments::OPERATION_UPDATE,
            RequestProperties::PARAM_RESOURCE_TYPE     => Comments::RESOURCE_TYPE,
            RequestProperties::PARAM_RESOURCE_IDENTITY => 1234, // <- ID 1234 is not owned
        ]);
        $this->assertTrue($policyEnforcement->authorize($authRequest));
    }

    /**
     * Test evaluate policy.
     */
    public function testEvaluatePolicyWithIntermediateAndPermit()
    {
        TestRuleAlgorithm::$result = EvaluationEnum::PERMIT;
        $policy                    = new Policy([(new Rule())], new TestRuleAlgorithm());
        $encodedPolicy             = Encoder::encodePolicy($policy);
        $context                   = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $result = BasePolicyOrSetAlgorithm::evaluatePolicy(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $this->logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::INDETERMINATE_PERMIT,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy.
     */
    public function testEvaluatePolicyWithIntermediateAndDeny()
    {
        TestRuleAlgorithm::$result = EvaluationEnum::DENY;
        $policy                    = new Policy([(new Rule())], new TestRuleAlgorithm());
        $encodedPolicy             = Encoder::encodePolicy($policy);
        $context                   = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $result = BasePolicyOrSetAlgorithm::evaluatePolicy(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $this->logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::INDETERMINATE_DENY,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy.
     */
    public function testEvaluatePolicyWithIntermediateAndIntermediate()
    {
        TestRuleAlgorithm::$result = EvaluationEnum::INDETERMINATE;
        $policy                    = new Policy([(new Rule())], new TestRuleAlgorithm());
        $encodedPolicy             = Encoder::encodePolicy($policy);
        $context                   = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $result = BasePolicyOrSetAlgorithm::evaluatePolicy(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $this->logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::INDETERMINATE_DENY_OR_PERMIT,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy.
     */
    public function testEvaluatePolicyWithIntermediateAndIntermediateDenyOrPermit()
    {
        TestRuleAlgorithm::$result = EvaluationEnum::INDETERMINATE_DENY_OR_PERMIT;
        $policy                    = new Policy([(new Rule())], new TestRuleAlgorithm());
        $encodedPolicy             = Encoder::encodePolicy($policy);
        $context                   = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $result = BasePolicyOrSetAlgorithm::evaluatePolicy(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $this->logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::INDETERMINATE_DENY_OR_PERMIT,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy.
     */
    public function testEvaluatePolicyWithIntermediateAndIntermediatePermit()
    {
        TestRuleAlgorithm::$result = EvaluationEnum::INDETERMINATE_PERMIT;
        $policy                    = new Policy([(new Rule())], new TestRuleAlgorithm());
        $encodedPolicy             = Encoder::encodePolicy($policy);
        $context                   = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $result = BasePolicyOrSetAlgorithm::evaluatePolicy(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $this->logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::INDETERMINATE_PERMIT,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy.
     */
    public function testEvaluatePolicyWithIntermediateAndIntermediateDeny()
    {
        TestRuleAlgorithm::$result = EvaluationEnum::INDETERMINATE_DENY;
        $policy                    = new Policy([(new Rule())], new TestRuleAlgorithm());
        $encodedPolicy             = Encoder::encodePolicy($policy);
        $context                   = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $result = BasePolicyOrSetAlgorithm::evaluatePolicy(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $this->logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::INDETERMINATE_DENY,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy set.
     */
    public function testEvaluatePolicySetWithIntermediate()
    {
        $set           = Application::getApplicationPolicy();
        $encodedPolicy = Encoder::encodePolicySet($set);
        $context       = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $logger = null;

        $result = BasePolicyOrSetAlgorithm::evaluatePolicySet(
            $context,
            TargetMatchEnum::INDETERMINATE,
            $encodedPolicy,
            $logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::NOT_APPLICABLE,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * Test evaluate policy set.
     */
    public function testEvaluatePolicySetWithNotMatch()
    {
        $set           = Application::getApplicationPolicy();
        $encodedPolicy = Encoder::encodePolicySet($set);
        $context       = new Context(new Request([
            RequestProperties::PARAM_OPERATION => Messaging::OPERATION_SEND,
        ]), $this->getContextDefinitions());

        $logger = null;

        $result = BasePolicyOrSetAlgorithm::evaluatePolicySet(
            $context,
            TargetMatchEnum::NOT_MATCH,
            $encodedPolicy,
            $logger
        );
        $this->assertEquals([
            BasePolicyOrSetAlgorithm::EVALUATION_VALUE       => EvaluationEnum::NOT_APPLICABLE,
            BasePolicyOrSetAlgorithm::EVALUATION_OBLIGATIONS => [],
            BasePolicyOrSetAlgorithm::EVALUATION_ADVICE      => [],
        ], $result);
    }

    /**
     * @param ContextInterface $context
     *
     * @return void
     */
    public static function markObligationAsCalled(ContextInterface $context)
    {
        // cant be null but to avoid 'not used variable' warning
        static::assertNotNull($context);

        static::$obligationCalled = true;
    }

    /**
     * @param ContextInterface $context
     *
     * @return void
     */
    public static function markAdviceAsCalled(ContextInterface $context)
    {
        // cant be null but to avoid 'not used variable' warning
        static::assertNotNull($context);

        static::$adviceCalled = true;
    }

    /**
     * @inheritdoc
     */
    protected function setUp()
    {
        parent::setUp();

        $this->logStream = fopen('php://memory', 'rw');
        $this->logger    = new Logger('auth', [new StreamHandler($this->getLogStream())]);

        $this->currentUserId   = null;
        $this->currentUserRole = null;
        $this->isWorkTime      = false;

        static::$obligationCalled = false;
        static::$adviceCalled     = false;
    }

    /**
     * @return resource
     */
    protected function getLogStream()
    {
        return $this->logStream;
    }

    /**
     * @inheritdoc
     */
    protected function tearDown()
    {
        parent::tearDown();

        fclose($this->getLogStream());
    }

    /**
     * @return string
     */
    protected function getLogs()
    {
        rewind($this->getLogStream());
        $logs = stream_get_contents($this->getLogStream());

        return $logs;
    }

    /**
     * @return PolicyEnforcementPointInterface
     */
    private function createPolicyEnforcementPoint()
    {
        $pip = $this->createPolicyInformationPoint();

        $pdp = new PolicyDecisionPoint(Application::getApplicationPolicy());
        $pdp->setLogger($this->getLogger());

        $pep = new PolicyEnforcementPoint($pip, $pdp);
        $pep->setLogger($this->getLogger());

        $this->assertTrue($pep->isExecuteAdvice());
        $pep->disableExecuteAdvice();
        $this->assertFalse($pep->isExecuteAdvice());
        $pep->enableExecuteAdvice();
        $this->assertTrue($pep->isExecuteAdvice());

        return $pep;
    }

    /**
     * @return PolicyInformationPointInterface
     */
    private function createPolicyInformationPoint()
    {
        // Typically values are taken from application container, system environment and
        // external systems but not from constructor parameters. However it's fine for testing purposes.
        // Both scalar values and methods/closures are supported.
        $pip = new PolicyInformationPoint($this->getContextDefinitions());

        return $pip;
    }

    /**
     * @return array
     */
    private function getContextDefinitions()