|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
/* |
|
4
|
|
|
* This file is part of the OverblogGraphQLBundle package. |
|
5
|
|
|
* |
|
6
|
|
|
* (c) Overblog <http://github.com/overblog/> |
|
7
|
|
|
* |
|
8
|
|
|
* For the full copyright and license information, please view the LICENSE |
|
9
|
|
|
* file that was distributed with this source code. |
|
10
|
|
|
*/ |
|
11
|
|
|
|
|
12
|
|
|
namespace Overblog\GraphQLBundle\Tests\Functional\Security; |
|
13
|
|
|
|
|
14
|
|
|
use Overblog\GraphQLBundle\Tests\Functional\TestCase; |
|
15
|
|
|
|
|
16
|
|
|
class AccessTest extends TestCase |
|
17
|
|
|
{ |
|
18
|
|
|
const USER_RYAN = 'ryan'; |
|
19
|
|
|
const USER_ADMIN = 'admin'; |
|
20
|
|
|
const ANONYMOUS_USER = null; |
|
21
|
|
|
|
|
22
|
|
|
private $userNameQuery = 'query MyQuery { user { name } }'; |
|
23
|
|
|
|
|
24
|
|
|
private $userRolesQuery = 'query MyQuery { user { roles } }'; |
|
25
|
|
|
|
|
26
|
|
|
private $userIsEnabledQuery = 'query MyQuery { user { isEnabled } }'; |
|
27
|
|
|
|
|
28
|
|
|
private $userFriendsQuery = <<<EOF |
|
29
|
|
|
query MyQuery { |
|
30
|
|
|
user { |
|
31
|
|
|
friends(first: 2) { |
|
32
|
|
|
edges { |
|
33
|
|
|
node { |
|
34
|
|
|
name |
|
35
|
|
|
} |
|
36
|
|
|
} |
|
37
|
|
|
} |
|
38
|
|
|
} |
|
39
|
|
|
} |
|
40
|
|
|
EOF; |
|
41
|
|
|
|
|
42
|
|
|
private $simpleMutationWithThunkQuery = <<<EOF |
|
43
|
|
|
mutation M { |
|
44
|
|
|
simpleMutationWithThunkFields(input: {inputData: %d, clientMutationId: "bac"}) { |
|
45
|
|
|
result |
|
46
|
|
|
clientMutationId |
|
47
|
|
|
} |
|
48
|
|
|
} |
|
49
|
|
|
EOF; |
|
50
|
|
|
|
|
51
|
|
|
private $simpleMutationQuery = <<<EOF |
|
52
|
|
|
mutation M { |
|
53
|
|
|
simpleMutation(input: {clientMutationId: "bac"}) { |
|
54
|
|
|
result |
|
55
|
|
|
clientMutationId |
|
56
|
|
|
} |
|
57
|
|
|
} |
|
58
|
|
|
EOF; |
|
59
|
|
|
|
|
60
|
|
View Code Duplication |
public function testNotAuthenticatedUserAccessToUserName() |
|
|
|
|
|
|
61
|
|
|
{ |
|
62
|
|
|
$expected = [ |
|
63
|
|
|
'data' => [ |
|
64
|
|
|
'user' => [ |
|
65
|
|
|
'name' => null, |
|
66
|
|
|
], |
|
67
|
|
|
], |
|
68
|
|
|
'errors' => [ |
|
69
|
|
|
[ |
|
70
|
|
|
'message' => 'Access denied to this field.', |
|
71
|
|
|
'locations' => [['line' => 1, 'column' => 24]], |
|
72
|
|
|
], |
|
73
|
|
|
], |
|
74
|
|
|
]; |
|
75
|
|
|
|
|
76
|
|
|
$this->assertResponse($this->userNameQuery, $expected, static::ANONYMOUS_USER); |
|
77
|
|
|
} |
|
78
|
|
|
|
|
79
|
|
|
public function testFullyAuthenticatedUserAccessToUserName() |
|
80
|
|
|
{ |
|
81
|
|
|
$expected = [ |
|
82
|
|
|
'data' => [ |
|
83
|
|
|
'user' => [ |
|
84
|
|
|
'name' => 'Dan', |
|
85
|
|
|
], |
|
86
|
|
|
], |
|
87
|
|
|
]; |
|
88
|
|
|
|
|
89
|
|
|
$this->assertResponse($this->userNameQuery, $expected, static::USER_RYAN); |
|
90
|
|
|
} |
|
91
|
|
|
|
|
92
|
|
|
public function testNotAuthenticatedUserAccessToUserRoles() |
|
93
|
|
|
{ |
|
94
|
|
|
$this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::ANONYMOUS_USER); |
|
95
|
|
|
} |
|
96
|
|
|
|
|
97
|
|
|
public function testAuthenticatedUserAccessToUserRolesWithoutEnoughRights() |
|
98
|
|
|
{ |
|
99
|
|
|
$this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::USER_RYAN); |
|
100
|
|
|
} |
|
101
|
|
|
|
|
102
|
|
|
public function testUserWithCorrectRightsAccessToUserRoles() |
|
103
|
|
|
{ |
|
104
|
|
|
$expected = [ |
|
105
|
|
|
'data' => [ |
|
106
|
|
|
'user' => [ |
|
107
|
|
|
'roles' => ['ROLE_USER'], |
|
108
|
|
|
], |
|
109
|
|
|
], |
|
110
|
|
|
]; |
|
111
|
|
|
|
|
112
|
|
|
$this->assertResponse($this->userRolesQuery, $expected, static::USER_ADMIN); |
|
113
|
|
|
} |
|
114
|
|
|
|
|
115
|
|
|
public function testUserAccessToUserFriends() |
|
116
|
|
|
{ |
|
117
|
|
|
$expected = [ |
|
118
|
|
|
'data' => [ |
|
119
|
|
|
'user' => [ |
|
120
|
|
|
'friends' => [ |
|
121
|
|
|
'edges' => [ |
|
122
|
|
|
['node' => ['name' => 'Nick']], |
|
123
|
|
|
['node' => null], |
|
124
|
|
|
], |
|
125
|
|
|
], |
|
126
|
|
|
], |
|
127
|
|
|
], |
|
128
|
|
|
]; |
|
129
|
|
|
|
|
130
|
|
|
$this->assertResponse($this->userFriendsQuery, $expected, static::USER_ADMIN); |
|
131
|
|
|
} |
|
132
|
|
|
|
|
133
|
|
View Code Duplication |
public function testUserAccessToUserIsEnabledWithExpressionLanguageEvaluationFailed() |
|
|
|
|
|
|
134
|
|
|
{ |
|
135
|
|
|
$expected = [ |
|
136
|
|
|
'data' => [ |
|
137
|
|
|
'user' => [ |
|
138
|
|
|
'isEnabled' => null, |
|
139
|
|
|
], |
|
140
|
|
|
], |
|
141
|
|
|
'errors' => [ |
|
142
|
|
|
[ |
|
143
|
|
|
'message' => 'Access denied to this field.', |
|
144
|
|
|
'locations' => [['line' => 1, 'column' => 24]], |
|
145
|
|
|
], |
|
146
|
|
|
], |
|
147
|
|
|
]; |
|
148
|
|
|
|
|
149
|
|
|
$this->assertResponse($this->userIsEnabledQuery, $expected, static::USER_ADMIN); |
|
150
|
|
|
} |
|
151
|
|
|
|
|
152
|
|
|
public function testReturnTheSameClientMutationIdForAdmin() |
|
153
|
|
|
{ |
|
154
|
|
|
$expected = [ |
|
155
|
|
|
'data' => [ |
|
156
|
|
|
'simpleMutation' => [ |
|
157
|
|
|
'result' => 1, |
|
158
|
|
|
'clientMutationId' => 'bac', |
|
159
|
|
|
], |
|
160
|
|
|
], |
|
161
|
|
|
]; |
|
162
|
|
|
|
|
163
|
|
|
$this->assertResponse($this->simpleMutationQuery, $expected, static::USER_ADMIN); |
|
164
|
|
|
} |
|
165
|
|
|
|
|
166
|
|
View Code Duplication |
public function testReturnTheSameClientMutationIdForRyanDontHasRightsToDisplayPayloadResultField() |
|
|
|
|
|
|
167
|
|
|
{ |
|
168
|
|
|
$expected = [ |
|
169
|
|
|
'data' => [ |
|
170
|
|
|
'simpleMutation' => [ |
|
171
|
|
|
'result' => null, |
|
172
|
|
|
'clientMutationId' => 'bac', |
|
173
|
|
|
], |
|
174
|
|
|
], |
|
175
|
|
|
'errors' => [ |
|
176
|
|
|
[ |
|
177
|
|
|
'message' => 'Access denied to this field.', |
|
178
|
|
|
"locations" => [ |
|
179
|
|
|
[ |
|
180
|
|
|
"line" => 3, |
|
181
|
|
|
"column" => 5, |
|
182
|
|
|
] |
|
183
|
|
|
] |
|
184
|
|
|
], |
|
185
|
|
|
], |
|
186
|
|
|
]; |
|
187
|
|
|
|
|
188
|
|
|
$this->assertResponse($this->simpleMutationQuery, $expected, static::USER_RYAN); |
|
189
|
|
|
} |
|
190
|
|
|
|
|
191
|
|
View Code Duplication |
public function testReturnTheSameClientMutationIdForAnonymousUserDontHasRightToMutateSimpleMutation() |
|
|
|
|
|
|
192
|
|
|
{ |
|
193
|
|
|
$expected = [ |
|
194
|
|
|
'data' => [ |
|
195
|
|
|
'simpleMutation' => null, |
|
196
|
|
|
], |
|
197
|
|
|
'errors' => [ |
|
198
|
|
|
[ |
|
199
|
|
|
'message' => 'Access denied to this field.', |
|
200
|
|
|
"locations" => [ |
|
201
|
|
|
[ |
|
202
|
|
|
"line" => 2, |
|
203
|
|
|
"column" => 3, |
|
204
|
|
|
] |
|
205
|
|
|
] |
|
206
|
|
|
], |
|
207
|
|
|
], |
|
208
|
|
|
]; |
|
209
|
|
|
|
|
210
|
|
|
$this->assertResponse($this->simpleMutationQuery, $expected, static::ANONYMOUS_USER); |
|
211
|
|
|
} |
|
212
|
|
|
|
|
213
|
|
|
public function testUseObjectInMutationPayload() |
|
214
|
|
|
{ |
|
215
|
|
|
$result = 123; |
|
216
|
|
|
|
|
217
|
|
|
$expected = [ |
|
218
|
|
|
'data' => [ |
|
219
|
|
|
'simpleMutationWithThunkFields' => [ |
|
220
|
|
|
'result' => $result, |
|
221
|
|
|
'clientMutationId' => 'bac', |
|
222
|
|
|
], |
|
223
|
|
|
], |
|
224
|
|
|
]; |
|
225
|
|
|
|
|
226
|
|
|
$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, $result), $expected, static::USER_ADMIN); |
|
227
|
|
|
|
|
228
|
|
|
$expected = [ |
|
229
|
|
|
'data' => [ |
|
230
|
|
|
'simpleMutationWithThunkFields' => [ |
|
231
|
|
|
'result' => null, |
|
232
|
|
|
'clientMutationId' => 'bac', |
|
233
|
|
|
], |
|
234
|
|
|
], |
|
235
|
|
|
'errors' => [ |
|
236
|
|
|
[ |
|
237
|
|
|
'message' => 'Access denied to this field.', |
|
238
|
|
|
"locations" => [ |
|
239
|
|
|
[ |
|
240
|
|
|
"line" => 3, |
|
241
|
|
|
"column" => 5, |
|
242
|
|
|
] |
|
243
|
|
|
] |
|
244
|
|
|
], |
|
245
|
|
|
], |
|
246
|
|
|
]; |
|
247
|
|
|
|
|
248
|
|
|
$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 321), $expected, static::USER_ADMIN); |
|
249
|
|
|
} |
|
250
|
|
|
|
|
251
|
|
|
private function expectedFailedUserRoles() |
|
252
|
|
|
{ |
|
253
|
|
|
return [ |
|
254
|
|
|
'data' => [ |
|
255
|
|
|
'user' => [ |
|
256
|
|
|
'roles' => [0 => null], |
|
257
|
|
|
], |
|
258
|
|
|
], |
|
259
|
|
|
]; |
|
260
|
|
|
} |
|
261
|
|
|
|
|
262
|
|
View Code Duplication |
private static function assertResponse($query, array $expected, $username) |
|
|
|
|
|
|
263
|
|
|
{ |
|
264
|
|
|
$client = self::createClientAuthenticated($username); |
|
265
|
|
|
$client->request('GET', '/', ['query' => $query]); |
|
266
|
|
|
|
|
267
|
|
|
$result = $client->getResponse()->getContent(); |
|
268
|
|
|
|
|
269
|
|
|
static::assertEquals($expected, json_decode($result, true), $result); |
|
270
|
|
|
|
|
271
|
|
|
return $client; |
|
272
|
|
|
} |
|
273
|
|
|
|
|
274
|
|
|
private static function createClientAuthenticated($username) |
|
275
|
|
|
{ |
|
276
|
|
|
$client = static::createClient(['test_case' => 'access']); |
|
277
|
|
|
|
|
278
|
|
|
if ($username) { |
|
279
|
|
|
$client->setServerParameters([ |
|
280
|
|
|
'PHP_AUTH_USER' => $username, |
|
281
|
|
|
'PHP_AUTH_PW' => '123', |
|
282
|
|
|
]); |
|
283
|
|
|
} |
|
284
|
|
|
|
|
285
|
|
|
return $client; |
|
286
|
|
|
} |
|
287
|
|
|
} |
|
288
|
|
|
|
overblog /
GraphQLBundle
Loading history...
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.