|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
/* |
|
4
|
|
|
* This file is part of the OverblogGraphQLBundle package. |
|
5
|
|
|
* |
|
6
|
|
|
* (c) Overblog <http://github.com/overblog/> |
|
7
|
|
|
* |
|
8
|
|
|
* For the full copyright and license information, please view the LICENSE |
|
9
|
|
|
* file that was distributed with this source code. |
|
10
|
|
|
*/ |
|
11
|
|
|
|
|
12
|
|
|
namespace Overblog\GraphQLBundle\Tests\Functional\Security; |
|
13
|
|
|
|
|
14
|
|
|
use Overblog\GraphQLBundle\Tests\Functional\app\Mutation\SimpleMutationWithThunkFieldsMutation; |
|
15
|
|
|
use Overblog\GraphQLBundle\Tests\Functional\TestCase; |
|
16
|
|
|
|
|
17
|
|
|
class AccessTest extends TestCase |
|
18
|
|
|
{ |
|
19
|
|
|
const USER_RYAN = 'ryan'; |
|
20
|
|
|
const USER_ADMIN = 'admin'; |
|
21
|
|
|
const ANONYMOUS_USER = null; |
|
22
|
|
|
|
|
23
|
|
|
private $userNameQuery = 'query MyQuery { user { name } }'; |
|
24
|
|
|
|
|
25
|
|
|
private $userRolesQuery = 'query MyQuery { user { roles } }'; |
|
26
|
|
|
|
|
27
|
|
|
private $userIsEnabledQuery = 'query MyQuery { user { isEnabled } }'; |
|
28
|
|
|
|
|
29
|
|
|
private $userFriendsQuery = <<<EOF |
|
30
|
|
|
query MyQuery { |
|
31
|
|
|
user { |
|
32
|
|
|
friends(first: 2) { |
|
33
|
|
|
edges { |
|
34
|
|
|
node { |
|
35
|
|
|
name |
|
36
|
|
|
} |
|
37
|
|
|
} |
|
38
|
|
|
} |
|
39
|
|
|
} |
|
40
|
|
|
} |
|
41
|
|
|
EOF; |
|
42
|
|
|
|
|
43
|
|
|
private $simpleMutationWithThunkQuery = <<<EOF |
|
44
|
|
|
mutation M { |
|
45
|
|
|
simpleMutationWithThunkFields(input: {inputData: %d, clientMutationId: "bac"}) { |
|
46
|
|
|
result |
|
47
|
|
|
clientMutationId |
|
48
|
|
|
} |
|
49
|
|
|
} |
|
50
|
|
|
EOF; |
|
51
|
|
|
|
|
52
|
|
View Code Duplication |
public function testNotAuthenticatedUserAccessToUserName() |
|
|
|
|
|
|
53
|
|
|
{ |
|
54
|
|
|
$expected = [ |
|
55
|
|
|
'data' => [ |
|
56
|
|
|
'user' => [ |
|
57
|
|
|
'name' => null, |
|
58
|
|
|
], |
|
59
|
|
|
], |
|
60
|
|
|
'errors' => [ |
|
61
|
|
|
[ |
|
62
|
|
|
'message' => 'Access denied to this field.', |
|
63
|
|
|
'locations' => [['line' => 1, 'column' => 24]], |
|
64
|
|
|
], |
|
65
|
|
|
], |
|
66
|
|
|
]; |
|
67
|
|
|
|
|
68
|
|
|
$this->assertResponse($this->userNameQuery, $expected, static::ANONYMOUS_USER); |
|
69
|
|
|
} |
|
70
|
|
|
|
|
71
|
|
|
public function testFullyAuthenticatedUserAccessToUserName() |
|
72
|
|
|
{ |
|
73
|
|
|
$expected = [ |
|
74
|
|
|
'data' => [ |
|
75
|
|
|
'user' => [ |
|
76
|
|
|
'name' => 'Dan', |
|
77
|
|
|
], |
|
78
|
|
|
], |
|
79
|
|
|
]; |
|
80
|
|
|
|
|
81
|
|
|
$this->assertResponse($this->userNameQuery, $expected, static::USER_RYAN); |
|
82
|
|
|
} |
|
83
|
|
|
|
|
84
|
|
|
public function testNotAuthenticatedUserAccessToUserRoles() |
|
85
|
|
|
{ |
|
86
|
|
|
$this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::ANONYMOUS_USER); |
|
87
|
|
|
} |
|
88
|
|
|
|
|
89
|
|
|
public function testAuthenticatedUserAccessToUserRolesWithoutEnoughRights() |
|
90
|
|
|
{ |
|
91
|
|
|
$this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::USER_RYAN); |
|
92
|
|
|
} |
|
93
|
|
|
|
|
94
|
|
|
public function testUserWithCorrectRightsAccessToUserRoles() |
|
95
|
|
|
{ |
|
96
|
|
|
$expected = [ |
|
97
|
|
|
'data' => [ |
|
98
|
|
|
'user' => [ |
|
99
|
|
|
'roles' => ['ROLE_USER'], |
|
100
|
|
|
], |
|
101
|
|
|
], |
|
102
|
|
|
]; |
|
103
|
|
|
|
|
104
|
|
|
$this->assertResponse($this->userRolesQuery, $expected, static::USER_ADMIN); |
|
105
|
|
|
} |
|
106
|
|
|
|
|
107
|
|
|
public function testUserAccessToUserFriends() |
|
108
|
|
|
{ |
|
109
|
|
|
$expected = [ |
|
110
|
|
|
'data' => [ |
|
111
|
|
|
'user' => [ |
|
112
|
|
|
'friends' => [ |
|
113
|
|
|
'edges' => [ |
|
114
|
|
|
['node' => ['name' => 'Nick']], |
|
115
|
|
|
['node' => null], |
|
116
|
|
|
], |
|
117
|
|
|
], |
|
118
|
|
|
], |
|
119
|
|
|
], |
|
120
|
|
|
]; |
|
121
|
|
|
|
|
122
|
|
|
$this->assertResponse($this->userFriendsQuery, $expected, static::USER_ADMIN); |
|
123
|
|
|
} |
|
124
|
|
|
|
|
125
|
|
View Code Duplication |
public function testUserAccessToUserIsEnabledWithExpressionLanguageEvaluationFailed() |
|
|
|
|
|
|
126
|
|
|
{ |
|
127
|
|
|
$expected = [ |
|
128
|
|
|
'data' => [ |
|
129
|
|
|
'user' => [ |
|
130
|
|
|
'isEnabled' => null, |
|
131
|
|
|
], |
|
132
|
|
|
], |
|
133
|
|
|
'errors' => [ |
|
134
|
|
|
[ |
|
135
|
|
|
'message' => 'Access denied to this field.', |
|
136
|
|
|
'locations' => [['line' => 1, 'column' => 24]], |
|
137
|
|
|
], |
|
138
|
|
|
], |
|
139
|
|
|
]; |
|
140
|
|
|
|
|
141
|
|
|
$this->assertResponse($this->userIsEnabledQuery, $expected, static::USER_ADMIN); |
|
142
|
|
|
} |
|
143
|
|
|
|
|
144
|
|
|
public function testMutationAllowedUser() |
|
145
|
|
|
{ |
|
146
|
|
|
$result = 123; |
|
147
|
|
|
|
|
148
|
|
|
$expected = [ |
|
149
|
|
|
'data' => [ |
|
150
|
|
|
'simpleMutationWithThunkFields' => [ |
|
151
|
|
|
'result' => $result, |
|
152
|
|
|
'clientMutationId' => 'bac', |
|
153
|
|
|
], |
|
154
|
|
|
], |
|
155
|
|
|
]; |
|
156
|
|
|
|
|
157
|
|
|
$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, $result), $expected, static::USER_ADMIN); |
|
158
|
|
|
$this->assertTrue(SimpleMutationWithThunkFieldsMutation::hasMutate(true)); |
|
159
|
|
|
} |
|
160
|
|
|
|
|
161
|
|
|
public function testMutationAllowedButNoRightsToDisplayPayload() |
|
162
|
|
|
{ |
|
163
|
|
|
$expected = [ |
|
164
|
|
|
'data' => [ |
|
165
|
|
|
'simpleMutationWithThunkFields' => [ |
|
166
|
|
|
'result' => null, |
|
167
|
|
|
'clientMutationId' => 'bac', |
|
168
|
|
|
], |
|
169
|
|
|
], |
|
170
|
|
|
'errors' => [ |
|
171
|
|
|
[ |
|
172
|
|
|
'message' => 'Access denied to this field.', |
|
173
|
|
|
'locations' => [ |
|
174
|
|
|
[ |
|
175
|
|
|
'line' => 3, |
|
176
|
|
|
'column' => 5, |
|
177
|
|
|
], |
|
178
|
|
|
], |
|
179
|
|
|
], |
|
180
|
|
|
], |
|
181
|
|
|
]; |
|
182
|
|
|
|
|
183
|
|
|
$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 321), $expected, static::USER_ADMIN); |
|
184
|
|
|
$this->assertTrue(SimpleMutationWithThunkFieldsMutation::hasMutate(true)); |
|
185
|
|
|
} |
|
186
|
|
|
|
|
187
|
|
|
public function testMutationNotAllowedUser() |
|
188
|
|
|
{ |
|
189
|
|
|
$expected = [ |
|
190
|
|
|
'data' => [ |
|
191
|
|
|
'simpleMutationWithThunkFields' => null, |
|
192
|
|
|
], |
|
193
|
|
|
'errors' => [ |
|
194
|
|
|
[ |
|
195
|
|
|
'message' => 'Access denied to this field.', |
|
196
|
|
|
'locations' => [ |
|
197
|
|
|
[ |
|
198
|
|
|
'line' => 2, |
|
199
|
|
|
'column' => 3, |
|
200
|
|
|
], |
|
201
|
|
|
], |
|
202
|
|
|
], |
|
203
|
|
|
], |
|
204
|
|
|
]; |
|
205
|
|
|
|
|
206
|
|
|
$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 123), $expected, static::USER_RYAN); |
|
207
|
|
|
$this->assertFalse(SimpleMutationWithThunkFieldsMutation::hasMutate(true)); |
|
208
|
|
|
} |
|
209
|
|
|
|
|
210
|
|
|
private function expectedFailedUserRoles() |
|
211
|
|
|
{ |
|
212
|
|
|
return [ |
|
213
|
|
|
'data' => [ |
|
214
|
|
|
'user' => [ |
|
215
|
|
|
'roles' => [0 => null], |
|
216
|
|
|
], |
|
217
|
|
|
], |
|
218
|
|
|
]; |
|
219
|
|
|
} |
|
220
|
|
|
|
|
221
|
|
View Code Duplication |
private static function assertResponse($query, array $expected, $username) |
|
|
|
|
|
|
222
|
|
|
{ |
|
223
|
|
|
$client = self::createClientAuthenticated($username); |
|
224
|
|
|
$client->request('GET', '/', ['query' => $query]); |
|
225
|
|
|
|
|
226
|
|
|
$result = $client->getResponse()->getContent(); |
|
227
|
|
|
|
|
228
|
|
|
static::assertEquals($expected, json_decode($result, true), $result); |
|
229
|
|
|
|
|
230
|
|
|
return $client; |
|
231
|
|
|
} |
|
232
|
|
|
|
|
233
|
|
|
private static function createClientAuthenticated($username) |
|
234
|
|
|
{ |
|
235
|
|
|
$client = static::createClient(['test_case' => 'access']); |
|
236
|
|
|
|
|
237
|
|
|
if ($username) { |
|
238
|
|
|
$client->setServerParameters([ |
|
239
|
|
|
'PHP_AUTH_USER' => $username, |
|
240
|
|
|
'PHP_AUTH_PW' => '123', |
|
241
|
|
|
]); |
|
242
|
|
|
} |
|
243
|
|
|
|
|
244
|
|
|
return $client; |
|
245
|
|
|
} |
|
246
|
|
|
} |
|
247
|
|
|
|
overblog /
GraphQLBundle
Loading history...
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.