AccessTest::testMutationNotAllowedUser() - Code Metrics - Inspection of "Mutation access denied throws error instead of a w..." - overblog/GraphQLBundle - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#44)

by Jérémiah

created 2016-05-23 08:53 UTC

AccessTest::testMutationNotAllowedUser() A

↳ Parent: AccessTest

Complexity

Conditions	1
Paths	1

Size

Total Lines	22
Code Lines	11

Duplication

Lines	0
Ratio	0 %

Importance

Changes	3
Bugs	0	Features	0

Metric	Value
c	3
b	0
f	0
dl	0
loc	22
rs	9.2
cc	1
eloc	11
nc	1
nop	0

<?php

/*
 * This file is part of the OverblogGraphQLBundle package.
 *
 * (c) Overblog <http://github.com/overblog/>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Overblog\GraphQLBundle\Tests\Functional\Security;

use Overblog\GraphQLBundle\Tests\Functional\app\Mutation\SimpleMutationWithThunkFieldsMutation;
use Overblog\GraphQLBundle\Tests\Functional\TestCase;

class AccessTest extends TestCase
{
    const USER_RYAN = 'ryan';
    const USER_ADMIN = 'admin';
    const ANONYMOUS_USER = null;

    private $userNameQuery = 'query MyQuery { user { name } }';

    private $userRolesQuery = 'query MyQuery { user { roles } }';

    private $userIsEnabledQuery = 'query MyQuery { user { isEnabled } }';

    private $userFriendsQuery = <<<EOF
query MyQuery {
  user {
    friends(first: 2) {
      edges {
        node {
          name
        }
      }
    }
  }
}
EOF;

    private $simpleMutationWithThunkQuery = <<<EOF
mutation M {
  simpleMutationWithThunkFields(input: {inputData: %d, clientMutationId: "bac"}) {
    result
    clientMutationId
  }
}
EOF;

    public function testNotAuthenticatedUserAccessToUserName()

    {
        $expected = [
            'data' => [
                'user' => [
                    'name' => null,
                ],
            ],
            'extensions' => [
                'warnings' => [
                    [
                        'message' => 'Access denied to this field.',
                        'locations' => [['line' => 1, 'column' => 24]],
                    ],
                ],
            ],
        ];

        $this->assertResponse($this->userNameQuery, $expected, static::ANONYMOUS_USER);
    }

    public function testFullyAuthenticatedUserAccessToUserName()
    {
        $expected = [
            'data' => [
                'user' => [
                    'name' => 'Dan',
                ],
            ],
        ];

        $this->assertResponse($this->userNameQuery, $expected, static::USER_RYAN);
    }

    public function testNotAuthenticatedUserAccessToUserRoles()
    {
        $this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::ANONYMOUS_USER);
    }

    public function testAuthenticatedUserAccessToUserRolesWithoutEnoughRights()
    {
        $this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::USER_RYAN);
    }

    public function testUserWithCorrectRightsAccessToUserRoles()
    {
        $expected = [
            'data' => [
                'user' => [
                    'roles' => ['ROLE_USER'],
                ],
            ],
        ];

        $this->assertResponse($this->userRolesQuery, $expected, static::USER_ADMIN);
    }

    public function testUserForbiddenField()

    {
        $expected = [
            'data' => [
                'user' => null,
            ],
            'extensions' => [
                'warnings' => [
                    [
                        'message' => 'Access denied to this field.',
                        'locations' => [
                            [
                                'line' => 3,
                                'column' => 5,
                            ],
                        ],
                    ],
                ],
            ],
        ];

        $query = <<<EOF
query MyQuery {
  user {
    forbidden
  }
}
EOF;

        $this->assertResponse($query, $expected, static::USER_ADMIN);
    }

    public function testUserAccessToUserFriends()
    {
        $expected = [
            'data' => [
                'user' => [
                    'friends' => [
                        'edges' => [
                            ['node' => ['name' => 'Nick']],
                            ['node' => null],
                        ],
                    ],
                ],
            ],
        ];

        $this->assertResponse($this->userFriendsQuery, $expected, static::USER_ADMIN);
    }

    public function testUserAccessToUserIsEnabledWithExpressionLanguageEvaluationFailed()

    {
        $expected = [
            'data' => [
                'user' => [
                    'isEnabled' => null,
                ],
            ],
            'extensions' => [
                'warnings' => [
                    [
                        'message' => 'Access denied to this field.',
                        'locations' => [['line' => 1, 'column' => 24]],
                    ],
                ],
            ],
        ];

        $this->assertResponse($this->userIsEnabledQuery, $expected, static::USER_ADMIN);
    }

    public function testMutationAllowedUser()
    {
        $result = 123;

        $expected = [
            'data' => [
                'simpleMutationWithThunkFields' => [
                    'result' => $result,
                    'clientMutationId' => 'bac',
                ],
            ],
        ];

        $this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, $result), $expected, static::USER_ADMIN);
        $this->assertTrue(SimpleMutationWithThunkFieldsMutation::hasMutate(true));
    }

    public function testMutationAllowedButNoRightsToDisplayPayload()
    {
        $expected = [
            'data' => [
                'simpleMutationWithThunkFields' => [
                    'result' => null,
                    'clientMutationId' => 'bac',
                ],
            ],
            'extensions' => [
                'warnings' => [
                    [
                        'message' => 'Access denied to this field.',
                        'locations' => [
                            [
                                'line' => 3,
                                'column' => 5,
                            ],
                        ],
                    ],
                ],
            ],
        ];

        $this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 321), $expected, static::USER_ADMIN);
        $this->assertTrue(SimpleMutationWithThunkFieldsMutation::hasMutate(true));
    }

    public function testMutationNotAllowedUser()
    {
        $expected = [
            'data' => [
                'simpleMutationWithThunkFields' => null,
            ],
            'errors' => [
                [
                    'message' => 'Access denied to this field.',
                    'locations' => [
                        [
                            'line' => 2,
                            'column' => 3,
                        ],
                    ],
                ],
            ],
        ];

        $this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 123), $expected, static::USER_RYAN);
        $this->assertFalse(SimpleMutationWithThunkFieldsMutation::hasMutate(true));
    }

    private function expectedFailedUserRoles()
    {
        return [
            'data' => [
                'user' => [
                    'roles' => [0 => null],
                ],
            ],
        ];
    }

    private static function assertResponse($query, array $expected, $username)

    {
        $client = self::createClientAuthenticated($username);
        $client->request('GET', '/', ['query' => $query]);

        $result = $client->getResponse()->getContent();

        static::assertEquals($expected, json_decode($result, true), $result);

        return $client;
    }

    private static function createClientAuthenticated($username)
    {
        $client = static::createClient(['test_case' => 'access']);

        if ($username) {
            $client->setServerParameters([
                'PHP_AUTH_USER' => $username,
                'PHP_AUTH_PW' => '123',
            ]);
        }

        return $client;
    }
}


1		<?php
2
3		/*
4		* This file is part of the OverblogGraphQLBundle package.
5		*
6		* (c) Overblog <http://github.com/overblog/>
7		*
8		* For the full copyright and license information, please view the LICENSE
9		* file that was distributed with this source code.
10		*/
11
12		namespace Overblog\GraphQLBundle\Tests\Functional\Security;
13
14		use Overblog\GraphQLBundle\Tests\Functional\app\Mutation\SimpleMutationWithThunkFieldsMutation;
15		use Overblog\GraphQLBundle\Tests\Functional\TestCase;
16
17		class AccessTest extends TestCase
18		{
19		const USER_RYAN = 'ryan';
20		const USER_ADMIN = 'admin';
21		const ANONYMOUS_USER = null;
22
23		private $userNameQuery = 'query MyQuery { user { name } }';
24
25		private $userRolesQuery = 'query MyQuery { user { roles } }';
26
27		private $userIsEnabledQuery = 'query MyQuery { user { isEnabled } }';
28
29		private $userFriendsQuery = <<<EOF
30		query MyQuery {
31		user {
32		friends(first: 2) {
33		edges {
34		node {
35		name
36		}
37		}
38		}
39		}
40		}
41		EOF;
42
43		private $simpleMutationWithThunkQuery = <<<EOF
44		mutation M {
45		simpleMutationWithThunkFields(input: {inputData: %d, clientMutationId: "bac"}) {
46		result
47		clientMutationId
48		}
49		}
50		EOF;
51
52	View Code Duplication	public function testNotAuthenticatedUserAccessToUserName()
		0 ignored issues – show Duplication introduced 2016-04-02 20:15 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
53		{
54		$expected = [
55		'data' => [
56		'user' => [
57		'name' => null,
58		],
59		],
60		'extensions' => [
61		'warnings' => [
62		[
63		'message' => 'Access denied to this field.',
64		'locations' => [['line' => 1, 'column' => 24]],
65		],
66		],
67		],
68		];
69
70		$this->assertResponse($this->userNameQuery, $expected, static::ANONYMOUS_USER);
71		}
72
73		public function testFullyAuthenticatedUserAccessToUserName()
74		{
75		$expected = [
76		'data' => [
77		'user' => [
78		'name' => 'Dan',
79		],
80		],
81		];
82
83		$this->assertResponse($this->userNameQuery, $expected, static::USER_RYAN);
84		}
85
86		public function testNotAuthenticatedUserAccessToUserRoles()
87		{
88		$this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::ANONYMOUS_USER);
89		}
90
91		public function testAuthenticatedUserAccessToUserRolesWithoutEnoughRights()
92		{
93		$this->assertResponse($this->userRolesQuery, $this->expectedFailedUserRoles(), static::USER_RYAN);
94		}
95
96		public function testUserWithCorrectRightsAccessToUserRoles()
97		{
98		$expected = [
99		'data' => [
100		'user' => [
101		'roles' => ['ROLE_USER'],
102		],
103		],
104		];
105
106		$this->assertResponse($this->userRolesQuery, $expected, static::USER_ADMIN);
107		}
108
109	View Code Duplication	public function testUserForbiddenField()
		0 ignored issues – show Duplication introduced 2016-05-16 09:56 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
110		{
111		$expected = [
112		'data' => [
113		'user' => null,
114		],
115		'extensions' => [
116		'warnings' => [
117		[
118		'message' => 'Access denied to this field.',
119		'locations' => [
120		[
121		'line' => 3,
122		'column' => 5,
123		],
124		],
125		],
126		],
127		],
128		];
129
130		$query = <<<EOF
131		query MyQuery {
132		user {
133		forbidden
134		}
135		}
136		EOF;
137
138		$this->assertResponse($query, $expected, static::USER_ADMIN);
139		}
140
141		public function testUserAccessToUserFriends()
142		{
143		$expected = [
144		'data' => [
145		'user' => [
146		'friends' => [
147		'edges' => [
148		['node' => ['name' => 'Nick']],
149		['node' => null],
150		],
151		],
152		],
153		],
154		];
155
156		$this->assertResponse($this->userFriendsQuery, $expected, static::USER_ADMIN);
157		}
158
159	View Code Duplication	public function testUserAccessToUserIsEnabledWithExpressionLanguageEvaluationFailed()
		0 ignored issues – show Duplication introduced 2016-04-02 20:15 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
160		{
161		$expected = [
162		'data' => [
163		'user' => [
164		'isEnabled' => null,
165		],
166		],
167		'extensions' => [
168		'warnings' => [
169		[
170		'message' => 'Access denied to this field.',
171		'locations' => [['line' => 1, 'column' => 24]],
172		],
173		],
174		],
175		];
176
177		$this->assertResponse($this->userIsEnabledQuery, $expected, static::USER_ADMIN);
178		}
179
180		public function testMutationAllowedUser()
181		{
182		$result = 123;
183
184		$expected = [
185		'data' => [
186		'simpleMutationWithThunkFields' => [
187		'result' => $result,
188		'clientMutationId' => 'bac',
189		],
190		],
191		];
192
193		$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, $result), $expected, static::USER_ADMIN);
194		$this->assertTrue(SimpleMutationWithThunkFieldsMutation::hasMutate(true));
195		}
196
197		public function testMutationAllowedButNoRightsToDisplayPayload()
198		{
199		$expected = [
200		'data' => [
201		'simpleMutationWithThunkFields' => [
202		'result' => null,
203		'clientMutationId' => 'bac',
204		],
205		],
206		'extensions' => [
207		'warnings' => [
208		[
209		'message' => 'Access denied to this field.',
210		'locations' => [
211		[
212		'line' => 3,
213		'column' => 5,
214		],
215		],
216		],
217		],
218		],
219		];
220
221		$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 321), $expected, static::USER_ADMIN);
222		$this->assertTrue(SimpleMutationWithThunkFieldsMutation::hasMutate(true));
223		}
224
225		public function testMutationNotAllowedUser()
226		{
227		$expected = [
228		'data' => [
229		'simpleMutationWithThunkFields' => null,
230		],
231		'errors' => [
232		[
233		'message' => 'Access denied to this field.',
234		'locations' => [
235		[
236		'line' => 2,
237		'column' => 3,
238		],
239		],
240		],
241		],
242		];
243
244		$this->assertResponse(sprintf($this->simpleMutationWithThunkQuery, 123), $expected, static::USER_RYAN);
245		$this->assertFalse(SimpleMutationWithThunkFieldsMutation::hasMutate(true));
246		}
247
248		private function expectedFailedUserRoles()
249		{
250		return [
251		'data' => [
252		'user' => [
253		'roles' => [0 => null],
254		],
255		],
256		];
257		}
258
259	View Code Duplication	private static function assertResponse($query, array $expected, $username)
		0 ignored issues – show Duplication introduced 2016-04-02 20:15 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
260		{
261		$client = self::createClientAuthenticated($username);
262		$client->request('GET', '/', ['query' => $query]);
263
264		$result = $client->getResponse()->getContent();
265
266		static::assertEquals($expected, json_decode($result, true), $result);
267
268		return $client;
269		}
270
271		private static function createClientAuthenticated($username)
272		{
273		$client = static::createClient(['test_case' => 'access']);
274
275		if ($username) {
276		$client->setServerParameters([
277		'PHP_AUTH_USER' => $username,
278		'PHP_AUTH_PW' => '123',
279		]);
280		}
281
282		return $client;
283		}
284		}
285

overblog / GraphQLBundle

Scrutinizer GitHub App not installed

Pull Request — master (#44)

AccessTest::testMutationNotAllowedUser() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like