|
1
|
|
|
<?php |
|
2
|
|
|
namespace ShlinkioTest\Shlink\Rest\Middleware; |
|
3
|
|
|
|
|
4
|
|
|
use Interop\Http\ServerMiddleware\DelegateInterface; |
|
5
|
|
|
use PHPUnit\Framework\TestCase; |
|
6
|
|
|
use Prophecy\Prophecy\MethodProphecy; |
|
7
|
|
|
use Prophecy\Prophecy\ObjectProphecy; |
|
8
|
|
|
use Shlinkio\Shlink\Rest\Authentication\JWTService; |
|
9
|
|
|
use Shlinkio\Shlink\Rest\Middleware\CheckAuthenticationMiddleware; |
|
10
|
|
|
use ShlinkioTest\Shlink\Common\Util\TestUtils; |
|
11
|
|
|
use Zend\Diactoros\Response; |
|
12
|
|
|
use Zend\Diactoros\ServerRequestFactory; |
|
13
|
|
|
use Zend\Expressive\Router\Route; |
|
14
|
|
|
use Zend\Expressive\Router\RouteResult; |
|
15
|
|
|
use Zend\I18n\Translator\Translator; |
|
16
|
|
|
|
|
17
|
|
|
class CheckAuthenticationMiddlewareTest extends TestCase |
|
18
|
|
|
{ |
|
19
|
|
|
/** |
|
20
|
|
|
* @var CheckAuthenticationMiddleware |
|
21
|
|
|
*/ |
|
22
|
|
|
protected $middleware; |
|
23
|
|
|
/** |
|
24
|
|
|
* @var ObjectProphecy |
|
25
|
|
|
*/ |
|
26
|
|
|
protected $jwtService; |
|
27
|
|
|
|
|
28
|
|
|
public function setUp() |
|
29
|
|
|
{ |
|
30
|
|
|
$this->jwtService = $this->prophesize(JWTService::class); |
|
31
|
|
|
$this->middleware = new CheckAuthenticationMiddleware($this->jwtService->reveal(), Translator::factory([])); |
|
32
|
|
|
} |
|
33
|
|
|
|
|
34
|
|
|
/** |
|
35
|
|
|
* @test |
|
36
|
|
|
*/ |
|
37
|
|
|
public function someWhiteListedSituationsFallbackToNextMiddleware() |
|
38
|
|
|
{ |
|
39
|
|
|
$request = ServerRequestFactory::fromGlobals(); |
|
40
|
|
|
$delegate = $this->prophesize(DelegateInterface::class); |
|
41
|
|
|
/** @var MethodProphecy $process */ |
|
42
|
|
|
$process = $delegate->process($request)->willReturn(new Response()); |
|
43
|
|
|
|
|
44
|
|
|
$this->middleware->process($request, $delegate->reveal()); |
|
45
|
|
|
$process->shouldHaveBeenCalledTimes(1); |
|
46
|
|
|
|
|
47
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
48
|
|
|
RouteResult::class, |
|
49
|
|
|
RouteResult::fromRouteFailure(['GET']) |
|
50
|
|
|
); |
|
51
|
|
|
$delegate = $this->prophesize(DelegateInterface::class); |
|
52
|
|
|
/** @var MethodProphecy $process */ |
|
53
|
|
|
$process = $delegate->process($request)->willReturn(new Response()); |
|
54
|
|
|
$this->middleware->process($request, $delegate->reveal()); |
|
55
|
|
|
$process->shouldHaveBeenCalledTimes(1); |
|
56
|
|
|
|
|
57
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
58
|
|
|
RouteResult::class, |
|
59
|
|
|
RouteResult::fromRoute(new Route('foo', '', Route::HTTP_METHOD_ANY, 'rest-authenticate'), []) |
|
60
|
|
|
); |
|
61
|
|
|
$delegate = $this->prophesize(DelegateInterface::class); |
|
62
|
|
|
/** @var MethodProphecy $process */ |
|
63
|
|
|
$process = $delegate->process($request)->willReturn(new Response()); |
|
64
|
|
|
$this->middleware->process($request, $delegate->reveal()); |
|
65
|
|
|
$process->shouldHaveBeenCalledTimes(1); |
|
66
|
|
|
|
|
67
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
68
|
|
|
RouteResult::class, |
|
69
|
|
|
RouteResult::fromRoute(new Route('bar', 'foo'), []) |
|
70
|
|
|
)->withMethod('OPTIONS'); |
|
71
|
|
|
$delegate = $this->prophesize(DelegateInterface::class); |
|
72
|
|
|
/** @var MethodProphecy $process */ |
|
73
|
|
|
$process = $delegate->process($request)->willReturn(new Response()); |
|
74
|
|
|
$this->middleware->process($request, $delegate->reveal()); |
|
75
|
|
|
$process->shouldHaveBeenCalledTimes(1); |
|
76
|
|
|
} |
|
77
|
|
|
|
|
78
|
|
|
/** |
|
79
|
|
|
* @test |
|
80
|
|
|
*/ |
|
81
|
|
|
public function noHeaderReturnsError() |
|
82
|
|
|
{ |
|
83
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
84
|
|
|
RouteResult::class, |
|
85
|
|
|
RouteResult::fromRoute(new Route('bar', 'foo'), []) |
|
86
|
|
|
); |
|
87
|
|
|
$response = $this->middleware->process($request, TestUtils::createDelegateMock()->reveal()); |
|
88
|
|
|
$this->assertEquals(401, $response->getStatusCode()); |
|
89
|
|
|
} |
|
90
|
|
|
|
|
91
|
|
|
/** |
|
92
|
|
|
* @test |
|
93
|
|
|
*/ |
|
94
|
|
View Code Duplication |
public function provideAnAuthorizationWithoutTypeReturnsError() |
|
|
|
|
|
|
95
|
|
|
{ |
|
96
|
|
|
$authToken = 'ABC-abc'; |
|
97
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
98
|
|
|
RouteResult::class, |
|
99
|
|
|
RouteResult::fromRoute(new Route('bar', 'foo'), []) |
|
100
|
|
|
)->withHeader(CheckAuthenticationMiddleware::AUTHORIZATION_HEADER, $authToken); |
|
101
|
|
|
|
|
102
|
|
|
$response = $this->middleware->process($request, TestUtils::createDelegateMock()->reveal()); |
|
103
|
|
|
|
|
104
|
|
|
$this->assertEquals(401, $response->getStatusCode()); |
|
105
|
|
|
$this->assertTrue(strpos($response->getBody()->getContents(), 'You need to provide the Bearer type') > 0); |
|
106
|
|
|
} |
|
107
|
|
|
|
|
108
|
|
|
/** |
|
109
|
|
|
* @test |
|
110
|
|
|
*/ |
|
111
|
|
View Code Duplication |
public function provideAnAuthorizationWithWrongTypeReturnsError() |
|
|
|
|
|
|
112
|
|
|
{ |
|
113
|
|
|
$authToken = 'ABC-abc'; |
|
114
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
115
|
|
|
RouteResult::class, |
|
116
|
|
|
RouteResult::fromRoute(new Route('bar', 'foo'), []) |
|
117
|
|
|
)->withHeader(CheckAuthenticationMiddleware::AUTHORIZATION_HEADER, 'Basic ' . $authToken); |
|
118
|
|
|
|
|
119
|
|
|
$response = $this->middleware->process($request, TestUtils::createDelegateMock()->reveal()); |
|
120
|
|
|
|
|
121
|
|
|
$this->assertEquals(401, $response->getStatusCode()); |
|
122
|
|
|
$this->assertTrue( |
|
123
|
|
|
strpos($response->getBody()->getContents(), 'Provided authorization type Basic is not supported') > 0 |
|
124
|
|
|
); |
|
125
|
|
|
} |
|
126
|
|
|
|
|
127
|
|
|
/** |
|
128
|
|
|
* @test |
|
129
|
|
|
*/ |
|
130
|
|
View Code Duplication |
public function provideAnExpiredTokenReturnsError() |
|
|
|
|
|
|
131
|
|
|
{ |
|
132
|
|
|
$authToken = 'ABC-abc'; |
|
133
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
134
|
|
|
RouteResult::class, |
|
135
|
|
|
RouteResult::fromRoute(new Route('bar', 'foo'), []) |
|
136
|
|
|
)->withHeader(CheckAuthenticationMiddleware::AUTHORIZATION_HEADER, 'Bearer ' . $authToken); |
|
137
|
|
|
$this->jwtService->verify($authToken)->willReturn(false)->shouldBeCalledTimes(1); |
|
138
|
|
|
|
|
139
|
|
|
$response = $this->middleware->process($request, TestUtils::createDelegateMock()->reveal()); |
|
140
|
|
|
$this->assertEquals(401, $response->getStatusCode()); |
|
141
|
|
|
} |
|
142
|
|
|
|
|
143
|
|
|
/** |
|
144
|
|
|
* @test |
|
145
|
|
|
*/ |
|
146
|
|
|
public function provideCorrectTokenUpdatesExpirationAndFallsBackToNextMiddleware() |
|
147
|
|
|
{ |
|
148
|
|
|
$authToken = 'ABC-abc'; |
|
149
|
|
|
$request = ServerRequestFactory::fromGlobals()->withAttribute( |
|
150
|
|
|
RouteResult::class, |
|
151
|
|
|
RouteResult::fromRoute(new Route('bar', 'foo'), []) |
|
152
|
|
|
)->withHeader(CheckAuthenticationMiddleware::AUTHORIZATION_HEADER, 'bearer ' . $authToken); |
|
153
|
|
|
$this->jwtService->verify($authToken)->willReturn(true)->shouldBeCalledTimes(1); |
|
154
|
|
|
$this->jwtService->refresh($authToken)->willReturn($authToken)->shouldBeCalledTimes(1); |
|
155
|
|
|
|
|
156
|
|
|
$delegate = $this->prophesize(DelegateInterface::class); |
|
157
|
|
|
/** @var MethodProphecy $process */ |
|
158
|
|
|
$process = $delegate->process($request)->willReturn(new Response()); |
|
159
|
|
|
$resp = $this->middleware->process($request, $delegate->reveal()); |
|
160
|
|
|
|
|
161
|
|
|
$process->shouldHaveBeenCalledTimes(1); |
|
162
|
|
|
$this->assertArrayHasKey(CheckAuthenticationMiddleware::AUTHORIZATION_HEADER, $resp->getHeaders()); |
|
163
|
|
|
} |
|
164
|
|
|
} |
|
165
|
|
|
|
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.