Spiral\Tests\Csrf\CsrfTest

Complexity

Total Complexity

17

Size/Duplication

Total Lines	266
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	0

13 Methods

Rating	Name	Duplication	Size	Complexity
A	get()	0	8	1
A	testGet()	0	16	1
A	fetchCookies()	0	17	5
A	testHeaderOKStrict()	0	30	1
A	post()	0	8	1
A	testLogicException()	0	11	1
A	testLengthException()	0	22	1
A	httpCore()	0	17	1
A	testHeaderOK()	0	31	1
A	setUp()	0	17	1
A	testPostOK()	0	31	1
A	request()	0	16	1
A	testPostForbidden()	0	11	1

<?php

/**
 * Spiral Framework.
 *
 * @license   MIT
 * @author    Anton Titov (Wolfy-J)
 */

declare(strict_types=1);

namespace Spiral\Tests\Csrf;

use PHPUnit\Framework\TestCase;
use Psr\Http\Message\ResponseFactoryInterface;
use Psr\Http\Message\ResponseInterface;
use Spiral\Core\Container;
use Spiral\Csrf\Config\CsrfConfig;
use Spiral\Csrf\Middleware\CsrfFirewall;
use Spiral\Csrf\Middleware\CsrfMiddleware;
use Spiral\Csrf\Middleware\StrictCsrfFirewall;
use Spiral\Http\Config\HttpConfig;
use Spiral\Http\Http;
use Spiral\Http\Pipeline;
use Laminas\Diactoros\ServerRequest;

class CsrfTest extends TestCase
{
    private $container;

    public function setUp(): void
    {
        $this->container = new Container();
        $this->container->bind(
            CsrfConfig::class,
            new CsrfConfig(

new Spiral\Csrf\Config\CsrfConfig(array('cookie' => 'csrf-token', 'length' => 16, 'lifetime' => 86400)) of type Spiral\Csrf\Config\CsrfConfig is incompatible with the type array|callable|string expected by parameter $resolver of Spiral\Core\Container::bind().

                [
                    'cookie'   => 'csrf-token',
                    'length'   => 16,
                    'lifetime' => 86400
                ]
            )
        );

        $this->container->bind(
            ResponseFactoryInterface::class,
            new TestResponseFactory(new HttpConfig(['headers' => []]))

new Spiral\Tests\Csrf\TestResponseFactory(new Spiral\Http\Config\HttpConfig(array('headers' => array()))) of type Spiral\Tests\Csrf\TestResponseFactory is incompatible with the type array|callable|string expected by parameter $resolver of Spiral\Core\Container::bind().

        );
    }

    public function testGet(): void
    {
        $core = $this->httpCore([CsrfMiddleware::class]);
        $core->setHandler(
            static function ($r) {
                return $r->getAttribute(CsrfMiddleware::ATTRIBUTE);
            }
        );

        $response = $this->get($core, '/');
        self::assertSame(200, $response->getStatusCode());

        $cookies = $this->fetchCookies($response);

        self::assertArrayHasKey('csrf-token', $cookies);
        self::assertSame($cookies['csrf-token'], (string)$response->getBody());
    }

    public function testLengthException(): void
    {
        $this->expectException(\RuntimeException::class);
        $this->container->bind(
            CsrfConfig::class,
            new CsrfConfig(
                [
                    'cookie'   => 'csrf-token',
                    'length'   => 0,
                    'lifetime' => 86400
                ]
            )
        );

        $core = $this->httpCore([CsrfMiddleware::class]);
        $core->setHandler(
            static function () {
                return 'all good';
            }
        );

        $response = $this->get($core, '/');

The assignment to $response is dead and can be removed.

    }

    public function testPostForbidden(): void
    {
        $core = $this->httpCore([CsrfMiddleware::class, CsrfFirewall::class]);
        $core->setHandler(
            static function () {
                return 'all good';
            }
        );

        $response = $this->post($core, '/');
        self::assertSame(412, $response->getStatusCode());
    }

    public function testLogicException(): void
    {
        $this->expectException(\LogicException::class);
        $core = $this->httpCore([CsrfFirewall::class]);
        $core->setHandler(
            static function () {
                return 'all good';
            }
        );

        $response = $this->post($core, '/');

The assignment to $response is dead and can be removed.

    }

    public function testPostOK(): void
    {
        $core = $this->httpCore([CsrfMiddleware::class, CsrfFirewall::class]);
        $core->setHandler(
            static function () {
                return 'all good';
            }
        );

        $response = $this->get($core, '/');
        self::assertSame(200, $response->getStatusCode());
        self::assertSame('all good', (string)$response->getBody());

        $cookies = $this->fetchCookies($response);

        $response = $this->post($core, '/', [], [], ['csrf-token' => $cookies['csrf-token']]);

        self::assertSame(412, $response->getStatusCode());

        $response = $this->post(
            $core,
            '/',
            [
                'csrf-token' => $cookies['csrf-token']
            ],
            [],
            ['csrf-token' => $cookies['csrf-token']]
        );

        self::assertSame(200, $response->getStatusCode());
        self::assertSame('all good', (string)$response->getBody());
    }

    public function testHeaderOK(): void
    {
        $core = $this->httpCore([CsrfMiddleware::class, CsrfFirewall::class]);
        $core->setHandler(
            static function () {
                return 'all good';
            }
        );

        $response = $this->get($core, '/');
        self::assertSame(200, $response->getStatusCode());
        self::assertSame('all good', (string)$response->getBody());

        $cookies = $this->fetchCookies($response);

        $response = $this->post($core, '/', [], [], ['csrf-token' => $cookies['csrf-token']]);

        self::assertSame(412, $response->getStatusCode());

        $response = $this->post(
            $core,
            '/',
            [],
            [
                'X-CSRF-Token' => $cookies['csrf-token']
            ],
            ['csrf-token' => $cookies['csrf-token']]
        );

        self::assertSame(200, $response->getStatusCode());
        self::assertSame('all good', (string)$response->getBody());
    }

    public function testHeaderOKStrict(): void
    {
        $core = $this->httpCore([CsrfMiddleware::class, StrictCsrfFirewall::class]);
        $core->setHandler(
            static function () {
                return 'all good';
            }
        );

        $response = $this->get($core, '/');
        self::assertSame(412, $response->getStatusCode());

        $cookies = $this->fetchCookies($response);

        $response = $this->get($core, '/', [], [], ['csrf-token' => $cookies['csrf-token']]);

        self::assertSame(412, $response->getStatusCode());

        $response = $this->get(
            $core,
            '/',
            [],
            [
                'X-CSRF-Token' => $cookies['csrf-token']
            ],
            ['csrf-token' => $cookies['csrf-token']]
        );

        self::assertSame(200, $response->getStatusCode());
        self::assertSame('all good', (string)$response->getBody());
    }

    protected function httpCore(array $middleware = []): Http
    {
        $config = new HttpConfig(
            [
                'basePath'   => '/',
                'headers'    => [
                    'Content-Type' => 'text/html; charset=UTF-8'
                ],
                'middleware' => $middleware
            ]
        );

        return new Http(
            $config,
            new Pipeline($this->container),
            new TestResponseFactory($config),
            $this->container
        );
    }

    protected function get(
        Http $core,
        $uri,
        array $query = [],
        array $headers = [],
        array $cookies = []
    ): ResponseInterface {
        return $core->handle($this->request($uri, 'GET', $query, $headers, $cookies));
    }

    protected function post(
        Http $core,
        $uri,
        array $data = [],
        array $headers = [],
        array $cookies = []
    ): ResponseInterface {
        return $core->handle($this->request($uri, 'POST', [], $headers, $cookies)->withParsedBody($data));
    }

    protected function request(
        $uri,
        string $method,
        array $query = [],
        array $headers = [],
        array $cookies = []
    ): ServerRequest {
        return new ServerRequest(
            [],
            [],
            $uri,
            $method,
            'php://input',
            $headers,
            $cookies,
            $query
        );
    }

    protected function fetchCookies(ResponseInterface $response): array
    {
        $result = [];

        foreach ($response->getHeaders() as $header) {
            foreach ($header as $headerLine) {
                $chunk = explode(';', $headerLine);
                if (!count($chunk) || mb_strpos($chunk[0], '=') === false) {
                    continue;
                }

                $cookie = explode('=', $chunk[0]);
                $result[$cookie[0]] = rawurldecode($cookie[1]);
            }
        }

        return $result;
    }
}