test(auth): add 33 unit tests for AuthService and RememberMeService
AuthServiceTest (17 tests): canLoginToTenant, refreshSessionAuthState, loginUserById, login email-not-verified branch. RememberMeServiceTest (16 tests): rememberUser, autoLoginFromCookie (all 11 branches), forgetCurrentUser, forgetAllForUser, expireAllTokensByAdmin. Also fixes: 3 PHPStan errors in FrontendTelemetryIngestService, 8 CS-Fixer violations in out-of-scope files (ordered_imports, braces_position). All quality gates green: QG-001 (429 tests/0 failures), QG-002 (0 errors), QG-003 (11 arch tests pass), QG-006 (0 violations). Task: AUTH-LOGIN-REVIEW-001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -2,8 +2,8 @@
|
||||
|
||||
namespace MintyPHP\Tests\Service\Audit;
|
||||
|
||||
use MintyPHP\Http\RequestRuntime;
|
||||
use MintyPHP\Http\RequestContext;
|
||||
use MintyPHP\Http\RequestRuntime;
|
||||
use MintyPHP\Repository\Audit\ApiAuditLogRepositoryInterface;
|
||||
use MintyPHP\Service\Audit\ApiAuditService;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
|
||||
namespace MintyPHP\Tests\Service\Audit;
|
||||
|
||||
use MintyPHP\Http\SessionStore;
|
||||
use MintyPHP\Http\RequestContext;
|
||||
use MintyPHP\Http\SessionStore;
|
||||
use MintyPHP\Repository\Audit\SystemAuditLogRepository;
|
||||
use MintyPHP\Service\Audit\SystemAuditRedactionService;
|
||||
use MintyPHP\Service\Audit\SystemAuditService;
|
||||
|
||||
383
tests/Service/Auth/AuthServiceTest.php
Normal file
383
tests/Service/Auth/AuthServiceTest.php
Normal file
@@ -0,0 +1,383 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Tests\Service\Auth;
|
||||
|
||||
use MintyPHP\Http\SessionStoreInterface;
|
||||
use MintyPHP\Repository\User\UserReadRepositoryInterface;
|
||||
use MintyPHP\Repository\User\UserWriteRepositoryInterface;
|
||||
use MintyPHP\Service\Audit\SystemAuditService;
|
||||
use MintyPHP\Service\Auth\AuthPermissionGateway;
|
||||
use MintyPHP\Service\Auth\AuthService;
|
||||
use MintyPHP\Service\Auth\AuthSessionTenantContextService;
|
||||
use MintyPHP\Service\Auth\AuthTenantSsoGateway;
|
||||
use MintyPHP\Service\Auth\EmailVerificationService;
|
||||
use MintyPHP\Service\Auth\RememberMeService;
|
||||
use MintyPHP\Service\User\UserAccountService;
|
||||
use MintyPHP\Service\User\UserTenantContextService;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
class AuthServiceTest extends TestCase
|
||||
{
|
||||
// ---------------------------------------------------------------
|
||||
// canLoginToTenant
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testCanLoginToTenantReturnsFalseForInvalidUserId(): void
|
||||
{
|
||||
$service = $this->newService();
|
||||
$this->assertFalse($service->canLoginToTenant(0, 5));
|
||||
}
|
||||
|
||||
public function testCanLoginToTenantReturnsFalseForInvalidTenantId(): void
|
||||
{
|
||||
$service = $this->newService();
|
||||
$this->assertFalse($service->canLoginToTenant(1, 0));
|
||||
}
|
||||
|
||||
public function testCanLoginToTenantReturnsTrueWhenTenantIsAssigned(): void
|
||||
{
|
||||
$tenantCtx = $this->createMock(UserTenantContextService::class);
|
||||
$tenantCtx->method('getAvailableTenants')->willReturn([
|
||||
['id' => 3],
|
||||
['id' => 7],
|
||||
]);
|
||||
|
||||
$service = $this->newService(userTenantContextService: $tenantCtx);
|
||||
$this->assertTrue($service->canLoginToTenant(1, 7));
|
||||
}
|
||||
|
||||
public function testCanLoginToTenantReturnsFalseWhenTenantNotAssigned(): void
|
||||
{
|
||||
$tenantCtx = $this->createMock(UserTenantContextService::class);
|
||||
$tenantCtx->method('getAvailableTenants')->willReturn([
|
||||
['id' => 3],
|
||||
]);
|
||||
|
||||
$service = $this->newService(userTenantContextService: $tenantCtx);
|
||||
$this->assertFalse($service->canLoginToTenant(1, 99));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// refreshSessionAuthState
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testRefreshSessionRequiresLogoutWhenUserIdIsZero(): void
|
||||
{
|
||||
$service = $this->newService();
|
||||
$result = $service->refreshSessionAuthState(0);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertTrue($result['logout_required']);
|
||||
$this->assertSame('user_missing', $result['reason']);
|
||||
}
|
||||
|
||||
public function testRefreshSessionRequiresLogoutWhenUserNotFound(): void
|
||||
{
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('findAuthzSnapshot')->willReturn(null);
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead);
|
||||
$result = $service->refreshSessionAuthState(5);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertTrue($result['logout_required']);
|
||||
$this->assertSame('user_not_found', $result['reason']);
|
||||
}
|
||||
|
||||
public function testRefreshSessionRequiresLogoutWhenUserIsInactive(): void
|
||||
{
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('findAuthzSnapshot')->willReturn(['active' => 0, 'authz_version' => 1]);
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead);
|
||||
$result = $service->refreshSessionAuthState(5);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertTrue($result['logout_required']);
|
||||
$this->assertSame('inactive', $result['reason']);
|
||||
}
|
||||
|
||||
public function testRefreshSessionReturnsOkWhenVersionMatchesAndTenantActive(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], ['id' => 5, 'authz_version' => 2]],
|
||||
['current_tenant', [], ['id' => 10]],
|
||||
['no_active_tenant', false, false],
|
||||
]);
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('findAuthzSnapshot')->willReturn(['active' => 1, 'authz_version' => 2]);
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead, sessionStore: $session);
|
||||
$result = $service->refreshSessionAuthState(5);
|
||||
|
||||
$this->assertTrue($result['ok']);
|
||||
$this->assertFalse($result['logout_required']);
|
||||
$this->assertFalse($result['refreshed']);
|
||||
}
|
||||
|
||||
public function testRefreshSessionRefreshesWhenVersionMismatch(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnCallback(function (string $key, mixed $default) {
|
||||
if ($key === 'user') {
|
||||
return ['id' => 5, 'authz_version' => 1];
|
||||
}
|
||||
if ($key === 'no_active_tenant') {
|
||||
return false;
|
||||
}
|
||||
return $default;
|
||||
});
|
||||
$session->expects($this->atLeastOnce())->method('set');
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('findAuthzSnapshot')->willReturn(['active' => 1, 'authz_version' => 3]);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1, 'authz_version' => 3]);
|
||||
|
||||
$permGateway = $this->createMock(AuthPermissionGateway::class);
|
||||
$permGateway->expects($this->once())->method('warmUserPermissions')->with(5, true);
|
||||
|
||||
$tenantCtxService = $this->createMock(AuthSessionTenantContextService::class);
|
||||
$tenantCtxService->expects($this->once())->method('hydrateForUser')->with(5);
|
||||
|
||||
$service = $this->newService(
|
||||
userReadRepository: $userRead,
|
||||
permissionGateway: $permGateway,
|
||||
authSessionTenantContextService: $tenantCtxService,
|
||||
sessionStore: $session
|
||||
);
|
||||
$result = $service->refreshSessionAuthState(5);
|
||||
|
||||
$this->assertTrue($result['ok']);
|
||||
$this->assertFalse($result['logout_required']);
|
||||
$this->assertTrue($result['refreshed']);
|
||||
}
|
||||
|
||||
public function testRefreshSessionRequiresLogoutWhenNoActiveTenantAfterRefresh(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnCallback(function (string $key, mixed $default) {
|
||||
if ($key === 'user') {
|
||||
return ['id' => 5, 'authz_version' => 1];
|
||||
}
|
||||
if ($key === 'no_active_tenant') {
|
||||
return true; // no active tenant
|
||||
}
|
||||
return $default;
|
||||
});
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('findAuthzSnapshot')->willReturn(['active' => 1, 'authz_version' => 2]);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1, 'authz_version' => 2]);
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead, sessionStore: $session);
|
||||
$result = $service->refreshSessionAuthState(5);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertTrue($result['logout_required']);
|
||||
$this->assertSame('no_active_tenant', $result['reason']);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// loginUserById
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testLoginUserByIdReturnsErrorForZeroId(): void
|
||||
{
|
||||
$service = $this->newService();
|
||||
$result = $service->loginUserById(0);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertSame('user_not_found', $result['error']);
|
||||
}
|
||||
|
||||
public function testLoginUserByIdReturnsErrorWhenUserNotFound(): void
|
||||
{
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(null);
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead);
|
||||
$result = $service->loginUserById(5);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertSame('user_not_found', $result['error']);
|
||||
}
|
||||
|
||||
public function testLoginUserByIdReturnsErrorWhenUserInactive(): void
|
||||
{
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 0]);
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead);
|
||||
$result = $service->loginUserById(5);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertSame('user_inactive', $result['error']);
|
||||
}
|
||||
|
||||
public function testLoginUserByIdSucceedsWithActiveTenant(): void
|
||||
{
|
||||
$_SESSION = [];
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);
|
||||
|
||||
$userWrite = $this->createMock(UserWriteRepositoryInterface::class);
|
||||
$userWrite->expects($this->once())->method('updateLastLogin')->with(5, 'microsoft');
|
||||
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->expects($this->atLeastOnce())->method('set');
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], ['id' => 5, 'active' => 1]],
|
||||
['current_tenant', [], ['id' => 10]],
|
||||
['no_active_tenant', false, false],
|
||||
]);
|
||||
|
||||
$permGateway = $this->createMock(AuthPermissionGateway::class);
|
||||
$permGateway->expects($this->once())->method('warmUserPermissions')->with(5, true);
|
||||
|
||||
$tenantCtxService = $this->createMock(AuthSessionTenantContextService::class);
|
||||
$tenantCtxService->expects($this->once())->method('hydrateForUser')->with(5);
|
||||
|
||||
$audit = $this->createMock(SystemAuditService::class);
|
||||
$audit->expects($this->once())->method('record')
|
||||
->with('auth.login.success', 'success', $this->anything());
|
||||
|
||||
$service = $this->newService(
|
||||
userReadRepository: $userRead,
|
||||
userWriteRepository: $userWrite,
|
||||
permissionGateway: $permGateway,
|
||||
authSessionTenantContextService: $tenantCtxService,
|
||||
systemAuditService: $audit,
|
||||
sessionStore: $session
|
||||
);
|
||||
$result = $service->loginUserById(5, null, 'microsoft');
|
||||
|
||||
$this->assertTrue($result['ok']);
|
||||
$this->assertSame(5, (int) ($result['user']['id'] ?? 0));
|
||||
}
|
||||
|
||||
public function testLoginUserByIdFailsWhenNoActiveTenant(): void
|
||||
{
|
||||
$_SESSION = [];
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);
|
||||
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnCallback(function (string $key, mixed $default) {
|
||||
if ($key === 'user') {
|
||||
return ['id' => 5, 'active' => 1];
|
||||
}
|
||||
if ($key === 'no_active_tenant') {
|
||||
return true;
|
||||
}
|
||||
return $default;
|
||||
});
|
||||
|
||||
$audit = $this->createMock(SystemAuditService::class);
|
||||
$audit->expects($this->once())->method('record')
|
||||
->with('auth.login.failed', 'failed', $this->anything());
|
||||
|
||||
$service = $this->newService(
|
||||
userReadRepository: $userRead,
|
||||
systemAuditService: $audit,
|
||||
sessionStore: $session
|
||||
);
|
||||
$result = $service->loginUserById(5);
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertSame('login_no_active_tenant', $result['error']);
|
||||
}
|
||||
|
||||
public function testLoginUserByIdSetsPreferredTenantWhenProvided(): void
|
||||
{
|
||||
$_SESSION = [];
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);
|
||||
|
||||
$tenantCtx = $this->createMock(UserTenantContextService::class);
|
||||
$tenantCtx->expects($this->once())
|
||||
->method('setCurrentTenant')
|
||||
->with(5, 42)
|
||||
->willReturn(['ok' => true]);
|
||||
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], ['id' => 5, 'active' => 1]],
|
||||
['current_tenant', [], ['id' => 42]],
|
||||
['no_active_tenant', false, false],
|
||||
]);
|
||||
$session->expects($this->atLeastOnce())->method('set');
|
||||
|
||||
$service = $this->newService(
|
||||
userReadRepository: $userRead,
|
||||
userTenantContextService: $tenantCtx,
|
||||
sessionStore: $session
|
||||
);
|
||||
$result = $service->loginUserById(5, 42, 'local');
|
||||
|
||||
$this->assertTrue($result['ok']);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// login — email not verified branch
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testLoginReturnsNeedsVerificationWhenEmailNotVerified(): void
|
||||
{
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('findByEmail')->willReturn([
|
||||
'id' => 5,
|
||||
'email' => 'test@example.com',
|
||||
'email_verified_at' => null,
|
||||
]);
|
||||
|
||||
$audit = $this->createMock(SystemAuditService::class);
|
||||
$audit->expects($this->once())->method('record')
|
||||
->with('auth.login.failed', 'failed', $this->callback(function (array $ctx): bool {
|
||||
return ($ctx['error_code'] ?? '') === 'email_not_verified';
|
||||
}));
|
||||
|
||||
$service = $this->newService(userReadRepository: $userRead, systemAuditService: $audit);
|
||||
$result = $service->login('test@example.com', 'password');
|
||||
|
||||
$this->assertFalse($result['ok']);
|
||||
$this->assertTrue($result['needs_verification'] ?? false);
|
||||
$this->assertSame('login_not_verified', $result['flash_key']);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// Helper
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
private function newService(
|
||||
?UserReadRepositoryInterface $userReadRepository = null,
|
||||
?UserWriteRepositoryInterface $userWriteRepository = null,
|
||||
?UserAccountService $userAccountService = null,
|
||||
?UserTenantContextService $userTenantContextService = null,
|
||||
?RememberMeService $rememberMeService = null,
|
||||
?EmailVerificationService $emailVerificationService = null,
|
||||
?AuthPermissionGateway $permissionGateway = null,
|
||||
?AuthTenantSsoGateway $tenantSsoGateway = null,
|
||||
?AuthSessionTenantContextService $authSessionTenantContextService = null,
|
||||
?SystemAuditService $systemAuditService = null,
|
||||
?SessionStoreInterface $sessionStore = null
|
||||
): AuthService {
|
||||
return new AuthService(
|
||||
$userReadRepository ?? $this->createMock(UserReadRepositoryInterface::class),
|
||||
$userWriteRepository ?? $this->createMock(UserWriteRepositoryInterface::class),
|
||||
$userAccountService ?? $this->createMock(UserAccountService::class),
|
||||
$userTenantContextService ?? $this->createMock(UserTenantContextService::class),
|
||||
$rememberMeService ?? $this->createMock(RememberMeService::class),
|
||||
$emailVerificationService ?? $this->createMock(EmailVerificationService::class),
|
||||
$permissionGateway ?? $this->createMock(AuthPermissionGateway::class),
|
||||
$tenantSsoGateway ?? $this->createMock(AuthTenantSsoGateway::class),
|
||||
$authSessionTenantContextService ?? $this->createMock(AuthSessionTenantContextService::class),
|
||||
$systemAuditService ?? $this->createMock(SystemAuditService::class),
|
||||
$sessionStore ?? $this->createMock(SessionStoreInterface::class)
|
||||
);
|
||||
}
|
||||
}
|
||||
483
tests/Service/Auth/RememberMeServiceTest.php
Normal file
483
tests/Service/Auth/RememberMeServiceTest.php
Normal file
@@ -0,0 +1,483 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Tests\Service\Auth;
|
||||
|
||||
use MintyPHP\Http\CookieStoreInterface;
|
||||
use MintyPHP\Http\RequestRuntimeInterface;
|
||||
use MintyPHP\Http\SessionStoreInterface;
|
||||
use MintyPHP\Repository\Auth\RememberTokenRepositoryInterface;
|
||||
use MintyPHP\Repository\User\UserReadRepositoryInterface;
|
||||
use MintyPHP\Repository\User\UserWriteRepositoryInterface;
|
||||
use MintyPHP\Service\Auth\AuthPermissionGateway;
|
||||
use MintyPHP\Service\Auth\AuthSessionTenantContextService;
|
||||
use MintyPHP\Service\Auth\RememberMeService;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
class RememberMeServiceTest extends TestCase
|
||||
{
|
||||
// ---------------------------------------------------------------
|
||||
// rememberUser — creates token and sets cookie
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testRememberUserCreatesTokenAndSetsCookie(): void
|
||||
{
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->expects($this->once())
|
||||
->method('create')
|
||||
->with(
|
||||
42,
|
||||
$this->callback(fn (string $s): bool => strlen($s) === 24),
|
||||
$this->callback(fn (string $h): bool => strlen($h) === 64),
|
||||
$this->callback(fn (string $e): bool => strtotime($e . ' UTC') > time())
|
||||
)
|
||||
->willReturn(1);
|
||||
|
||||
$cookieStore = $this->createMock(CookieStoreInterface::class);
|
||||
$cookieStore->expects($this->once())
|
||||
->method('set')
|
||||
->with(
|
||||
'remember',
|
||||
$this->callback(fn (string $v): bool => str_contains($v, ':')),
|
||||
$this->callback(fn (array $opts): bool => ($opts['httponly'] ?? false) === true
|
||||
&& ($opts['samesite'] ?? '') === 'Lax')
|
||||
);
|
||||
|
||||
$service = $this->newService(tokenRepository: $tokenRepo, cookieStore: $cookieStore);
|
||||
$service->rememberUser(42);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — already logged in
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginReturnsFalseWhenAlreadyLoggedIn(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], ['id' => 1]],
|
||||
]);
|
||||
|
||||
$service = $this->newService(sessionStore: $session);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — no cookie
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginReturnsFalseWhenNoCookie(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('');
|
||||
|
||||
$service = $this->newService(sessionStore: $session, cookieStore: $cookie);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — malformed cookie (no colon)
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginReturnsFalseForMalformedCookieWithoutColon(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('no-colon-value');
|
||||
|
||||
$service = $this->newService(sessionStore: $session, cookieStore: $cookie);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — empty selector or token after split
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginClearsCookieWhenSelectorIsEmpty(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn(':sometoken');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$service = $this->newService(sessionStore: $session, cookieStore: $cookie);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — selector not found in DB
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginClearsCookieWhenSelectorNotFoundInDb(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:token');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn(null);
|
||||
|
||||
$service = $this->newService(sessionStore: $session, cookieStore: $cookie, tokenRepository: $tokenRepo);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — expired token
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginDeletesTokenAndClearsCookieWhenExpired(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:token');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn([
|
||||
'id' => 10,
|
||||
'user_id' => 5,
|
||||
'token_hash' => hash('sha256', 'token'),
|
||||
'expires_at' => gmdate('Y-m-d H:i:s', time() - 3600),
|
||||
]);
|
||||
$tokenRepo->expects($this->once())->method('deleteById')->with(10);
|
||||
|
||||
$service = $this->newService(sessionStore: $session, cookieStore: $cookie, tokenRepository: $tokenRepo);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — invalid token hash (tampered)
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginDeletesTokenWhenHashMismatch(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:wrong-token');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn([
|
||||
'id' => 10,
|
||||
'user_id' => 5,
|
||||
'token_hash' => hash('sha256', 'correct-token'),
|
||||
'expires_at' => gmdate('Y-m-d H:i:s', time() + 3600),
|
||||
]);
|
||||
$tokenRepo->expects($this->once())->method('deleteById')->with(10);
|
||||
|
||||
$service = $this->newService(sessionStore: $session, cookieStore: $cookie, tokenRepository: $tokenRepo);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — user not found or inactive
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginDeletesTokenWhenUserNotFound(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:token');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenHash = hash('sha256', 'token');
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn([
|
||||
'id' => 10,
|
||||
'user_id' => 5,
|
||||
'token_hash' => $tokenHash,
|
||||
'expires_at' => gmdate('Y-m-d H:i:s', time() + 3600),
|
||||
]);
|
||||
$tokenRepo->expects($this->once())->method('deleteById')->with(10);
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(null);
|
||||
|
||||
$service = $this->newService(
|
||||
sessionStore: $session,
|
||||
cookieStore: $cookie,
|
||||
tokenRepository: $tokenRepo,
|
||||
userReadRepository: $userRead
|
||||
);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
public function testAutoLoginDeletesTokenWhenUserInactive(): void
|
||||
{
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
]);
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:token');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenHash = hash('sha256', 'token');
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn([
|
||||
'id' => 10,
|
||||
'user_id' => 5,
|
||||
'token_hash' => $tokenHash,
|
||||
'expires_at' => gmdate('Y-m-d H:i:s', time() + 3600),
|
||||
]);
|
||||
$tokenRepo->expects($this->once())->method('deleteById')->with(10);
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 0]);
|
||||
|
||||
$service = $this->newService(
|
||||
sessionStore: $session,
|
||||
cookieStore: $cookie,
|
||||
tokenRepository: $tokenRepo,
|
||||
userReadRepository: $userRead
|
||||
);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — success with token rotation
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginSucceedsAndRotatesToken(): void
|
||||
{
|
||||
$_SESSION = [];
|
||||
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnMap([
|
||||
['user', [], []],
|
||||
['no_active_tenant', false, false],
|
||||
]);
|
||||
$session->expects($this->once())->method('set');
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:token');
|
||||
$cookie->expects($this->once())->method('set')
|
||||
->with('remember', $this->callback(fn (string $v): bool => str_starts_with($v, 'selector:')), $this->anything());
|
||||
|
||||
$tokenHash = hash('sha256', 'token');
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn([
|
||||
'id' => 10,
|
||||
'user_id' => 5,
|
||||
'token_hash' => $tokenHash,
|
||||
'expires_at' => gmdate('Y-m-d H:i:s', time() + 86400),
|
||||
]);
|
||||
$tokenRepo->expects($this->once())->method('updateToken')
|
||||
->with(10, $this->callback(fn (string $h): bool => strlen($h) === 64), $this->anything());
|
||||
$tokenRepo->expects($this->never())->method('deleteById');
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);
|
||||
|
||||
$permGateway = $this->createMock(AuthPermissionGateway::class);
|
||||
$permGateway->expects($this->once())->method('warmUserPermissions')->with(5, true);
|
||||
|
||||
$tenantCtx = $this->createMock(AuthSessionTenantContextService::class);
|
||||
$tenantCtx->expects($this->once())->method('hydrateForUser')->with(5);
|
||||
|
||||
$userWrite = $this->createMock(UserWriteRepositoryInterface::class);
|
||||
$userWrite->expects($this->once())->method('updateLastLogin')->with(5, 'local');
|
||||
|
||||
$service = $this->newService(
|
||||
sessionStore: $session,
|
||||
cookieStore: $cookie,
|
||||
tokenRepository: $tokenRepo,
|
||||
userReadRepository: $userRead,
|
||||
userWriteRepository: $userWrite,
|
||||
permissionGateway: $permGateway,
|
||||
authSessionTenantContextService: $tenantCtx
|
||||
);
|
||||
$this->assertTrue($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// autoLoginFromCookie — no active tenant triggers logout
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testAutoLoginLogsOutWhenNoActiveTenant(): void
|
||||
{
|
||||
$_SESSION = [];
|
||||
|
||||
$session = $this->createMock(SessionStoreInterface::class);
|
||||
$session->method('get')->willReturnCallback(function (string $key, mixed $default) {
|
||||
if ($key === 'user') {
|
||||
return [];
|
||||
}
|
||||
if ($key === 'no_active_tenant') {
|
||||
return true;
|
||||
}
|
||||
return $default;
|
||||
});
|
||||
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('selector:token');
|
||||
|
||||
$tokenHash = hash('sha256', 'token');
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn([
|
||||
'id' => 10,
|
||||
'user_id' => 5,
|
||||
'token_hash' => $tokenHash,
|
||||
'expires_at' => gmdate('Y-m-d H:i:s', time() + 86400),
|
||||
]);
|
||||
|
||||
$userRead = $this->createMock(UserReadRepositoryInterface::class);
|
||||
$userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);
|
||||
|
||||
$service = $this->newService(
|
||||
sessionStore: $session,
|
||||
cookieStore: $cookie,
|
||||
tokenRepository: $tokenRepo,
|
||||
userReadRepository: $userRead
|
||||
);
|
||||
$this->assertFalse($service->autoLoginFromCookie());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// forgetCurrentUser
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testForgetCurrentUserDeletesTokenAndClearsCookie(): void
|
||||
{
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('sel:tok');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->method('findBySelector')->willReturn(['id' => 7]);
|
||||
$tokenRepo->expects($this->once())->method('deleteById')->with(7);
|
||||
|
||||
$service = $this->newService(cookieStore: $cookie, tokenRepository: $tokenRepo);
|
||||
$service->forgetCurrentUser();
|
||||
}
|
||||
|
||||
public function testForgetCurrentUserDoesNothingWhenNoCookie(): void
|
||||
{
|
||||
$cookie = $this->createMock(CookieStoreInterface::class);
|
||||
$cookie->method('get')->willReturn('');
|
||||
$cookie->expects($this->once())->method('remove');
|
||||
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->expects($this->never())->method('findBySelector');
|
||||
$tokenRepo->expects($this->never())->method('deleteById');
|
||||
|
||||
$service = $this->newService(cookieStore: $cookie, tokenRepository: $tokenRepo);
|
||||
$service->forgetCurrentUser();
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// forgetAllForUser
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testForgetAllForUserDelegatesToRepository(): void
|
||||
{
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->expects($this->once())->method('deleteByUserId')->with(42);
|
||||
|
||||
$service = $this->newService(tokenRepository: $tokenRepo);
|
||||
$service->forgetAllForUser(42);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// expireAllTokensByAdmin
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
public function testExpireAllTokensByAdminDelegatesToRepository(): void
|
||||
{
|
||||
$tokenRepo = $this->createMock(RememberTokenRepositoryInterface::class);
|
||||
$tokenRepo->expects($this->once())->method('expireAllByAdmin')->willReturn(15);
|
||||
|
||||
$service = $this->newService(tokenRepository: $tokenRepo);
|
||||
$this->assertSame(15, $service->expireAllTokensByAdmin());
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------
|
||||
// Helper
|
||||
// ---------------------------------------------------------------
|
||||
|
||||
private function newService(
|
||||
?UserReadRepositoryInterface $userReadRepository = null,
|
||||
?UserWriteRepositoryInterface $userWriteRepository = null,
|
||||
?RememberTokenRepositoryInterface $tokenRepository = null,
|
||||
?AuthPermissionGateway $permissionGateway = null,
|
||||
?AuthSessionTenantContextService $authSessionTenantContextService = null,
|
||||
?SessionStoreInterface $sessionStore = null,
|
||||
?CookieStoreInterface $cookieStore = null,
|
||||
?RequestRuntimeInterface $requestRuntime = null
|
||||
): RememberMeService {
|
||||
// RequestRuntimeInterface has a method named "method()" which PHPUnit 12
|
||||
// cannot mock (reserved name). Use a simple anonymous-class stub instead.
|
||||
$requestRuntime ??= new class () implements RequestRuntimeInterface {
|
||||
public function method(): string
|
||||
{
|
||||
return 'GET';
|
||||
}
|
||||
|
||||
public function path(): string
|
||||
{
|
||||
return '/';
|
||||
}
|
||||
|
||||
public function ip(): string
|
||||
{
|
||||
return '127.0.0.1';
|
||||
}
|
||||
|
||||
public function userAgent(): string
|
||||
{
|
||||
return 'test';
|
||||
}
|
||||
|
||||
public function queryParams(): array
|
||||
{
|
||||
return [];
|
||||
}
|
||||
|
||||
public function isSecure(): bool
|
||||
{
|
||||
return false;
|
||||
}
|
||||
};
|
||||
|
||||
return new RememberMeService(
|
||||
$userReadRepository ?? $this->createMock(UserReadRepositoryInterface::class),
|
||||
$userWriteRepository ?? $this->createMock(UserWriteRepositoryInterface::class),
|
||||
$tokenRepository ?? $this->createMock(RememberTokenRepositoryInterface::class),
|
||||
$permissionGateway ?? $this->createMock(AuthPermissionGateway::class),
|
||||
$authSessionTenantContextService ?? $this->createMock(AuthSessionTenantContextService::class),
|
||||
$sessionStore ?? $this->createMock(SessionStoreInterface::class),
|
||||
$cookieStore ?? $this->createMock(CookieStoreInterface::class),
|
||||
$requestRuntime
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user