119 lines
4.8 KiB
PHP
119 lines
4.8 KiB
PHP
<?php
|
|
|
|
namespace Unit\app\Core\Middleware;
|
|
|
|
use Leantime\Core\Http\IncomingRequest;
|
|
use Leantime\Core\Middleware\AuthCheck;
|
|
use Leantime\Domain\Api\Services\Api;
|
|
use Leantime\Domain\Users\Services\Users;
|
|
|
|
/**
|
|
* Guards the Bearer-auth regression (3.9.0): the permission engine reads the user's id + role from
|
|
* session('userdata'), which the x-api-key guard establishes as a side effect of getAPIKeyUser()
|
|
* but the Sanctum (Bearer) guard never did — so every gated @api method denied Bearer requests.
|
|
* establishApiUserSession() makes the API auth path uniform: any guard that resolves a user has the
|
|
* same userdata built from the canonical user row, through the same setApiUserSession() builder.
|
|
*
|
|
* This tests the middleware's responsibility — resolve the user id, fetch the canonical row, and
|
|
* hand it to the session builder, idempotently. The builder itself is covered by ApiServiceTest.
|
|
*/
|
|
class AuthCheckTest extends \Unit\TestCase
|
|
{
|
|
use \Codeception\Test\Feature\Stub;
|
|
|
|
/**
|
|
* A request whose user() resolver returns an object with the given id — i.e. a guard (Sanctum
|
|
* or x-api-key) has authenticated, but userdata has not been established yet.
|
|
*/
|
|
private function apiRequestForUser(int $userId): IncomingRequest
|
|
{
|
|
$request = IncomingRequest::create('/api/jsonrpc', 'POST');
|
|
$request->setUserResolver(fn () => (object) ['id' => $userId]);
|
|
|
|
return $request;
|
|
}
|
|
|
|
/** Invoke the protected establishApiUserSession() on a constructor-less AuthCheck. */
|
|
private function establish(IncomingRequest $request): void
|
|
{
|
|
$authCheck = $this->make(AuthCheck::class);
|
|
(fn () => $this->establishApiUserSession($request))->call($authCheck);
|
|
}
|
|
|
|
public function test_establishes_userdata_from_the_canonical_row_when_missing(): void
|
|
{
|
|
session()->forget('userdata');
|
|
|
|
$row = ['id' => 42, 'firstname' => 'Gloria', 'role' => 20];
|
|
|
|
app()->instance(Users::class, $this->make(Users::class, [
|
|
'getUser' => fn ($id = null) => (int) $id === 42 ? $row : false,
|
|
]));
|
|
|
|
$captured = null;
|
|
app()->instance(Api::class, $this->make(Api::class, [
|
|
'setApiUserSession' => function (array $user, bool $isExternalAuth = false) use (&$captured) {
|
|
$captured = ['user' => $user, 'external' => $isExternalAuth];
|
|
},
|
|
]));
|
|
|
|
$this->establish($this->apiRequestForUser(42));
|
|
|
|
$this->assertSame($row, $captured['user'] ?? null, 'the canonical row must be handed to the session builder');
|
|
$this->assertTrue($captured['external'] ?? false, 'API sessions are external auth');
|
|
}
|
|
|
|
public function test_is_idempotent_when_userdata_already_exists(): void
|
|
{
|
|
// x-api-key (and stateful web) already populated userdata before this runs — leave it,
|
|
// and never re-resolve the user.
|
|
session(['userdata' => ['id' => 7, 'role' => 'admin']]);
|
|
|
|
app()->instance(Users::class, $this->make(Users::class, [
|
|
'getUser' => function ($id = null) {
|
|
$this->fail('must not re-resolve the user when userdata already exists');
|
|
},
|
|
]));
|
|
|
|
$called = false;
|
|
app()->instance(Api::class, $this->make(Api::class, [
|
|
'setApiUserSession' => function (array $user, bool $isExternalAuth = false) use (&$called) {
|
|
$called = true;
|
|
},
|
|
]));
|
|
|
|
$this->establish($this->apiRequestForUser(42));
|
|
|
|
$this->assertFalse($called, 'must not rebuild an already-established session');
|
|
$this->assertSame(7, session('userdata.id'), 'existing userdata must be left untouched');
|
|
}
|
|
|
|
/**
|
|
* The mobile SSO exchange (/oidc/mobile/exchange) arrives with no session
|
|
* cookie — the validated one-time code + PKCE verifier are the authorization —
|
|
* so it must be allow-listed as public. Guards that allow-list from regressing.
|
|
*/
|
|
public function test_oidc_mobile_exchange_is_a_public_route(): void
|
|
{
|
|
$authCheck = $this->make(AuthCheck::class);
|
|
|
|
$this->assertTrue(
|
|
$authCheck->isPublicController('oidc.mobile.exchange'),
|
|
'the mobile exchange endpoint must be public (no session at exchange time)'
|
|
);
|
|
|
|
// Negative control: an oidc sub-route that is NOT allow-listed stays private.
|
|
$this->assertFalse($authCheck->isPublicController('oidc.settings.save'));
|
|
}
|
|
|
|
public function test_status_discovery_is_a_public_route(): void
|
|
{
|
|
$authCheck = $this->make(AuthCheck::class);
|
|
|
|
// The mobile app hits /status unauthenticated at connect time to discover
|
|
// login methods, so the route must be public.
|
|
$this->assertTrue($authCheck->isPublicController('status.index'));
|
|
$this->assertTrue($authCheck->isPublicController('status'));
|
|
}
|
|
}
|