253 lines
15 KiB
PHP
253 lines
15 KiB
PHP
<?php
|
|
|
|
namespace Acceptance\API;
|
|
|
|
use Codeception\Attribute\Group;
|
|
use PHPUnit\Framework\Assert;
|
|
use Tests\Support\AcceptanceTester;
|
|
use Tests\Support\Page\Acceptance\Install;
|
|
|
|
/**
|
|
* Bearer-token JSON-RPC contract test.
|
|
*
|
|
* Sibling to ApiCest (x-api-key auth). Exists because the JSON-RPC endpoint accepts three auth
|
|
* modes (session cookie, x-api-key, Bearer token) and only the first two had coverage. The Bearer
|
|
* path is what the mobile app + any AdvancedAuth integrator hits, and a permission-engine deploy in
|
|
* 2026-06 silently broke it (every gated read 401'd) without CI noticing.
|
|
*
|
|
* Each test is self-contained: the minted token lives in zp_access_tokens and the Db module deletes
|
|
* haveInDatabase() rows after each test, so a method keeps everything it needs alive within itself
|
|
* (a multi-method #[Depends] chain would lose the token between the mint and the assertions). Each
|
|
* authed call asserts 200, JSON, and NOT a -32001 permission denial — that last assertion is the
|
|
* regression gate.
|
|
*
|
|
* Two scenarios:
|
|
* - bearerAuthHonorsGatedReads — the OWNER (role 50). Owner short-circuits project-role resolution.
|
|
* - nonManagerBearerHonorsProjectScopedReads — an EDITOR (role 20). Sub-manager roles run a wholly
|
|
* different authorization path (getProjectRole + isUserAssignedToProject + a resolved projectId),
|
|
* which owner-only testing never exercises. This is the path that would silently break for real
|
|
* non-admin mobile users.
|
|
*/
|
|
class BearerApiCest
|
|
{
|
|
private string $bearerToken;
|
|
|
|
public function _before(AcceptanceTester $I, Install $installPage)
|
|
{
|
|
// Fresh install — same fixture as ApiCest so this Cest can run standalone or alongside it.
|
|
$installPage->install('test@leantime.io', 'Test123456!', 'John', 'Smith', 'Smith & Co');
|
|
}
|
|
|
|
#[Group('bearer-api')]
|
|
public function bearerAuthHonorsGatedReads(AcceptanceTester $I)
|
|
{
|
|
// 1) No bearer → 401. Done first, before any Authorization header is set (Codeception
|
|
// headers are sticky across requests within a test).
|
|
$I->haveHttpHeader('Content-Type', 'application/json');
|
|
$I->sendPost('/api/jsonrpc', json_encode([
|
|
'jsonrpc' => '2.0',
|
|
'method' => 'leantime.rpc.Tickets.Tickets.getAllOpenUserTickets',
|
|
'params' => new \stdClass,
|
|
'id' => 1,
|
|
], JSON_THROW_ON_ERROR));
|
|
$I->seeResponseCodeIs(401);
|
|
|
|
// 2) Mint a Bearer token directly in the DB — no UI flow, no AdvancedAuth plugin. A token
|
|
// is just a random string whose sha256 is stored in zp_access_tokens, exactly as
|
|
// AccessTokenRepository::createToken persists it. (Done via the Db module because the
|
|
// Laravel container is not reliably bootstrapped against the test DB in the acceptance
|
|
// process, so app()->getUserByEmail() resolves the wrong connection.)
|
|
$userId = $I->grabFromDatabase('zp_user', 'id', ['username' => 'test@leantime.io']);
|
|
Assert::assertNotEmpty($userId, 'Test user not found after install');
|
|
|
|
$this->bearerToken = bin2hex(random_bytes(20)); // 40-char opaque token
|
|
$I->haveInDatabase('zp_access_tokens', [
|
|
'tokenable_type' => 'Leantime\\Domain\\Auth\\Services\\Auth',
|
|
'tokenable_id' => (int) $userId,
|
|
'name' => 'bearer-api-cest',
|
|
'token' => hash('sha256', $this->bearerToken),
|
|
'abilities' => json_encode(['*']),
|
|
'created_at' => date('Y-m-d H:i:s'),
|
|
]);
|
|
|
|
// 3) Gated reads over Bearer must all resolve (200, no -32001).
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Users.Users.getUser', new \stdClass);
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Projects.Projects.getProjectsUserHasAccessTo', new \stdClass);
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Tickets.Tickets.getAllOpenUserTickets', new \stdClass);
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Notifications.Notifications.getUnreadCount', new \stdClass);
|
|
|
|
// 4) The exact pair that broke mobile: create a ticket, then fetch it by id.
|
|
// quickAddTicket($params) takes a single array argument literally named "params".
|
|
$created = $this->rpc($I, 'leantime.rpc.Tickets.Tickets.quickAddTicket', [
|
|
'params' => ['headline' => 'Bearer-auth contract test', 'projectId' => 1],
|
|
]);
|
|
$newId = $created['result'] ?? null;
|
|
Assert::assertIsInt($newId, 'quickAddTicket should return an int id, got: '.json_encode($created));
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Tickets.Tickets.getTicket', ['id' => $newId]);
|
|
|
|
// 5) Entity-scoped comments resolve the project from (module, moduleId).
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Comments.Comments.getComments', ['module' => 'ticket', 'moduleId' => 1]);
|
|
|
|
// 6) Session-scoped mobile endpoints: no userId param, the caller is resolved from the
|
|
// token. These previously 404'd on mobile because the userId-taking originals are
|
|
// deliberately NOT @api (IDOR guard); the session-scoped siblings are the fix.
|
|
// getInbox is the inbox list (getAllNotifications stays non-@api — it takes a $userId).
|
|
$inbox = $this->rpc($I, 'leantime.rpc.Notifications.Notifications.getInbox', new \stdClass);
|
|
Assert::assertArrayNotHasKey('error', $inbox, 'getInbox must be exposed + session-scoped: '.json_encode($inbox));
|
|
Assert::assertIsArray($inbox['result'] ?? null, 'getInbox should return an array: '.json_encode($inbox));
|
|
|
|
// getExternalCalendarEvents (subscribed iCal feeds) is already session-scoped; it only
|
|
// lacked the @api tag. No external calendars on a fresh install => an empty array.
|
|
$extEvents = $this->rpc($I, 'leantime.rpc.Calendar.Calendar.getExternalCalendarEvents', new \stdClass);
|
|
Assert::assertArrayNotHasKey('error', $extEvents, 'getExternalCalendarEvents must be exposed: '.json_encode($extEvents));
|
|
Assert::assertIsArray($extEvents['result'] ?? null, 'getExternalCalendarEvents should return an array: '.json_encode($extEvents));
|
|
|
|
// getICalUrl is now exposed too. It legitimately errors with -32602 when the user has no
|
|
// iCal feed configured yet, so a valid response is EITHER a URL string OR -32602 — but
|
|
// NEVER -32601 (method-not-found regression) or -32001 (permission regression).
|
|
$icalUrl = $this->rpc($I, 'leantime.rpc.Calendar.Calendar.getICalUrl', new \stdClass);
|
|
$icalErr = $icalUrl['error']['code'] ?? null;
|
|
Assert::assertNotSame(-32601, $icalErr, 'getICalUrl must be exposed via @api (not method-not-found): '.json_encode($icalUrl));
|
|
Assert::assertNotSame(-32001, $icalErr, 'getICalUrl must not be permission-denied for the owner: '.json_encode($icalUrl));
|
|
Assert::assertTrue(
|
|
array_key_exists('result', $icalUrl) || $icalErr === -32602,
|
|
'getICalUrl should return a URL or -32602 (no feed configured): '.json_encode($icalUrl)
|
|
);
|
|
}
|
|
|
|
#[Group('bearer-api')]
|
|
public function nonManagerBearerHonorsProjectScopedReads(AcceptanceTester $I)
|
|
{
|
|
// A non-manager (editor, role 20) assigned to a project. Unlike the owner, this role does
|
|
// NOT short-circuit effectiveRoleForProject() — it exercises getProjectRole() +
|
|
// isUserAssignedToProject() + a resolved project role over Bearer. That path only works
|
|
// when the session role context is correctly established (the regression), so this is the
|
|
// guard for "works for the owner but -32001s for real non-admin users."
|
|
$ownerProjectId = (int) $I->grabFromDatabase('zp_projects', 'id', ['name' => 'My Project']);
|
|
Assert::assertNotEmpty($ownerProjectId, 'Seed project not found after install');
|
|
|
|
$editorId = (int) $I->haveInDatabase('zp_user', [
|
|
'firstname' => 'Ed',
|
|
'lastname' => 'Itor',
|
|
'username' => 'editor@leantime.io',
|
|
'password' => 'x',
|
|
'role' => '20',
|
|
'status' => 'A',
|
|
'createdOn' => date('Y-m-d H:i:s'),
|
|
]);
|
|
$I->haveInDatabase('zp_relationuserproject', [
|
|
'userId' => $editorId,
|
|
'projectId' => $ownerProjectId,
|
|
'projectRole' => '',
|
|
]);
|
|
|
|
$this->bearerToken = bin2hex(random_bytes(20));
|
|
$I->haveInDatabase('zp_access_tokens', [
|
|
'tokenable_type' => 'Leantime\\Domain\\Auth\\Services\\Auth',
|
|
'tokenable_id' => $editorId,
|
|
'name' => 'bearer-api-cest-editor',
|
|
'token' => hash('sha256', $this->bearerToken),
|
|
'abilities' => json_encode(['*']),
|
|
'created_at' => date('Y-m-d H:i:s'),
|
|
]);
|
|
|
|
// Cross-project "my work" read (no projectId) + a project-scoped read by id, both as the
|
|
// editor over Bearer. Must resolve (200, no -32001).
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Tickets.Tickets.getAllOpenUserTickets', new \stdClass);
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Projects.Projects.getProject', ['id' => $ownerProjectId]);
|
|
$this->assertRpcSucceeds($I, 'leantime.rpc.Projects.Projects.getProjectProgress', ['projectId' => $ownerProjectId]);
|
|
|
|
// Cross-project "my work" with the projectId=0 sentinel mobile sends — must actually
|
|
// SUCCEED, not just avoid -32001 (it previously -32001'd on 0 / -32602 when omitted, for
|
|
// every role incl. owner). Assert no error at all + an array result, so a regression to any
|
|
// error code (not only -32001) fails the test.
|
|
$body = $this->rpc($I, 'leantime.rpc.Tickets.Tickets.getOpenUserTicketsThisWeekAndLater', ['userId' => $editorId, 'projectId' => 0]);
|
|
Assert::assertArrayNotHasKey('error', $body, 'projectId=0 cross-project read must not error: '.json_encode($body));
|
|
Assert::assertIsArray($body['result'] ?? null, 'expected an array result, got: '.json_encode($body));
|
|
|
|
// markTicketDone (mobile swipe-complete) must be EXPOSED (was -32601) AND succeed for the
|
|
// assigned editor. Assert no error + result true, so a regression to -32601/-32602/false is
|
|
// caught — assertRpcSucceeds (absence of -32001 only) would not catch those.
|
|
$assignedTicketId = (int) $I->grabFromDatabase('zp_tickets', 'id', ['projectId' => $ownerProjectId]);
|
|
Assert::assertNotEmpty($assignedTicketId, 'Seed ticket not found in project');
|
|
$done = $this->rpc($I, 'leantime.rpc.Tickets.Tickets.markTicketDone', ['id' => $assignedTicketId]);
|
|
Assert::assertArrayNotHasKey('error', $done, 'markTicketDone must be exposed + authorized: '.json_encode($done));
|
|
Assert::assertTrue($done['result'] ?? false, 'markTicketDone should return true: '.json_encode($done));
|
|
|
|
// getMyCalendar is the session-scoped calendar feed (getCalendar itself trusts a userId and
|
|
// stays non-@api). Its calendar.view gate is project-scoped, but on an API call there is no
|
|
// session project, so it resolves capability-only against the effective role — which a
|
|
// non-manager editor holds (calendar.view is readonly+). This is the exact path that would
|
|
// -32001 if a project-scoped gate fell closed on a null project, so prove it resolves for a
|
|
// non-manager, not just the owner.
|
|
$cal = $this->rpc($I, 'leantime.rpc.Calendar.Calendar.getMyCalendar', new \stdClass);
|
|
Assert::assertArrayNotHasKey('error', $cal, 'getMyCalendar must resolve for a non-manager editor: '.json_encode($cal));
|
|
Assert::assertIsArray($cal['result'] ?? null, 'getMyCalendar should return an array: '.json_encode($cal));
|
|
|
|
// And the inbox list resolves for the editor too (session-scoped, ungated).
|
|
$editorInbox = $this->rpc($I, 'leantime.rpc.Notifications.Notifications.getInbox', new \stdClass);
|
|
Assert::assertArrayNotHasKey('error', $editorInbox, 'getInbox must resolve for a non-manager editor: '.json_encode($editorInbox));
|
|
Assert::assertIsArray($editorInbox['result'] ?? null, 'getInbox should return an array: '.json_encode($editorInbox));
|
|
|
|
// IDOR guard: markNotificationUnread is session-scoped (matches on (id, session user)).
|
|
// Seed a notification owned by the OWNER, read=1, then — as the editor — try to flip it
|
|
// unread by its id. With the previous unscoped where('id') update this would succeed; now
|
|
// it must NOT: the result is false and the row stays read.
|
|
$ownerId = (int) $I->grabFromDatabase('zp_user', 'id', ['username' => 'test@leantime.io']);
|
|
$ownerNotifId = (int) $I->haveInDatabase('zp_notifications', [
|
|
'userId' => $ownerId,
|
|
'read' => 1,
|
|
'type' => 'mention',
|
|
'module' => 'ticket',
|
|
'moduleId' => 1,
|
|
'message' => 'owner-only notification',
|
|
'datetime' => date('Y-m-d H:i:s'),
|
|
'url' => '',
|
|
'authorId' => $ownerId,
|
|
]);
|
|
// result === false proves the IDOR is closed: the session-scoped repo matched (id, editor)
|
|
// => 0 rows => update affected nothing. (A DB read-back is avoided here because `read` is a
|
|
// MySQL reserved word and Codeception's grabFromDatabase doesn't quote the column.)
|
|
$unread = $this->rpc($I, 'leantime.rpc.Notifications.Notifications.markNotificationUnread', ['id' => $ownerNotifId]);
|
|
Assert::assertArrayNotHasKey('error', $unread, 'markNotificationUnread should respond cleanly: '.json_encode($unread));
|
|
Assert::assertFalse($unread['result'] ?? true, 'editor must NOT mark the owner\'s notification unread (IDOR): '.json_encode($unread));
|
|
}
|
|
|
|
/** POST /api/jsonrpc with the test bearer + method, return the decoded body. */
|
|
private function rpc(AcceptanceTester $I, string $method, array|\stdClass $params): array
|
|
{
|
|
$I->haveHttpHeader('Content-Type', 'application/json');
|
|
$I->haveHttpHeader('Authorization', 'Bearer '.$this->bearerToken);
|
|
|
|
// JSON string body (not a PHP array): an array body with a stdClass param makes
|
|
// Codeception's REST module form-encode it, so it never arrives as JSON-RPC.
|
|
$I->sendPost('/api/jsonrpc', json_encode([
|
|
'jsonrpc' => '2.0',
|
|
'method' => $method,
|
|
'params' => $params,
|
|
'id' => 1,
|
|
], JSON_THROW_ON_ERROR));
|
|
|
|
$I->seeResponseCodeIs(200);
|
|
$I->seeResponseIsJson();
|
|
|
|
return json_decode($I->grabResponse(), true) ?? [];
|
|
}
|
|
|
|
/**
|
|
* Assert a Bearer call is NOT denied by the permission engine (-32001). Other engine codes
|
|
* (e.g. -32602 invalid params) are out of scope — this gates auth → user-context → project-role
|
|
* on the Bearer path, not method correctness. A -32001 here is the regression.
|
|
*/
|
|
private function assertRpcSucceeds(AcceptanceTester $I, string $method, array|\stdClass $params): void
|
|
{
|
|
$body = $this->rpc($I, $method, $params);
|
|
|
|
Assert::assertNotSame(
|
|
-32001,
|
|
$body['error']['code'] ?? null,
|
|
sprintf('Bearer-auth call to %s was denied by the permission engine (-32001). Response: %s', $method, json_encode($body))
|
|
);
|
|
}
|
|
}
|