118 lines
4.7 KiB
PHP
118 lines
4.7 KiB
PHP
<?php
|
|
|
|
namespace Unit\app\Core\Middleware;
|
|
|
|
use Leantime\Core\Configuration\AppSettings;
|
|
use Leantime\Core\Http\IncomingRequest;
|
|
use Leantime\Core\Middleware\Updated;
|
|
use Leantime\Domain\Setting\Repositories\Setting as SettingRepository;
|
|
|
|
/**
|
|
* Guards the stale-session redirect loop: the Updated middleware caches the
|
|
* db-version in the session and (before the fix) never re-read the database
|
|
* once a value was cached. After an admin ran an update in THEIR session,
|
|
* every other live session kept the old cached version, concluded "not
|
|
* updated", and bounced between every page and /install/update until the
|
|
* user's cookies were cleared.
|
|
*
|
|
* The fix self-heals: when a CACHED value would trigger the redirect, the
|
|
* middleware re-reads the real version from the database first — one extra
|
|
* query, only on the would-redirect path.
|
|
*/
|
|
class UpdatedTest extends \Unit\TestCase
|
|
{
|
|
use \Codeception\Test\Feature\Stub;
|
|
|
|
private function appSettings(string $codeVersion): void
|
|
{
|
|
$settings = new AppSettings;
|
|
$settings->dbVersion = $codeVersion;
|
|
app()->instance(AppSettings::class, $settings);
|
|
}
|
|
|
|
/** @param array<int, string|false> $dbVersions consecutive getSetting('db-version') results */
|
|
private function settingRepo(array $dbVersions, ?int &$reads = null): void
|
|
{
|
|
$reads = 0;
|
|
app()->instance(SettingRepository::class, $this->make(SettingRepository::class, [
|
|
// Mirrors the real signature so forwarded arguments can't ever
|
|
// make the stub brittle.
|
|
'getSetting' => function (string $type = 'db-version') use (&$reads, $dbVersions) {
|
|
$value = $dbVersions[min($reads, count($dbVersions) - 1)];
|
|
$reads++;
|
|
|
|
return $value;
|
|
},
|
|
]));
|
|
}
|
|
|
|
/** Run the middleware; returns [response, nextWasCalled]. */
|
|
private function handleRequest(): array
|
|
{
|
|
// The redirect path resolves Frontcontroller from the container; its
|
|
// real constructor needs the full HTTP stack, so bind a bare instance
|
|
// (its redirect()/getCurrentRoute() members are static and work as-is).
|
|
app()->instance(
|
|
\Leantime\Core\Controller\Frontcontroller::class,
|
|
$this->make(\Leantime\Core\Controller\Frontcontroller::class)
|
|
);
|
|
|
|
$called = false;
|
|
$response = (new Updated)->handle(
|
|
IncomingRequest::create('/dashboard/home', 'GET'),
|
|
function () use (&$called) {
|
|
$called = true;
|
|
|
|
return new \Symfony\Component\HttpFoundation\Response('ok');
|
|
}
|
|
);
|
|
|
|
return [$response, $called];
|
|
}
|
|
|
|
public function test_stale_session_cache_self_heals_after_an_update_ran_elsewhere(): void
|
|
{
|
|
// Session still remembers 3.5.25 from before the admin upgraded; the
|
|
// DATABASE already says 3.5.26 (matching the code). The middleware
|
|
// must re-read and pass through — not redirect-loop the user.
|
|
session(['dbVersion' => '3.5.25', 'isUpdated' => false]);
|
|
$this->appSettings('3.5.26');
|
|
$this->settingRepo(['3.5.26'], $reads);
|
|
|
|
[, $nextCalled] = $this->handleRequest();
|
|
|
|
$this->assertTrue($nextCalled, 'a session whose cache is stale but whose DB is current must pass through');
|
|
$this->assertSame(1, $reads, 'the DB is consulted exactly once to heal the cache');
|
|
$this->assertSame('3.5.26', session('dbVersion'), 'the healed version is re-cached');
|
|
$this->assertTrue(session('isUpdated'));
|
|
}
|
|
|
|
public function test_current_session_cache_passes_through_without_touching_the_db(): void
|
|
{
|
|
session(['dbVersion' => '3.5.26', 'isUpdated' => true]);
|
|
$this->appSettings('3.5.26');
|
|
$this->settingRepo(['3.5.26'], $reads);
|
|
|
|
[, $nextCalled] = $this->handleRequest();
|
|
|
|
$this->assertTrue($nextCalled);
|
|
$this->assertSame(0, $reads, 'an up-to-date cached version costs zero settings reads');
|
|
}
|
|
|
|
public function test_genuinely_outdated_install_still_redirects_to_update(): void
|
|
{
|
|
// Both the cache AND the database are behind the code: the redirect is
|
|
// correct. The self-heal costs one confirming read, then redirects.
|
|
session(['dbVersion' => '3.5.25', 'isUpdated' => false]);
|
|
$this->appSettings('3.5.26');
|
|
$this->settingRepo(['3.5.25'], $reads);
|
|
|
|
[$response, $nextCalled] = $this->handleRequest();
|
|
|
|
$this->assertFalse($nextCalled, 'a genuinely outdated install must not pass through');
|
|
$this->assertSame(1, $reads);
|
|
$this->assertStringContainsString('/install/update', $response->headers->get('Location') ?? '', 'the redirect still points at the updater');
|
|
$this->assertFalse(session('isUpdated'));
|
|
}
|
|
}
|