1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207 |
- <?php
- /**
- * Copyright (c) 2013 Robin Appelman <icewind@owncloud.com>
- * This file is licensed under the Affero General Public License version 3 or
- * later.
- * See the COPYING-README file.
- */
- namespace Test\User;
- use OC\AppFramework\Http\Request;
- use OC\Authentication\Events\LoginFailed;
- use OC\Authentication\Exceptions\InvalidTokenException;
- use OC\Authentication\Exceptions\PasswordLoginForbiddenException;
- use OC\Authentication\Token\IProvider;
- use OC\Authentication\Token\IToken;
- use OC\Security\Bruteforce\Throttler;
- use OC\Session\Memory;
- use OC\User\LoginException;
- use OC\User\Manager;
- use OC\User\Session;
- use OC\User\User;
- use OCA\DAV\Connector\Sabre\Auth;
- use OCP\AppFramework\Utility\ITimeFactory;
- use OCP\EventDispatcher\IEventDispatcher;
- use OCP\ICacheFactory;
- use OCP\IConfig;
- use OCP\IRequest;
- use OCP\IRequestId;
- use OCP\ISession;
- use OCP\IUser;
- use OCP\Lockdown\ILockdownManager;
- use OCP\Security\ISecureRandom;
- use OCP\User\Events\PostLoginEvent;
- use PHPUnit\Framework\MockObject\MockObject;
- use Psr\Log\LoggerInterface;
- use Symfony\Component\EventDispatcher\EventDispatcherInterface;
- use OC\Security\CSRF\CsrfTokenManager;
- /**
- * @group DB
- * @package Test\User
- */
- class SessionTest extends \Test\TestCase {
- /** @var ITimeFactory|MockObject */
- private $timeFactory;
- /** @var IProvider|MockObject */
- private $tokenProvider;
- /** @var IConfig|MockObject */
- private $config;
- /** @var Throttler|MockObject */
- private $throttler;
- /** @var ISecureRandom|MockObject */
- private $random;
- /** @var Manager|MockObject */
- private $manager;
- /** @var ISession|MockObject */
- private $session;
- /** @var Session|MockObject */
- private $userSession;
- /** @var ILockdownManager|MockObject */
- private $lockdownManager;
- /** @var LoggerInterface|MockObject */
- private $logger;
- /** @var IEventDispatcher|MockObject */
- private $dispatcher;
- protected function setUp(): void {
- parent::setUp();
- $this->timeFactory = $this->createMock(ITimeFactory::class);
- $this->timeFactory->expects($this->any())
- ->method('getTime')
- ->willReturn(10000);
- $this->tokenProvider = $this->createMock(IProvider::class);
- $this->config = $this->createMock(IConfig::class);
- $this->throttler = $this->createMock(Throttler::class);
- $this->random = $this->createMock(ISecureRandom::class);
- $this->manager = $this->createMock(Manager::class);
- $this->session = $this->createMock(ISession::class);
- $this->lockdownManager = $this->createMock(ILockdownManager::class);
- $this->logger = $this->createMock(LoggerInterface::class);
- $this->dispatcher = $this->createMock(IEventDispatcher::class);
- $this->userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([
- $this->manager,
- $this->session,
- $this->timeFactory,
- $this->tokenProvider,
- $this->config,
- $this->random,
- $this->lockdownManager,
- $this->logger,
- $this->dispatcher
- ])
- ->setMethods([
- 'setMagicInCookie',
- ])
- ->getMock();
- \OC_User::setIncognitoMode(false);
- }
- public function isLoggedInData() {
- return [
- [true],
- [false],
- ];
- }
- /**
- * @dataProvider isLoggedInData
- */
- public function testIsLoggedIn($isLoggedIn) {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $manager = $this->createMock(Manager::class);
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods([
- 'getUser'
- ])
- ->getMock();
- $user = new User('sepp', null, $this->createMock(EventDispatcherInterface::class));
- $userSession->expects($this->once())
- ->method('getUser')
- ->willReturn($isLoggedIn ? $user : null);
- $this->assertEquals($isLoggedIn, $userSession->isLoggedIn());
- }
- public function testSetUser() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $session->expects($this->once())
- ->method('set')
- ->with('user_id', 'foo');
- $manager = $this->createMock(Manager::class);
- $backend = $this->createMock(\Test\Util\User\Dummy::class);
- $user = $this->createMock(IUser::class);
- $user->expects($this->once())
- ->method('getUID')
- ->willReturn('foo');
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $userSession->setUser($user);
- }
- public function testLoginValidPasswordEnabled() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $session->expects($this->once())
- ->method('regenerateId');
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('bar')
- ->will($this->throwException(new InvalidTokenException()));
- $session->expects($this->exactly(2))
- ->method('set')
- ->with($this->callback(function ($key) {
- switch ($key) {
- case 'user_id':
- case 'loginname':
- return true;
- break;
- default:
- return false;
- break;
- }
- }, 'foo'));
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $backend = $this->createMock(\Test\Util\User\Dummy::class);
- $user = $this->createMock(IUser::class);
- $user->expects($this->any())
- ->method('isEnabled')
- ->willReturn(true);
- $user->expects($this->any())
- ->method('getUID')
- ->willReturn('foo');
- $user->expects($this->once())
- ->method('updateLastLoginTimestamp');
- $manager->expects($this->once())
- ->method('checkPasswordNoLogging')
- ->with('foo', 'bar')
- ->willReturn($user);
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods([
- 'prepareUserLogin'
- ])
- ->getMock();
- $userSession->expects($this->once())
- ->method('prepareUserLogin');
- $this->dispatcher->expects($this->once())
- ->method('dispatchTyped')
- ->with(
- $this->callback(function (PostLoginEvent $e) {
- return $e->getUser()->getUID() === 'foo' &&
- $e->getPassword() === 'bar' &&
- $e->isTokenLogin() === false;
- })
- );
- $userSession->login('foo', 'bar');
- $this->assertEquals($user, $userSession->getUser());
- }
- public function testLoginValidPasswordDisabled() {
- $this->expectException(LoginException::class);
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $session->expects($this->never())
- ->method('set');
- $session->expects($this->once())
- ->method('regenerateId');
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('bar')
- ->will($this->throwException(new InvalidTokenException()));
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $user = $this->createMock(IUser::class);
- $user->expects($this->any())
- ->method('isEnabled')
- ->willReturn(false);
- $user->expects($this->never())
- ->method('updateLastLoginTimestamp');
- $manager->expects($this->once())
- ->method('checkPasswordNoLogging')
- ->with('foo', 'bar')
- ->willReturn($user);
- $this->dispatcher->expects($this->never())
- ->method('dispatch');
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $userSession->login('foo', 'bar');
- }
- public function testLoginInvalidPassword() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $backend = $this->createMock(\Test\Util\User\Dummy::class);
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $user = $this->createMock(IUser::class);
- $session->expects($this->never())
- ->method('set');
- $session->expects($this->once())
- ->method('regenerateId');
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('bar')
- ->will($this->throwException(new InvalidTokenException()));
- $user->expects($this->never())
- ->method('isEnabled');
- $user->expects($this->never())
- ->method('updateLastLoginTimestamp');
- $manager->expects($this->once())
- ->method('checkPasswordNoLogging')
- ->with('foo', 'bar')
- ->willReturn(false);
- $this->dispatcher->expects($this->never())
- ->method('dispatch');
- $userSession->login('foo', 'bar');
- }
- public function testLoginNonExisting() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $manager = $this->createMock(Manager::class);
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $session->expects($this->never())
- ->method('set');
- $session->expects($this->once())
- ->method('regenerateId');
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('bar')
- ->will($this->throwException(new InvalidTokenException()));
- $manager->expects($this->once())
- ->method('checkPasswordNoLogging')
- ->with('foo', 'bar')
- ->willReturn(false);
- $userSession->login('foo', 'bar');
- }
- public function testLogClientInNoTokenPasswordWith2fa() {
- $this->expectException(PasswordLoginForbiddenException::class);
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $request = $this->createMock(IRequest::class);
- /** @var Session $userSession */
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods(['login', 'supportsCookies', 'createSessionToken', 'getUser'])
- ->getMock();
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('doe')
- ->will($this->throwException(new InvalidTokenException()));
- $this->config->expects($this->once())
- ->method('getSystemValue')
- ->with('token_auth_enforced', false)
- ->willReturn(true);
- $request
- ->expects($this->any())
- ->method('getRemoteAddress')
- ->willReturn('192.168.0.1');
- $this->throttler
- ->expects($this->once())
- ->method('sleepDelayOrThrowOnMax')
- ->with('192.168.0.1');
- $this->throttler
- ->expects($this->any())
- ->method('getDelay')
- ->with('192.168.0.1')
- ->willReturn(0);
- $userSession->logClientIn('john', 'doe', $request, $this->throttler);
- }
- public function testLogClientInUnexist() {
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $request = $this->createMock(IRequest::class);
- /** @var Session $userSession */
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods(['login', 'supportsCookies', 'createSessionToken', 'getUser'])
- ->getMock();
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('doe')
- ->will($this->throwException(new InvalidTokenException()));
- $this->config->expects($this->once())
- ->method('getSystemValue')
- ->with('token_auth_enforced', false)
- ->willReturn(false);
- $manager->method('getByEmail')
- ->with('unexist')
- ->willReturn([]);
- $this->assertFalse($userSession->logClientIn('unexist', 'doe', $request, $this->throttler));
- }
- public function testLogClientInWithTokenPassword() {
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $request = $this->createMock(IRequest::class);
- /** @var Session $userSession */
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods(['isTokenPassword', 'login', 'supportsCookies', 'createSessionToken', 'getUser'])
- ->getMock();
- $userSession->expects($this->once())
- ->method('isTokenPassword')
- ->willReturn(true);
- $userSession->expects($this->once())
- ->method('login')
- ->with('john', 'I-AM-AN-APP-PASSWORD')
- ->willReturn(true);
- $session->expects($this->once())
- ->method('set')
- ->with('app_password', 'I-AM-AN-APP-PASSWORD');
- $request
- ->expects($this->any())
- ->method('getRemoteAddress')
- ->willReturn('192.168.0.1');
- $this->throttler
- ->expects($this->once())
- ->method('sleepDelayOrThrowOnMax')
- ->with('192.168.0.1');
- $this->throttler
- ->expects($this->any())
- ->method('getDelay')
- ->with('192.168.0.1')
- ->willReturn(0);
- $this->assertTrue($userSession->logClientIn('john', 'I-AM-AN-APP-PASSWORD', $request, $this->throttler));
- }
- public function testLogClientInNoTokenPasswordNo2fa() {
- $this->expectException(PasswordLoginForbiddenException::class);
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $request = $this->createMock(IRequest::class);
- /** @var Session $userSession */
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods(['login', 'isTwoFactorEnforced'])
- ->getMock();
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with('doe')
- ->will($this->throwException(new InvalidTokenException()));
- $this->config->expects($this->once())
- ->method('getSystemValue')
- ->with('token_auth_enforced', false)
- ->willReturn(false);
- $userSession->expects($this->once())
- ->method('isTwoFactorEnforced')
- ->with('john')
- ->willReturn(true);
- $request
- ->expects($this->any())
- ->method('getRemoteAddress')
- ->willReturn('192.168.0.1');
- $this->throttler
- ->expects($this->once())
- ->method('sleepDelayOrThrowOnMax')
- ->with('192.168.0.1');
- $this->throttler
- ->expects($this->any())
- ->method('getDelay')
- ->with('192.168.0.1')
- ->willReturn(0);
- $userSession->logClientIn('john', 'doe', $request, $this->throttler);
- }
- public function testTryTokenLoginNoHeaderNoSessionCookie(): void {
- $request = $this->createMock(IRequest::class);
- $this->config->expects(self::once())
- ->method('getSystemValueString')
- ->with('instanceid')
- ->willReturn('abc123');
- $request->method('getHeader')->with('Authorization')->willReturn('');
- $request->method('getCookie')->with('abc123')->willReturn(null);
- $this->tokenProvider->expects(self::never())
- ->method('getToken');
- $loginResult = $this->userSession->tryTokenLogin($request);
- self::assertFalse($loginResult);
- }
- public function testTryTokenLoginAuthorizationHeaderTokenNotFound(): void {
- $request = $this->createMock(IRequest::class);
- $request->method('getHeader')->with('Authorization')->willReturn('Bearer abcde-12345');
- $this->tokenProvider->expects(self::once())
- ->method('getToken')
- ->with('abcde-12345')
- ->willThrowException(new InvalidTokenException());
- $loginResult = $this->userSession->tryTokenLogin($request);
- self::assertFalse($loginResult);
- }
- public function testTryTokenLoginSessionIdTokenNotFound(): void {
- $request = $this->createMock(IRequest::class);
- $this->config->expects(self::once())
- ->method('getSystemValueString')
- ->with('instanceid')
- ->willReturn('abc123');
- $request->method('getHeader')->with('Authorization')->willReturn('');
- $request->method('getCookie')->with('abc123')->willReturn('abcde12345');
- $this->session->expects(self::once())
- ->method('getId')
- ->willReturn('abcde12345');
- $this->tokenProvider->expects(self::once())
- ->method('getToken')
- ->with('abcde12345')
- ->willThrowException(new InvalidTokenException());
- $loginResult = $this->userSession->tryTokenLogin($request);
- self::assertFalse($loginResult);
- }
- public function testRememberLoginValidToken() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $userSession = $this->getMockBuilder(Session::class)
- //override, otherwise tests will fail because of setcookie()
- ->setMethods(['setMagicInCookie', 'setLoginName'])
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->getMock();
- $user = $this->createMock(IUser::class);
- $token = 'goodToken';
- $oldSessionId = 'sess321';
- $sessionId = 'sess123';
- $session->expects($this->once())
- ->method('regenerateId');
- $manager->expects($this->once())
- ->method('get')
- ->with('foo')
- ->willReturn($user);
- $this->config->expects($this->once())
- ->method('getUserKeys')
- ->with('foo', 'login_token')
- ->willReturn([$token]);
- $this->config->expects($this->once())
- ->method('deleteUserValue')
- ->with('foo', 'login_token', $token);
- $this->random->expects($this->once())
- ->method('generate')
- ->with(32)
- ->willReturn('abcdefg123456');
- $this->config->expects($this->once())
- ->method('setUserValue')
- ->with('foo', 'login_token', 'abcdefg123456', 10000);
- $tokenObject = $this->createMock(IToken::class);
- $tokenObject->expects($this->once())
- ->method('getLoginName')
- ->willReturn('foobar');
- $tokenObject->method('getId')
- ->willReturn(42);
- $session->expects($this->once())
- ->method('getId')
- ->willReturn($sessionId);
- $this->tokenProvider->expects($this->once())
- ->method('renewSessionToken')
- ->with($oldSessionId, $sessionId)
- ->willReturn($tokenObject);
- $this->tokenProvider->expects($this->never())
- ->method('getToken');
- $user->expects($this->any())
- ->method('getUID')
- ->willReturn('foo');
- $userSession->expects($this->once())
- ->method('setMagicInCookie');
- $user->expects($this->once())
- ->method('updateLastLoginTimestamp');
- $setUID = false;
- $session
- ->method('set')
- ->willReturnCallback(function ($k, $v) use (&$setUID) {
- if ($k === 'user_id' && $v === 'foo') {
- $setUID = true;
- }
- });
- $userSession->expects($this->once())
- ->method('setLoginName')
- ->willReturn('foobar');
- $granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
- $this->assertTrue($setUID);
- $this->assertTrue($granted);
- }
- public function testRememberLoginInvalidSessionToken() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $userSession = $this->getMockBuilder(Session::class)
- //override, otherwise tests will fail because of setcookie()
- ->setMethods(['setMagicInCookie'])
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->getMock();
- $user = $this->createMock(IUser::class);
- $token = 'goodToken';
- $oldSessionId = 'sess321';
- $sessionId = 'sess123';
- $session->expects($this->once())
- ->method('regenerateId');
- $manager->expects($this->once())
- ->method('get')
- ->with('foo')
- ->willReturn($user);
- $this->config->expects($this->once())
- ->method('getUserKeys')
- ->with('foo', 'login_token')
- ->willReturn([$token]);
- $this->config->expects($this->once())
- ->method('deleteUserValue')
- ->with('foo', 'login_token', $token);
- $this->config->expects($this->once())
- ->method('setUserValue'); // TODO: mock new random value
- $session->expects($this->once())
- ->method('getId')
- ->willReturn($sessionId);
- $this->tokenProvider->expects($this->once())
- ->method('renewSessionToken')
- ->with($oldSessionId, $sessionId)
- ->will($this->throwException(new InvalidTokenException()));
- $user->expects($this->never())
- ->method('getUID')
- ->willReturn('foo');
- $userSession->expects($this->never())
- ->method('setMagicInCookie');
- $user->expects($this->never())
- ->method('updateLastLoginTimestamp');
- $session->expects($this->never())
- ->method('set')
- ->with('user_id', 'foo');
- $granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
- $this->assertFalse($granted);
- }
- public function testRememberLoginInvalidToken() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $userSession = $this->getMockBuilder(Session::class)
- //override, otherwise tests will fail because of setcookie()
- ->setMethods(['setMagicInCookie'])
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->getMock();
- $user = $this->createMock(IUser::class);
- $token = 'goodToken';
- $oldSessionId = 'sess321';
- $session->expects($this->once())
- ->method('regenerateId');
- $manager->expects($this->once())
- ->method('get')
- ->with('foo')
- ->willReturn($user);
- $this->config->expects($this->once())
- ->method('getUserKeys')
- ->with('foo', 'login_token')
- ->willReturn(['anothertoken']);
- $this->config->expects($this->never())
- ->method('deleteUserValue')
- ->with('foo', 'login_token', $token);
- $this->tokenProvider->expects($this->never())
- ->method('renewSessionToken');
- $userSession->expects($this->never())
- ->method('setMagicInCookie');
- $user->expects($this->never())
- ->method('updateLastLoginTimestamp');
- $session->expects($this->never())
- ->method('set')
- ->with('user_id', 'foo');
- $granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
- $this->assertFalse($granted);
- }
- public function testRememberLoginInvalidUser() {
- $session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
- $managerMethods = get_class_methods(Manager::class);
- //keep following methods intact in order to ensure hooks are working
- $mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
- $manager = $this->getMockBuilder(Manager::class)
- ->setMethods($mockedManagerMethods)
- ->setConstructorArgs([
- $this->config,
- $this->createMock(EventDispatcherInterface::class),
- $this->createMock(ICacheFactory::class),
- $this->createMock(IEventDispatcher::class),
- ])
- ->getMock();
- $userSession = $this->getMockBuilder(Session::class)
- //override, otherwise tests will fail because of setcookie()
- ->setMethods(['setMagicInCookie'])
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->getMock();
- $token = 'goodToken';
- $oldSessionId = 'sess321';
- $session->expects($this->once())
- ->method('regenerateId');
- $manager->expects($this->once())
- ->method('get')
- ->with('foo')
- ->willReturn(null);
- $this->config->expects($this->never())
- ->method('getUserKeys')
- ->with('foo', 'login_token')
- ->willReturn(['anothertoken']);
- $this->tokenProvider->expects($this->never())
- ->method('renewSessionToken');
- $userSession->expects($this->never())
- ->method('setMagicInCookie');
- $session->expects($this->never())
- ->method('set')
- ->with('user_id', 'foo');
- $granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
- $this->assertFalse($granted);
- }
- public function testActiveUserAfterSetSession() {
- $users = [
- 'foo' => new User('foo', null, $this->createMock(EventDispatcherInterface::class)),
- 'bar' => new User('bar', null, $this->createMock(EventDispatcherInterface::class))
- ];
- $manager = $this->getMockBuilder(Manager::class)
- ->disableOriginalConstructor()
- ->getMock();
- $manager->expects($this->any())
- ->method('get')
- ->willReturnCallback(function ($uid) use ($users) {
- return $users[$uid];
- });
- $session = new Memory('');
- $session->set('user_id', 'foo');
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods([
- 'validateSession'
- ])
- ->getMock();
- $userSession->expects($this->any())
- ->method('validateSession');
- $this->assertEquals($users['foo'], $userSession->getUser());
- $session2 = new Memory('');
- $session2->set('user_id', 'bar');
- $userSession->setSession($session2);
- $this->assertEquals($users['bar'], $userSession->getUser());
- }
- public function testCreateSessionToken() {
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $user = $this->createMock(IUser::class);
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $requestId = $this->createMock(IRequestId::class);
- $config = $this->createMock(IConfig::class);
- $csrf = $this->getMockBuilder(CsrfTokenManager::class)
- ->disableOriginalConstructor()
- ->getMock();
- $request = new Request([
- 'server' => [
- 'HTTP_USER_AGENT' => 'Firefox',
- ]
- ], $requestId, $config, $csrf);
- $uid = 'user123';
- $loginName = 'User123';
- $password = 'passme';
- $sessionId = 'abcxyz';
- $manager->expects($this->once())
- ->method('get')
- ->with($uid)
- ->willReturn($user);
- $session->expects($this->once())
- ->method('getId')
- ->willReturn($sessionId);
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with($password)
- ->will($this->throwException(new InvalidTokenException()));
- $this->tokenProvider->expects($this->once())
- ->method('generateToken')
- ->with($sessionId, $uid, $loginName, $password, 'Firefox', IToken::TEMPORARY_TOKEN, IToken::DO_NOT_REMEMBER);
- $this->assertTrue($userSession->createSessionToken($request, $uid, $loginName, $password));
- }
- public function testCreateRememberedSessionToken() {
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $user = $this->createMock(IUser::class);
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $requestId = $this->createMock(IRequestId::class);
- $config = $this->createMock(IConfig::class);
- $csrf = $this->getMockBuilder(CsrfTokenManager::class)
- ->disableOriginalConstructor()
- ->getMock();
- $request = new Request([
- 'server' => [
- 'HTTP_USER_AGENT' => 'Firefox',
- ]
- ], $requestId, $config, $csrf);
- $uid = 'user123';
- $loginName = 'User123';
- $password = 'passme';
- $sessionId = 'abcxyz';
- $manager->expects($this->once())
- ->method('get')
- ->with($uid)
- ->willReturn($user);
- $session->expects($this->once())
- ->method('getId')
- ->willReturn($sessionId);
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with($password)
- ->will($this->throwException(new InvalidTokenException()));
- $this->tokenProvider->expects($this->once())
- ->method('generateToken')
- ->with($sessionId, $uid, $loginName, $password, 'Firefox', IToken::TEMPORARY_TOKEN, IToken::REMEMBER);
- $this->assertTrue($userSession->createSessionToken($request, $uid, $loginName, $password, true));
- }
- public function testCreateSessionTokenWithTokenPassword() {
- $manager = $this->getMockBuilder(Manager::class)
- ->disableOriginalConstructor()
- ->getMock();
- $session = $this->createMock(ISession::class);
- $token = $this->createMock(IToken::class);
- $user = $this->createMock(IUser::class);
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $requestId = $this->createMock(IRequestId::class);
- $config = $this->createMock(IConfig::class);
- $csrf = $this->getMockBuilder(CsrfTokenManager::class)
- ->disableOriginalConstructor()
- ->getMock();
- $request = new Request([
- 'server' => [
- 'HTTP_USER_AGENT' => 'Firefox',
- ]
- ], $requestId, $config, $csrf);
- $uid = 'user123';
- $loginName = 'User123';
- $password = 'iamatoken';
- $realPassword = 'passme';
- $sessionId = 'abcxyz';
- $manager->expects($this->once())
- ->method('get')
- ->with($uid)
- ->willReturn($user);
- $session->expects($this->once())
- ->method('getId')
- ->willReturn($sessionId);
- $this->tokenProvider->expects($this->once())
- ->method('getToken')
- ->with($password)
- ->willReturn($token);
- $this->tokenProvider->expects($this->once())
- ->method('getPassword')
- ->with($token, $password)
- ->willReturn($realPassword);
- $this->tokenProvider->expects($this->once())
- ->method('generateToken')
- ->with($sessionId, $uid, $loginName, $realPassword, 'Firefox', IToken::TEMPORARY_TOKEN, IToken::DO_NOT_REMEMBER);
- $this->assertTrue($userSession->createSessionToken($request, $uid, $loginName, $password));
- }
- public function testCreateSessionTokenWithNonExistentUser() {
- $manager = $this->getMockBuilder(Manager::class)
- ->disableOriginalConstructor()
- ->getMock();
- $session = $this->createMock(ISession::class);
- $userSession = new Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher);
- $request = $this->createMock(IRequest::class);
- $uid = 'user123';
- $loginName = 'User123';
- $password = 'passme';
- $manager->expects($this->once())
- ->method('get')
- ->with($uid)
- ->willReturn(null);
- $this->assertFalse($userSession->createSessionToken($request, $uid, $loginName, $password));
- }
- public function testCreateRememberMeToken() {
- $user = $this->createMock(IUser::class);
- $user
- ->expects($this->exactly(2))
- ->method('getUID')
- ->willReturn('UserUid');
- $this->random
- ->expects($this->once())
- ->method('generate')
- ->with(32)
- ->willReturn('LongRandomToken');
- $this->config
- ->expects($this->once())
- ->method('setUserValue')
- ->with('UserUid', 'login_token', 'LongRandomToken', 10000);
- $this->userSession
- ->expects($this->once())
- ->method('setMagicInCookie')
- ->with('UserUid', 'LongRandomToken');
- $this->userSession->createRememberMeToken($user);
- }
- public function testTryBasicAuthLoginValid() {
- $request = $this->createMock(Request::class);
- $request->method('__get')
- ->willReturn([
- 'PHP_AUTH_USER' => 'username',
- 'PHP_AUTH_PW' => 'password',
- ]);
- $request->method('__isset')
- ->with('server')
- ->willReturn(true);
- $davAuthenticatedSet = false;
- $lastPasswordConfirmSet = false;
- $this->session
- ->method('set')
- ->willReturnCallback(function ($k, $v) use (&$davAuthenticatedSet, &$lastPasswordConfirmSet) {
- switch ($k) {
- case Auth::DAV_AUTHENTICATED:
- $davAuthenticatedSet = $v;
- return;
- case 'last-password-confirm':
- $lastPasswordConfirmSet = 1000;
- return;
- default:
- throw new \Exception();
- }
- });
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([
- $this->manager,
- $this->session,
- $this->timeFactory,
- $this->tokenProvider,
- $this->config,
- $this->random,
- $this->lockdownManager,
- $this->logger,
- $this->dispatcher
- ])
- ->setMethods([
- 'logClientIn',
- 'getUser',
- ])
- ->getMock();
- /** @var Session|MockObject */
- $userSession->expects($this->once())
- ->method('logClientIn')
- ->with(
- $this->equalTo('username'),
- $this->equalTo('password'),
- $this->equalTo($request),
- $this->equalTo($this->throttler)
- )->willReturn(true);
- $user = $this->createMock(IUser::class);
- $user->method('getUID')->willReturn('username');
- $userSession->expects($this->once())
- ->method('getUser')
- ->willReturn($user);
- $this->assertTrue($userSession->tryBasicAuthLogin($request, $this->throttler));
- $this->assertSame('username', $davAuthenticatedSet);
- $this->assertSame(1000, $lastPasswordConfirmSet);
- }
- public function testTryBasicAuthLoginNoLogin() {
- $request = $this->createMock(Request::class);
- $request->method('__get')
- ->willReturn([]);
- $request->method('__isset')
- ->with('server')
- ->willReturn(true);
- $this->session->expects($this->never())
- ->method($this->anything());
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([
- $this->manager,
- $this->session,
- $this->timeFactory,
- $this->tokenProvider,
- $this->config,
- $this->random,
- $this->lockdownManager,
- $this->logger,
- $this->dispatcher
- ])
- ->setMethods([
- 'logClientIn',
- ])
- ->getMock();
- /** @var Session|MockObject */
- $userSession->expects($this->never())
- ->method('logClientIn');
- $this->assertFalse($userSession->tryBasicAuthLogin($request, $this->throttler));
- }
- public function testUpdateTokens() {
- $this->tokenProvider->expects($this->once())
- ->method('updatePasswords')
- ->with('uid', 'pass');
- $this->userSession->updateTokens('uid', 'pass');
- }
- public function testLogClientInThrottlerUsername() {
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $request = $this->createMock(IRequest::class);
- /** @var Session $userSession */
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods(['isTokenPassword', 'login', 'supportsCookies', 'createSessionToken', 'getUser'])
- ->getMock();
- $userSession->expects($this->once())
- ->method('isTokenPassword')
- ->willReturn(true);
- $userSession->expects($this->once())
- ->method('login')
- ->with('john', 'I-AM-AN-PASSWORD')
- ->willReturn(false);
- $session->expects($this->never())
- ->method('set');
- $request
- ->method('getRemoteAddress')
- ->willReturn('192.168.0.1');
- $this->throttler
- ->expects($this->exactly(2))
- ->method('sleepDelayOrThrowOnMax')
- ->with('192.168.0.1');
- $this->throttler
- ->expects($this->any())
- ->method('getDelay')
- ->with('192.168.0.1')
- ->willReturn(0);
- $this->throttler
- ->expects($this->once())
- ->method('registerAttempt')
- ->with('login', '192.168.0.1', ['user' => 'john']);
- $this->dispatcher
- ->expects($this->once())
- ->method('dispatchTyped')
- ->with(new LoginFailed('john', 'I-AM-AN-PASSWORD'));
- $this->assertFalse($userSession->logClientIn('john', 'I-AM-AN-PASSWORD', $request, $this->throttler));
- }
- public function testLogClientInThrottlerEmail() {
- $manager = $this->createMock(Manager::class);
- $session = $this->createMock(ISession::class);
- $request = $this->createMock(IRequest::class);
- /** @var Session $userSession */
- $userSession = $this->getMockBuilder(Session::class)
- ->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config, $this->random, $this->lockdownManager, $this->logger, $this->dispatcher])
- ->setMethods(['isTokenPassword', 'login', 'supportsCookies', 'createSessionToken', 'getUser'])
- ->getMock();
- $userSession->expects($this->once())
- ->method('isTokenPassword')
- ->willReturn(false);
- $userSession->expects($this->once())
- ->method('login')
- ->with('john@foo.bar', 'I-AM-AN-PASSWORD')
- ->willReturn(false);
- $manager
- ->method('getByEmail')
- ->with('john@foo.bar')
- ->willReturn([]);
- $session->expects($this->never())
- ->method('set');
- $request
- ->method('getRemoteAddress')
- ->willReturn('192.168.0.1');
- $this->throttler
- ->expects($this->exactly(2))
- ->method('sleepDelayOrThrowOnMax')
- ->with('192.168.0.1');
- $this->throttler
- ->expects($this->any())
- ->method('getDelay')
- ->with('192.168.0.1')
- ->willReturn(0);
- $this->throttler
- ->expects($this->once())
- ->method('registerAttempt')
- ->with('login', '192.168.0.1', ['user' => 'john@foo.bar']);
- $this->dispatcher
- ->expects($this->once())
- ->method('dispatchTyped')
- ->with(new LoginFailed('john@foo.bar', 'I-AM-AN-PASSWORD'));
- $this->assertFalse($userSession->logClientIn('john@foo.bar', 'I-AM-AN-PASSWORD', $request, $this->throttler));
- }
- }
|