VerificationTokenTest.php 9.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2021 Arthur Schiwon <blizzz@arthur-schiwon.de>
  5. *
  6. * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
  7. *
  8. * @license GNU AGPL version 3 or any later version
  9. *
  10. * This program is free software: you can redistribute it and/or modify
  11. * it under the terms of the GNU Affero General Public License as
  12. * published by the Free Software Foundation, either version 3 of the
  13. * License, or (at your option) any later version.
  14. *
  15. * This program is distributed in the hope that it will be useful,
  16. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18. * GNU Affero General Public License for more details.
  19. *
  20. * You should have received a copy of the GNU Affero General Public License
  21. * along with this program. If not, see <https://www.gnu.org/licenses/>.
  22. *
  23. */
  24. namespace Test\Security\VerificationToken;
  25. use OC\Security\VerificationToken\VerificationToken;
  26. use OCP\AppFramework\Utility\ITimeFactory;
  27. use OCP\BackgroundJob\IJobList;
  28. use OCP\IConfig;
  29. use OCP\IUser;
  30. use OCP\Security\ICrypto;
  31. use OCP\Security\ISecureRandom;
  32. use OCP\Security\VerificationToken\InvalidTokenException;
  33. use Test\TestCase;
  34. use PHPUnit\Framework\MockObject\MockObject;
  35. class VerificationTokenTest extends TestCase {
  36. /** @var VerificationToken */
  37. protected $token;
  38. /** @var IConfig|MockObject */
  39. protected $config;
  40. /** @var ISecureRandom|MockObject */
  41. protected $secureRandom;
  42. /** @var ICrypto|MockObject */
  43. protected $crypto;
  44. /** @var ITimeFactory|MockObject */
  45. protected $timeFactory;
  46. /** @var IJobList|MockObject */
  47. protected $jobList;
  48. protected function setUp(): void {
  49. parent::setUp();
  50. $this->config = $this->createMock(IConfig::class);
  51. $this->crypto = $this->createMock(ICrypto::class);
  52. $this->timeFactory = $this->createMock(ITimeFactory::class);
  53. $this->secureRandom = $this->createMock(ISecureRandom::class);
  54. $this->jobList = $this->createMock(IJobList::class);
  55. $this->token = new VerificationToken(
  56. $this->config,
  57. $this->crypto,
  58. $this->timeFactory,
  59. $this->secureRandom,
  60. $this->jobList
  61. );
  62. }
  63. public function testTokenUserUnknown() {
  64. $this->expectException(InvalidTokenException::class);
  65. $this->expectExceptionCode(InvalidTokenException::USER_UNKNOWN);
  66. $this->token->check('encryptedToken', null, 'fingerprintToken', 'foobar');
  67. }
  68. public function testTokenUserUnknown2() {
  69. $user = $this->createMock(IUser::class);
  70. $user->expects($this->atLeastOnce())
  71. ->method('isEnabled')
  72. ->willReturn(false);
  73. $this->expectException(InvalidTokenException::class);
  74. $this->expectExceptionCode(InvalidTokenException::USER_UNKNOWN);
  75. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
  76. }
  77. public function testTokenNotFound() {
  78. $user = $this->createMock(IUser::class);
  79. $user->expects($this->atLeastOnce())
  80. ->method('isEnabled')
  81. ->willReturn(true);
  82. $user->expects($this->atLeastOnce())
  83. ->method('getUID')
  84. ->willReturn('alice');
  85. // implicit: IConfig::getUserValue returns null by default
  86. $this->expectException(InvalidTokenException::class);
  87. $this->expectExceptionCode(InvalidTokenException::TOKEN_NOT_FOUND);
  88. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
  89. }
  90. public function testTokenDecryptionError() {
  91. $user = $this->createMock(IUser::class);
  92. $user->expects($this->atLeastOnce())
  93. ->method('isEnabled')
  94. ->willReturn(true);
  95. $user->expects($this->atLeastOnce())
  96. ->method('getUID')
  97. ->willReturn('alice');
  98. $this->config->expects($this->atLeastOnce())
  99. ->method('getUserValue')
  100. ->with('alice', 'core', 'fingerprintToken', null)
  101. ->willReturn('encryptedToken');
  102. $this->config->expects($this->any())
  103. ->method('getSystemValue')
  104. ->with('secret')
  105. ->willReturn('357111317');
  106. $this->crypto->method('decrypt')
  107. ->with('encryptedToken', 'foobar' . '357111317')
  108. ->willThrowException(new \Exception('decryption failed'));
  109. $this->expectException(InvalidTokenException::class);
  110. $this->expectExceptionCode(InvalidTokenException::TOKEN_DECRYPTION_ERROR);
  111. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
  112. }
  113. public function testTokenInvalidFormat() {
  114. $user = $this->createMock(IUser::class);
  115. $user->expects($this->atLeastOnce())
  116. ->method('isEnabled')
  117. ->willReturn(true);
  118. $user->expects($this->atLeastOnce())
  119. ->method('getUID')
  120. ->willReturn('alice');
  121. $this->config->expects($this->atLeastOnce())
  122. ->method('getUserValue')
  123. ->with('alice', 'core', 'fingerprintToken', null)
  124. ->willReturn('encryptedToken');
  125. $this->config->expects($this->any())
  126. ->method('getSystemValue')
  127. ->with('secret')
  128. ->willReturn('357111317');
  129. $this->crypto->method('decrypt')
  130. ->with('encryptedToken', 'foobar' . '357111317')
  131. ->willReturn('decrypted^nonsense');
  132. $this->expectException(InvalidTokenException::class);
  133. $this->expectExceptionCode(InvalidTokenException::TOKEN_INVALID_FORMAT);
  134. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
  135. }
  136. public function testTokenExpired() {
  137. $user = $this->createMock(IUser::class);
  138. $user->expects($this->atLeastOnce())
  139. ->method('isEnabled')
  140. ->willReturn(true);
  141. $user->expects($this->atLeastOnce())
  142. ->method('getUID')
  143. ->willReturn('alice');
  144. $user->expects($this->any())
  145. ->method('getLastLogin')
  146. ->willReturn(604803);
  147. $this->config->expects($this->atLeastOnce())
  148. ->method('getUserValue')
  149. ->with('alice', 'core', 'fingerprintToken', null)
  150. ->willReturn('encryptedToken');
  151. $this->config->expects($this->any())
  152. ->method('getSystemValue')
  153. ->with('secret')
  154. ->willReturn('357111317');
  155. $this->crypto->method('decrypt')
  156. ->with('encryptedToken', 'foobar' . '357111317')
  157. ->willReturn('604800:mY70K3n');
  158. $this->timeFactory->expects($this->any())
  159. ->method('getTime')
  160. ->willReturn(604800 * 3);
  161. $this->expectException(InvalidTokenException::class);
  162. $this->expectExceptionCode(InvalidTokenException::TOKEN_EXPIRED);
  163. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
  164. }
  165. public function testTokenExpiredByLogin() {
  166. $user = $this->createMock(IUser::class);
  167. $user->expects($this->atLeastOnce())
  168. ->method('isEnabled')
  169. ->willReturn(true);
  170. $user->expects($this->atLeastOnce())
  171. ->method('getUID')
  172. ->willReturn('alice');
  173. $user->expects($this->any())
  174. ->method('getLastLogin')
  175. ->willReturn(604803);
  176. $this->config->expects($this->atLeastOnce())
  177. ->method('getUserValue')
  178. ->with('alice', 'core', 'fingerprintToken', null)
  179. ->willReturn('encryptedToken');
  180. $this->config->expects($this->any())
  181. ->method('getSystemValue')
  182. ->with('secret')
  183. ->willReturn('357111317');
  184. $this->crypto->method('decrypt')
  185. ->with('encryptedToken', 'foobar' . '357111317')
  186. ->willReturn('604800:mY70K3n');
  187. $this->timeFactory->expects($this->any())
  188. ->method('getTime')
  189. ->willReturn(604801);
  190. $this->expectException(InvalidTokenException::class);
  191. $this->expectExceptionCode(InvalidTokenException::TOKEN_EXPIRED);
  192. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar', true);
  193. }
  194. public function testTokenMismatch() {
  195. $user = $this->createMock(IUser::class);
  196. $user->expects($this->atLeastOnce())
  197. ->method('isEnabled')
  198. ->willReturn(true);
  199. $user->expects($this->atLeastOnce())
  200. ->method('getUID')
  201. ->willReturn('alice');
  202. $user->expects($this->any())
  203. ->method('getLastLogin')
  204. ->willReturn(604703);
  205. $this->config->expects($this->atLeastOnce())
  206. ->method('getUserValue')
  207. ->with('alice', 'core', 'fingerprintToken', null)
  208. ->willReturn('encryptedToken');
  209. $this->config->expects($this->any())
  210. ->method('getSystemValue')
  211. ->with('secret')
  212. ->willReturn('357111317');
  213. $this->crypto->method('decrypt')
  214. ->with('encryptedToken', 'foobar' . '357111317')
  215. ->willReturn('604802:mY70K3n');
  216. $this->timeFactory->expects($this->any())
  217. ->method('getTime')
  218. ->willReturn(604801);
  219. $this->expectException(InvalidTokenException::class);
  220. $this->expectExceptionCode(InvalidTokenException::TOKEN_MISMATCH);
  221. $this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
  222. }
  223. public function testTokenSuccess() {
  224. $user = $this->createMock(IUser::class);
  225. $user->expects($this->atLeastOnce())
  226. ->method('isEnabled')
  227. ->willReturn(true);
  228. $user->expects($this->atLeastOnce())
  229. ->method('getUID')
  230. ->willReturn('alice');
  231. $user->expects($this->any())
  232. ->method('getLastLogin')
  233. ->willReturn(604703);
  234. $this->config->expects($this->atLeastOnce())
  235. ->method('getUserValue')
  236. ->with('alice', 'core', 'fingerprintToken', null)
  237. ->willReturn('encryptedToken');
  238. $this->config->expects($this->any())
  239. ->method('getSystemValue')
  240. ->with('secret')
  241. ->willReturn('357111317');
  242. $this->crypto->method('decrypt')
  243. ->with('encryptedToken', 'foobar' . '357111317')
  244. ->willReturn('604802:barfoo');
  245. $this->timeFactory->expects($this->any())
  246. ->method('getTime')
  247. ->willReturn(604801);
  248. $this->token->check('barfoo', $user, 'fingerprintToken', 'foobar');
  249. }
  250. public function testCreate() {
  251. $user = $this->createMock(IUser::class);
  252. $user->expects($this->any())
  253. ->method('getUID')
  254. ->willReturn('alice');
  255. $this->secureRandom->expects($this->atLeastOnce())
  256. ->method('generate')
  257. ->willReturn('barfoo');
  258. $this->crypto->expects($this->atLeastOnce())
  259. ->method('encrypt')
  260. ->willReturn('encryptedToken');
  261. $this->config->expects($this->atLeastOnce())
  262. ->method('setUserValue')
  263. ->with('alice', 'core', 'fingerprintToken', 'encryptedToken');
  264. $vToken = $this->token->create($user, 'fingerprintToken', 'foobar');
  265. $this->assertSame('barfoo', $vToken);
  266. }
  267. }