AuthTest.php 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
  6. * @author Bjoern Schiessle <bjoern@schiessle.org>
  7. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  8. * @author Joas Schilling <coding@schilljs.com>
  9. * @author Lukas Reschke <lukas@statuscode.ch>
  10. * @author Morris Jobke <hey@morrisjobke.de>
  11. * @author Roeland Jago Douma <roeland@famdouma.nl>
  12. * @author Thomas Müller <thomas.mueller@tmit.eu>
  13. * @author Vincent Petry <pvince81@owncloud.com>
  14. *
  15. * @license AGPL-3.0
  16. *
  17. * This code is free software: you can redistribute it and/or modify
  18. * it under the terms of the GNU Affero General Public License, version 3,
  19. * as published by the Free Software Foundation.
  20. *
  21. * This program is distributed in the hope that it will be useful,
  22. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  24. * GNU Affero General Public License for more details.
  25. *
  26. * You should have received a copy of the GNU Affero General Public License, version 3,
  27. * along with this program. If not, see <http://www.gnu.org/licenses/>
  28. *
  29. */
  30. namespace OCA\DAV\Tests\unit\Connector\Sabre;
  31. use OC\Authentication\TwoFactorAuth\Manager;
  32. use OC\Security\Bruteforce\Throttler;
  33. use OC\User\Session;
  34. use OCP\IRequest;
  35. use OCP\ISession;
  36. use OCP\IUser;
  37. use Sabre\DAV\Server;
  38. use Sabre\HTTP\RequestInterface;
  39. use Sabre\HTTP\ResponseInterface;
  40. use Test\TestCase;
  41. /**
  42. * Class AuthTest
  43. *
  44. * @package OCA\DAV\Tests\unit\Connector\Sabre
  45. * @group DB
  46. */
  47. class AuthTest extends TestCase {
  48. /** @var ISession */
  49. private $session;
  50. /** @var \OCA\DAV\Connector\Sabre\Auth */
  51. private $auth;
  52. /** @var Session */
  53. private $userSession;
  54. /** @var IRequest */
  55. private $request;
  56. /** @var Manager */
  57. private $twoFactorManager;
  58. /** @var Throttler */
  59. private $throttler;
  60. protected function setUp(): void {
  61. parent::setUp();
  62. $this->session = $this->getMockBuilder(ISession::class)
  63. ->disableOriginalConstructor()->getMock();
  64. $this->userSession = $this->getMockBuilder(Session::class)
  65. ->disableOriginalConstructor()->getMock();
  66. $this->request = $this->getMockBuilder(IRequest::class)
  67. ->disableOriginalConstructor()->getMock();
  68. $this->twoFactorManager = $this->getMockBuilder(Manager::class)
  69. ->disableOriginalConstructor()
  70. ->getMock();
  71. $this->throttler = $this->getMockBuilder(Throttler::class)
  72. ->disableOriginalConstructor()
  73. ->getMock();
  74. $this->auth = new \OCA\DAV\Connector\Sabre\Auth(
  75. $this->session,
  76. $this->userSession,
  77. $this->request,
  78. $this->twoFactorManager,
  79. $this->throttler
  80. );
  81. }
  82. public function testIsDavAuthenticatedWithoutDavSession() {
  83. $this->session
  84. ->expects($this->once())
  85. ->method('get')
  86. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  87. ->willReturn(null);
  88. $this->assertFalse($this->invokePrivate($this->auth, 'isDavAuthenticated', ['MyTestUser']));
  89. }
  90. public function testIsDavAuthenticatedWithWrongDavSession() {
  91. $this->session
  92. ->expects($this->exactly(2))
  93. ->method('get')
  94. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  95. ->willReturn('AnotherUser');
  96. $this->assertFalse($this->invokePrivate($this->auth, 'isDavAuthenticated', ['MyTestUser']));
  97. }
  98. public function testIsDavAuthenticatedWithCorrectDavSession() {
  99. $this->session
  100. ->expects($this->exactly(2))
  101. ->method('get')
  102. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  103. ->willReturn('MyTestUser');
  104. $this->assertTrue($this->invokePrivate($this->auth, 'isDavAuthenticated', ['MyTestUser']));
  105. }
  106. public function testValidateUserPassOfAlreadyDAVAuthenticatedUser() {
  107. $user = $this->getMockBuilder(IUser::class)
  108. ->disableOriginalConstructor()
  109. ->getMock();
  110. $user->expects($this->exactly(2))
  111. ->method('getUID')
  112. ->willReturn('MyTestUser');
  113. $this->userSession
  114. ->expects($this->once())
  115. ->method('isLoggedIn')
  116. ->willReturn(true);
  117. $this->userSession
  118. ->expects($this->exactly(2))
  119. ->method('getUser')
  120. ->willReturn($user);
  121. $this->session
  122. ->expects($this->exactly(2))
  123. ->method('get')
  124. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  125. ->willReturn('MyTestUser');
  126. $this->session
  127. ->expects($this->once())
  128. ->method('close');
  129. $this->assertTrue($this->invokePrivate($this->auth, 'validateUserPass', ['MyTestUser', 'MyTestPassword']));
  130. }
  131. public function testValidateUserPassOfInvalidDAVAuthenticatedUser() {
  132. $user = $this->getMockBuilder(IUser::class)
  133. ->disableOriginalConstructor()
  134. ->getMock();
  135. $user->expects($this->once())
  136. ->method('getUID')
  137. ->willReturn('MyTestUser');
  138. $this->userSession
  139. ->expects($this->once())
  140. ->method('isLoggedIn')
  141. ->willReturn(true);
  142. $this->userSession
  143. ->expects($this->once())
  144. ->method('getUser')
  145. ->willReturn($user);
  146. $this->session
  147. ->expects($this->exactly(2))
  148. ->method('get')
  149. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  150. ->willReturn('AnotherUser');
  151. $this->session
  152. ->expects($this->once())
  153. ->method('close');
  154. $this->assertFalse($this->invokePrivate($this->auth, 'validateUserPass', ['MyTestUser', 'MyTestPassword']));
  155. }
  156. public function testValidateUserPassOfInvalidDAVAuthenticatedUserWithValidPassword() {
  157. $user = $this->getMockBuilder(IUser::class)
  158. ->disableOriginalConstructor()
  159. ->getMock();
  160. $user->expects($this->exactly(3))
  161. ->method('getUID')
  162. ->willReturn('MyTestUser');
  163. $this->userSession
  164. ->expects($this->once())
  165. ->method('isLoggedIn')
  166. ->willReturn(true);
  167. $this->userSession
  168. ->expects($this->exactly(3))
  169. ->method('getUser')
  170. ->willReturn($user);
  171. $this->session
  172. ->expects($this->exactly(2))
  173. ->method('get')
  174. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  175. ->willReturn('AnotherUser');
  176. $this->userSession
  177. ->expects($this->once())
  178. ->method('logClientIn')
  179. ->with('MyTestUser', 'MyTestPassword', $this->request)
  180. ->willReturn(true);
  181. $this->session
  182. ->expects($this->once())
  183. ->method('set')
  184. ->with('AUTHENTICATED_TO_DAV_BACKEND', 'MyTestUser');
  185. $this->session
  186. ->expects($this->once())
  187. ->method('close');
  188. $this->assertTrue($this->invokePrivate($this->auth, 'validateUserPass', ['MyTestUser', 'MyTestPassword']));
  189. }
  190. public function testValidateUserPassWithInvalidPassword() {
  191. $this->userSession
  192. ->expects($this->once())
  193. ->method('isLoggedIn')
  194. ->willReturn(false);
  195. $this->userSession
  196. ->expects($this->once())
  197. ->method('logClientIn')
  198. ->with('MyTestUser', 'MyTestPassword')
  199. ->willReturn(false);
  200. $this->session
  201. ->expects($this->once())
  202. ->method('close');
  203. $this->assertFalse($this->invokePrivate($this->auth, 'validateUserPass', ['MyTestUser', 'MyTestPassword']));
  204. }
  205. public function testValidateUserPassWithPasswordLoginForbidden() {
  206. $this->expectException(\OCA\DAV\Connector\Sabre\Exception\PasswordLoginForbidden::class);
  207. $this->userSession
  208. ->expects($this->once())
  209. ->method('isLoggedIn')
  210. ->willReturn(false);
  211. $this->userSession
  212. ->expects($this->once())
  213. ->method('logClientIn')
  214. ->with('MyTestUser', 'MyTestPassword')
  215. ->will($this->throwException(new \OC\Authentication\Exceptions\PasswordLoginForbiddenException()));
  216. $this->session
  217. ->expects($this->once())
  218. ->method('close');
  219. $this->invokePrivate($this->auth, 'validateUserPass', ['MyTestUser', 'MyTestPassword']);
  220. }
  221. public function testAuthenticateAlreadyLoggedInWithoutCsrfTokenForNonGet() {
  222. $request = $this->getMockBuilder(RequestInterface::class)
  223. ->disableOriginalConstructor()
  224. ->getMock();
  225. $response = $this->getMockBuilder(ResponseInterface::class)
  226. ->disableOriginalConstructor()
  227. ->getMock();
  228. $this->userSession
  229. ->expects($this->any())
  230. ->method('isLoggedIn')
  231. ->willReturn(true);
  232. $this->request
  233. ->expects($this->any())
  234. ->method('getMethod')
  235. ->willReturn('POST');
  236. $this->session
  237. ->expects($this->any())
  238. ->method('get')
  239. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  240. ->willReturn(null);
  241. $user = $this->getMockBuilder(IUser::class)
  242. ->disableOriginalConstructor()
  243. ->getMock();
  244. $user->expects($this->any())
  245. ->method('getUID')
  246. ->willReturn('MyWrongDavUser');
  247. $this->userSession
  248. ->expects($this->any())
  249. ->method('getUser')
  250. ->willReturn($user);
  251. $this->request
  252. ->expects($this->once())
  253. ->method('passesCSRFCheck')
  254. ->willReturn(false);
  255. $expectedResponse = [
  256. false,
  257. "No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured",
  258. ];
  259. $response = $this->auth->check($request, $response);
  260. $this->assertSame($expectedResponse, $response);
  261. }
  262. public function testAuthenticateAlreadyLoggedInWithoutCsrfTokenAndCorrectlyDavAuthenticated() {
  263. $request = $this->getMockBuilder(RequestInterface::class)
  264. ->disableOriginalConstructor()
  265. ->getMock();
  266. $response = $this->getMockBuilder(ResponseInterface::class)
  267. ->disableOriginalConstructor()
  268. ->getMock();
  269. $this->userSession
  270. ->expects($this->any())
  271. ->method('isLoggedIn')
  272. ->willReturn(true);
  273. $this->request
  274. ->expects($this->any())
  275. ->method('getMethod')
  276. ->willReturn('PROPFIND');
  277. $this->request
  278. ->expects($this->any())
  279. ->method('isUserAgent')
  280. ->with([
  281. '/^Mozilla\/5\.0 \([A-Za-z ]+\) (mirall|csyncoC)\/.*$/',
  282. '/^Mozilla\/5\.0 \(Android\) (ownCloud|Nextcloud)\-android.*$/',
  283. '/^Mozilla\/5\.0 \(iOS\) (ownCloud|Nextcloud)\-iOS.*$/',
  284. ])
  285. ->willReturn(false);
  286. $this->session
  287. ->expects($this->any())
  288. ->method('get')
  289. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  290. ->willReturn('LoggedInUser');
  291. $user = $this->getMockBuilder(IUser::class)
  292. ->disableOriginalConstructor()
  293. ->getMock();
  294. $user->expects($this->any())
  295. ->method('getUID')
  296. ->willReturn('LoggedInUser');
  297. $this->userSession
  298. ->expects($this->any())
  299. ->method('getUser')
  300. ->willReturn($user);
  301. $this->request
  302. ->expects($this->once())
  303. ->method('passesCSRFCheck')
  304. ->willReturn(false);
  305. $this->auth->check($request, $response);
  306. }
  307. public function testAuthenticateAlreadyLoggedInWithoutTwoFactorChallengePassed() {
  308. $this->expectException(\Sabre\DAV\Exception\NotAuthenticated::class);
  309. $this->expectExceptionMessage('2FA challenge not passed.');
  310. $request = $this->getMockBuilder(RequestInterface::class)
  311. ->disableOriginalConstructor()
  312. ->getMock();
  313. $response = $this->getMockBuilder(ResponseInterface::class)
  314. ->disableOriginalConstructor()
  315. ->getMock();
  316. $this->userSession
  317. ->expects($this->any())
  318. ->method('isLoggedIn')
  319. ->willReturn(true);
  320. $this->request
  321. ->expects($this->any())
  322. ->method('getMethod')
  323. ->willReturn('PROPFIND');
  324. $this->request
  325. ->expects($this->any())
  326. ->method('isUserAgent')
  327. ->with([
  328. '/^Mozilla\/5\.0 \([A-Za-z ]+\) (mirall|csyncoC)\/.*$/',
  329. '/^Mozilla\/5\.0 \(Android\) ownCloud\-android.*$/',
  330. '/^Mozilla\/5\.0 \(iOS\) (ownCloud|Nextcloud)\-iOS.*$/',
  331. ])
  332. ->willReturn(false);
  333. $this->session
  334. ->expects($this->any())
  335. ->method('get')
  336. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  337. ->willReturn('LoggedInUser');
  338. $user = $this->getMockBuilder(IUser::class)
  339. ->disableOriginalConstructor()
  340. ->getMock();
  341. $user->expects($this->any())
  342. ->method('getUID')
  343. ->willReturn('LoggedInUser');
  344. $this->userSession
  345. ->expects($this->any())
  346. ->method('getUser')
  347. ->willReturn($user);
  348. $this->request
  349. ->expects($this->once())
  350. ->method('passesCSRFCheck')
  351. ->willReturn(true);
  352. $this->twoFactorManager->expects($this->once())
  353. ->method('needsSecondFactor')
  354. ->with($user)
  355. ->willReturn(true);
  356. $this->auth->check($request, $response);
  357. }
  358. public function testAuthenticateAlreadyLoggedInWithoutCsrfTokenAndIncorrectlyDavAuthenticated() {
  359. $this->expectException(\Sabre\DAV\Exception\NotAuthenticated::class);
  360. $this->expectExceptionMessage('CSRF check not passed.');
  361. $request = $this->getMockBuilder(RequestInterface::class)
  362. ->disableOriginalConstructor()
  363. ->getMock();
  364. $response = $this->getMockBuilder(ResponseInterface::class)
  365. ->disableOriginalConstructor()
  366. ->getMock();
  367. $this->userSession
  368. ->expects($this->any())
  369. ->method('isLoggedIn')
  370. ->willReturn(true);
  371. $this->request
  372. ->expects($this->any())
  373. ->method('getMethod')
  374. ->willReturn('PROPFIND');
  375. $this->request
  376. ->expects($this->any())
  377. ->method('isUserAgent')
  378. ->with([
  379. '/^Mozilla\/5\.0 \([A-Za-z ]+\) (mirall|csyncoC)\/.*$/',
  380. '/^Mozilla\/5\.0 \(Android\) (ownCloud|Nextcloud)\-android.*$/',
  381. '/^Mozilla\/5\.0 \(iOS\) (ownCloud|Nextcloud)\-iOS.*$/',
  382. ])
  383. ->willReturn(false);
  384. $this->session
  385. ->expects($this->any())
  386. ->method('get')
  387. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  388. ->willReturn('AnotherUser');
  389. $user = $this->getMockBuilder(IUser::class)
  390. ->disableOriginalConstructor()
  391. ->getMock();
  392. $user->expects($this->any())
  393. ->method('getUID')
  394. ->willReturn('LoggedInUser');
  395. $this->userSession
  396. ->expects($this->any())
  397. ->method('getUser')
  398. ->willReturn($user);
  399. $this->request
  400. ->expects($this->once())
  401. ->method('passesCSRFCheck')
  402. ->willReturn(false);
  403. $this->auth->check($request, $response);
  404. }
  405. public function testAuthenticateAlreadyLoggedInWithoutCsrfTokenForNonGetAndDesktopClient() {
  406. $request = $this->getMockBuilder(RequestInterface::class)
  407. ->disableOriginalConstructor()
  408. ->getMock();
  409. $response = $this->getMockBuilder(ResponseInterface::class)
  410. ->disableOriginalConstructor()
  411. ->getMock();
  412. $this->userSession
  413. ->expects($this->any())
  414. ->method('isLoggedIn')
  415. ->willReturn(true);
  416. $this->request
  417. ->expects($this->any())
  418. ->method('getMethod')
  419. ->willReturn('POST');
  420. $this->request
  421. ->expects($this->any())
  422. ->method('isUserAgent')
  423. ->with([
  424. '/^Mozilla\/5\.0 \([A-Za-z ]+\) (mirall|csyncoC)\/.*$/',
  425. '/^Mozilla\/5\.0 \(Android\) (ownCloud|Nextcloud)\-android.*$/',
  426. '/^Mozilla\/5\.0 \(iOS\) (ownCloud|Nextcloud)\-iOS.*$/',
  427. ])
  428. ->willReturn(true);
  429. $this->session
  430. ->expects($this->any())
  431. ->method('get')
  432. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  433. ->willReturn(null);
  434. $user = $this->getMockBuilder(IUser::class)
  435. ->disableOriginalConstructor()
  436. ->getMock();
  437. $user->expects($this->any())
  438. ->method('getUID')
  439. ->willReturn('MyWrongDavUser');
  440. $this->userSession
  441. ->expects($this->any())
  442. ->method('getUser')
  443. ->willReturn($user);
  444. $this->request
  445. ->expects($this->once())
  446. ->method('passesCSRFCheck')
  447. ->willReturn(false);
  448. $this->auth->check($request, $response);
  449. }
  450. public function testAuthenticateAlreadyLoggedInWithoutCsrfTokenForGet() {
  451. $request = $this->getMockBuilder(RequestInterface::class)
  452. ->disableOriginalConstructor()
  453. ->getMock();
  454. $response = $this->getMockBuilder(ResponseInterface::class)
  455. ->disableOriginalConstructor()
  456. ->getMock();
  457. $this->userSession
  458. ->expects($this->any())
  459. ->method('isLoggedIn')
  460. ->willReturn(true);
  461. $this->session
  462. ->expects($this->any())
  463. ->method('get')
  464. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  465. ->willReturn(null);
  466. $user = $this->getMockBuilder(IUser::class)
  467. ->disableOriginalConstructor()
  468. ->getMock();
  469. $user->expects($this->any())
  470. ->method('getUID')
  471. ->willReturn('MyWrongDavUser');
  472. $this->userSession
  473. ->expects($this->any())
  474. ->method('getUser')
  475. ->willReturn($user);
  476. $this->request
  477. ->expects($this->any())
  478. ->method('getMethod')
  479. ->willReturn('GET');
  480. $response = $this->auth->check($request, $response);
  481. $this->assertEquals([true, 'principals/users/MyWrongDavUser'], $response);
  482. }
  483. public function testAuthenticateAlreadyLoggedInWithCsrfTokenForGet() {
  484. $request = $this->getMockBuilder(RequestInterface::class)
  485. ->disableOriginalConstructor()
  486. ->getMock();
  487. $response = $this->getMockBuilder(ResponseInterface::class)
  488. ->disableOriginalConstructor()
  489. ->getMock();
  490. $this->userSession
  491. ->expects($this->any())
  492. ->method('isLoggedIn')
  493. ->willReturn(true);
  494. $this->session
  495. ->expects($this->any())
  496. ->method('get')
  497. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  498. ->willReturn(null);
  499. $user = $this->getMockBuilder(IUser::class)
  500. ->disableOriginalConstructor()
  501. ->getMock();
  502. $user->expects($this->any())
  503. ->method('getUID')
  504. ->willReturn('MyWrongDavUser');
  505. $this->userSession
  506. ->expects($this->any())
  507. ->method('getUser')
  508. ->willReturn($user);
  509. $this->request
  510. ->expects($this->once())
  511. ->method('passesCSRFCheck')
  512. ->willReturn(true);
  513. $response = $this->auth->check($request, $response);
  514. $this->assertEquals([true, 'principals/users/MyWrongDavUser'], $response);
  515. }
  516. public function testAuthenticateNoBasicAuthenticateHeadersProvided() {
  517. $server = $this->getMockBuilder(Server::class)
  518. ->disableOriginalConstructor()
  519. ->getMock();
  520. $server->httpRequest = $this->getMockBuilder(RequestInterface::class)
  521. ->disableOriginalConstructor()
  522. ->getMock();
  523. $server->httpResponse = $this->getMockBuilder(ResponseInterface::class)
  524. ->disableOriginalConstructor()
  525. ->getMock();
  526. $response = $this->auth->check($server->httpRequest, $server->httpResponse);
  527. $this->assertEquals([false, 'No \'Authorization: Basic\' header found. Either the client didn\'t send one, or the server is misconfigured'], $response);
  528. }
  529. public function testAuthenticateNoBasicAuthenticateHeadersProvidedWithAjax() {
  530. $this->expectException(\Sabre\DAV\Exception\NotAuthenticated::class);
  531. $this->expectExceptionMessage('Cannot authenticate over ajax calls');
  532. /** @var \Sabre\HTTP\RequestInterface $httpRequest */
  533. $httpRequest = $this->getMockBuilder(RequestInterface::class)
  534. ->disableOriginalConstructor()
  535. ->getMock();
  536. /** @var \Sabre\HTTP\ResponseInterface $httpResponse */
  537. $httpResponse = $this->getMockBuilder(ResponseInterface::class)
  538. ->disableOriginalConstructor()
  539. ->getMock();
  540. $this->userSession
  541. ->expects($this->any())
  542. ->method('isLoggedIn')
  543. ->willReturn(false);
  544. $httpRequest
  545. ->expects($this->once())
  546. ->method('getHeader')
  547. ->with('X-Requested-With')
  548. ->willReturn('XMLHttpRequest');
  549. $this->auth->check($httpRequest, $httpResponse);
  550. }
  551. public function testAuthenticateNoBasicAuthenticateHeadersProvidedWithAjaxButUserIsStillLoggedIn() {
  552. /** @var \Sabre\HTTP\RequestInterface $httpRequest */
  553. $httpRequest = $this->getMockBuilder(RequestInterface::class)
  554. ->disableOriginalConstructor()
  555. ->getMock();
  556. /** @var \Sabre\HTTP\ResponseInterface $httpResponse */
  557. $httpResponse = $this->getMockBuilder(ResponseInterface::class)
  558. ->disableOriginalConstructor()
  559. ->getMock();
  560. /** @var IUser */
  561. $user = $this->getMockBuilder(IUser::class)
  562. ->disableOriginalConstructor()
  563. ->getMock();
  564. $user->method('getUID')->willReturn('MyTestUser');
  565. $this->userSession
  566. ->expects($this->any())
  567. ->method('isLoggedIn')
  568. ->willReturn(true);
  569. $this->userSession
  570. ->expects($this->any())
  571. ->method('getUser')
  572. ->willReturn($user);
  573. $this->session
  574. ->expects($this->atLeastOnce())
  575. ->method('get')
  576. ->with('AUTHENTICATED_TO_DAV_BACKEND')
  577. ->willReturn('MyTestUser');
  578. $this->request
  579. ->expects($this->once())
  580. ->method('getMethod')
  581. ->willReturn('GET');
  582. $httpRequest
  583. ->expects($this->atLeastOnce())
  584. ->method('getHeader')
  585. ->with('Authorization')
  586. ->willReturn(null);
  587. $this->assertEquals(
  588. [true, 'principals/users/MyTestUser'],
  589. $this->auth->check($httpRequest, $httpResponse)
  590. );
  591. }
  592. public function testAuthenticateValidCredentials() {
  593. $server = $this->getMockBuilder(Server::class)
  594. ->disableOriginalConstructor()
  595. ->getMock();
  596. $server->httpRequest = $this->getMockBuilder(RequestInterface::class)
  597. ->disableOriginalConstructor()
  598. ->getMock();
  599. $server->httpRequest
  600. ->expects($this->at(0))
  601. ->method('getHeader')
  602. ->with('X-Requested-With')
  603. ->willReturn(null);
  604. $server->httpRequest
  605. ->expects($this->at(1))
  606. ->method('getHeader')
  607. ->with('Authorization')
  608. ->willReturn('basic dXNlcm5hbWU6cGFzc3dvcmQ=');
  609. $server->httpResponse = $this->getMockBuilder(ResponseInterface::class)
  610. ->disableOriginalConstructor()
  611. ->getMock();
  612. $this->userSession
  613. ->expects($this->once())
  614. ->method('logClientIn')
  615. ->with('username', 'password')
  616. ->willReturn(true);
  617. $user = $this->getMockBuilder(IUser::class)
  618. ->disableOriginalConstructor()
  619. ->getMock();
  620. $user->expects($this->exactly(3))
  621. ->method('getUID')
  622. ->willReturn('MyTestUser');
  623. $this->userSession
  624. ->expects($this->exactly(4))
  625. ->method('getUser')
  626. ->willReturn($user);
  627. $response = $this->auth->check($server->httpRequest, $server->httpResponse);
  628. $this->assertEquals([true, 'principals/users/MyTestUser'], $response);
  629. }
  630. public function testAuthenticateInvalidCredentials() {
  631. $server = $this->getMockBuilder(Server::class)
  632. ->disableOriginalConstructor()
  633. ->getMock();
  634. $server->httpRequest = $this->getMockBuilder(RequestInterface::class)
  635. ->disableOriginalConstructor()
  636. ->getMock();
  637. $server->httpRequest
  638. ->expects($this->at(0))
  639. ->method('getHeader')
  640. ->with('X-Requested-With')
  641. ->willReturn(null);
  642. $server->httpRequest
  643. ->expects($this->at(1))
  644. ->method('getHeader')
  645. ->with('Authorization')
  646. ->willReturn('basic dXNlcm5hbWU6cGFzc3dvcmQ=');
  647. $server->httpResponse = $this->getMockBuilder(ResponseInterface::class)
  648. ->disableOriginalConstructor()
  649. ->getMock();
  650. $this->userSession
  651. ->expects($this->once())
  652. ->method('logClientIn')
  653. ->with('username', 'password')
  654. ->willReturn(false);
  655. $response = $this->auth->check($server->httpRequest, $server->httpResponse);
  656. $this->assertEquals([false, 'Username or password was incorrect'], $response);
  657. }
  658. }