jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

new stateless firewall to prevent new sessions for API calls (#3602)

Browse Source
This commit is contained in:
Kevin Papst
2022-10-28 15:13:40 +02:00
committed by GitHub
parent 78749ad3b4
commit 0461539f4b
6 changed files with 228 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
tests/Security/ApiAuthenticatorTest.php Normal file
View File

@@ -0,0 +1,62 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Security;
use App\Security\TokenAuthenticator;
use PHPUnit\Framework\TestCase;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
/**
* @covers \App\Security\ApiAuthenticator
*/
class ApiAuthenticatorTest extends TestCase
{
public function testRememberMe()
{
$factory = $this->createMock(EncoderFactoryInterface::class);
$sut = new TokenAuthenticator($factory);
self::assertFalse($sut->supportsRememberMe());
}
public function testSupports()
{
$factory = $this->createMock(EncoderFactoryInterface::class);
$sut = new TokenAuthenticator($factory);
$request = new Request([], [], [], [], [], ['REQUEST_URI' => 'dfghj/api/doc/dfghj']);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo']);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-SESSION' => true]);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => 'bar']);
self::assertTrue($sut->supports($request));
}
public function testGetCredentials()
{
$factory = $this->createMock(EncoderFactoryInterface::class);
$sut = new TokenAuthenticator($factory);
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-SESSION' => true]);
self::assertEquals(['user' => null, 'token' => null], $sut->getCredentials($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo']);
self::assertEquals(['user' => 'foo', 'token' => null], $sut->getCredentials($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => 'bar']);
self::assertEquals(['user' => 'foo', 'token' => 'bar'], $sut->getCredentials($request));
}
}