Release 2.59 (#5957)

tests/Security/ApiAccessControlTest.php

@@ -0,0 +1,48 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Security;
+
+use PHPUnit\Framework\Attributes\Group;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Http\AccessMapInterface;
+
+/**
+ * Regression test for the 2FA-API-bypass security advisory.
+ *
+ * The firewall-level access_control for ^/api was raised from IS_AUTHENTICATED
+ * to IS_AUTHENTICATED_REMEMBERED so that a TwoFactorToken (which only satisfies
+ * IS_AUTHENTICATED) can no longer reach any /api/* route, while remember_me
+ * sessions used by the web frontend continue to work.
+ */
+#[Group('integration')]
+class ApiAccessControlTest extends KernelTestCase
+{
+    public function testApiRouteRequiresAuthenticatedRemembered(): void
+    {
+        self::bootKernel();
+        $accessMap = self::getContainer()->get('security.access_map');
+        self::assertInstanceOf(AccessMapInterface::class, $accessMap);
+
+        [$attributes] = $accessMap->getPatterns(Request::create('/api/users/me'));
+
+        self::assertIsArray($attributes);
+        self::assertContains(
+            'IS_AUTHENTICATED_REMEMBERED',
+            $attributes,
+            'API access_control must require IS_AUTHENTICATED_REMEMBERED to keep a TwoFactorToken from reaching /api/*'
+        );
+        self::assertNotContains(
+            'IS_AUTHENTICATED',
+            $attributes,
+            'API access_control must not fall back to IS_AUTHENTICATED, which a TwoFactorToken satisfies'
+        );
+    }
+}