jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

added API tokens, deprecate API passwords (#4637)

Browse Source
This commit is contained in:
Kevin Papst
2024-04-05 23:51:16 +02:00
committed by GitHub
parent dd51c8dfba
commit afe0656502
60 changed files with 889 additions and 624 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
tests/API/Authentication/AccessTokenHandlerTest.php Normal file
View File

@@ -0,0 +1,65 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace API\Authentication;
use App\API\Authentication\AccessTokenHandler;
use App\Entity\AccessToken;
use App\Entity\User;
use App\Repository\AccessTokenRepository;
use PHPUnit\Framework\TestCase;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
/**
* @covers \App\API\Authentication\AccessTokenHandler
*/
class AccessTokenHandlerTest extends TestCase
{
private function getSut(?AccessToken $accessToken = null): AccessTokenHandler
{
$userProvider = $this->createMock(AccessTokenRepository::class);
$userProvider->method('findByToken')->willReturn($accessToken);
return new AccessTokenHandler($userProvider);
}
public function testUnknownToken(): void
{
$this->expectException(BadCredentialsException::class);
$this->expectExceptionMessage('Invalid credentials.');
$sut = $this->getSut();
$sut->getUserBadgeFrom('foo');
}
public function testInvalidToken(): void
{
$user = new User();
$user->setUserIdentifier('foo');
$accessToken = new AccessToken($user, 'Test');
$accessToken->setExpiresAt(new \DateTimeImmutable('-1 day'));
$this->expectException(BadCredentialsException::class);
$this->expectExceptionMessage('Invalid token.');
$sut = $this->getSut($accessToken);
$sut->getUserBadgeFrom('foo');
}
public function testValidTokenSetsLastUsage(): void
{
$user = new User();
$user->setUserIdentifier('foo-bar');
$accessToken = new AccessToken($user, 'Test');
$this->assertNull($accessToken->getLastUsage());
$sut = $this->getSut($accessToken);
$badge = $sut->getUserBadgeFrom('foo');
$this->assertNotNull($accessToken->getLastUsage());
$this->assertSame('foo-bar', $badge->getUserIdentifier());
}
}

178
tests/API/Authentication/SessionAuthenticatorTest.php
View File

@@ -1,178 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\API\Authentication;
use App\API\Authentication\SessionAuthenticator;
use App\API\Authentication\TokenAuthenticator;
use App\Entity\User;
use App\Repository\ApiUserRepository;
use PHPUnit\Framework\TestCase;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface;
use Symfony\Component\PasswordHasher\PasswordHasherInterface;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\CustomCredentials;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
/**
* @covers \App\API\Authentication\SessionAuthenticator
*/
class SessionAuthenticatorTest extends TestCase
{
private function getSut(bool $verify = true): SessionAuthenticator
{
$userProvider = $this->createMock(ApiUserRepository::class);
$passwordHasherFactory = $this->createMock(PasswordHasherFactoryInterface::class);
$passwordHasher = $this->createMock(PasswordHasherInterface::class);
$passwordHasher->method('verify')->willReturn($verify);
$passwordHasherFactory->method('getPasswordHasher')->willReturn($passwordHasher);
$token = new TokenAuthenticator($userProvider, $passwordHasherFactory);
return new SessionAuthenticator($token);
}
public function testSupports(): void
{
$sut = $this->getSut();
// not supporting because /api path is not the beginning of the URL
$request = new Request([], [], [], [], [], ['REQUEST_URI' => 'dfghj/api/doc/dfghj']);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo']);
self::assertTrue($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/doc']);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-SESSION' => true]);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => 'bar']);
self::assertTrue($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => 'bar', 'HTTP_X-AUTH-SESSION' => true]);
self::assertFalse($sut->supports($request));
}
public function testAuthenticateWithMissingAuthHeader(): void
{
$this->expectException(CustomUserMessageAuthenticationException::class);
$this->expectExceptionMessage('Authentication required, missing user header: X-AUTH-USER');
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo']);
$sut->authenticate($request);
}
public function testAuthenticateWithMissingToken(): void
{
$this->expectException(CustomUserMessageAuthenticationException::class);
$this->expectExceptionMessage('Authentication required, missing token header: X-AUTH-TOKEN');
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo']);
$sut->authenticate($request);
}
public function testAuthenticateWithEmptyToken(): void
{
$this->expectException(CustomUserMessageAuthenticationException::class);
$this->expectExceptionMessage('Authentication required, missing token header: X-AUTH-TOKEN');
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => '']);
$sut->authenticate($request);
}
public function testAuthenticateWithMissingUser(): void
{
$this->expectException(CustomUserMessageAuthenticationException::class);
$this->expectExceptionMessage('Authentication required, missing user header: X-AUTH-USER');
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-TOKEN' => 'bar']);
$sut->authenticate($request);
}
public function testAuthenticateWithEmptyUser(): void
{
$this->expectException(CustomUserMessageAuthenticationException::class);
$this->expectExceptionMessage('Authentication required, missing user header: X-AUTH-USER');
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => '', 'HTTP_X-AUTH-TOKEN' => 'bar']);
$sut->authenticate($request);
}
public function testAuthenticate(): void
{
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo2', 'HTTP_X-AUTH-TOKEN' => 'bar']);
$passport = $sut->authenticate($request);
self::assertInstanceOf(Passport::class, $passport);
$badge = $passport->getBadge(UserBadge::class);
self::assertInstanceOf(UserBadge::class, $badge);
self::assertEquals('foo2', $badge->getUserIdentifier());
$user = new User();
$user->setApiToken('bar2');
$badge = $passport->getBadge(CustomCredentials::class);
self::assertInstanceOf(CustomCredentials::class, $badge);
self::assertFalse($badge->isResolved());
$badge->executeCustomChecker($user);
self::assertTrue($badge->isResolved());
}
public function testAuthenticateFailsOnMissingApiTokenForUser(): void
{
$this->expectException(BadCredentialsException::class);
$this->expectExceptionMessage('The user has no activated API account.');
$sut = $this->getSut();
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo2', 'HTTP_X-AUTH-TOKEN' => 'bar']);
$passport = $sut->authenticate($request);
$user = new User();
/** @var CustomCredentials $badge */
$badge = $passport->getBadge(CustomCredentials::class);
$badge->executeCustomChecker($user);
}
public function testAuthenticateFailsOnWrongPassword(): void
{
$this->expectException(BadCredentialsException::class);
$this->expectExceptionMessage('The presented password is invalid.');
$sut = $this->getSut(false);
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo2', 'HTTP_X-AUTH-TOKEN' => 'bar']);
$passport = $sut->authenticate($request);
$user = new User();
$user->setApiToken('bar');
/** @var CustomCredentials $badge */
$badge = $passport->getBadge(CustomCredentials::class);
$badge->executeCustomChecker($user);
}
}

9
tests/API/Authentication/TokenAuthenticatorTest.php
View File

@@ -24,6 +24,7 @@ use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
/**
* @covers \App\API\Authentication\TokenAuthenticator
* @group legacy
*/
class TokenAuthenticatorTest extends TestCase
{
@@ -47,19 +48,13 @@ class TokenAuthenticatorTest extends TestCase
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo']);
self::assertTrue($sut->supports($request));
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/doc']);
self::assertFalse($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-SESSION' => true]);
self::assertTrue($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => 'bar']);
self::assertTrue($sut->supports($request));
$request = new Request([], [], [], [], [], ['REQUEST_URI' => '/api/fooo', 'HTTP_X-AUTH-USER' => 'foo', 'HTTP_X-AUTH-TOKEN' => 'bar', 'HTTP_X-AUTH-SESSION' => true]);
self::assertTrue($sut->supports($request));
}
public function testAuthenticateWithMissingAuthHeader(): void