From 1e2d595992da5346b496c2c2be234991f0febdbb Mon Sep 17 00:00:00 2001 From: "J. King" Date: Tue, 19 Mar 2019 23:37:08 -0400 Subject: [PATCH] Full set of authentication tests for Fever --- lib/REST/Fever/API.php | 9 ++++++ tests/cases/REST/Fever/TestAPI.php | 44 ++++++++++++++++++++++++++++-- 2 files changed, 50 insertions(+), 3 deletions(-) diff --git a/lib/REST/Fever/API.php b/lib/REST/Fever/API.php index 6effe27..30665ab 100644 --- a/lib/REST/Fever/API.php +++ b/lib/REST/Fever/API.php @@ -49,10 +49,19 @@ class API extends \JKingWeb\Arsse\REST\AbstractHandler { 'api_version' => self::LEVEL, 'auth' => 0, ]; + if ($req->getAttribute("authenticated", false)) { + // if HTTP authentication was successfully used, set the expected user ID + Arsse::$user->id = $req->getAttribute("authenticatedUser"); + $out['auth'] = 1; + } elseif (Arsse::$conf->userHTTPAuthRequired || Arsse::$conf->userPreAuth || $req->getAttribute("authenticationFailed", false)) { + // otherwise if HTTP authentication failed or is required, deny access at the HTTP level + return new EmptyResponse(401); + } // check that the user specified credentials if ($this->logIn(strtolower($inW['api_key'] ?? ""))) { $out['auth'] = 1; } else { + $out['auth'] = 0; return $this->formatResponse($out, $xml); } // handle each possible parameter diff --git a/tests/cases/REST/Fever/TestAPI.php b/tests/cases/REST/Fever/TestAPI.php index 54b3e07..ccf4564 100644 --- a/tests/cases/REST/Fever/TestAPI.php +++ b/tests/cases/REST/Fever/TestAPI.php @@ -80,21 +80,59 @@ class TestAPI extends \JKingWeb\Arsse\Test\AbstractTest { } /** @dataProvider provideAuthenticationRequests */ - public function testAuthenticateAUser(bool $httpRequired, bool $tokenEnforced, string $httpUser = null, array $dataPost, array $dataGet, bool $success) { + public function testAuthenticateAUser(bool $httpRequired, bool $tokenEnforced, string $httpUser = null, array $dataPost, array $dataGet, ResponseInterface $exp) { self::setConf([ 'userHTTPAuthRequired' => $httpRequired, 'userSessionEnforced' => $tokenEnforced, ], true); + Arsse::$user->id = null; \Phake::when(Arsse::$db)->tokenLookup->thenThrow(new ExceptionInput("subjectMissing")); \Phake::when(Arsse::$db)->tokenLookup("fever.login", "validtoken")->thenReturn(['user' => "jane.doe@example.com"]); - $exp = new JsonResponse($success ? ['api_version' => API::LEVEL, 'auth' => 1] : ['api_version' => API::LEVEL, 'auth' => 0]); $act = $this->req($dataGet, $dataPost, "POST", null, "", $httpUser); $this->assertMessage($exp, $act); } public function provideAuthenticationRequests() { + $success = new JsonResponse(['api_version' => API::LEVEL, 'auth' => 1]); + $failure = new JsonResponse(['api_version' => API::LEVEL, 'auth' => 0]); + $denied = new EmptyResponse(401); return [ - [false, true, null, ['api_key' => "validToken"], ['api' => null], true], + [false, true, null, [], ['api' => null], $failure], + [false, false, null, [], ['api' => null], $failure], + [true, true, null, [], ['api' => null], $denied], + [true, false, null, [], ['api' => null], $denied], + [false, true, "", [], ['api' => null], $denied], + [false, false, "", [], ['api' => null], $denied], + [true, true, "", [], ['api' => null], $denied], + [true, false, "", [], ['api' => null], $denied], + [false, true, null, [], ['api' => null, 'api_key' => "validToken"], $failure], + [false, false, null, [], ['api' => null, 'api_key' => "validToken"], $failure], + [true, true, null, [], ['api' => null, 'api_key' => "validToken"], $denied], + [true, false, null, [], ['api' => null, 'api_key' => "validToken"], $denied], + [false, true, null, ['api_key' => "validToken"], ['api' => null], $success], + [false, false, null, ['api_key' => "validToken"], ['api' => null], $success], + [true, true, null, ['api_key' => "validToken"], ['api' => null], $denied], + [true, false, null, ['api_key' => "validToken"], ['api' => null], $denied], + [false, true, "", ['api_key' => "validToken"], ['api' => null], $denied], + [false, false, "", ['api_key' => "validToken"], ['api' => null], $denied], + [true, true, "", ['api_key' => "validToken"], ['api' => null], $denied], + [true, false, "", ['api_key' => "validToken"], ['api' => null], $denied], + [false, true, "validUser", ['api_key' => "validToken"], ['api' => null], $success], + [false, false, "validUser", ['api_key' => "validToken"], ['api' => null], $success], + [true, true, "validUser", ['api_key' => "validToken"], ['api' => null], $success], + [true, false, "validUser", ['api_key' => "validToken"], ['api' => null], $success], + [false, true, null, ['api_key' => "invalidToken"], ['api' => null], $failure], + [false, false, null, ['api_key' => "invalidToken"], ['api' => null], $failure], + [true, true, null, ['api_key' => "invalidToken"], ['api' => null], $denied], + [true, false, null, ['api_key' => "invalidToken"], ['api' => null], $denied], + [false, true, "", ['api_key' => "invalidToken"], ['api' => null], $denied], + [false, false, "", ['api_key' => "invalidToken"], ['api' => null], $denied], + [true, true, "", ['api_key' => "invalidToken"], ['api' => null], $denied], + [true, false, "", ['api_key' => "invalidToken"], ['api' => null], $denied], + [false, true, "validUser", ['api_key' => "invalidToken"], ['api' => null], $failure], + [false, false, "validUser", ['api_key' => "invalidToken"], ['api' => null], $success], + [true, true, "validUser", ['api_key' => "invalidToken"], ['api' => null], $failure], + [true, false, "validUser", ['api_key' => "invalidToken"], ['api' => null], $success], ]; } }