shlink/module/Rest/test-api/Middleware/AuthenticationTest.php

116 lines
4.4 KiB
PHP
Raw Normal View History

2019-01-26 12:19:20 +03:00
<?php
2019-10-05 18:26:10 +03:00
2019-01-26 12:19:20 +03:00
declare(strict_types=1);
namespace ShlinkioApiTest\Shlink\Rest\Middleware;
use Shlinkio\Shlink\Rest\Authentication\Plugin;
2019-01-27 12:54:04 +03:00
use Shlinkio\Shlink\Rest\Authentication\RequestToHttpAuthPlugin;
2019-08-11 17:30:46 +03:00
use Shlinkio\Shlink\TestUtils\ApiTest\ApiTestCase;
2019-01-27 12:54:04 +03:00
use function implode;
use function sprintf;
2019-01-26 12:19:20 +03:00
class AuthenticationTest extends ApiTestCase
{
2019-02-17 22:28:34 +03:00
/** @test */
public function authorizationErrorIsReturnedIfNoApiKeyIsSent(): void
2019-01-26 12:19:20 +03:00
{
$expectedDetail = sprintf(
'Expected one of the following authentication headers, but none were provided, ["%s"]',
implode('", "', RequestToHttpAuthPlugin::SUPPORTED_AUTH_HEADERS)
);
$resp = $this->callApi(self::METHOD_GET, '/short-codes');
$payload = $this->getJsonResponsePayload($resp);
2019-01-26 12:19:20 +03:00
$this->assertEquals(self::STATUS_UNAUTHORIZED, $resp->getStatusCode());
$this->assertEquals(self::STATUS_UNAUTHORIZED, $payload['status']);
$this->assertEquals('INVALID_AUTHORIZATION', $payload['type']);
$this->assertEquals('INVALID_AUTHORIZATION', $payload['error']); // Deprecated
$this->assertEquals($expectedDetail, $payload['detail']);
$this->assertEquals($expectedDetail, $payload['message']); // Deprecated
$this->assertEquals('Invalid authorization', $payload['title']);
2019-01-27 12:54:04 +03:00
}
/**
* @test
2019-01-27 14:14:18 +03:00
* @dataProvider provideInvalidApiKeys
2019-01-27 12:54:04 +03:00
*/
2019-02-17 22:28:34 +03:00
public function apiKeyErrorIsReturnedWhenProvidedApiKeyIsInvalid(string $apiKey): void
2019-01-27 12:54:04 +03:00
{
$expectedDetail = 'Provided API key does not exist or is invalid.';
$resp = $this->callApi(self::METHOD_GET, '/short-codes', [
'headers' => [
Plugin\ApiKeyHeaderPlugin::HEADER_NAME => $apiKey,
],
]);
$payload = $this->getJsonResponsePayload($resp);
2019-01-27 12:54:04 +03:00
$this->assertEquals(self::STATUS_UNAUTHORIZED, $resp->getStatusCode());
$this->assertEquals(self::STATUS_UNAUTHORIZED, $payload['status']);
$this->assertEquals('INVALID_API_KEY', $payload['type']);
$this->assertEquals('INVALID_API_KEY', $payload['error']); // Deprecated
$this->assertEquals($expectedDetail, $payload['detail']);
$this->assertEquals($expectedDetail, $payload['message']); // Deprecated
$this->assertEquals('Invalid API key', $payload['title']);
2019-01-26 12:19:20 +03:00
}
2019-01-27 14:14:18 +03:00
2019-02-17 22:28:34 +03:00
public function provideInvalidApiKeys(): iterable
2019-01-27 14:14:18 +03:00
{
2019-02-17 22:28:34 +03:00
yield 'key which does not exist' => ['invalid'];
yield 'key which is expired' => ['expired_api_key'];
yield 'key which is disabled' => ['disabled_api_key'];
2019-01-27 14:14:18 +03:00
}
/**
* @test
* @dataProvider provideInvalidAuthorizations
*/
public function authorizationErrorIsReturnedIfInvalidDataIsProvided(
string $authValue,
string $expectedDetail,
string $expectedType,
string $expectedTitle
): void {
$resp = $this->callApi(self::METHOD_GET, '/short-codes', [
'headers' => [
Plugin\AuthorizationHeaderPlugin::HEADER_NAME => $authValue,
],
]);
$payload = $this->getJsonResponsePayload($resp);
$this->assertEquals(self::STATUS_UNAUTHORIZED, $resp->getStatusCode());
$this->assertEquals(self::STATUS_UNAUTHORIZED, $payload['status']);
$this->assertEquals($expectedType, $payload['type']);
$this->assertEquals($expectedType, $payload['error']); // Deprecated
$this->assertEquals($expectedDetail, $payload['detail']);
$this->assertEquals($expectedDetail, $payload['message']); // Deprecated
$this->assertEquals($expectedTitle, $payload['title']);
}
public function provideInvalidAuthorizations(): iterable
{
yield 'no type' => [
'invalid',
'You need to provide the Bearer type in the Authorization header.',
'INVALID_AUTHORIZATION',
'Invalid authorization',
];
yield 'invalid type' => [
'Basic invalid',
'Provided authorization type Basic is not supported. Use Bearer instead.',
'INVALID_AUTHORIZATION',
'Invalid authorization',
];
yield 'invalid JWT' => [
'Bearer invalid',
'Missing or invalid auth token provided. Perform a new authentication request and send provided '
. 'token on every new request on the Authorization header',
'INVALID_AUTH_TOKEN',
'Invalid auth token',
];
}
2019-01-26 12:19:20 +03:00
}