2016-07-31 00:26:49 +03:00
|
|
|
<?php
|
2019-10-05 18:26:10 +03:00
|
|
|
|
2017-10-12 11:13:20 +03:00
|
|
|
declare(strict_types=1);
|
|
|
|
|
2016-07-31 00:26:49 +03:00
|
|
|
namespace ShlinkioTest\Shlink\Rest\Middleware;
|
|
|
|
|
2018-09-28 23:08:01 +03:00
|
|
|
use Fig\Http\Message\RequestMethodInterface;
|
2020-01-01 23:11:53 +03:00
|
|
|
use Laminas\Diactoros\Response;
|
|
|
|
use Laminas\Diactoros\ServerRequest;
|
2020-11-07 14:53:14 +03:00
|
|
|
use Laminas\Diactoros\ServerRequestFactory;
|
2020-01-01 23:11:53 +03:00
|
|
|
use Mezzio\Router\Route;
|
|
|
|
use Mezzio\Router\RouteResult;
|
2023-02-09 22:42:18 +03:00
|
|
|
use PHPUnit\Framework\Attributes\DataProvider;
|
|
|
|
use PHPUnit\Framework\Attributes\Test;
|
2022-10-23 23:40:14 +03:00
|
|
|
use PHPUnit\Framework\MockObject\MockObject;
|
2017-03-24 22:34:18 +03:00
|
|
|
use PHPUnit\Framework\TestCase;
|
2018-09-28 23:08:01 +03:00
|
|
|
use Psr\Http\Message\ServerRequestInterface;
|
|
|
|
use Psr\Http\Server\MiddlewareInterface;
|
2018-03-26 20:02:41 +03:00
|
|
|
use Psr\Http\Server\RequestHandlerInterface;
|
2019-12-31 17:38:37 +03:00
|
|
|
use Shlinkio\Shlink\Rest\Action\HealthAction;
|
2020-11-08 13:28:27 +03:00
|
|
|
use Shlinkio\Shlink\Rest\Entity\ApiKey;
|
2020-11-07 14:53:14 +03:00
|
|
|
use Shlinkio\Shlink\Rest\Exception\MissingAuthenticationException;
|
|
|
|
use Shlinkio\Shlink\Rest\Exception\VerifyAuthenticationException;
|
2018-09-24 20:24:23 +03:00
|
|
|
use Shlinkio\Shlink\Rest\Middleware\AuthenticationMiddleware;
|
2020-11-08 13:28:27 +03:00
|
|
|
use Shlinkio\Shlink\Rest\Service\ApiKeyCheckResult;
|
2020-11-07 14:53:14 +03:00
|
|
|
use Shlinkio\Shlink\Rest\Service\ApiKeyServiceInterface;
|
2019-02-27 00:56:43 +03:00
|
|
|
|
2020-01-01 23:11:53 +03:00
|
|
|
use function Laminas\Stratigility\middleware;
|
2018-03-21 03:05:55 +03:00
|
|
|
|
2018-09-24 20:24:23 +03:00
|
|
|
class AuthenticationMiddlewareTest extends TestCase
|
2016-07-31 00:26:49 +03:00
|
|
|
{
|
2019-12-30 00:48:40 +03:00
|
|
|
private AuthenticationMiddleware $middleware;
|
2022-10-24 20:59:03 +03:00
|
|
|
private MockObject & ApiKeyServiceInterface $apiKeyService;
|
|
|
|
private MockObject & RequestHandlerInterface $handler;
|
2018-03-21 13:13:03 +03:00
|
|
|
|
2022-09-11 13:02:49 +03:00
|
|
|
protected function setUp(): void
|
2016-07-31 00:26:49 +03:00
|
|
|
{
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->apiKeyService = $this->createMock(ApiKeyServiceInterface::class);
|
2021-01-21 21:26:19 +03:00
|
|
|
$this->middleware = new AuthenticationMiddleware(
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->apiKeyService,
|
2021-01-21 21:26:19 +03:00
|
|
|
[HealthAction::class],
|
|
|
|
['with_query_api_key'],
|
|
|
|
);
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->handler = $this->createMock(RequestHandlerInterface::class);
|
2016-07-31 00:26:49 +03:00
|
|
|
}
|
|
|
|
|
2023-02-09 22:42:18 +03:00
|
|
|
#[Test, DataProvider('provideRequestsWithoutAuth')]
|
2021-02-16 17:28:03 +03:00
|
|
|
public function someSituationsFallbackToNextMiddleware(ServerRequestInterface $request): void
|
2016-07-31 00:26:49 +03:00
|
|
|
{
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->handler->expects($this->once())->method('handle')->with($request)->willReturn(new Response());
|
|
|
|
$this->apiKeyService->expects($this->never())->method('check');
|
2016-07-31 00:26:49 +03:00
|
|
|
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->middleware->process($request, $this->handler);
|
2016-07-31 00:26:49 +03:00
|
|
|
}
|
2016-07-31 14:01:08 +03:00
|
|
|
|
2023-02-09 11:32:38 +03:00
|
|
|
public static function provideRequestsWithoutAuth(): iterable
|
2016-07-31 14:01:08 +03:00
|
|
|
{
|
2023-02-09 11:32:38 +03:00
|
|
|
$dummyMiddleware = self::getDummyMiddleware();
|
2018-09-28 23:08:01 +03:00
|
|
|
|
2021-02-16 17:28:03 +03:00
|
|
|
yield 'no route result' => [new ServerRequest()];
|
|
|
|
yield 'failure route result' => [(new ServerRequest())->withAttribute(
|
2019-02-17 22:28:34 +03:00
|
|
|
RouteResult::class,
|
2020-01-01 22:48:31 +03:00
|
|
|
RouteResult::fromRouteFailure([RequestMethodInterface::METHOD_GET]),
|
2019-02-17 22:28:34 +03:00
|
|
|
)];
|
2021-02-16 17:28:03 +03:00
|
|
|
yield 'route without API key required' => [(new ServerRequest())->withAttribute(
|
2019-02-17 22:28:34 +03:00
|
|
|
RouteResult::class,
|
|
|
|
RouteResult::fromRoute(
|
2020-01-01 22:48:31 +03:00
|
|
|
new Route('foo', $dummyMiddleware, Route::HTTP_METHOD_ANY, HealthAction::class),
|
|
|
|
),
|
2019-02-17 22:28:34 +03:00
|
|
|
)];
|
2021-02-16 17:28:03 +03:00
|
|
|
yield 'OPTIONS method' => [(new ServerRequest())->withAttribute(
|
2019-02-17 22:28:34 +03:00
|
|
|
RouteResult::class,
|
2020-01-01 22:48:31 +03:00
|
|
|
RouteResult::fromRoute(new Route('bar', $dummyMiddleware), []),
|
2019-02-17 22:28:34 +03:00
|
|
|
)->withMethod(RequestMethodInterface::METHOD_OPTIONS)];
|
2016-07-31 14:01:08 +03:00
|
|
|
}
|
|
|
|
|
2023-02-09 22:42:18 +03:00
|
|
|
#[Test, DataProvider('provideRequestsWithoutApiKey')]
|
2021-01-21 21:26:19 +03:00
|
|
|
public function throwsExceptionWhenNoApiKeyIsProvided(
|
|
|
|
ServerRequestInterface $request,
|
2021-05-23 13:31:10 +03:00
|
|
|
string $expectedMessage,
|
2021-01-21 21:26:19 +03:00
|
|
|
): void {
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->apiKeyService->expects($this->never())->method('check');
|
|
|
|
$this->handler->expects($this->never())->method('handle');
|
2020-11-07 14:53:14 +03:00
|
|
|
$this->expectException(MissingAuthenticationException::class);
|
2021-01-21 21:26:19 +03:00
|
|
|
$this->expectExceptionMessage($expectedMessage);
|
2020-11-07 14:53:14 +03:00
|
|
|
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->middleware->process($request, $this->handler);
|
2020-11-07 14:53:14 +03:00
|
|
|
}
|
|
|
|
|
2023-02-09 11:32:38 +03:00
|
|
|
public static function provideRequestsWithoutApiKey(): iterable
|
2016-07-31 14:01:08 +03:00
|
|
|
{
|
2021-01-21 21:26:19 +03:00
|
|
|
$baseRequest = fn (string $routeName) => ServerRequestFactory::fromGlobals()->withAttribute(
|
2016-07-31 14:01:08 +03:00
|
|
|
RouteResult::class,
|
2023-02-09 11:32:38 +03:00
|
|
|
RouteResult::fromRoute(new Route($routeName, self::getDummyMiddleware())), // @phpstan-ignore-line
|
2018-09-29 09:16:40 +03:00
|
|
|
);
|
2021-01-21 21:26:19 +03:00
|
|
|
$apiKeyMessage = 'Expected one of the following authentication headers, ["X-Api-Key"], but none were provided';
|
|
|
|
$queryMessage = 'Expected authentication to be provided in "apiKey" query param';
|
|
|
|
|
|
|
|
yield 'no api key in header' => [$baseRequest('bar'), $apiKeyMessage];
|
|
|
|
yield 'empty api key in header' => [$baseRequest('bar')->withHeader('X-Api-Key', ''), $apiKeyMessage];
|
|
|
|
yield 'no api key in query' => [$baseRequest('with_query_api_key'), $queryMessage];
|
|
|
|
yield 'empty api key in query' => [
|
|
|
|
$baseRequest('with_query_api_key')->withQueryParams(['apiKey' => '']),
|
|
|
|
$queryMessage,
|
|
|
|
];
|
2020-11-07 14:53:14 +03:00
|
|
|
}
|
|
|
|
|
2023-02-09 22:42:18 +03:00
|
|
|
#[Test]
|
2020-11-07 14:53:14 +03:00
|
|
|
public function throwsExceptionWhenProvidedApiKeyIsInvalid(): void
|
|
|
|
{
|
|
|
|
$apiKey = 'abc123';
|
|
|
|
$request = ServerRequestFactory::fromGlobals()
|
|
|
|
->withAttribute(
|
|
|
|
RouteResult::class,
|
2023-02-09 11:32:38 +03:00
|
|
|
RouteResult::fromRoute(new Route('bar', self::getDummyMiddleware()), []),
|
2020-11-07 14:53:14 +03:00
|
|
|
)
|
|
|
|
->withHeader('X-Api-Key', $apiKey);
|
|
|
|
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->apiKeyService->expects($this->once())->method('check')->with($apiKey)->willReturn(
|
|
|
|
new ApiKeyCheckResult(),
|
|
|
|
);
|
|
|
|
$this->handler->expects($this->never())->method('handle');
|
2020-11-07 14:53:14 +03:00
|
|
|
$this->expectException(VerifyAuthenticationException::class);
|
|
|
|
$this->expectExceptionMessage('Provided API key does not exist or is invalid');
|
|
|
|
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->middleware->process($request, $this->handler);
|
2020-11-07 14:53:14 +03:00
|
|
|
}
|
|
|
|
|
2023-02-09 22:42:18 +03:00
|
|
|
#[Test]
|
2020-11-07 14:53:14 +03:00
|
|
|
public function validApiKeyFallsBackToNextMiddleware(): void
|
|
|
|
{
|
2021-03-14 11:59:35 +03:00
|
|
|
$apiKey = ApiKey::create();
|
2020-11-08 13:28:27 +03:00
|
|
|
$key = $apiKey->toString();
|
2020-11-07 14:53:14 +03:00
|
|
|
$request = ServerRequestFactory::fromGlobals()
|
|
|
|
->withAttribute(
|
|
|
|
RouteResult::class,
|
2023-02-09 11:32:38 +03:00
|
|
|
RouteResult::fromRoute(new Route('bar', self::getDummyMiddleware()), []),
|
2020-11-07 14:53:14 +03:00
|
|
|
)
|
2020-11-08 13:28:27 +03:00
|
|
|
->withHeader('X-Api-Key', $key);
|
2020-11-07 14:53:14 +03:00
|
|
|
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->handler->expects($this->once())->method('handle')->with(
|
|
|
|
$request->withAttribute(ApiKey::class, $apiKey),
|
|
|
|
)->willReturn(new Response());
|
|
|
|
$this->apiKeyService->expects($this->once())->method('check')->with($key)->willReturn(
|
|
|
|
new ApiKeyCheckResult($apiKey),
|
|
|
|
);
|
2018-09-28 23:08:01 +03:00
|
|
|
|
2022-10-23 23:40:14 +03:00
|
|
|
$this->middleware->process($request, $this->handler);
|
2016-07-31 14:01:08 +03:00
|
|
|
}
|
|
|
|
|
2023-02-09 11:32:38 +03:00
|
|
|
private static function getDummyMiddleware(): MiddlewareInterface
|
2016-07-31 14:01:08 +03:00
|
|
|
{
|
2019-12-30 01:16:55 +03:00
|
|
|
return middleware(fn () => new Response\EmptyResponse());
|
2016-07-31 14:01:08 +03:00
|
|
|
}
|
2016-07-31 00:26:49 +03:00
|
|
|
}
|