shlink/module/Rest/test/Middleware/AuthenticationMiddlewareTest.php

164 lines
6.2 KiB
PHP
Raw Normal View History

<?php
2019-10-05 10:26:10 -05:00
2017-10-12 03:13:20 -05:00
declare(strict_types=1);
namespace ShlinkioTest\Shlink\Rest\Middleware;
use Fig\Http\Message\RequestMethodInterface;
2020-01-01 14:11:53 -06:00
use Laminas\Diactoros\Response;
use Laminas\Diactoros\ServerRequest;
use Laminas\Diactoros\ServerRequestFactory;
2020-01-01 14:11:53 -06:00
use Mezzio\Router\Route;
use Mezzio\Router\RouteResult;
2017-03-24 14:34:18 -05:00
use PHPUnit\Framework\TestCase;
use Prophecy\Argument;
2020-11-02 04:50:19 -06:00
use Prophecy\PhpUnit\ProphecyTrait;
use Prophecy\Prophecy\ObjectProphecy;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
2018-03-26 12:02:41 -05:00
use Psr\Http\Server\RequestHandlerInterface;
2019-12-31 08:38:37 -06:00
use Shlinkio\Shlink\Rest\Action\HealthAction;
2020-11-08 04:28:27 -06:00
use Shlinkio\Shlink\Rest\Entity\ApiKey;
use Shlinkio\Shlink\Rest\Exception\MissingAuthenticationException;
use Shlinkio\Shlink\Rest\Exception\VerifyAuthenticationException;
use Shlinkio\Shlink\Rest\Middleware\AuthenticationMiddleware;
2020-11-08 04:28:27 -06:00
use Shlinkio\Shlink\Rest\Service\ApiKeyCheckResult;
use Shlinkio\Shlink\Rest\Service\ApiKeyServiceInterface;
2020-01-01 14:11:53 -06:00
use function Laminas\Stratigility\middleware;
class AuthenticationMiddlewareTest extends TestCase
{
2020-11-02 04:50:19 -06:00
use ProphecyTrait;
private AuthenticationMiddleware $middleware;
private ObjectProphecy $apiKeyService;
private ObjectProphecy $handler;
2018-03-21 05:13:03 -05:00
2019-02-16 03:53:45 -06:00
public function setUp(): void
{
$this->apiKeyService = $this->prophesize(ApiKeyServiceInterface::class);
2021-01-21 12:26:19 -06:00
$this->middleware = new AuthenticationMiddleware(
$this->apiKeyService->reveal(),
[HealthAction::class],
['with_query_api_key'],
);
$this->handler = $this->prophesize(RequestHandlerInterface::class);
}
/**
* @test
* @dataProvider provideWhitelistedRequests
*/
2019-02-17 13:28:34 -06:00
public function someWhiteListedSituationsFallbackToNextMiddleware(ServerRequestInterface $request): void
{
$handle = $this->handler->handle($request)->willReturn(new Response());
$checkApiKey = $this->apiKeyService->check(Argument::any());
$this->middleware->process($request, $this->handler->reveal());
2018-11-11 06:18:21 -06:00
$handle->shouldHaveBeenCalledOnce();
$checkApiKey->shouldNotHaveBeenCalled();
}
2019-02-17 13:28:34 -06:00
public function provideWhitelistedRequests(): iterable
{
$dummyMiddleware = $this->getDummyMiddleware();
2019-02-17 13:28:34 -06:00
yield 'with no route result' => [new ServerRequest()];
yield 'with failure route result' => [(new ServerRequest())->withAttribute(
RouteResult::class,
2020-01-01 13:48:31 -06:00
RouteResult::fromRouteFailure([RequestMethodInterface::METHOD_GET]),
2019-02-17 13:28:34 -06:00
)];
yield 'with whitelisted route' => [(new ServerRequest())->withAttribute(
RouteResult::class,
RouteResult::fromRoute(
2020-01-01 13:48:31 -06:00
new Route('foo', $dummyMiddleware, Route::HTTP_METHOD_ANY, HealthAction::class),
),
2019-02-17 13:28:34 -06:00
)];
yield 'with OPTIONS method' => [(new ServerRequest())->withAttribute(
RouteResult::class,
2020-01-01 13:48:31 -06:00
RouteResult::fromRoute(new Route('bar', $dummyMiddleware), []),
2019-02-17 13:28:34 -06:00
)->withMethod(RequestMethodInterface::METHOD_OPTIONS)];
}
/**
* @test
* @dataProvider provideRequestsWithoutApiKey
*/
2021-01-21 12:26:19 -06:00
public function throwsExceptionWhenNoApiKeyIsProvided(
ServerRequestInterface $request,
string $expectedMessage
): void {
$this->apiKeyService->check(Argument::any())->shouldNotBeCalled();
$this->handler->handle($request)->shouldNotBeCalled();
$this->expectException(MissingAuthenticationException::class);
2021-01-21 12:26:19 -06:00
$this->expectExceptionMessage($expectedMessage);
$this->middleware->process($request, $this->handler->reveal());
}
public function provideRequestsWithoutApiKey(): iterable
{
2021-01-21 12:26:19 -06:00
$baseRequest = fn (string $routeName) => ServerRequestFactory::fromGlobals()->withAttribute(
RouteResult::class,
2021-01-21 12:26:19 -06:00
RouteResult::fromRoute(new Route($routeName, $this->getDummyMiddleware()), []),
);
2021-01-21 12:26:19 -06:00
$apiKeyMessage = 'Expected one of the following authentication headers, ["X-Api-Key"], but none were provided';
$queryMessage = 'Expected authentication to be provided in "apiKey" query param';
yield 'no api key in header' => [$baseRequest('bar'), $apiKeyMessage];
yield 'empty api key in header' => [$baseRequest('bar')->withHeader('X-Api-Key', ''), $apiKeyMessage];
yield 'no api key in query' => [$baseRequest('with_query_api_key'), $queryMessage];
yield 'empty api key in query' => [
$baseRequest('with_query_api_key')->withQueryParams(['apiKey' => '']),
$queryMessage,
];
}
/** @test */
public function throwsExceptionWhenProvidedApiKeyIsInvalid(): void
{
$apiKey = 'abc123';
$request = ServerRequestFactory::fromGlobals()
->withAttribute(
RouteResult::class,
RouteResult::fromRoute(new Route('bar', $this->getDummyMiddleware()), []),
)
->withHeader('X-Api-Key', $apiKey);
2020-11-08 04:28:27 -06:00
$this->apiKeyService->check($apiKey)->willReturn(new ApiKeyCheckResult())->shouldBeCalledOnce();
$this->handler->handle($request)->shouldNotBeCalled();
$this->expectException(VerifyAuthenticationException::class);
$this->expectExceptionMessage('Provided API key does not exist or is invalid');
$this->middleware->process($request, $this->handler->reveal());
}
/** @test */
public function validApiKeyFallsBackToNextMiddleware(): void
{
2020-11-08 04:28:27 -06:00
$apiKey = new ApiKey();
$key = $apiKey->toString();
$request = ServerRequestFactory::fromGlobals()
->withAttribute(
RouteResult::class,
RouteResult::fromRoute(new Route('bar', $this->getDummyMiddleware()), []),
)
2020-11-08 04:28:27 -06:00
->withHeader('X-Api-Key', $key);
2020-11-08 04:28:27 -06:00
$handle = $this->handler->handle($request->withAttribute(ApiKey::class, $apiKey))->willReturn(new Response());
$checkApiKey = $this->apiKeyService->check($key)->willReturn(new ApiKeyCheckResult($apiKey));
$this->middleware->process($request, $this->handler->reveal());
2018-11-11 06:18:21 -06:00
$handle->shouldHaveBeenCalledOnce();
$checkApiKey->shouldHaveBeenCalledOnce();
}
private function getDummyMiddleware(): MiddlewareInterface
{
return middleware(fn () => new Response\EmptyResponse());
}
}