Rewrite of the authentication and authorization system

3 files changed, 326 insertions, 0 deletions

diff --git a/tests/units/Core/Http/OAuth2Test.php b/tests/units/Core/Http/OAuth2Test.php
new file mode 100644
index 00000000..d703dd7a
--- /dev/null
+++ b/tests/units/Core/Http/OAuth2Test.php
@@ -0,0 +1,43 @@
+<?php
+
+require_once __DIR__.'/../../Base.php';
+
+use Kanboard\Core\Http\OAuth2;
+
+class OAuth2Test extends Base
+{
+    public function testAuthUrl()
+    {
+        $oauth = new OAuth2($this->container);
+        $oauth->createService('A', 'B', 'C', 'D', 'E', array('f', 'g'));
+        $this->assertEquals('D?response_type=code&client_id=A&redirect_uri=C&scope=f+g', $oauth->getAuthorizationUrl());
+    }
+
+    public function testAuthHeader()
+    {
+        $oauth = new OAuth2($this->container);
+        $oauth->createService('A', 'B', 'C', 'D', 'E', array('f', 'g'));
+
+        $oauth->setAccessToken('foobar', 'BeaRer');
+        $this->assertEquals('Authorization: Bearer foobar', $oauth->getAuthorizationHeader());
+
+        $oauth->setAccessToken('foobar', 'unknown');
+        $this->assertEquals('', $oauth->getAuthorizationHeader());
+    }
+
+    public function testAccessToken()
+    {
+        $oauth = new OAuth2($this->container);
+        $oauth->createService('A', 'B', 'C', 'D', 'E', array('f', 'g'));
+        $oauth->getAccessToken('something');
+
+        $data = $this->container['httpClient']->getData();
+        $this->assertEquals('something', $data['code']);
+        $this->assertEquals('A', $data['client_id']);
+        $this->assertEquals('B', $data['client_secret']);
+        $this->assertEquals('C', $data['redirect_uri']);
+        $this->assertEquals('authorization_code', $data['grant_type']);
+
+        $this->assertEquals('E', $this->container['httpClient']->getUrl());
+    }
+}
diff --git a/tests/units/Core/Http/RememberMeCookieTest.php b/tests/units/Core/Http/RememberMeCookieTest.php
new file mode 100644
index 00000000..ae5606ac
--- /dev/null
+++ b/tests/units/Core/Http/RememberMeCookieTest.php
@@ -0,0 +1,108 @@
+<?php
+
+namespace Kanboard\Core\Http;
+
+require_once __DIR__.'/../../Base.php';
+
+function setcookie($name, $value = "", $expire = 0, $path = "", $domain = "", $secure = false, $httponly = false)
+{
+    return RememberMeCookieTest::$functions->setcookie($name, $value, $expire, $path, $domain, $secure, $httponly);
+}
+
+class RememberMeCookieTest extends \Base
+{
+    public static $functions;
+
+    public function setUp()
+    {
+        parent::setup();
+
+        self::$functions = $this
+            ->getMockBuilder('stdClass')
+            ->setMethods(array(
+                'setcookie',
+            ))
+            ->getMock();
+    }
+
+    public function tearDown()
+    {
+        parent::tearDown();
+        self::$functions = null;
+    }
+
+    public function testEncode()
+    {
+        $cookie = new RememberMeCookie($this->container);
+        $this->assertEquals('a|b', $cookie->encode('a', 'b'));
+    }
+
+    public function testDecode()
+    {
+        $cookie = new RememberMeCookie($this->container);
+        $this->assertEquals(array('token' => 'a', 'sequence' => 'b'), $cookie->decode('a|b'));
+    }
+
+    public function testHasCookie()
+    {
+        $this->container['request'] = new Request($this->container, array(), array(), array(), array(), array());
+
+        $cookie = new RememberMeCookie($this->container);
+        $this->assertFalse($cookie->hasCookie());
+
+        $this->container['request'] = new Request($this->container, array(), array(), array(), array(), array(RememberMeCookie::COOKIE_NAME => 'miam'));
+        $this->assertTrue($cookie->hasCookie());
+    }
+
+    public function testWrite()
+    {
+        self::$functions
+            ->expects($this->once())
+            ->method('setcookie')
+            ->with(
+                RememberMeCookie::COOKIE_NAME,
+                'myToken|mySequence',
+                1234,
+                '',
+                '',
+                false,
+                true
+            )
+            ->will($this->returnValue(true));
+
+        $cookie = new RememberMeCookie($this->container);
+        $this->assertTrue($cookie->write('myToken', 'mySequence', 1234));
+    }
+
+    public function testRead()
+    {
+        $this->container['request'] = new Request($this->container, array(), array(), array(), array(), array());
+
+        $cookie = new RememberMeCookie($this->container);
+        $this->assertFalse($cookie->read());
+
+        $this->container['request'] = new Request($this->container, array(), array(), array(), array(), array(RememberMeCookie::COOKIE_NAME => 'T|S'));
+
+        $this->assertEquals(array('token' => 'T', 'sequence' => 'S'), $cookie->read());
+    }
+
+    public function testRemove()
+    {
+        self::$functions
+            ->expects($this->once())
+            ->method('setcookie')
+            ->with(
+                RememberMeCookie::COOKIE_NAME,
+                '',
+                time() - 3600,
+                '',
+                '',
+                false,
+                true
+            )
+            ->will($this->returnValue(true));
+
+        $cookie = new RememberMeCookie($this->container);
+        $this->assertTrue($cookie->remove());
+    }
+}
diff --git a/tests/units/Core/Http/RequestTest.php b/tests/units/Core/Http/RequestTest.php
new file mode 100644
index 00000000..217698f9
--- /dev/null
+++ b/tests/units/Core/Http/RequestTest.php
@@ -0,0 +1,175 @@
+<?php
+
+require_once __DIR__.'/../../Base.php';
+
+use Kanboard\Core\Http\Request;
+
+class RequestTest extends Base
+{
+    public function testGetStringParam()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEquals('', $request->getStringParam('myvar'));
+
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEquals('default', $request->getStringParam('myvar', 'default'));
+
+        $request = new Request($this->container, array(), array('myvar' => 'myvalue'), array(), array(), array());
+        $this->assertEquals('myvalue', $request->getStringParam('myvar'));
+    }
+
+    public function testGetIntegerParam()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEquals(0, $request->getIntegerParam('myvar'));
+
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEquals(5, $request->getIntegerParam('myvar', 5));
+
+        $request = new Request($this->container, array(), array('myvar' => 'myvalue'), array(), array(), array());
+        $this->assertEquals(0, $request->getIntegerParam('myvar'));
+
+        $request = new Request($this->container, array(), array('myvar' => '123'), array(), array(), array());
+        $this->assertEquals(123, $request->getIntegerParam('myvar'));
+    }
+
+    public function testGetValues()
+    {
+        $request = new Request($this->container, array(), array(), array('myvar' => 'myvalue'), array(), array());
+        $this->assertEmpty($request->getValue('myvar'));
+
+        $request = new Request($this->container, array(), array(), array('myvar' => 'myvalue', 'csrf_token' => $this->container['token']->getCSRFToken()), array(), array());
+        $this->assertEquals('myvalue', $request->getValue('myvar'));
+
+        $request = new Request($this->container, array(), array(), array('myvar' => 'myvalue', 'csrf_token' => $this->container['token']->getCSRFToken()), array(), array());
+        $this->assertEquals(array('myvar' => 'myvalue'), $request->getValues());
+    }
+
+    public function testGetFileContent()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getFileContent('myfile'));
+
+        $filename = tempnam(sys_get_temp_dir(), 'UnitTest');
+        file_put_contents($filename, 'something');
+
+        $request = new Request($this->container, array(), array(), array(), array('myfile' => array('tmp_name' => $filename)), array());
+        $this->assertEquals('something', $request->getFileContent('myfile'));
+
+        unlink($filename);
+    }
+
+    public function testGetFilePath()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getFilePath('myfile'));
+
+        $request = new Request($this->container, array(), array(), array(), array('myfile' => array('tmp_name' => 'somewhere')), array());
+        $this->assertEquals('somewhere', $request->getFilePath('myfile'));
+    }
+
+    public function testIsPost()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertFalse($request->isPost());
+
+        $request = new Request($this->container, array('REQUEST_METHOD' => 'POST'), array(), array(), array(), array());
+        $this->assertTrue($request->isPost());
+    }
+
+    public function testIsAjax()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertFalse($request->isAjax());
+
+        $request = new Request($this->container, array('HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest'), array(), array(), array(), array());
+        $this->assertTrue($request->isAjax());
+    }
+
+    public function testIsHTTPS()
+    {
+        $request = new Request($this->container, array(), array(), array(), array());
+        $this->assertFalse($request->isHTTPS());
+
+        $request = new Request($this->container, array('HTTPS' => ''), array(), array(), array(), array());
+        $this->assertFalse($request->isHTTPS());
+
+        $request = new Request($this->container, array('HTTPS' => 'off'), array(), array(), array(), array());
+        $this->assertFalse($request->isHTTPS());
+
+        $request = new Request($this->container, array('HTTPS' => 'on'), array(), array(), array(), array());
+        $this->assertTrue($request->isHTTPS());
+
+        $request = new Request($this->container, array('HTTPS' => '1'), array(), array(), array(), array());
+        $this->assertTrue($request->isHTTPS());
+    }
+
+    public function testGetCookie()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getCookie('mycookie'));
+
+        $request = new Request($this->container, array(), array(), array(), array(), array('mycookie' => 'miam'));
+        $this->assertEquals('miam', $request->getCookie('mycookie'));
+    }
+
+    public function testGetHeader()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getHeader('X-Forwarded-For'));
+
+        $request = new Request($this->container, array('HTTP_X_FORWARDED_FOR' => 'test'), array(), array(), array(), array());
+        $this->assertEquals('test', $request->getHeader('X-Forwarded-For'));
+    }
+
+    public function testGetRemoteUser()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getRemoteUser());
+
+        $request = new Request($this->container, array(REVERSE_PROXY_USER_HEADER => 'test'), array(), array(), array(), array());
+        $this->assertEquals('test', $request->getRemoteUser());
+    }
+
+    public function testGetQueryString()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getQueryString());
+
+        $request = new Request($this->container, array('QUERY_STRING' => 'k=v'), array(), array(), array(), array());
+        $this->assertEquals('k=v', $request->getQueryString());
+    }
+
+    public function testGetUri()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEmpty($request->getUri());
+
+        $request = new Request($this->container, array('REQUEST_URI' => '/blah'), array(), array(), array(), array());
+        $this->assertEquals('/blah', $request->getUri());
+    }
+
+    public function testGetUserAgent()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEquals('Unknown', $request->getUserAgent());
+
+        $request = new Request($this->container, array('HTTP_USER_AGENT' => 'My browser'), array(), array(), array(), array());
+        $this->assertEquals('My browser', $request->getUserAgent());
+    }
+
+    public function testGetIpAddress()
+    {
+        $request = new Request($this->container, array(), array(), array(), array(), array());
+        $this->assertEquals('Unknown', $request->getIpAddress());
+
+        $request = new Request($this->container, array('HTTP_X_FORWARDED_FOR' => '192.168.0.1,127.0.0.1'), array(), array(), array(), array());
+        $this->assertEquals('192.168.0.1', $request->getIpAddress());
+
+        $request = new Request($this->container, array('REMOTE_ADDR' => '192.168.0.1'), array(), array(), array(), array());
+        $this->assertEquals('192.168.0.1', $request->getIpAddress());
+
+        $request = new Request($this->container, array('REMOTE_ADDR' => ''), array(), array(), array(), array());
+        $this->assertEquals('Unknown', $request->getIpAddress());
+    }
+}