feat: add oauth2 login against myep

tests/Security/EpClientTest.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Security\OAuth2\AuthorizationRequestException;
+use App\Security\OAuth2\EpClient;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+
+class EpClientTest extends KernelTestCase
+{
+    public function testAnUnregisteredClientIsReportedAsSuch(): void
+    {
+        // The state the project is in until somebody runs create-client on myep. The login page
+        // checks this so it can explain itself instead of redirecting into a broken flow.
+        self::assertFalse($this->client(clientId: '', clientSecret: '')->isConfigured());
+        self::assertFalse($this->client(clientId: 'ephub', clientSecret: '')->isConfigured());
+        self::assertTrue($this->client()->isConfigured());
+    }
+
+    public function testTheAuthorizationUrlCarriesTheClientAndScopes(): void
+    {
+        $request = $this->request();
+
+        $url = $this->client()->authorizationUrl($request);
+
+        self::assertStringStartsWith('https://myep.test/authorize?', $url);
+        parse_str((string) parse_url($url, \PHP_URL_QUERY), $query);
+
+        self::assertSame('ephub', $query['client_id']);
+        self::assertSame('code', $query['response_type']);
+        // myep's server wants space-separated scopes; the library's default is a comma.
+        self::assertSame('email profile roles', $query['scope']);
+        self::assertStringEndsWith('/auth/check', $query['redirect_uri']);
+    }
+
+    public function testTheStateIsRememberedOnTheSession(): void
+    {
+        $request = $this->request();
+
+        $url = $this->client()->authorizationUrl($request);
+        parse_str((string) parse_url($url, \PHP_URL_QUERY), $query);
+
+        self::assertNotEmpty($query['state']);
+        self::assertSame($query['state'], $request->getSession()->get('oauth2state'));
+    }
+
+    public function testACallbackWithoutACodeIsRefused(): void
+    {
+        $request = $this->request(['state' => 'abc']);
+        $request->getSession()->set('oauth2state', 'abc');
+
+        $this->expectException(AuthorizationRequestException::class);
+        $this->expectExceptionMessage('keinen Code');
+
+        $this->client()->fetchAccessToken($request);
+    }
+
+    /**
+     * Without this check an attacker can hand a victim a callback URL carrying the attacker's
+     * code and bind the victim's session to the attacker's identity.
+     */
+    public function testACallbackWhoseStateDoesNotMatchIsRefused(): void
+    {
+        $request = $this->request(['code' => 'xyz', 'state' => 'forged']);
+        $request->getSession()->set('oauth2state', 'expected');
+
+        $this->expectException(AuthorizationRequestException::class);
+        $this->expectExceptionMessage('state-Parameter');
+
+        $this->client()->fetchAccessToken($request);
+    }
+
+    public function testACallbackWithNoStateOnTheSessionIsRefused(): void
+    {
+        $request = $this->request(['code' => 'xyz', 'state' => 'anything']);
+
+        $this->expectException(AuthorizationRequestException::class);
+
+        $this->client()->fetchAccessToken($request);
+    }
+
+    /**
+     * The stored state is consumed whether or not the check passed, so the same callback URL
+     * cannot be replayed.
+     */
+    public function testTheStoredStateIsConsumedEvenOnFailure(): void
+    {
+        $request = $this->request(['code' => 'xyz', 'state' => 'forged']);
+        $session = $request->getSession();
+        $session->set('oauth2state', 'expected');
+
+        try {
+            $this->client()->fetchAccessToken($request);
+        } catch (AuthorizationRequestException) {
+        }
+
+        self::assertNull($session->get('oauth2state'));
+    }
+
+    /**
+     * @param array<string, string> $query
+     */
+    private function request(array $query = []): Request
+    {
+        $request = new Request($query);
+        $request->setSession(new Session(new MockArraySessionStorage()));
+
+        return $request;
+    }
+
+    private function client(string $clientId = 'ephub', string $clientSecret = 'secret'): EpClient
+    {
+        self::bootKernel();
+
+        return new EpClient(self::getContainer()->get(UrlGeneratorInterface::class), [
+            'client_id' => $clientId,
+            'client_secret' => $clientSecret,
+            'url_authorize' => 'https://myep.test/authorize',
+            'url_access_token' => 'https://myep.test/token',
+            'url_userinfo' => 'https://myep.test/api/userinfo',
+            'scopes' => ['email', 'profile', 'roles'],
+        ]);
+    }
+}