83 lines
2.4 KiB
PHP
83 lines
2.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Security;
|
|
|
|
use App\Entity\User;
|
|
use App\Security\UserChecker;
|
|
use App\Service\AuditLogger;
|
|
use Monolog\Handler\TestHandler;
|
|
use Monolog\Logger;
|
|
use PHPUnit\Framework\TestCase;
|
|
use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
|
|
|
|
/**
|
|
* The local lockout, which is the one access decision myep has no say in.
|
|
*/
|
|
class UserCheckerTest extends TestCase
|
|
{
|
|
private TestHandler $auditRecords;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
$this->auditRecords = new TestHandler();
|
|
}
|
|
|
|
public function testAnOrdinaryAccountPasses(): void
|
|
{
|
|
$this->expectNotToPerformAssertions();
|
|
|
|
$this->checker()->checkPreAuth(new User('[email protected]', 'Anna'));
|
|
}
|
|
|
|
public function testALockedOutAccountIsRefusedWithItsReason(): void
|
|
{
|
|
$user = new User('[email protected]', 'Anna');
|
|
$user->disable('Auf eigenen Wunsch');
|
|
|
|
$this->expectException(CustomUserMessageAccountStatusException::class);
|
|
$this->expectExceptionMessage('Auf eigenen Wunsch');
|
|
|
|
$this->checker()->checkPreAuth($user);
|
|
}
|
|
|
|
public function testALockoutWithoutAReasonStillSaysWhatHappened(): void
|
|
{
|
|
$user = new User('[email protected]', 'Anna');
|
|
$user->disable();
|
|
|
|
$this->expectException(CustomUserMessageAccountStatusException::class);
|
|
$this->expectExceptionMessage('gesperrt');
|
|
|
|
$this->checker()->checkPreAuth($user);
|
|
}
|
|
|
|
/**
|
|
* The authenticator audits the refusals it can see; this one happens after it has handed the
|
|
* passport over, so the trail would otherwise show a sign-in that simply never completed.
|
|
*/
|
|
public function testTheRefusalIsAudited(): void
|
|
{
|
|
$user = new User('[email protected]', 'Anna');
|
|
$user->disable('Auf eigenen Wunsch');
|
|
|
|
try {
|
|
$this->checker()->checkPreAuth($user);
|
|
} catch (CustomUserMessageAccountStatusException) {
|
|
}
|
|
|
|
$records = $this->auditRecords->getRecords();
|
|
|
|
self::assertCount(1, $records);
|
|
self::assertSame('Sign-in refused.', $records[0]->message);
|
|
self::assertSame('account_disabled', $records[0]->context['reason']);
|
|
self::assertSame('[email protected]', $records[0]->context['account']);
|
|
}
|
|
|
|
private function checker(): UserChecker
|
|
{
|
|
return new UserChecker(new AuditLogger(new Logger('audit', [$this->auditRecords])));
|
|
}
|
|
}
|