feat: identify accounts by a uuid in the oauth2 sub claim

2026-09-23 15:17:09 +02:00
parent cc3d32fcbb
commit bad916cfb7
6 changed files with 153 additions and 7 deletions
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Entity;
+
+use App\Entity\User;
+use PHPUnit\Framework\TestCase;
+
+class UserTest extends TestCase
+{
+    /**
+     * The uuid is what /api/userinfo exports as `sub`, and consumers key their own accounts on
+     * it, so an account has to carry one from the moment it exists -- there is no later step
+     * that could assign it.
+     */
+    public function testAnAccountIsGivenAUuidOnCreation(): void
+    {
+        $user = new User('[email protected]');
+
+        self::assertMatchesRegularExpression(
+            '/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/',
+            $user->getUuid()
+        );
+    }
+
+    /**
+     * v4, not the framework's default v7: a v7 would sort by creation time and carry that
+     * timestamp in the claim, which is the disclosure the column exists to avoid.
+     */
+    public function testUuidsAreRandomRatherThanOrdered(): void
+    {
+        $uuids = [];
+        for ($i = 0; $i < 50; ++$i) {
+            $uuids[] = (new User("someone{$i}@ep-reisen.de"))->getUuid();
+        }
+
+        self::assertCount(50, array_unique($uuids));
+
+        $sorted = $uuids;
+        sort($sorted);
+        self::assertNotSame($sorted, $uuids, 'v4 uuids must not come out in creation order');
+    }
+}