feat: local password hashes
This commit is contained in:
Björn Fromme committed
1 parent
08f6633507
commit
fe562e5e73
15 files changed
+541
-253
No files matched your search
@@ -0,0 +1,222 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Security;
|
||||
|
||||
use App\BusProNet\ApiClient;
|
||||
use App\BusProNet\Model\CrmAttributes;
|
||||
use App\BusProNet\Model\PersonalData;
|
||||
use App\Entity\User;
|
||||
use App\Security\BpnAuthenticator;
|
||||
use App\Security\Crypt;
|
||||
use Doctrine\ORM\EntityManagerInterface;
|
||||
use Doctrine\ORM\EntityRepository;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
|
||||
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
|
||||
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
|
||||
use App\Service\ProfileCompletenessChecker;
|
||||
|
||||
class BpnAuthenticatorTest extends TestCase
|
||||
{
|
||||
public function testAuthenticateAcceptsLocalPasswordHashWithoutLegacyDecryption(): void
|
||||
{
|
||||
$user = new User('[email protected]');
|
||||
$user->setPassword(password_hash('secret', PASSWORD_BCRYPT));
|
||||
|
||||
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
||||
$passwordHasher
|
||||
->expects(self::once())
|
||||
->method('isPasswordValid')
|
||||
->with($user, 'secret')
|
||||
->willReturn(true);
|
||||
|
||||
$authenticator = $this->createAuthenticator(
|
||||
user: $user,
|
||||
passwordHasher: $passwordHasher,
|
||||
);
|
||||
|
||||
$passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
|
||||
|
||||
self::assertInstanceOf(SelfValidatingPassport::class, $passport);
|
||||
}
|
||||
|
||||
public function testAuthenticateMigratesLegacyPasswordToLocalHashOnSuccess(): void
|
||||
{
|
||||
$user = new User('[email protected]');
|
||||
$user->setPassword(base64_encode('legacy-ciphertext'));
|
||||
|
||||
$crypt = $this->createMock(Crypt::class);
|
||||
$crypt
|
||||
->expects(self::once())
|
||||
->method('decrypt')
|
||||
->with('legacy-ciphertext')
|
||||
->willReturn(md5('secret'));
|
||||
|
||||
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
||||
$passwordHasher
|
||||
->expects(self::never())
|
||||
->method('isPasswordValid');
|
||||
$passwordHasher
|
||||
->expects(self::once())
|
||||
->method('hashPassword')
|
||||
->with($user, 'secret')
|
||||
->willReturn('local-hash');
|
||||
|
||||
$authenticator = $this->createAuthenticator(
|
||||
user: $user,
|
||||
crypt: $crypt,
|
||||
passwordHasher: $passwordHasher,
|
||||
);
|
||||
|
||||
$passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
|
||||
|
||||
self::assertInstanceOf(SelfValidatingPassport::class, $passport);
|
||||
self::assertSame('local-hash', $user->getPassword());
|
||||
}
|
||||
|
||||
public function testAuthenticateBootstrapsMissingUserFromBpn(): void
|
||||
{
|
||||
$email = '[email protected]';
|
||||
$password = 'secret';
|
||||
|
||||
$personalData = new PersonalData();
|
||||
$personalData->addressId = 123;
|
||||
$personalData->personId = 456;
|
||||
$personalData->firstName = 'Mia';
|
||||
$personalData->name = 'Muster';
|
||||
$personalData->gender = 'W';
|
||||
$personalData->nationality = 'DE';
|
||||
$personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
|
||||
$personalData->communication->email = $email;
|
||||
$personalData->communication->mobile = '+49123456789';
|
||||
$personalData->address->street = 'Main Street 1';
|
||||
$personalData->address->postCode = '10115';
|
||||
$personalData->address->city = 'Berlin';
|
||||
$personalData->address->country = 'DE';
|
||||
|
||||
$crmAttributes = new CrmAttributes();
|
||||
$crmAttributes->roles = ['ROLE_CUSTOMER'];
|
||||
$crmAttributes->hotelCodes = ['AAA'];
|
||||
|
||||
$apiClient = $this->createMock(ApiClient::class);
|
||||
$apiClient->expects(self::once())
|
||||
->method('getPersonalDataWithPassword')
|
||||
->with($email, $password)
|
||||
->willReturn($personalData);
|
||||
$apiClient->expects(self::once())
|
||||
->method('getCrmAttributesWithPassword')
|
||||
->with($email, $password)
|
||||
->willReturn($crmAttributes);
|
||||
|
||||
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
||||
$passwordHasher
|
||||
->expects(self::once())
|
||||
->method('hashPassword')
|
||||
->with(self::isInstanceOf(User::class), $password)
|
||||
->willReturn('local-hash');
|
||||
|
||||
$completenessChecker = $this->createMock(ProfileCompletenessChecker::class);
|
||||
$completenessChecker
|
||||
->expects(self::once())
|
||||
->method('isComplete')
|
||||
->with($personalData)
|
||||
->willReturn(true);
|
||||
|
||||
$persistedUser = null;
|
||||
$repository = $this->createMock(EntityRepository::class);
|
||||
$repository
|
||||
->expects(self::once())
|
||||
->method('findOneBy')
|
||||
->with(['email' => $email])
|
||||
->willReturn(null);
|
||||
|
||||
$entityManager = $this->createMock(EntityManagerInterface::class);
|
||||
$entityManager
|
||||
->method('getRepository')
|
||||
->willReturn($repository);
|
||||
$entityManager
|
||||
->expects(self::once())
|
||||
->method('persist')
|
||||
->with(self::callback(static function (User $user) use (&$persistedUser): bool {
|
||||
$persistedUser = $user;
|
||||
|
||||
return true;
|
||||
}));
|
||||
$entityManager
|
||||
->expects(self::once())
|
||||
->method('flush');
|
||||
|
||||
$authenticator = new BpnAuthenticator(
|
||||
$this->createMock(UrlGeneratorInterface::class),
|
||||
$apiClient,
|
||||
$entityManager,
|
||||
$this->createMock(Crypt::class),
|
||||
$completenessChecker,
|
||||
$passwordHasher,
|
||||
$this->createMock(LoggerInterface::class),
|
||||
);
|
||||
|
||||
$passport = $authenticator->authenticate($this->createRequest($email, $password));
|
||||
|
||||
self::assertInstanceOf(SelfValidatingPassport::class, $passport);
|
||||
self::assertInstanceOf(User::class, $persistedUser);
|
||||
self::assertSame('local-hash', $persistedUser->getPassword());
|
||||
self::assertSame(123, $persistedUser->getAddressId());
|
||||
self::assertSame(456, $persistedUser->getPersonId());
|
||||
self::assertSame(['ROLE_USER', 'ROLE_CUSTOMER'], $persistedUser->getRoles());
|
||||
self::assertSame(['AAA'], $persistedUser->getHotelCodes());
|
||||
self::assertTrue($persistedUser->isProfileComplete());
|
||||
}
|
||||
|
||||
private function createAuthenticator(
|
||||
?User $user = null,
|
||||
?ApiClient $apiClient = null,
|
||||
?Crypt $crypt = null,
|
||||
?ProfileCompletenessChecker $completenessChecker = null,
|
||||
?UserPasswordHasherInterface $passwordHasher = null,
|
||||
): BpnAuthenticator {
|
||||
$repository = $this->createMock(EntityRepository::class);
|
||||
$repository
|
||||
->expects(self::once())
|
||||
->method('findOneBy')
|
||||
->with(self::callback(static function (array $criteria): bool {
|
||||
return isset($criteria['email']) && is_string($criteria['email']);
|
||||
}))
|
||||
->willReturn($user);
|
||||
|
||||
$entityManager = $this->createMock(EntityManagerInterface::class);
|
||||
$entityManager
|
||||
->method('getRepository')
|
||||
->with(User::class)
|
||||
->willReturn($repository);
|
||||
$entityManager
|
||||
->expects(self::once())
|
||||
->method('flush');
|
||||
$entityManager
|
||||
->expects(null === $user ? self::once() : self::never())
|
||||
->method('persist');
|
||||
|
||||
return new BpnAuthenticator(
|
||||
$this->createMock(UrlGeneratorInterface::class),
|
||||
$apiClient ?? $this->createMock(ApiClient::class),
|
||||
$entityManager,
|
||||
$crypt ?? $this->createMock(Crypt::class),
|
||||
$completenessChecker ?? $this->createMock(ProfileCompletenessChecker::class),
|
||||
$passwordHasher ?? $this->createMock(UserPasswordHasherInterface::class),
|
||||
$this->createMock(LoggerInterface::class),
|
||||
);
|
||||
}
|
||||
|
||||
private function createRequest(string $email, string $password): Request
|
||||
{
|
||||
return Request::create('/login', Request::METHOD_POST, [
|
||||
'_username' => $email,
|
||||
'_password' => $password,
|
||||
'_csrf_token' => 'csrf-token',
|
||||
]);
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user