460 lines
17 KiB
PHP
460 lines
17 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Security;
|
|
|
|
use App\BusProNet\ApiClient;
|
|
use App\BusProNet\Exception\TimeoutException;
|
|
use App\BusProNet\Model\CrmAttributes;
|
|
use App\BusProNet\Model\PersonalData;
|
|
use App\Entity\User;
|
|
use App\Repository\UserRepository;
|
|
use App\Security\BpnAuthenticator;
|
|
use App\Security\Crypt;
|
|
use App\Service\UserBootstrapper;
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use PHPUnit\Framework\TestCase;
|
|
use Psr\Log\LoggerInterface;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
|
|
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
|
|
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
|
|
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
|
|
use Symfony\Component\Validator\ConstraintViolationList;
|
|
use Symfony\Component\Validator\Validator\ValidatorInterface;
|
|
|
|
class BpnAuthenticatorTest extends TestCase
|
|
{
|
|
public function testAuthenticateAcceptsLocalPasswordHashWithoutLegacyDecryption(): void
|
|
{
|
|
$user = new User('[email protected]');
|
|
$user
|
|
->setAddressId(10)
|
|
->setPersonId(20)
|
|
->setProfileComplete(false)
|
|
;
|
|
$user->setPassword(password_hash('secret', PASSWORD_BCRYPT));
|
|
|
|
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
|
$passwordHasher
|
|
->expects(self::once())
|
|
->method('isPasswordValid')
|
|
->with($user, 'secret')
|
|
->willReturn(true);
|
|
|
|
$personalData = new PersonalData();
|
|
$personalData->addressId = 123;
|
|
$personalData->personId = 456;
|
|
$personalData->firstName = 'Mia';
|
|
$personalData->name = 'Muster';
|
|
$personalData->gender = 'W';
|
|
$personalData->nationality = 'DE';
|
|
$personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
|
|
$personalData->communication->email = '[email protected]';
|
|
$personalData->address->street = 'Main Street 1';
|
|
$personalData->address->postCode = '10115';
|
|
$personalData->address->city = 'Berlin';
|
|
$personalData->address->country = 'DE';
|
|
|
|
$apiClient = $this->createMock(ApiClient::class);
|
|
$apiClient
|
|
->expects(self::once())
|
|
->method('getPersonalData')
|
|
->with('[email protected]', 10, 20)
|
|
->willReturn($personalData);
|
|
$apiClient
|
|
->expects(self::once())
|
|
->method('getCrmAttributes')
|
|
->with('[email protected]', 123, 456)
|
|
->willReturn((function (): CrmAttributes {
|
|
$crmAttributes = new CrmAttributes();
|
|
$crmAttributes->roles = ['ROLE_ADMIN'];
|
|
$crmAttributes->hotelCodes = ['AAA'];
|
|
|
|
return $crmAttributes;
|
|
})());
|
|
|
|
$authenticator = $this->createAuthenticator(
|
|
user: $user,
|
|
apiClient: $apiClient,
|
|
passwordHasher: $passwordHasher,
|
|
);
|
|
|
|
$passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
|
|
|
|
self::assertInstanceOf(SelfValidatingPassport::class, $passport);
|
|
self::assertSame(123, $user->getAddressId());
|
|
self::assertSame(456, $user->getPersonId());
|
|
self::assertTrue($user->isProfileComplete());
|
|
self::assertSame(['ROLE_USER', 'ROLE_ADMIN'], $user->getRoles());
|
|
self::assertSame(['AAA'], $user->getHotelCodes());
|
|
}
|
|
|
|
public function testAuthenticateMigratesLegacyPasswordToLocalHashOnSuccess(): void
|
|
{
|
|
$user = new User('[email protected]');
|
|
$user->setPassword(base64_encode('legacy-ciphertext'));
|
|
|
|
$crypt = $this->createMock(Crypt::class);
|
|
$crypt
|
|
->expects(self::once())
|
|
->method('decrypt')
|
|
->with('legacy-ciphertext')
|
|
->willReturn(md5('secret'));
|
|
|
|
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
|
$passwordHasher
|
|
->expects(self::never())
|
|
->method('isPasswordValid');
|
|
$passwordHasher
|
|
->expects(self::once())
|
|
->method('hashPassword')
|
|
->with($user, 'secret')
|
|
->willReturn('local-hash');
|
|
|
|
$personalData = new PersonalData();
|
|
$personalData->addressId = 123;
|
|
$personalData->personId = 456;
|
|
$personalData->firstName = 'Mia';
|
|
$personalData->name = 'Muster';
|
|
$personalData->gender = 'W';
|
|
$personalData->nationality = 'DE';
|
|
$personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
|
|
$personalData->communication->email = '[email protected]';
|
|
$personalData->address->street = 'Main Street 1';
|
|
$personalData->address->postCode = '10115';
|
|
$personalData->address->city = 'Berlin';
|
|
$personalData->address->country = 'DE';
|
|
|
|
$apiClient = $this->createMock(ApiClient::class);
|
|
$apiClient
|
|
->expects(self::once())
|
|
->method('getPersonalData')
|
|
->with('[email protected]', null, null)
|
|
->willReturn($personalData);
|
|
$apiClient
|
|
->expects(self::once())
|
|
->method('getCrmAttributes')
|
|
->with('[email protected]', 123, 456)
|
|
->willReturn((function (): CrmAttributes {
|
|
$crmAttributes = new CrmAttributes();
|
|
$crmAttributes->roles = ['ROLE_CUSTOMER'];
|
|
$crmAttributes->hotelCodes = [];
|
|
|
|
return $crmAttributes;
|
|
})());
|
|
|
|
$authenticator = $this->createAuthenticator(
|
|
user: $user,
|
|
apiClient: $apiClient,
|
|
crypt: $crypt,
|
|
passwordHasher: $passwordHasher,
|
|
);
|
|
|
|
$passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
|
|
|
|
self::assertInstanceOf(SelfValidatingPassport::class, $passport);
|
|
self::assertSame(base64_encode('legacy-ciphertext'), $user->getPreviousPassword());
|
|
self::assertSame('local-hash', $user->getPassword());
|
|
self::assertSame(123, $user->getAddressId());
|
|
self::assertSame(456, $user->getPersonId());
|
|
}
|
|
|
|
public function testAuthenticateFailsClosedWhenCrmSyncFailsAfterLocalPasswordValidation(): void
|
|
{
|
|
$user = new User('[email protected]');
|
|
$user
|
|
->setPassword(password_hash('secret', PASSWORD_BCRYPT))
|
|
->setRoles(['ROLE_ADMIN'])
|
|
->setHotelCodes(['STALE'])
|
|
;
|
|
|
|
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
|
$passwordHasher
|
|
->expects(self::once())
|
|
->method('isPasswordValid')
|
|
->with($user, 'secret')
|
|
->willReturn(true);
|
|
|
|
$personalData = new PersonalData();
|
|
$personalData->addressId = 123;
|
|
$personalData->personId = 456;
|
|
$personalData->firstName = 'Mia';
|
|
$personalData->name = 'Muster';
|
|
$personalData->gender = 'W';
|
|
$personalData->nationality = 'DE';
|
|
$personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
|
|
$personalData->communication->email = '[email protected]';
|
|
$personalData->address->street = 'Main Street 1';
|
|
$personalData->address->postCode = '10115';
|
|
$personalData->address->city = 'Berlin';
|
|
$personalData->address->country = 'DE';
|
|
|
|
$apiClient = $this->createMock(ApiClient::class);
|
|
$apiClient
|
|
->expects(self::once())
|
|
->method('getPersonalData')
|
|
->with('[email protected]', null, null)
|
|
->willReturn($personalData);
|
|
$apiClient
|
|
->expects(self::once())
|
|
->method('getCrmAttributes')
|
|
->with('[email protected]', 123, 456)
|
|
->willThrowException(new TimeoutException());
|
|
|
|
$validator = $this->createMock(ValidatorInterface::class);
|
|
$validator
|
|
->expects(self::once())
|
|
->method('validate')
|
|
->with($personalData, null, ['personal_data'])
|
|
->willReturn(new ConstraintViolationList());
|
|
|
|
$authenticator = $this->createAuthenticator(
|
|
user: $user,
|
|
apiClient: $apiClient,
|
|
passwordHasher: $passwordHasher,
|
|
validator: $validator,
|
|
expectFlush: false,
|
|
);
|
|
|
|
$this->expectException(CustomUserMessageAuthenticationException::class);
|
|
|
|
$authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
|
|
}
|
|
|
|
public function testAuthenticateBootstrapsMissingUserFromBpn(): void
|
|
{
|
|
$email = '[email protected]';
|
|
$password = 'secret';
|
|
|
|
$personalData = new PersonalData();
|
|
$personalData->addressId = 123;
|
|
$personalData->personId = 456;
|
|
$personalData->firstName = 'Mia';
|
|
$personalData->name = 'Muster';
|
|
$personalData->gender = 'W';
|
|
$personalData->nationality = 'DE';
|
|
$personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
|
|
$personalData->communication->email = $email;
|
|
$personalData->communication->mobile = '+49123456789';
|
|
$personalData->address->street = 'Main Street 1';
|
|
$personalData->address->postCode = '10115';
|
|
$personalData->address->city = 'Berlin';
|
|
$personalData->address->country = 'DE';
|
|
|
|
$crmAttributes = new CrmAttributes();
|
|
$crmAttributes->roles = ['ROLE_CUSTOMER'];
|
|
$crmAttributes->hotelCodes = ['AAA'];
|
|
|
|
$apiClient = $this->createMock(ApiClient::class);
|
|
$apiClient->expects(self::once())
|
|
->method('getPersonalDataWithPassword')
|
|
->with($email, $password)
|
|
->willReturn($personalData);
|
|
$apiClient->expects(self::once())
|
|
->method('getCrmAttributesWithPassword')
|
|
->with($email, $password)
|
|
->willReturn($crmAttributes);
|
|
|
|
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
|
$passwordHasher
|
|
->expects(self::once())
|
|
->method('hashPassword')
|
|
->with(self::isInstanceOf(User::class), $password)
|
|
->willReturn('local-hash');
|
|
|
|
$validator = $this->createMock(ValidatorInterface::class);
|
|
$validator
|
|
->expects(self::once())
|
|
->method('validate')
|
|
->with($personalData, null, ['personal_data'])
|
|
->willReturn(new ConstraintViolationList());
|
|
$userBootstrapper = new UserBootstrapper();
|
|
|
|
$persistedUser = null;
|
|
$repository = $this->createMock(UserRepository::class);
|
|
$repository
|
|
->expects(self::once())
|
|
->method('findOneByNormalizedEmail')
|
|
->with($email)
|
|
->willReturn(null);
|
|
|
|
$entityManager = $this->createMock(EntityManagerInterface::class);
|
|
$entityManager
|
|
->method('getRepository')
|
|
->willReturn($repository);
|
|
$entityManager
|
|
->expects(self::once())
|
|
->method('persist')
|
|
->with(self::callback(static function (User $user) use (&$persistedUser): bool {
|
|
$persistedUser = $user;
|
|
|
|
return true;
|
|
}));
|
|
$entityManager
|
|
->expects(self::once())
|
|
->method('flush');
|
|
|
|
$authenticator = new BpnAuthenticator(
|
|
$this->createMock(UrlGeneratorInterface::class),
|
|
$apiClient,
|
|
$entityManager,
|
|
$this->createMock(Crypt::class),
|
|
$passwordHasher,
|
|
$validator,
|
|
$userBootstrapper,
|
|
$this->createMock(LoggerInterface::class),
|
|
);
|
|
|
|
$passport = $authenticator->authenticate($this->createRequest($email, $password));
|
|
|
|
self::assertInstanceOf(SelfValidatingPassport::class, $passport);
|
|
self::assertInstanceOf(User::class, $persistedUser);
|
|
self::assertSame('local-hash', $persistedUser->getPassword());
|
|
self::assertSame(123, $persistedUser->getAddressId());
|
|
self::assertSame(456, $persistedUser->getPersonId());
|
|
self::assertSame(['ROLE_USER', 'ROLE_CUSTOMER'], $persistedUser->getRoles());
|
|
self::assertSame(['AAA'], $persistedUser->getHotelCodes());
|
|
self::assertTrue($persistedUser->isProfileComplete());
|
|
}
|
|
|
|
public function testAuthenticatePreservesNullBpnIdsWhenBootstrappingMissingUser(): void
|
|
{
|
|
$email = '[email protected]';
|
|
$password = 'secret';
|
|
|
|
$personalData = new PersonalData();
|
|
$personalData->addressId = null;
|
|
$personalData->personId = null;
|
|
|
|
$crmAttributes = new CrmAttributes();
|
|
|
|
$apiClient = $this->createMock(ApiClient::class);
|
|
$apiClient->expects(self::once())
|
|
->method('getPersonalDataWithPassword')
|
|
->with($email, $password)
|
|
->willReturn($personalData);
|
|
$apiClient->expects(self::once())
|
|
->method('getCrmAttributesWithPassword')
|
|
->with($email, $password)
|
|
->willReturn($crmAttributes);
|
|
|
|
$passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
|
|
$passwordHasher
|
|
->expects(self::once())
|
|
->method('hashPassword')
|
|
->with(self::isInstanceOf(User::class), $password)
|
|
->willReturn('local-hash');
|
|
|
|
$validator = $this->createMock(ValidatorInterface::class);
|
|
$validator
|
|
->expects(self::once())
|
|
->method('validate')
|
|
->with($personalData, null, ['personal_data'])
|
|
->willReturn(new ConstraintViolationList());
|
|
|
|
$persistedUser = null;
|
|
$repository = $this->createMock(UserRepository::class);
|
|
$repository
|
|
->expects(self::once())
|
|
->method('findOneByNormalizedEmail')
|
|
->with($email)
|
|
->willReturn(null);
|
|
|
|
$entityManager = $this->createMock(EntityManagerInterface::class);
|
|
$entityManager
|
|
->method('getRepository')
|
|
->willReturn($repository);
|
|
$entityManager
|
|
->expects(self::once())
|
|
->method('persist')
|
|
->with(self::callback(static function (User $user) use (&$persistedUser): bool {
|
|
$persistedUser = $user;
|
|
|
|
return true;
|
|
}));
|
|
$entityManager
|
|
->expects(self::once())
|
|
->method('flush');
|
|
|
|
$authenticator = new BpnAuthenticator(
|
|
$this->createMock(UrlGeneratorInterface::class),
|
|
$apiClient,
|
|
$entityManager,
|
|
$this->createMock(Crypt::class),
|
|
$passwordHasher,
|
|
$validator,
|
|
new UserBootstrapper(),
|
|
$this->createMock(LoggerInterface::class),
|
|
);
|
|
|
|
$authenticator->authenticate($this->createRequest($email, $password));
|
|
|
|
self::assertInstanceOf(User::class, $persistedUser);
|
|
self::assertNull($persistedUser->getAddressId());
|
|
self::assertNull($persistedUser->getPersonId());
|
|
}
|
|
|
|
private function createAuthenticator(
|
|
?User $user = null,
|
|
?ApiClient $apiClient = null,
|
|
?Crypt $crypt = null,
|
|
?UserPasswordHasherInterface $passwordHasher = null,
|
|
?ValidatorInterface $validator = null,
|
|
?UserBootstrapper $userBootstrapper = null,
|
|
bool $expectFlush = true,
|
|
): BpnAuthenticator {
|
|
$validatorProvided = null !== $validator;
|
|
$passwordHasher ??= $this->createMock(UserPasswordHasherInterface::class);
|
|
$validator ??= $this->createMock(ValidatorInterface::class);
|
|
if (!$validatorProvided) {
|
|
$validator
|
|
->method('validate')
|
|
->willReturn(new ConstraintViolationList());
|
|
}
|
|
$userBootstrapper ??= new UserBootstrapper();
|
|
|
|
$repository = $this->createMock(UserRepository::class);
|
|
$repository
|
|
->expects(self::once())
|
|
->method('findOneByNormalizedEmail')
|
|
->with(self::callback(static function (string $email): bool {
|
|
return '' !== trim($email);
|
|
}))
|
|
->willReturn($user);
|
|
|
|
$entityManager = $this->createMock(EntityManagerInterface::class);
|
|
$entityManager
|
|
->method('getRepository')
|
|
->with(User::class)
|
|
->willReturn($repository);
|
|
$entityManager
|
|
->expects($expectFlush ? self::once() : self::never())
|
|
->method('flush');
|
|
$entityManager
|
|
->expects(null === $user ? self::once() : self::never())
|
|
->method('persist');
|
|
|
|
return new BpnAuthenticator(
|
|
$this->createMock(UrlGeneratorInterface::class),
|
|
$apiClient ?? $this->createMock(ApiClient::class),
|
|
$entityManager,
|
|
$crypt ?? $this->createMock(Crypt::class),
|
|
$passwordHasher,
|
|
$validator,
|
|
$userBootstrapper,
|
|
$this->createMock(LoggerInterface::class),
|
|
);
|
|
}
|
|
|
|
private function createRequest(string $email, string $password): Request
|
|
{
|
|
return Request::create('/login', Request::METHOD_POST, [
|
|
'_username' => $email,
|
|
'_password' => $password,
|
|
'_csrf_token' => 'csrf-token',
|
|
]);
|
|
}
|
|
}
|