419 lines
15 KiB
PHP
419 lines
15 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace BlackWall\Auth\Tests;
|
|
|
|
use BlackWall\Auth\AuthClient;
|
|
use BlackWall\Auth\Config;
|
|
use BlackWall\Auth\Exception\NonceMismatchException;
|
|
use BlackWall\Auth\Exception\StateMismatchException;
|
|
use BlackWall\Auth\Exception\TokenExchangeException;
|
|
use BlackWall\Auth\Exception\UserInfoException;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class AuthClientTest extends TestCase
|
|
{
|
|
private Config $config;
|
|
private FakeHttpClient $http;
|
|
private AuthClient $client;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
if (session_status() !== PHP_SESSION_ACTIVE) {
|
|
@session_start();
|
|
}
|
|
|
|
$_SESSION = [];
|
|
|
|
$this->config = Config::fromArray([
|
|
'clientId' => 'client-123',
|
|
'authorizeUrl' => 'https://provider.example/oauth/authorize',
|
|
'tokenUrl' => 'https://provider.example/oauth/token',
|
|
'userInfoUrl' => 'https://provider.example/oauth/userinfo',
|
|
'redirectUri' => 'https://app.example/callback.php',
|
|
'scope' => 'openid profile email',
|
|
'clientSecret' => 'secret-abc',
|
|
]);
|
|
|
|
$this->http = new FakeHttpClient();
|
|
$this->client = new AuthClient($this->config, $this->http);
|
|
}
|
|
|
|
public function testBuildAuthorisationUrlPersistsStateAndVerifier(): void
|
|
{
|
|
$result = $this->client->buildAuthorisationUrl();
|
|
|
|
self::assertArrayHasKey('url', $result);
|
|
self::assertArrayHasKey('state', $result);
|
|
self::assertArrayHasKey('code_verifier', $result);
|
|
self::assertArrayHasKey('code_challenge', $result);
|
|
self::assertArrayHasKey('nonce', $result);
|
|
self::assertIsString($result['nonce']);
|
|
self::assertNotSame('', $result['nonce']);
|
|
self::assertSame($result['state'], $_SESSION[AuthClient::STATE_SESSION_KEY]);
|
|
self::assertSame($result['code_verifier'], $_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY]);
|
|
self::assertSame($result['nonce'], $_SESSION[AuthClient::NONCE_SESSION_KEY]);
|
|
self::assertStringContainsString('code_challenge_method=S256', $result['url']);
|
|
self::assertStringContainsString('nonce=', $result['url']);
|
|
}
|
|
|
|
public function testBuildAuthorisationUrlDoesNotGenerateNonceWithoutOpenIdScope(): void
|
|
{
|
|
$result = $this->client->buildAuthorisationUrl([
|
|
'scope' => 'profile email',
|
|
]);
|
|
|
|
self::assertNull($result['nonce']);
|
|
self::assertArrayNotHasKey(AuthClient::NONCE_SESSION_KEY, $_SESSION);
|
|
self::assertStringNotContainsString('nonce=', $result['url']);
|
|
}
|
|
|
|
public function testBuildAuthorisationUrlPersistsProvidedNonce(): void
|
|
{
|
|
$result = $this->client->buildAuthorisationUrl([
|
|
'nonce' => 'nonce-123',
|
|
]);
|
|
|
|
self::assertSame('nonce-123', $result['nonce']);
|
|
self::assertSame('nonce-123', $_SESSION[AuthClient::NONCE_SESSION_KEY]);
|
|
}
|
|
|
|
public function testAssertNonceMatchesThrowsOnMismatch(): void
|
|
{
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'expected-nonce';
|
|
|
|
$this->expectException(NonceMismatchException::class);
|
|
$this->client->assertNonceMatches('actual-nonce');
|
|
}
|
|
|
|
public function testDecodeJwtPayloadClaimsReturnsClaimsWithoutVerification(): void
|
|
{
|
|
$claims = $this->client->decodeJwtPayloadClaims($this->makeJwt([
|
|
'sub' => 'user-1',
|
|
'nonce' => 'nonce-1',
|
|
]));
|
|
|
|
self::assertSame('user-1', $claims['sub']);
|
|
self::assertSame('nonce-1', $claims['nonce']);
|
|
}
|
|
|
|
public function testAssertStateMatchesThrowsOnMismatch(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'expected';
|
|
|
|
$this->expectException(StateMismatchException::class);
|
|
$this->client->assertStateMatches('actual');
|
|
}
|
|
|
|
public function testExchangeCodeForTokensReturnsTypedTokenSet(): void
|
|
{
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'id_token' => 'id-1',
|
|
'token_type' => 'Bearer',
|
|
'expires_in' => 3600,
|
|
'scope' => 'openid profile email',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$tokens = $this->client->exchangeCodeForTokens('code-1');
|
|
|
|
self::assertSame('access-1', $tokens->accessToken);
|
|
self::assertSame('refresh-1', $tokens->refreshToken);
|
|
self::assertSame('id-1', $tokens->idToken);
|
|
self::assertSame(3600, $tokens->expiresIn);
|
|
self::assertCount(1, $this->http->postCalls);
|
|
self::assertSame('authorization_code', $this->http->postCalls[0]['fields']['grant_type']);
|
|
self::assertSame('verifier-123', $this->http->postCalls[0]['fields']['code_verifier']);
|
|
}
|
|
|
|
public function testExchangeCodeForTokensThrowsWhenVerifierMissing(): void
|
|
{
|
|
$this->expectException(TokenExchangeException::class);
|
|
$this->client->exchangeCodeForTokens('code-2');
|
|
}
|
|
|
|
public function testExchangeCodeForTokensThrowsOnEndpointError(): void
|
|
{
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 400,
|
|
'body' => '{"error":"invalid_grant"}',
|
|
]);
|
|
|
|
$this->expectException(TokenExchangeException::class);
|
|
$this->expectExceptionMessage('Token endpoint error (400)');
|
|
$this->client->exchangeCodeForTokens('bad-code');
|
|
}
|
|
|
|
public function testRefreshAccessTokenCallsRefreshGrant(): void
|
|
{
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => '{"access_token":"access-2","refresh_token":"refresh-2","token_type":"Bearer"}',
|
|
]);
|
|
|
|
$tokens = $this->client->refreshAccessToken('refresh-1');
|
|
|
|
self::assertSame('access-2', $tokens->accessToken);
|
|
self::assertSame('refresh_token', $this->http->postCalls[0]['fields']['grant_type']);
|
|
self::assertSame('refresh-1', $this->http->postCalls[0]['fields']['refresh_token']);
|
|
self::assertSame('client-123', $this->http->postCalls[0]['fields']['client_id']);
|
|
}
|
|
|
|
public function testGetUserInfoReturnsPayload(): void
|
|
{
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"sub":"user-1","name":"Example User"}',
|
|
]);
|
|
|
|
$user = $this->client->getUserInfo('access-3');
|
|
|
|
self::assertSame('user-1', $user['sub']);
|
|
self::assertCount(1, $this->http->getCalls);
|
|
self::assertSame('Bearer access-3', $this->http->getCalls[0]['headers']['Authorization']);
|
|
}
|
|
|
|
public function testGetUserInfoThrowsOnErrorResponse(): void
|
|
{
|
|
$this->http->queueGet([
|
|
'status' => 401,
|
|
'body' => '{"error":"invalid_token"}',
|
|
]);
|
|
|
|
$this->expectException(UserInfoException::class);
|
|
$this->expectExceptionMessage('UserInfo endpoint error (401)');
|
|
$this->client->getUserInfo('expired-token');
|
|
}
|
|
|
|
public function testGetNormalizedUserInfoReturnsCanonicalFields(): void
|
|
{
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"email":"Admin@Example.com","claims":{"role":"admin"}}',
|
|
]);
|
|
|
|
$user = $this->client->getNormalizedUserInfo('access-4');
|
|
|
|
self::assertSame('admin@example.com', $user->email);
|
|
self::assertSame(1, $user->privilegeLevel);
|
|
self::assertSame('admin', $user->role);
|
|
}
|
|
|
|
public function testResolvePrivilegeLevelSupportsAliases(): void
|
|
{
|
|
self::assertSame(1, AuthClient::resolvePrivilegeLevel(['privilege_level' => 1]));
|
|
self::assertSame(2, AuthClient::resolvePrivilegeLevel(['claims' => ['role_level' => '2']]));
|
|
self::assertSame(1, AuthClient::resolvePrivilegeLevel(['role' => 'superadmin']));
|
|
self::assertSame(2, AuthClient::resolvePrivilegeLevel(['role' => 'tutor']));
|
|
self::assertNull(AuthClient::resolvePrivilegeLevel(['foo' => 'bar']));
|
|
}
|
|
|
|
public function testHandleCallbackReturnsCallbackResult(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'state-1';
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'nonce-1';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'id_token' => $this->makeJwt(['nonce' => 'nonce-1', 'sub' => 'user-1']),
|
|
'token_type' => 'Bearer',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"email":"tutor@example.com","privilege_level":2}',
|
|
]);
|
|
|
|
$result = $this->client->handleCallback([
|
|
'code' => 'code-1',
|
|
'state' => 'state-1',
|
|
]);
|
|
|
|
self::assertSame('access-1', $result->tokens->accessToken);
|
|
self::assertSame('tutor@example.com', $result->user->email);
|
|
self::assertSame(2, $result->user->privilegeLevel);
|
|
self::assertArrayNotHasKey(AuthClient::STATE_SESSION_KEY, $_SESSION);
|
|
self::assertArrayNotHasKey(AuthClient::CODE_VERIFIER_SESSION_KEY, $_SESSION);
|
|
self::assertArrayNotHasKey(AuthClient::NONCE_SESSION_KEY, $_SESSION);
|
|
}
|
|
|
|
public function testHandleCallbackThrowsWhenIdTokenNonceDoesNotMatch(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'state-1';
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'expected-nonce';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'id_token' => $this->makeJwt(['nonce' => 'actual-nonce', 'sub' => 'user-1']),
|
|
'token_type' => 'Bearer',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$this->expectException(NonceMismatchException::class);
|
|
$this->client->handleCallback([
|
|
'code' => 'code-1',
|
|
'state' => 'state-1',
|
|
]);
|
|
}
|
|
|
|
public function testHandleCallbackSucceedsWhenNoIdTokenReturned(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'state-1';
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'expected-nonce';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'token_type' => 'Bearer',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"email":"tutor@example.com","privilege_level":2}',
|
|
]);
|
|
|
|
$result = $this->client->handleCallback([
|
|
'code' => 'code-1',
|
|
'state' => 'state-1',
|
|
]);
|
|
|
|
self::assertSame('access-1', $result->tokens->accessToken);
|
|
self::assertNull($result->tokens->idToken);
|
|
}
|
|
|
|
public function testHandleCallbackAllowsMissingNonceClaimWhenEnabled(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'state-1';
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'expected-nonce';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'id_token' => $this->makeJwt(['sub' => 'user-1']),
|
|
'token_type' => 'Bearer',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"email":"tutor@example.com","privilege_level":2}',
|
|
]);
|
|
|
|
$result = $this->client->handleCallback([
|
|
'code' => 'code-1',
|
|
'state' => 'state-1',
|
|
], true, [
|
|
'allow_missing_nonce' => true,
|
|
]);
|
|
|
|
self::assertSame('access-1', $result->tokens->accessToken);
|
|
}
|
|
|
|
public function testHandleCallbackAllowsMissingNonceClaimByDefault(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'state-1';
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'expected-nonce';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'id_token' => $this->makeJwt(['sub' => 'user-1']),
|
|
'token_type' => 'Bearer',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"email":"tutor@example.com","privilege_level":2}',
|
|
]);
|
|
|
|
$result = $this->client->handleCallback([
|
|
'code' => 'code-1',
|
|
'state' => 'state-1',
|
|
]);
|
|
|
|
self::assertSame('access-1', $result->tokens->accessToken);
|
|
}
|
|
|
|
public function testHandleCallbackCanDisableNonceValidationTemporarily(): void
|
|
{
|
|
$_SESSION[AuthClient::STATE_SESSION_KEY] = 'state-1';
|
|
$_SESSION[AuthClient::CODE_VERIFIER_SESSION_KEY] = 'verifier-123';
|
|
$_SESSION[AuthClient::NONCE_SESSION_KEY] = 'expected-nonce';
|
|
|
|
$this->http->queuePost([
|
|
'status' => 200,
|
|
'body' => json_encode([
|
|
'access_token' => 'access-1',
|
|
'refresh_token' => 'refresh-1',
|
|
'id_token' => $this->makeJwt(['nonce' => 'different-nonce', 'sub' => 'user-1']),
|
|
'token_type' => 'Bearer',
|
|
], JSON_THROW_ON_ERROR),
|
|
]);
|
|
|
|
$this->http->queueGet([
|
|
'status' => 200,
|
|
'body' => '{"email":"tutor@example.com","privilege_level":2}',
|
|
]);
|
|
|
|
$result = $this->client->handleCallback([
|
|
'code' => 'code-1',
|
|
'state' => 'state-1',
|
|
], true, [
|
|
'validate_nonce' => false,
|
|
]);
|
|
|
|
self::assertSame('access-1', $result->tokens->accessToken);
|
|
}
|
|
|
|
public function testHandleCallbackThrowsOnMissingParams(): void
|
|
{
|
|
$this->expectException(UserInfoException::class);
|
|
$this->client->handleCallback(['state' => 'only-state']);
|
|
}
|
|
|
|
/**
|
|
* @param array<string, mixed> $claims
|
|
*/
|
|
private function makeJwt(array $claims): string
|
|
{
|
|
$header = $this->base64Url(json_encode(['alg' => 'none', 'typ' => 'JWT'], JSON_THROW_ON_ERROR));
|
|
$payload = $this->base64Url(json_encode($claims, JSON_THROW_ON_ERROR));
|
|
|
|
return $header . '.' . $payload . '.signature';
|
|
}
|
|
|
|
private function base64Url(string $value): string
|
|
{
|
|
return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
|
|
}
|
|
}
|