Skip to content

Commit d8a228b

Browse files
imanghafoori1imanghafoori1
authored
add tests for AuthenticateSession Middleware (#55900)
1 parent c08b9f5 commit d8a228b

File tree

1 file changed

+274
-0
lines changed

1 file changed

+274
-0
lines changed

‎tests/Session/Middleware/AuthenticateSessionTest.php

Lines changed: 274 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
<?php
2+
3+
namespace Illuminate\Tests\Session\Middleware;
4+
5+
use Illuminate\Auth\AuthenticationException;
6+
use Illuminate\Contracts\Auth\Factory as AuthFactory;
7+
use Illuminate\Http\Request;
8+
use Illuminate\Session\ArraySessionHandler;
9+
use Illuminate\Session\Middleware\AuthenticateSession;
10+
use Illuminate\Session\Store;
11+
use Mockery;
12+
use PHPUnit\Framework\TestCase;
13+
14+
class AuthenticateSessionTest extends TestCase
15+
{
16+
protected function tearDown(): void
17+
{
18+
Mockery::close();
19+
}
20+
21+
public function test_handle_without_session()
22+
{
23+
$request = new Request;
24+
$next = fn () => 'next-1';
25+
26+
$authFactory = Mockery::mock(AuthFactory::class);
27+
$authFactory->shouldReceive('viaRemember')->never();
28+
29+
$middleware = new AuthenticateSession($authFactory);
30+
$response = $middleware->handle($request, $next);
31+
$this->assertEquals('next-1', $response);
32+
}
33+
34+
public function test_handle_with_session_without_request_user()
35+
{
36+
$request = new Request;
37+
38+
// set session:
39+
$request->setLaravelSession(new Store('name', new ArraySessionHandler(1)));
40+
41+
$authFactory = Mockery::mock(AuthFactory::class);
42+
$authFactory->shouldReceive('viaRemember')->never();
43+
44+
$next = fn () => 'next-2';
45+
$middleware = new AuthenticateSession($authFactory);
46+
$response = $middleware->handle($request, $next);
47+
$this->assertEquals('next-2', $response);
48+
}
49+
50+
public function test_handle_with_session_without_auth_password()
51+
{
52+
$user = new class
53+
{
54+
public function getAuthPassword()
55+
{
56+
return null;
57+
}
58+
};
59+
60+
$request = new Request;
61+
62+
// set session:
63+
$request->setLaravelSession(new Store('name', new ArraySessionHandler(1)));
64+
// set a password-less user:
65+
$request->setUserResolver(fn () => $user);
66+
67+
$authFactory = Mockery::mock(AuthFactory::class);
68+
$authFactory->shouldReceive('viaRemember')->never();
69+
70+
$next = fn () => 'next-3';
71+
$middleware = new AuthenticateSession($authFactory);
72+
$response = $middleware->handle($request, $next);
73+
74+
$this->assertEquals('next-3', $response);
75+
}
76+
77+
public function test_handle_with_session_with_user_auth_password_on_request_via_remember_false()
78+
{
79+
$user = new class
80+
{
81+
public function getAuthPassword()
82+
{
83+
return 'my-pass-(*&^%$#!@';
84+
}
85+
};
86+
87+
$request = new Request;
88+
$request->setUserResolver(fn () => $user);
89+
90+
$session = new Store('name', new ArraySessionHandler(1));
91+
$request->setLaravelSession($session);
92+
93+
$authFactory = Mockery::mock(AuthFactory::class);
94+
$authFactory->shouldReceive('viaRemember')->andReturn(false);
95+
$authFactory->shouldReceive('getDefaultDriver')->andReturn('web');
96+
$authFactory->shouldReceive('user')->andReturn(null);
97+
98+
$middleware = new AuthenticateSession($authFactory);
99+
$response = $middleware->handle($request, fn () => 'next-4');
100+
101+
$this->assertEquals('my-pass-(*&^%$#!@', $session->get('password_hash_web'));
102+
$this->assertEquals('next-4', $response);
103+
}
104+
105+
public function test_handle_with_invalid_password_hash()
106+
{
107+
$user = new class
108+
{
109+
public function getAuthPassword()
110+
{
111+
return 'my-pass-(*&^%$#!@';
112+
}
113+
};
114+
115+
$request = new Request(cookies: ['recaller-name' => 'a|b|my-pass-dont-match']);
116+
$request->setUserResolver(fn () => $user);
117+
118+
$session = new Store('name', new ArraySessionHandler(1));
119+
$session->put('a', '1');
120+
$session->put('b', '2');
121+
// set session:
122+
$request->setLaravelSession($session);
123+
124+
$authFactory = Mockery::mock(AuthFactory::class);
125+
$authFactory->shouldReceive('viaRemember')->andReturn(true);
126+
$authFactory->shouldReceive('getRecallerName')->once()->andReturn('recaller-name');
127+
$authFactory->shouldReceive('logoutCurrentDevice')->once()->andReturn(null);
128+
$authFactory->shouldReceive('getDefaultDriver')->andReturn('web');
129+
$authFactory->shouldReceive('user')->andReturn(null);
130+
131+
$this->assertNotNull($session->get('a'));
132+
$this->assertNotNull($session->get('b'));
133+
AuthenticateSession::redirectUsing(fn ($request) => 'i-wanna-go-home');
134+
135+
// act:
136+
$middleware = new AuthenticateSession($authFactory);
137+
138+
$message = '';
139+
try {
140+
$middleware->handle($request, fn () => 'next-7');
141+
} catch (AuthenticationException $e) {
142+
$message = $e->getMessage();
143+
$this->assertEquals('i-wanna-go-home', $e->redirectTo($request));
144+
}
145+
$this->assertEquals('Unauthenticated.', $message);
146+
147+
// ensure session is flushed:
148+
$this->assertNull($session->get('a'));
149+
$this->assertNull($session->get('b'));
150+
}
151+
152+
public function test_handle_with_invalid_incookie_password_hash_via_remember_true()
153+
{
154+
$user = new class
155+
{
156+
public function getAuthPassword()
157+
{
158+
return 'my-pass-(*&^%$#!@';
159+
}
160+
};
161+
162+
$request = new Request(cookies: ['recaller-name' => 'a|b|my-pass-dont-match']);
163+
$request->setUserResolver(fn () => $user);
164+
165+
$session = new Store('name', new ArraySessionHandler(1));
166+
$session->put('a', '1');
167+
$session->put('b', '2');
168+
// set session:
169+
$request->setLaravelSession($session);
170+
171+
$authFactory = Mockery::mock(AuthFactory::class);
172+
$authFactory->shouldReceive('viaRemember')->andReturn(true);
173+
$authFactory->shouldReceive('getRecallerName')->once()->andReturn('recaller-name');
174+
$authFactory->shouldReceive('logoutCurrentDevice')->once();
175+
$authFactory->shouldReceive('getDefaultDriver')->andReturn('web');
176+
$authFactory->shouldReceive('user')->andReturn(null);
177+
178+
$middleware = new AuthenticateSession($authFactory);
179+
// act:
180+
try {
181+
$message = '';
182+
$middleware->handle($request, fn () => 'next-6');
183+
} catch (AuthenticationException $e) {
184+
$message = $e->getMessage();
185+
}
186+
$this->assertEquals('Unauthenticated.', $message);
187+
188+
// ensure session is flushed
189+
$this->assertNull($session->get('password_hash_web'));
190+
$this->assertNull($session->get('a'));
191+
$this->assertNull($session->get('b'));
192+
}
193+
194+
public function test_handle_with_valid_incookie_invalid_insession_hash_via_remember_true()
195+
{
196+
$user = new class
197+
{
198+
public function getAuthPassword()
199+
{
200+
return 'my-pass-(*&^%$#!@';
201+
}
202+
};
203+
204+
$request = new Request(cookies: ['recaller-name' => 'a|b|my-pass-(*&^%$#!@']);
205+
$request->setUserResolver(fn () => $user);
206+
207+
$session = new Store('name', new ArraySessionHandler(1));
208+
$session->put('a', '1');
209+
$session->put('b', '2');
210+
$session->put('password_hash_web', 'invalid-password');
211+
// set session on the request:
212+
$request->setLaravelSession($session);
213+
214+
$authFactory = Mockery::mock(AuthFactory::class);
215+
$authFactory->shouldReceive('viaRemember')->andReturn(true);
216+
$authFactory->shouldReceive('getRecallerName')->once()->andReturn('recaller-name');
217+
$authFactory->shouldReceive('logoutCurrentDevice')->once()->andReturn(null);
218+
$authFactory->shouldReceive('getDefaultDriver')->andReturn('web');
219+
$authFactory->shouldReceive('user')->andReturn(null);
220+
221+
// act:
222+
$middleware = new AuthenticateSession($authFactory);
223+
try {
224+
$message = '';
225+
$middleware->handle($request, fn () => 'next-7');
226+
} catch (AuthenticationException $e) {
227+
$message = $e->getMessage();
228+
}
229+
$this->assertEquals('Unauthenticated.', $message);
230+
231+
// ensure session is flushed:
232+
$this->assertNull($session->get('password_hash_web'));
233+
$this->assertNull($session->get('a'));
234+
$this->assertNull($session->get('b'));
235+
}
236+
237+
public function test_handle_with_valid_password_in_session_cookie_is_empty_guard_has_user()
238+
{
239+
$user = new class
240+
{
241+
public function getAuthPassword()
242+
{
243+
return 'my-pass-(*&^%$#!@';
244+
}
245+
};
246+
247+
$request = new Request(cookies: ['recaller-name' => 'a|b']);
248+
$request->setUserResolver(fn () => $user);
249+
250+
$session = new Store('name', new ArraySessionHandler(1));
251+
$session->put('a', '1');
252+
$session->put('b', '2');
253+
$session->put('password_hash_web', 'my-pass-(*&^%$#!@');
254+
// set session on the request:
255+
$request->setLaravelSession($session);
256+
257+
$authFactory = Mockery::mock(AuthFactory::class);
258+
$authFactory->shouldReceive('viaRemember')->andReturn(false);
259+
$authFactory->shouldReceive('getRecallerName')->never();
260+
$authFactory->shouldReceive('logoutCurrentDevice')->never();
261+
$authFactory->shouldReceive('getDefaultDriver')->andReturn('web');
262+
$authFactory->shouldReceive('user')->andReturn($user);
263+
264+
// act:
265+
$middleware = new AuthenticateSession($authFactory);
266+
$response = $middleware->handle($request, fn () => 'next-8');
267+
268+
$this->assertEquals('next-8', $response);
269+
// ensure session is flushed:
270+
$this->assertEquals('my-pass-(*&^%$#!@', $session->get('password_hash_web'));
271+
$this->assertEquals('1', $session->get('a'));
272+
$this->assertEquals('2', $session->get('b'));
273+
}
274+
}

0 commit comments

Comments
 (0)