2019-07-11 18:56:41 +00:00
|
|
|
<?php
|
|
|
|
|
|
2024-02-16 16:49:05 +00:00
|
|
|
namespace MediaWiki\Tests\Session;
|
2019-07-11 18:56:41 +00:00
|
|
|
|
2024-02-16 21:57:59 +00:00
|
|
|
use MediaWiki\Request\FauxRequest;
|
2024-02-16 16:49:05 +00:00
|
|
|
use MediaWiki\Session\Session;
|
|
|
|
|
use MediaWiki\Session\SessionId;
|
2019-07-11 18:56:41 +00:00
|
|
|
use MediaWikiUnitTestCase;
|
2020-01-10 00:00:51 +00:00
|
|
|
use Psr\Log\LogLevel;
|
2024-02-16 21:57:59 +00:00
|
|
|
use stdClass;
|
|
|
|
|
use TestLogger;
|
2019-07-11 18:56:41 +00:00
|
|
|
use Wikimedia\TestingAccessWrapper;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @group Session
|
2024-02-16 16:49:05 +00:00
|
|
|
* @covers \MediaWiki\Session\Session
|
2019-07-11 18:56:41 +00:00
|
|
|
*/
|
|
|
|
|
class SessionUnitTest extends MediaWikiUnitTestCase {
|
|
|
|
|
|
|
|
|
|
public function testConstructor() {
|
|
|
|
|
$backend = TestUtils::getDummySessionBackend();
|
|
|
|
|
TestingAccessWrapper::newFromObject( $backend )->requests = [ -1 => 'dummy' ];
|
|
|
|
|
TestingAccessWrapper::newFromObject( $backend )->id = new SessionId( 'abc' );
|
|
|
|
|
|
2024-02-16 21:57:59 +00:00
|
|
|
$session = new Session( $backend, 42, new TestLogger );
|
2019-07-11 18:56:41 +00:00
|
|
|
$priv = TestingAccessWrapper::newFromObject( $session );
|
|
|
|
|
$this->assertSame( $backend, $priv->backend );
|
|
|
|
|
$this->assertSame( 42, $priv->index );
|
|
|
|
|
|
2024-02-16 21:57:59 +00:00
|
|
|
$request = new FauxRequest();
|
2019-07-11 18:56:41 +00:00
|
|
|
$priv2 = TestingAccessWrapper::newFromObject( $session->sessionWithRequest( $request ) );
|
|
|
|
|
$this->assertSame( $backend, $priv2->backend );
|
|
|
|
|
$this->assertNotSame( $priv->index, $priv2->index );
|
|
|
|
|
$this->assertSame( $request, $priv2->getRequest() );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @dataProvider provideMethods
|
|
|
|
|
* @param string $m Method to test
|
|
|
|
|
* @param array $args Arguments to pass to the method
|
|
|
|
|
* @param bool $index Whether the backend method gets passed the index
|
|
|
|
|
*/
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
public function testMethods( $m, $args, $index ) {
|
|
|
|
|
$backend = $this->getMockBuilder( DummySessionBackend::class )
|
2021-03-20 15:18:58 +00:00
|
|
|
->onlyMethods( [ 'deregisterSession' ] )
|
|
|
|
|
->addMethods( [ $m ] )
|
2019-07-11 18:56:41 +00:00
|
|
|
->getMock();
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
$backend->expects( $this->once() )->method( 'deregisterSession' )
|
2019-07-11 18:56:41 +00:00
|
|
|
->with( $this->identicalTo( 42 ) );
|
|
|
|
|
|
|
|
|
|
$expectArgs = [];
|
|
|
|
|
if ( $index ) {
|
|
|
|
|
$expectArgs[] = $this->identicalTo( 42 );
|
|
|
|
|
}
|
|
|
|
|
foreach ( $args as $arg ) {
|
|
|
|
|
$expectArgs[] = $this->identicalTo( $arg );
|
|
|
|
|
}
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
$backend->expects( $this->once() )->method( $m )->with( ...$expectArgs );
|
2019-07-11 18:56:41 +00:00
|
|
|
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
$session = TestUtils::getDummySession( $backend, 42 );
|
2019-07-11 18:56:41 +00:00
|
|
|
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
$session->$m( ...$args );
|
|
|
|
|
$this->addToAssertionCount( 1 );
|
2019-07-11 18:56:41 +00:00
|
|
|
|
|
|
|
|
// Trigger Session destructor
|
|
|
|
|
$session = null;
|
|
|
|
|
}
|
|
|
|
|
|
2023-03-23 11:36:19 +00:00
|
|
|
public static function provideMethods() {
|
2019-07-11 18:56:41 +00:00
|
|
|
return [
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
[ 'getId', [], false ],
|
|
|
|
|
[ 'getSessionId', [], false ],
|
|
|
|
|
[ 'resetId', [], false ],
|
|
|
|
|
[ 'getProvider', [], false ],
|
|
|
|
|
[ 'isPersistent', [], false ],
|
|
|
|
|
[ 'persist', [], false ],
|
|
|
|
|
[ 'unpersist', [], false ],
|
|
|
|
|
[ 'shouldRememberUser', [], false ],
|
|
|
|
|
[ 'setRememberUser', [ true ], false ],
|
|
|
|
|
[ 'getRequest', [], true ],
|
|
|
|
|
[ 'getAllowedUserRights', [], false ],
|
|
|
|
|
[ 'canSetUser', [], false ],
|
2024-02-16 21:57:59 +00:00
|
|
|
[ 'setUser', [ new stdClass ], false ],
|
Make it possible to override the session in REST API tests
The current signature of the various execute methods only takes a
boolean parameter to determine if the session should be safe against
CSRF, but that does not give callers fine-grained control over the
Session object, including setting a specific token.
Also, do not use createNoOpMock in getSession(), since it implies
strong assertions on what methods are called. This way, getSession
can also be used to get a simple mock session that tests may further
manipulate.
Make $csrfSafe parameter of SessionHelperTestTrait::getSession
mandatory. This way, callers are forced to think what makes sense in
each use case. The various methods in HandlerTestTrait now default to
a session that is safe against CSRF. This assumes that most REST
handlers don't care about the session, and that any handler that does
care about the session and where someone needs to test the behaviour
in case of bad/missing token will explicitly provide a Session that
is NOT safe against CSRF.
Typehint the return value of Session(Backend)::getUser so that PHPUnit
will automatically make it return a mock User object even if the method
is not explicitly mocked. Remove a useless PHPUnit assertion -- setting
the return value to be X and then veryfing that is equal to X is a
tautology, and can only fail if the test itself is flawed (as was the
case, since it was using stdClass as the return type for all
methods). Remove the getUser test case altogether, there's no way to
make it work given the DummySessionBackend, and the test isn't that
helpful anyway. More and more methods will have the same issue as soon
as their return value is typehinted.
Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150
Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
2023-02-06 15:18:00 +00:00
|
|
|
[ 'suggestLoginUsername', [], true ],
|
|
|
|
|
[ 'shouldForceHTTPS', [], false ],
|
|
|
|
|
[ 'setForceHTTPS', [ true ], false ],
|
|
|
|
|
[ 'getLoggedOutTimestamp', [], false ],
|
|
|
|
|
[ 'setLoggedOutTimestamp', [ 123 ], false ],
|
|
|
|
|
[ 'getProviderMetadata', [], false ],
|
|
|
|
|
[ 'save', [], false ],
|
|
|
|
|
[ 'delaySave', [], false ],
|
|
|
|
|
[ 'renew', [], false ],
|
2019-07-11 18:56:41 +00:00
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function testDataAccess() {
|
|
|
|
|
$session = TestUtils::getDummySession();
|
|
|
|
|
$backend = TestingAccessWrapper::newFromObject( $session )->backend;
|
|
|
|
|
|
2020-05-30 10:36:42 +00:00
|
|
|
$this->assertSame( 1, $session->get( 'foo' ) );
|
2019-07-11 18:56:41 +00:00
|
|
|
$this->assertEquals( 'zero', $session->get( 0 ) );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
2019-09-17 14:03:28 +00:00
|
|
|
$this->assertNull( $session->get( 'null' ) );
|
2019-07-11 18:56:41 +00:00
|
|
|
$this->assertEquals( 'default', $session->get( 'null', 'default' ) );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$session->set( 'foo', 55 );
|
|
|
|
|
$this->assertEquals( 55, $backend->data['foo'] );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
|
|
|
|
|
$session->set( 1, 'one' );
|
|
|
|
|
$this->assertEquals( 'one', $backend->data[1] );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
|
|
|
|
|
$session->set( 1, 'one' );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$this->assertTrue( $session->exists( 'foo' ) );
|
|
|
|
|
$this->assertTrue( $session->exists( 1 ) );
|
|
|
|
|
$this->assertFalse( $session->exists( 'null' ) );
|
|
|
|
|
$this->assertFalse( $session->exists( 100 ) );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$session->remove( 'foo' );
|
|
|
|
|
$this->assertArrayNotHasKey( 'foo', $backend->data );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
$session->remove( 1 );
|
|
|
|
|
$this->assertArrayNotHasKey( 1, $backend->data );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
|
|
|
|
|
$session->remove( 101 );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$backend->data = [ 'a', 'b', '?' => 'c' ];
|
|
|
|
|
$this->assertSame( 3, $session->count() );
|
2020-02-28 15:45:22 +00:00
|
|
|
$this->assertCount( 3, $session );
|
2019-07-11 18:56:41 +00:00
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$data = [];
|
|
|
|
|
foreach ( $session as $key => $value ) {
|
|
|
|
|
$data[$key] = $value;
|
|
|
|
|
}
|
|
|
|
|
$this->assertEquals( $backend->data, $data );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$this->assertEquals( $backend->data, iterator_to_array( $session ) );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function testArrayAccess() {
|
2024-02-16 21:57:59 +00:00
|
|
|
$logger = new TestLogger;
|
2019-07-11 18:56:41 +00:00
|
|
|
$session = TestUtils::getDummySession( null, -1, $logger );
|
|
|
|
|
$backend = TestingAccessWrapper::newFromObject( $session )->backend;
|
|
|
|
|
|
2020-05-30 10:36:42 +00:00
|
|
|
$this->assertSame( 1, $session['foo'] );
|
2019-07-11 18:56:41 +00:00
|
|
|
$this->assertEquals( 'zero', $session[0] );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$logger->setCollect( true );
|
2019-09-17 14:03:28 +00:00
|
|
|
$this->assertNull( $session['null'] );
|
2019-07-11 18:56:41 +00:00
|
|
|
$logger->setCollect( false );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
$this->assertSame( [
|
|
|
|
|
[ LogLevel::DEBUG, 'Undefined index (auto-adds to session with a null value): null' ]
|
|
|
|
|
], $logger->getBuffer() );
|
|
|
|
|
$logger->clearBuffer();
|
|
|
|
|
|
|
|
|
|
$session['foo'] = 55;
|
|
|
|
|
$this->assertEquals( 55, $backend->data['foo'] );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
|
|
|
|
|
$session[1] = 'one';
|
|
|
|
|
$this->assertEquals( 'one', $backend->data[1] );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
|
|
|
|
|
$session[1] = 'one';
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
$session['bar'] = [ 'baz' => [] ];
|
|
|
|
|
$session['bar']['baz']['quux'] = 2;
|
|
|
|
|
$this->assertEquals( [ 'baz' => [ 'quux' => 2 ] ], $backend->data['bar'] );
|
|
|
|
|
|
|
|
|
|
$logger->setCollect( true );
|
|
|
|
|
$session['bar2']['baz']['quux'] = 3;
|
|
|
|
|
$logger->setCollect( false );
|
|
|
|
|
$this->assertEquals( [ 'baz' => [ 'quux' => 3 ] ], $backend->data['bar2'] );
|
|
|
|
|
$this->assertSame( [
|
|
|
|
|
[ LogLevel::DEBUG, 'Undefined index (auto-adds to session with a null value): bar2' ]
|
|
|
|
|
], $logger->getBuffer() );
|
|
|
|
|
$logger->clearBuffer();
|
|
|
|
|
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
$this->assertTrue( isset( $session['foo'] ) );
|
|
|
|
|
$this->assertTrue( isset( $session[1] ) );
|
|
|
|
|
$this->assertFalse( isset( $session['null'] ) );
|
|
|
|
|
$this->assertFalse( isset( $session['missing'] ) );
|
|
|
|
|
$this->assertFalse( isset( $session[100] ) );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
|
|
|
|
|
unset( $session['foo'] );
|
|
|
|
|
$this->assertArrayNotHasKey( 'foo', $backend->data );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
unset( $session[1] );
|
|
|
|
|
$this->assertArrayNotHasKey( 1, $backend->data );
|
|
|
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
|
$backend->dirty = false;
|
|
|
|
|
|
|
|
|
|
unset( $session[101] );
|
|
|
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function testTokens() {
|
|
|
|
|
$session = TestUtils::getDummySession();
|
|
|
|
|
$priv = TestingAccessWrapper::newFromObject( $session );
|
|
|
|
|
$backend = $priv->backend;
|
|
|
|
|
|
2021-06-02 22:13:53 +00:00
|
|
|
$this->assertFalse( $session->hasToken() );
|
2019-07-11 18:56:41 +00:00
|
|
|
$token = TestingAccessWrapper::newFromObject( $session->getToken() );
|
2021-06-02 22:13:53 +00:00
|
|
|
// Session::getToken auto-initializes the token.
|
|
|
|
|
$this->assertTrue( $session->hasToken() );
|
2019-07-11 18:56:41 +00:00
|
|
|
$this->assertArrayHasKey( 'wsTokenSecrets', $backend->data );
|
|
|
|
|
$this->assertArrayHasKey( 'default', $backend->data['wsTokenSecrets'] );
|
|
|
|
|
$secret = $backend->data['wsTokenSecrets']['default'];
|
|
|
|
|
$this->assertSame( $secret, $token->secret );
|
|
|
|
|
$this->assertSame( '', $token->salt );
|
|
|
|
|
$this->assertTrue( $token->wasNew() );
|
|
|
|
|
|
|
|
|
|
$token = TestingAccessWrapper::newFromObject( $session->getToken( 'foo' ) );
|
|
|
|
|
$this->assertSame( $secret, $token->secret );
|
|
|
|
|
$this->assertSame( 'foo', $token->salt );
|
|
|
|
|
$this->assertFalse( $token->wasNew() );
|
|
|
|
|
|
2021-06-02 22:13:53 +00:00
|
|
|
$this->assertFalse( $session->hasToken( 'secret' ) );
|
2019-07-11 18:56:41 +00:00
|
|
|
$backend->data['wsTokenSecrets']['secret'] = 'sekret';
|
|
|
|
|
$token = TestingAccessWrapper::newFromObject(
|
|
|
|
|
$session->getToken( [ 'bar', 'baz' ], 'secret' )
|
|
|
|
|
);
|
2021-06-02 22:13:53 +00:00
|
|
|
// Session::getToken auto-initializes the token.
|
|
|
|
|
$this->assertTrue( $session->hasToken() );
|
|
|
|
|
$this->assertTrue( $session->hasToken( 'secret' ) );
|
2019-07-11 18:56:41 +00:00
|
|
|
$this->assertSame( 'sekret', $token->secret );
|
|
|
|
|
$this->assertSame( 'bar|baz', $token->salt );
|
|
|
|
|
$this->assertFalse( $token->wasNew() );
|
|
|
|
|
|
|
|
|
|
$session->resetToken( 'secret' );
|
|
|
|
|
$this->assertArrayHasKey( 'wsTokenSecrets', $backend->data );
|
|
|
|
|
$this->assertArrayHasKey( 'default', $backend->data['wsTokenSecrets'] );
|
|
|
|
|
$this->assertArrayNotHasKey( 'secret', $backend->data['wsTokenSecrets'] );
|
|
|
|
|
|
|
|
|
|
$session->resetAllTokens();
|
|
|
|
|
$this->assertArrayNotHasKey( 'wsTokenSecrets', $backend->data );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|