19f8127ef0
The current signature of the various execute methods only takes a boolean parameter to determine if the session should be safe against CSRF, but that does not give callers fine-grained control over the Session object, including setting a specific token. Also, do not use createNoOpMock in getSession(), since it implies strong assertions on what methods are called. This way, getSession can also be used to get a simple mock session that tests may further manipulate. Make $csrfSafe parameter of SessionHelperTestTrait::getSession mandatory. This way, callers are forced to think what makes sense in each use case. The various methods in HandlerTestTrait now default to a session that is safe against CSRF. This assumes that most REST handlers don't care about the session, and that any handler that does care about the session and where someone needs to test the behaviour in case of bad/missing token will explicitly provide a Session that is NOT safe against CSRF. Typehint the return value of Session(Backend)::getUser so that PHPUnit will automatically make it return a mock User object even if the method is not explicitly mocked. Remove a useless PHPUnit assertion -- setting the return value to be X and then veryfing that is equal to X is a tautology, and can only fail if the test itself is flawed (as was the case, since it was using stdClass as the return type for all methods). Remove the getUser test case altogether, there's no way to make it work given the DummySessionBackend, and the test isn't that helpful anyway. More and more methods will have the same issue as soon as their return value is typehinted. Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150 Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
69 lines
2.5 KiB
PHP
69 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace MediaWiki\Tests\Rest;
|
|
|
|
use MediaWiki\Config\ServiceOptions;
|
|
use MediaWiki\MainConfigNames;
|
|
use MediaWiki\Rest\BasicAccess\StaticBasicAuthorizer;
|
|
use MediaWiki\Rest\Reporter\PHPErrorReporter;
|
|
use MediaWiki\Rest\RequestData;
|
|
use MediaWiki\Rest\ResponseFactory;
|
|
use MediaWiki\Rest\Router;
|
|
use MediaWiki\Rest\Validator\Validator;
|
|
use MediaWiki\Tests\Rest\Handler\SessionHelperTestTrait;
|
|
use MediaWiki\Tests\Unit\Permissions\MockAuthorityTrait;
|
|
use Psr\Container\ContainerInterface;
|
|
use Wikimedia\ObjectFactory\ObjectFactory;
|
|
|
|
/**
|
|
* A trait providing utility function for testing the REST framework.
|
|
* This trait is intended to be used on subclasses of MediaWikiUnitTestCase
|
|
* or MediaWikiIntegrationTestCase.
|
|
*
|
|
* @stable to use
|
|
* @package MediaWiki\Tests\Rest
|
|
*/
|
|
trait RestTestTrait {
|
|
use SessionHelperTestTrait;
|
|
use MockAuthorityTrait;
|
|
|
|
/**
|
|
* @param array $params Constructor parameters, as an associative array.
|
|
* In addition to the actual parameters, the following pseudo-parameters
|
|
* are supported:
|
|
* - 'config': an associative array of configuration variables, used
|
|
* to construct the 'options' parameter.
|
|
* - 'request': A request object, used to construct the 'validator' parameter.
|
|
* @return Router
|
|
*/
|
|
private function newRouter( array $params = [] ) {
|
|
$objectFactory = new ObjectFactory(
|
|
$this->getMockForAbstractClass( ContainerInterface::class )
|
|
);
|
|
$authority = $params['authority'] ?? $this->mockAnonUltimateAuthority();
|
|
|
|
$config = ( $params['config'] ?? [] ) + [
|
|
MainConfigNames::CanonicalServer => 'https://wiki.example.com',
|
|
MainConfigNames::InternalServer => 'http://api.local:8080',
|
|
MainConfigNames::RestPath => '/rest'
|
|
];
|
|
|
|
$request = $params['request'] ?? new RequestData();
|
|
|
|
return new Router(
|
|
$params['routeFiles'] ?? [ MW_INSTALL_PATH . '/tests/phpunit/unit/includes/Rest/testRoutes.json' ],
|
|
$params['extraRoutes'] ?? [],
|
|
$params['options'] ?? new ServiceOptions( Router::CONSTRUCTOR_OPTIONS, $config ),
|
|
$params['cacheBag'] ?? new \EmptyBagOStuff(),
|
|
$params['responseFactory'] ?? new ResponseFactory( [] ),
|
|
$params['basicAuth'] ?? new StaticBasicAuthorizer(),
|
|
$params['authority'] ?? $authority,
|
|
$params['objectFactory'] ?? $objectFactory,
|
|
$params['validator'] ?? new Validator( $objectFactory, $request, $authority ),
|
|
$params['errorReporter'] ?? new PHPErrorReporter(),
|
|
$params['hookContainer'] ?? $this->createHookContainer(),
|
|
$params['session'] ?? $this->getSession( true )
|
|
);
|
|
}
|
|
|
|
}
|