tests/security/SessionManagerTest.php

   1 <?php
   2 require_once 'tests/utils/FakeConfigManager.php';
   3
   4 // Initialize reference data _before_ PHPUnit starts a session
   5 require_once 'tests/utils/ReferenceSessionIdHashes.php';
   6 ReferenceSessionIdHashes::genAllHashes();
   7
   8 use \Shaarli\Security\SessionManager;
   9 use \PHPUnit\Framework\TestCase;
  10
  11
  12 /**
  13  * Test coverage for SessionManager
  14  */
  15 class SessionManagerTest extends TestCase
  16 {
  17     /** @var array Session ID hashes */
  18     protected static $sidHashes = null;
  19
  20     /** @var \FakeConfigManager ConfigManager substitute for testing */
  21     protected $conf = null;
  22
  23     /** @var array $_SESSION array for testing */
  24     protected $session = [];
  25
  26     /** @var SessionManager Server-side session management abstraction */
  27     protected $sessionManager = null;
  28
  29     /**
  30      * Assign reference data
  31      */
  32     public static function setUpBeforeClass()
  33     {
  34         self::$sidHashes = ReferenceSessionIdHashes::getHashes();
  35     }
  36
  37     /**
  38      * Initialize or reset test resources
  39      */
  40     public function setUp()
  41     {
  42         $this->conf = new FakeConfigManager([
  43             'credentials.login' => 'johndoe',
  44             'credentials.salt' => 'salt',
  45             'security.session_protection_disabled' => false,
  46         ]);
  47         $this->session = [];
  48         $this->sessionManager = new SessionManager($this->session, $this->conf);
  49     }
  50
  51     /**
  52      * Generate a session token
  53      */
  54     public function testGenerateToken()
  55     {
  56         $token = $this->sessionManager->generateToken();
  57
  58         $this->assertEquals(1, $this->session['tokens'][$token]);
  59         $this->assertEquals(40, strlen($token));
  60     }
  61
  62     /**
  63      * Check a session token
  64      */
  65     public function testCheckToken()
  66     {
  67         $token = '4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b';
  68         $session = [
  69             'tokens' => [
  70                 $token => 1,
  71             ],
  72         ];
  73         $sessionManager = new SessionManager($session, $this->conf);
  74
  75         // check and destroy the token
  76         $this->assertTrue($sessionManager->checkToken($token));
  77         $this->assertFalse(isset($session['tokens'][$token]));
  78
  79         // ensure the token has been destroyed
  80         $this->assertFalse($sessionManager->checkToken($token));
  81     }
  82
  83     /**
  84      * Generate and check a session token
  85      */
  86     public function testGenerateAndCheckToken()
  87     {
  88         $token = $this->sessionManager->generateToken();
  89
  90         // ensure a token has been generated
  91         $this->assertEquals(1, $this->session['tokens'][$token]);
  92         $this->assertEquals(40, strlen($token));
  93
  94         // check and destroy the token
  95         $this->assertTrue($this->sessionManager->checkToken($token));
  96         $this->assertFalse(isset($this->session['tokens'][$token]));
  97
  98         // ensure the token has been destroyed
  99         $this->assertFalse($this->sessionManager->checkToken($token));
 100     }
 101
 102     /**
 103      * Check an invalid session token
 104      */
 105     public function testCheckInvalidToken()
 106     {
 107         $this->assertFalse($this->sessionManager->checkToken('4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b'));
 108     }
 109
 110     /**
 111      * Test SessionManager::checkId with a valid ID - TEST ALL THE HASHES!
 112      *
 113      * This tests extensively covers all hash algorithms / bit representations
 114      */
 115     public function testIsAnyHashSessionIdValid()
 116     {
 117         foreach (self::$sidHashes as $algo => $bpcs) {
 118             foreach ($bpcs as $bpc => $hash) {
 119                 $this->assertTrue(SessionManager::checkId($hash));
 120             }
 121         }
 122     }
 123
 124     /**
 125      * Test checkId with a valid ID - SHA-1 hashes
 126      */
 127     public function testIsSha1SessionIdValid()
 128     {
 129         $this->assertTrue(SessionManager::checkId(sha1('shaarli')));
 130     }
 131
 132     /**
 133      * Test checkId with a valid ID - SHA-256 hashes
 134      */
 135     public function testIsSha256SessionIdValid()
 136     {
 137         $this->assertTrue(SessionManager::checkId(hash('sha256', 'shaarli')));
 138     }
 139
 140     /**
 141      * Test checkId with a valid ID - SHA-512 hashes
 142      */
 143     public function testIsSha512SessionIdValid()
 144     {
 145         $this->assertTrue(SessionManager::checkId(hash('sha512', 'shaarli')));
 146     }
 147
 148     /**
 149      * Test checkId with invalid IDs.
 150      */
 151     public function testIsSessionIdInvalid()
 152     {
 153         $this->assertFalse(SessionManager::checkId(''));
 154         $this->assertFalse(SessionManager::checkId([]));
 155         $this->assertFalse(
 156             SessionManager::checkId('c0ZqcWF3VFE2NmJBdm1HMVQ0ZHJ3UmZPbTFsNGhkNHI=')
 157         );
 158     }
 159
 160     /**
 161      * Store login information after a successful login
 162      */
 163     public function testStoreLoginInfo()
 164     {
 165         $this->sessionManager->storeLoginInfo('ip_id');
 166
 167         $this->assertGreaterThan(time(), $this->session['expires_on']);
 168         $this->assertEquals('ip_id', $this->session['ip']);
 169         $this->assertEquals('johndoe', $this->session['username']);
 170     }
 171
 172     /**
 173      * Extend a server-side session by SessionManager::$SHORT_TIMEOUT
 174      */
 175     public function testExtendSession()
 176     {
 177         $this->sessionManager->extendSession();
 178
 179         $this->assertGreaterThan(time(), $this->session['expires_on']);
 180         $this->assertLessThanOrEqual(
 181             time() + SessionManager::$SHORT_TIMEOUT,
 182             $this->session['expires_on']
 183         );
 184     }
 185
 186     /**
 187      * Extend a server-side session by SessionManager::$LONG_TIMEOUT
 188      */
 189     public function testExtendSessionStaySignedIn()
 190     {
 191         $this->sessionManager->setStaySignedIn(true);
 192         $this->sessionManager->extendSession();
 193
 194         $this->assertGreaterThan(time(), $this->session['expires_on']);
 195         $this->assertGreaterThan(
 196             time() + SessionManager::$LONG_TIMEOUT - 10,
 197             $this->session['expires_on']
 198         );
 199         $this->assertLessThanOrEqual(
 200             time() + SessionManager::$LONG_TIMEOUT,
 201             $this->session['expires_on']
 202         );
 203     }
 204
 205     /**
 206      * Unset session variables after logging out
 207      */
 208     public function testLogout()
 209     {
 210         $this->session = [
 211             'ip' => 'ip_id',
 212             'expires_on' => time() + 1000,
 213             'username' => 'johndoe',
 214             'visibility' => 'public',
 215             'untaggedonly' => false,
 216         ];
 217         $this->sessionManager->logout();
 218
 219         $this->assertFalse(isset($this->session['ip']));
 220         $this->assertFalse(isset($this->session['expires_on']));
 221         $this->assertFalse(isset($this->session['username']));
 222         $this->assertFalse(isset($this->session['visibility']));
 223         $this->assertFalse(isset($this->session['untaggedonly']));
 224     }
 225
 226     /**
 227      * The session is active and expiration time has been reached
 228      */
 229     public function testHasExpiredTimeElapsed()
 230     {
 231         $this->session['expires_on'] = time() - 10;
 232
 233         $this->assertTrue($this->sessionManager->hasSessionExpired());
 234     }
 235
 236     /**
 237      * The session is active and expiration time has not been reached
 238      */
 239     public function testHasNotExpired()
 240     {
 241         $this->session['expires_on'] = time() + 1000;
 242
 243         $this->assertFalse($this->sessionManager->hasSessionExpired());
 244     }
 245
 246     /**
 247      * Session hijacking protection is disabled, we assume the IP has not changed
 248      */
 249     public function testHasClientIpChangedNoSessionProtection()
 250     {
 251         $this->conf->set('security.session_protection_disabled', true);
 252
 253         $this->assertFalse($this->sessionManager->hasClientIpChanged(''));
 254     }
 255
 256     /**
 257      * The client IP identifier has not changed
 258      */
 259     public function testHasClientIpChangedNope()
 260     {
 261         $this->session['ip'] = 'ip_id';
 262         $this->assertFalse($this->sessionManager->hasClientIpChanged('ip_id'));
 263     }
 264
 265     /**
 266      * The client IP identifier has changed
 267      */
 268     public function testHasClientIpChanged()
 269     {
 270         $this->session['ip'] = 'ip_id_one';
 271         $this->assertTrue($this->sessionManager->hasClientIpChanged('ip_id_two'));
 272     }
 273 }