tests/security/SessionManagerTest.php

   1 <?php
   2
   3 namespace Shaarli\Security;
   4
   5 use Shaarli\FakeConfigManager;
   6 use Shaarli\TestCase;
   7
   8 /**
   9  * Test coverage for SessionManager
  10  */
  11 class SessionManagerTest extends TestCase
  12 {
  13     /** @var array Session ID hashes */
  14     protected static $sidHashes = null;
  15
  16     /** @var FakeConfigManager ConfigManager substitute for testing */
  17     protected $conf = null;
  18
  19     /** @var array $_SESSION array for testing */
  20     protected $session = [];
  21
  22     /** @var SessionManager Server-side session management abstraction */
  23     protected $sessionManager = null;
  24
  25     /**
  26      * Assign reference data
  27      */
  28     public static function setUpBeforeClass(): void
  29     {
  30         self::$sidHashes = \ReferenceSessionIdHashes::getHashes();
  31     }
  32
  33     /**
  34      * Initialize or reset test resources
  35      */
  36     protected function setUp(): void
  37     {
  38         $this->conf = new FakeConfigManager([
  39             'credentials.login' => 'johndoe',
  40             'credentials.salt' => 'salt',
  41             'security.session_protection_disabled' => false,
  42         ]);
  43         $this->session = [];
  44         $this->sessionManager = new SessionManager($this->session, $this->conf, 'session_path');
  45     }
  46
  47     /**
  48      * Generate a session token
  49      */
  50     public function testGenerateToken()
  51     {
  52         $token = $this->sessionManager->generateToken();
  53
  54         $this->assertEquals(1, $this->session['tokens'][$token]);
  55         $this->assertEquals(40, strlen($token));
  56     }
  57
  58     /**
  59      * Check a session token
  60      */
  61     public function testCheckToken()
  62     {
  63         $token = '4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b';
  64         $session = [
  65             'tokens' => [
  66                 $token => 1,
  67             ],
  68         ];
  69         $sessionManager = new SessionManager($session, $this->conf, 'session_path');
  70
  71         // check and destroy the token
  72         $this->assertTrue($sessionManager->checkToken($token));
  73         $this->assertFalse(isset($session['tokens'][$token]));
  74
  75         // ensure the token has been destroyed
  76         $this->assertFalse($sessionManager->checkToken($token));
  77     }
  78
  79     /**
  80      * Generate and check a session token
  81      */
  82     public function testGenerateAndCheckToken()
  83     {
  84         $token = $this->sessionManager->generateToken();
  85
  86         // ensure a token has been generated
  87         $this->assertEquals(1, $this->session['tokens'][$token]);
  88         $this->assertEquals(40, strlen($token));
  89
  90         // check and destroy the token
  91         $this->assertTrue($this->sessionManager->checkToken($token));
  92         $this->assertFalse(isset($this->session['tokens'][$token]));
  93
  94         // ensure the token has been destroyed
  95         $this->assertFalse($this->sessionManager->checkToken($token));
  96     }
  97
  98     /**
  99      * Check an invalid session token
 100      */
 101     public function testCheckInvalidToken()
 102     {
 103         $this->assertFalse($this->sessionManager->checkToken('4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b'));
 104     }
 105
 106     /**
 107      * Test SessionManager::checkId with a valid ID - TEST ALL THE HASHES!
 108      *
 109      * This tests extensively covers all hash algorithms / bit representations
 110      */
 111     public function testIsAnyHashSessionIdValid()
 112     {
 113         foreach (self::$sidHashes as $algo => $bpcs) {
 114             foreach ($bpcs as $bpc => $hash) {
 115                 $this->assertTrue(SessionManager::checkId($hash));
 116             }
 117         }
 118     }
 119
 120     /**
 121      * Test checkId with a valid ID - SHA-1 hashes
 122      */
 123     public function testIsSha1SessionIdValid()
 124     {
 125         $this->assertTrue(SessionManager::checkId(sha1('shaarli')));
 126     }
 127
 128     /**
 129      * Test checkId with a valid ID - SHA-256 hashes
 130      */
 131     public function testIsSha256SessionIdValid()
 132     {
 133         $this->assertTrue(SessionManager::checkId(hash('sha256', 'shaarli')));
 134     }
 135
 136     /**
 137      * Test checkId with a valid ID - SHA-512 hashes
 138      */
 139     public function testIsSha512SessionIdValid()
 140     {
 141         $this->assertTrue(SessionManager::checkId(hash('sha512', 'shaarli')));
 142     }
 143
 144     /**
 145      * Test checkId with invalid IDs.
 146      */
 147     public function testIsSessionIdInvalid()
 148     {
 149         $this->assertFalse(SessionManager::checkId(''));
 150         $this->assertFalse(SessionManager::checkId([]));
 151         $this->assertFalse(
 152             SessionManager::checkId('c0ZqcWF3VFE2NmJBdm1HMVQ0ZHJ3UmZPbTFsNGhkNHI=')
 153         );
 154     }
 155
 156     /**
 157      * Store login information after a successful login
 158      */
 159     public function testStoreLoginInfo()
 160     {
 161         $this->sessionManager->storeLoginInfo('ip_id');
 162
 163         $this->assertGreaterThan(time(), $this->session['expires_on']);
 164         $this->assertEquals('ip_id', $this->session['ip']);
 165         $this->assertEquals('johndoe', $this->session['username']);
 166     }
 167
 168     /**
 169      * Extend a server-side session by SessionManager::$SHORT_TIMEOUT
 170      */
 171     public function testExtendSession()
 172     {
 173         $this->sessionManager->extendSession();
 174
 175         $this->assertGreaterThan(time(), $this->session['expires_on']);
 176         $this->assertLessThanOrEqual(
 177             time() + SessionManager::$SHORT_TIMEOUT,
 178             $this->session['expires_on']
 179         );
 180     }
 181
 182     /**
 183      * Extend a server-side session by SessionManager::$LONG_TIMEOUT
 184      */
 185     public function testExtendSessionStaySignedIn()
 186     {
 187         $this->sessionManager->setStaySignedIn(true);
 188         $this->sessionManager->extendSession();
 189
 190         $this->assertGreaterThan(time(), $this->session['expires_on']);
 191         $this->assertGreaterThan(
 192             time() + SessionManager::$LONG_TIMEOUT - 10,
 193             $this->session['expires_on']
 194         );
 195         $this->assertLessThanOrEqual(
 196             time() + SessionManager::$LONG_TIMEOUT,
 197             $this->session['expires_on']
 198         );
 199     }
 200
 201     /**
 202      * Unset session variables after logging out
 203      */
 204     public function testLogout()
 205     {
 206         $this->session = [
 207             'ip' => 'ip_id',
 208             'expires_on' => time() + 1000,
 209             'username' => 'johndoe',
 210             'visibility' => 'public',
 211             'untaggedonly' => true,
 212         ];
 213         $this->sessionManager->logout();
 214
 215         $this->assertArrayNotHasKey('ip', $this->session);
 216         $this->assertArrayNotHasKey('expires_on', $this->session);
 217         $this->assertArrayNotHasKey('username', $this->session);
 218         $this->assertArrayNotHasKey('visibility', $this->session);
 219         $this->assertArrayHasKey('untaggedonly', $this->session);
 220         $this->assertTrue($this->session['untaggedonly']);
 221     }
 222
 223     /**
 224      * The session is active and expiration time has been reached
 225      */
 226     public function testHasExpiredTimeElapsed()
 227     {
 228         $this->session['expires_on'] = time() - 10;
 229
 230         $this->assertTrue($this->sessionManager->hasSessionExpired());
 231     }
 232
 233     /**
 234      * The session is active and expiration time has not been reached
 235      */
 236     public function testHasNotExpired()
 237     {
 238         $this->session['expires_on'] = time() + 1000;
 239
 240         $this->assertFalse($this->sessionManager->hasSessionExpired());
 241     }
 242
 243     /**
 244      * Session hijacking protection is disabled, we assume the IP has not changed
 245      */
 246     public function testHasClientIpChangedNoSessionProtection()
 247     {
 248         $this->conf->set('security.session_protection_disabled', true);
 249
 250         $this->assertFalse($this->sessionManager->hasClientIpChanged(''));
 251     }
 252
 253     /**
 254      * The client IP identifier has not changed
 255      */
 256     public function testHasClientIpChangedNope()
 257     {
 258         $this->session['ip'] = 'ip_id';
 259         $this->assertFalse($this->sessionManager->hasClientIpChanged('ip_id'));
 260     }
 261
 262     /**
 263      * The client IP identifier has changed
 264      */
 265     public function testHasClientIpChanged()
 266     {
 267         $this->session['ip'] = 'ip_id_one';
 268         $this->assertTrue($this->sessionManager->hasClientIpChanged('ip_id_two'));
 269     }
 270
 271     /**
 272      * Test creating an entry in the session array
 273      */
 274     public function testSetSessionParameterCreate(): void
 275     {
 276         $this->sessionManager->setSessionParameter('abc', 'def');
 277
 278         static::assertSame('def', $this->session['abc']);
 279     }
 280
 281     /**
 282      * Test updating an entry in the session array
 283      */
 284     public function testSetSessionParameterUpdate(): void
 285     {
 286         $this->session['abc'] = 'ghi';
 287
 288         $this->sessionManager->setSessionParameter('abc', 'def');
 289
 290         static::assertSame('def', $this->session['abc']);
 291     }
 292
 293     /**
 294      * Test updating an entry in the session array with null value
 295      */
 296     public function testSetSessionParameterUpdateNull(): void
 297     {
 298         $this->session['abc'] = 'ghi';
 299
 300         $this->sessionManager->setSessionParameter('abc', null);
 301
 302         static::assertArrayHasKey('abc', $this->session);
 303         static::assertNull($this->session['abc']);
 304     }
 305
 306     /**
 307      * Test deleting an existing entry in the session array
 308      */
 309     public function testDeleteSessionParameter(): void
 310     {
 311         $this->session['abc'] = 'def';
 312
 313         $this->sessionManager->deleteSessionParameter('abc');
 314
 315         static::assertArrayNotHasKey('abc', $this->session);
 316     }
 317
 318     /**
 319      * Test deleting a non existent entry in the session array
 320      */
 321     public function testDeleteSessionParameterNotExisting(): void
 322     {
 323         $this->sessionManager->deleteSessionParameter('abc');
 324
 325         static::assertArrayNotHasKey('abc', $this->session);
 326     }
 327 }