tests/security/SessionManagerTest.php

   1 <?php
   2 require_once 'tests/utils/FakeConfigManager.php';
   3
   4 // Initialize reference data _before_ PHPUnit starts a session
   5 require_once 'tests/utils/ReferenceSessionIdHashes.php';
   6 ReferenceSessionIdHashes::genAllHashes();
   7
   8 use \Shaarli\Security\SessionManager;
   9 use \PHPUnit\Framework\TestCase;
  10
  11 /**
  12  * Test coverage for SessionManager
  13  */
  14 class SessionManagerTest extends TestCase
  15 {
  16     /** @var array Session ID hashes */
  17     protected static $sidHashes = null;
  18
  19     /** @var \FakeConfigManager ConfigManager substitute for testing */
  20     protected $conf = null;
  21
  22     /** @var array $_SESSION array for testing */
  23     protected $session = [];
  24
  25     /** @var SessionManager Server-side session management abstraction */
  26     protected $sessionManager = null;
  27
  28     /**
  29      * Assign reference data
  30      */
  31     public static function setUpBeforeClass()
  32     {
  33         self::$sidHashes = ReferenceSessionIdHashes::getHashes();
  34     }
  35
  36     /**
  37      * Initialize or reset test resources
  38      */
  39     public function setUp()
  40     {
  41         $this->conf = new FakeConfigManager([
  42             'credentials.login' => 'johndoe',
  43             'credentials.salt' => 'salt',
  44             'security.session_protection_disabled' => false,
  45         ]);
  46         $this->session = [];
  47         $this->sessionManager = new SessionManager($this->session, $this->conf);
  48     }
  49
  50     /**
  51      * Generate a session token
  52      */
  53     public function testGenerateToken()
  54     {
  55         $token = $this->sessionManager->generateToken();
  56
  57         $this->assertEquals(1, $this->session['tokens'][$token]);
  58         $this->assertEquals(40, strlen($token));
  59     }
  60
  61     /**
  62      * Check a session token
  63      */
  64     public function testCheckToken()
  65     {
  66         $token = '4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b';
  67         $session = [
  68             'tokens' => [
  69                 $token => 1,
  70             ],
  71         ];
  72         $sessionManager = new SessionManager($session, $this->conf);
  73
  74         // check and destroy the token
  75         $this->assertTrue($sessionManager->checkToken($token));
  76         $this->assertFalse(isset($session['tokens'][$token]));
  77
  78         // ensure the token has been destroyed
  79         $this->assertFalse($sessionManager->checkToken($token));
  80     }
  81
  82     /**
  83      * Generate and check a session token
  84      */
  85     public function testGenerateAndCheckToken()
  86     {
  87         $token = $this->sessionManager->generateToken();
  88
  89         // ensure a token has been generated
  90         $this->assertEquals(1, $this->session['tokens'][$token]);
  91         $this->assertEquals(40, strlen($token));
  92
  93         // check and destroy the token
  94         $this->assertTrue($this->sessionManager->checkToken($token));
  95         $this->assertFalse(isset($this->session['tokens'][$token]));
  96
  97         // ensure the token has been destroyed
  98         $this->assertFalse($this->sessionManager->checkToken($token));
  99     }
 100
 101     /**
 102      * Check an invalid session token
 103      */
 104     public function testCheckInvalidToken()
 105     {
 106         $this->assertFalse($this->sessionManager->checkToken('4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b'));
 107     }
 108
 109     /**
 110      * Test SessionManager::checkId with a valid ID - TEST ALL THE HASHES!
 111      *
 112      * This tests extensively covers all hash algorithms / bit representations
 113      */
 114     public function testIsAnyHashSessionIdValid()
 115     {
 116         foreach (self::$sidHashes as $algo => $bpcs) {
 117             foreach ($bpcs as $bpc => $hash) {
 118                 $this->assertTrue(SessionManager::checkId($hash));
 119             }
 120         }
 121     }
 122
 123     /**
 124      * Test checkId with a valid ID - SHA-1 hashes
 125      */
 126     public function testIsSha1SessionIdValid()
 127     {
 128         $this->assertTrue(SessionManager::checkId(sha1('shaarli')));
 129     }
 130
 131     /**
 132      * Test checkId with a valid ID - SHA-256 hashes
 133      */
 134     public function testIsSha256SessionIdValid()
 135     {
 136         $this->assertTrue(SessionManager::checkId(hash('sha256', 'shaarli')));
 137     }
 138
 139     /**
 140      * Test checkId with a valid ID - SHA-512 hashes
 141      */
 142     public function testIsSha512SessionIdValid()
 143     {
 144         $this->assertTrue(SessionManager::checkId(hash('sha512', 'shaarli')));
 145     }
 146
 147     /**
 148      * Test checkId with invalid IDs.
 149      */
 150     public function testIsSessionIdInvalid()
 151     {
 152         $this->assertFalse(SessionManager::checkId(''));
 153         $this->assertFalse(SessionManager::checkId([]));
 154         $this->assertFalse(
 155             SessionManager::checkId('c0ZqcWF3VFE2NmJBdm1HMVQ0ZHJ3UmZPbTFsNGhkNHI=')
 156         );
 157     }
 158
 159     /**
 160      * Store login information after a successful login
 161      */
 162     public function testStoreLoginInfo()
 163     {
 164         $this->sessionManager->storeLoginInfo('ip_id');
 165
 166         $this->assertGreaterThan(time(), $this->session['expires_on']);
 167         $this->assertEquals('ip_id', $this->session['ip']);
 168         $this->assertEquals('johndoe', $this->session['username']);
 169     }
 170
 171     /**
 172      * Extend a server-side session by SessionManager::$SHORT_TIMEOUT
 173      */
 174     public function testExtendSession()
 175     {
 176         $this->sessionManager->extendSession();
 177
 178         $this->assertGreaterThan(time(), $this->session['expires_on']);
 179         $this->assertLessThanOrEqual(
 180             time() + SessionManager::$SHORT_TIMEOUT,
 181             $this->session['expires_on']
 182         );
 183     }
 184
 185     /**
 186      * Extend a server-side session by SessionManager::$LONG_TIMEOUT
 187      */
 188     public function testExtendSessionStaySignedIn()
 189     {
 190         $this->sessionManager->setStaySignedIn(true);
 191         $this->sessionManager->extendSession();
 192
 193         $this->assertGreaterThan(time(), $this->session['expires_on']);
 194         $this->assertGreaterThan(
 195             time() + SessionManager::$LONG_TIMEOUT - 10,
 196             $this->session['expires_on']
 197         );
 198         $this->assertLessThanOrEqual(
 199             time() + SessionManager::$LONG_TIMEOUT,
 200             $this->session['expires_on']
 201         );
 202     }
 203
 204     /**
 205      * Unset session variables after logging out
 206      */
 207     public function testLogout()
 208     {
 209         $this->session = [
 210             'ip' => 'ip_id',
 211             'expires_on' => time() + 1000,
 212             'username' => 'johndoe',
 213             'visibility' => 'public',
 214             'untaggedonly' => false,
 215         ];
 216         $this->sessionManager->logout();
 217
 218         $this->assertFalse(isset($this->session['ip']));
 219         $this->assertFalse(isset($this->session['expires_on']));
 220         $this->assertFalse(isset($this->session['username']));
 221         $this->assertFalse(isset($this->session['visibility']));
 222         $this->assertFalse(isset($this->session['untaggedonly']));
 223     }
 224
 225     /**
 226      * The session is active and expiration time has been reached
 227      */
 228     public function testHasExpiredTimeElapsed()
 229     {
 230         $this->session['expires_on'] = time() - 10;
 231
 232         $this->assertTrue($this->sessionManager->hasSessionExpired());
 233     }
 234
 235     /**
 236      * The session is active and expiration time has not been reached
 237      */
 238     public function testHasNotExpired()
 239     {
 240         $this->session['expires_on'] = time() + 1000;
 241
 242         $this->assertFalse($this->sessionManager->hasSessionExpired());
 243     }
 244
 245     /**
 246      * Session hijacking protection is disabled, we assume the IP has not changed
 247      */
 248     public function testHasClientIpChangedNoSessionProtection()
 249     {
 250         $this->conf->set('security.session_protection_disabled', true);
 251
 252         $this->assertFalse($this->sessionManager->hasClientIpChanged(''));
 253     }
 254
 255     /**
 256      * The client IP identifier has not changed
 257      */
 258     public function testHasClientIpChangedNope()
 259     {
 260         $this->session['ip'] = 'ip_id';
 261         $this->assertFalse($this->sessionManager->hasClientIpChanged('ip_id'));
 262     }
 263
 264     /**
 265      * The client IP identifier has changed
 266      */
 267     public function testHasClientIpChanged()
 268     {
 269         $this->session['ip'] = 'ip_id_one';
 270         $this->assertTrue($this->sessionManager->hasClientIpChanged('ip_id_two'));
 271     }
 272 }