From 18e6796726d73d7dc90ecdd16c181493941f5487 Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Thu, 15 Dec 2016 10:13:00 +0100 Subject: REST API structure using Slim framework * REST API routes are handle by Slim. * Every API controller go through ApiMiddleware which handles security. * First service implemented `/info`, for tests purpose. --- tests/api/ApiMiddlewareTest.php | 184 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 184 insertions(+) create mode 100644 tests/api/ApiMiddlewareTest.php (limited to 'tests/api/ApiMiddlewareTest.php') diff --git a/tests/api/ApiMiddlewareTest.php b/tests/api/ApiMiddlewareTest.php new file mode 100644 index 00000000..4d4dd9b9 --- /dev/null +++ b/tests/api/ApiMiddlewareTest.php @@ -0,0 +1,184 @@ +conf = new \ConfigManager('tests/utils/config/configJson.json.php'); + $this->conf->set('api.secret', 'NapoleonWasALizard'); + + $this->refDB = new \ReferenceLinkDB(); + $this->refDB->write(self::$testDatastore); + + $this->container = new Container(); + $this->container['conf'] = $this->conf; + } + + /** + * After every test, remove the test datastore. + */ + public function tearDown() + { + @unlink(self::$testDatastore); + } + + /** + * Invoke the middleware with the API disabled: + * should return a 401 error Unauthorized. + */ + public function testInvokeMiddlewareApiDisabled() + { + $this->conf->set('api.enabled', false); + $mw = new ApiMiddleware($this->container); + $env = Environment::mock([ + 'REQUEST_METHOD' => 'GET', + 'REQUEST_URI' => '/echo', + ]); + $request = Request::createFromEnvironment($env); + $response = new Response(); + /** @var Response $response */ + $response = $mw($request, $response, null); + + $this->assertEquals(401, $response->getStatusCode()); + $body = json_decode((string) $response->getBody()); + $this->assertEquals('Not authorized', $body); + } + + /** + * Invoke the middleware with the API disabled in debug mode: + * should return a 401 error Unauthorized - with a specific message and a stacktrace. + */ + public function testInvokeMiddlewareApiDisabledDebug() + { + $this->conf->set('api.enabled', false); + $this->conf->set('dev.debug', true); + $mw = new ApiMiddleware($this->container); + $env = Environment::mock([ + 'REQUEST_METHOD' => 'GET', + 'REQUEST_URI' => '/echo', + ]); + $request = Request::createFromEnvironment($env); + $response = new Response(); + /** @var Response $response */ + $response = $mw($request, $response, null); + + $this->assertEquals(401, $response->getStatusCode()); + $body = json_decode((string) $response->getBody()); + $this->assertEquals('Not authorized: API is disabled', $body->message); + $this->assertContains('ApiAuthorizationException', $body->stacktrace); + } + + /** + * Invoke the middleware without a token (debug): + * should return a 401 error Unauthorized - with a specific message and a stacktrace. + */ + public function testInvokeMiddlewareNoTokenProvidedDebug() + { + $this->conf->set('dev.debug', true); + $mw = new ApiMiddleware($this->container); + $env = Environment::mock([ + 'REQUEST_METHOD' => 'GET', + 'REQUEST_URI' => '/echo', + ]); + $request = Request::createFromEnvironment($env); + $response = new Response(); + /** @var Response $response */ + $response = $mw($request, $response, null); + + $this->assertEquals(401, $response->getStatusCode()); + $body = json_decode((string) $response->getBody()); + $this->assertEquals('Not authorized: JWT token not provided', $body->message); + $this->assertContains('ApiAuthorizationException', $body->stacktrace); + } + + /** + * Invoke the middleware without a secret set in settings (debug): + * should return a 401 error Unauthorized - with a specific message and a stacktrace. + */ + public function testInvokeMiddlewareNoSecretSetDebug() + { + $this->conf->set('dev.debug', true); + $this->conf->set('api.secret', ''); + $mw = new ApiMiddleware($this->container); + $env = Environment::mock([ + 'REQUEST_METHOD' => 'GET', + 'REQUEST_URI' => '/echo', + 'HTTP_JWT'=> 'jwt', + ]); + $request = Request::createFromEnvironment($env); + $response = new Response(); + /** @var Response $response */ + $response = $mw($request, $response, null); + + $this->assertEquals(401, $response->getStatusCode()); + $body = json_decode((string) $response->getBody()); + $this->assertEquals('Not authorized: Token secret must be set in Shaarli\'s administration', $body->message); + $this->assertContains('ApiAuthorizationException', $body->stacktrace); + } + + /** + * Invoke the middleware without an invalid JWT token (debug): + * should return a 401 error Unauthorized - with a specific message and a stacktrace. + * + * Note: specific JWT errors tests are handled in ApiUtilsTest. + */ + public function testInvokeMiddlewareInvalidJwtDebug() + { + $this->conf->set('dev.debug', true); + $mw = new ApiMiddleware($this->container); + $env = Environment::mock([ + 'REQUEST_METHOD' => 'GET', + 'REQUEST_URI' => '/echo', + 'HTTP_JWT'=> 'bad jwt', + ]); + $request = Request::createFromEnvironment($env); + $response = new Response(); + /** @var Response $response */ + $response = $mw($request, $response, null); + + $this->assertEquals(401, $response->getStatusCode()); + $body = json_decode((string) $response->getBody()); + $this->assertEquals('Not authorized: Malformed JWT token', $body->message); + $this->assertContains('ApiAuthorizationException', $body->stacktrace); + } +} -- cgit v1.2.3 From 63ef549749fac9d0e302842f06e7794d1daabc13 Mon Sep 17 00:00:00 2001 From: VirtualTam Date: Sat, 7 Jan 2017 22:23:47 +0100 Subject: API: expect JWT in the Authorization header Relates to https://github.com/shaarli/Shaarli/pull/731 Added: - require the presence of the 'Authorization' header Changed: - use the HTTP Bearer Token authorization schema See: - https://jwt.io/introduction/#how-do-json-web-tokens-work- - https://tools.ietf.org/html/rfc6750 - http://security.stackexchange.com/q/108662 Signed-off-by: VirtualTam --- tests/api/ApiMiddlewareTest.php | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) (limited to 'tests/api/ApiMiddlewareTest.php') diff --git a/tests/api/ApiMiddlewareTest.php b/tests/api/ApiMiddlewareTest.php index 4d4dd9b9..d9753b1d 100644 --- a/tests/api/ApiMiddlewareTest.php +++ b/tests/api/ApiMiddlewareTest.php @@ -143,7 +143,7 @@ class ApiMiddlewareTest extends \PHPUnit_Framework_TestCase $env = Environment::mock([ 'REQUEST_METHOD' => 'GET', 'REQUEST_URI' => '/echo', - 'HTTP_JWT'=> 'jwt', + 'HTTP_AUTHORIZATION'=> 'Bearer jwt', ]); $request = Request::createFromEnvironment($env); $response = new Response(); @@ -157,7 +157,30 @@ class ApiMiddlewareTest extends \PHPUnit_Framework_TestCase } /** - * Invoke the middleware without an invalid JWT token (debug): + * Invoke the middleware with an invalid JWT token header + */ + public function testInvalidJwtAuthHeaderDebug() + { + $this->conf->set('dev.debug', true); + $mw = new ApiMiddleware($this->container); + $env = Environment::mock([ + 'REQUEST_METHOD' => 'GET', + 'REQUEST_URI' => '/echo', + 'HTTP_AUTHORIZATION'=> 'PolarBearer jwt', + ]); + $request = Request::createFromEnvironment($env); + $response = new Response(); + /** @var Response $response */ + $response = $mw($request, $response, null); + + $this->assertEquals(401, $response->getStatusCode()); + $body = json_decode((string) $response->getBody()); + $this->assertEquals('Not authorized: Invalid JWT header', $body->message); + $this->assertContains('ApiAuthorizationException', $body->stacktrace); + } + + /** + * Invoke the middleware with an invalid JWT token (debug): * should return a 401 error Unauthorized - with a specific message and a stacktrace. * * Note: specific JWT errors tests are handled in ApiUtilsTest. @@ -169,7 +192,7 @@ class ApiMiddlewareTest extends \PHPUnit_Framework_TestCase $env = Environment::mock([ 'REQUEST_METHOD' => 'GET', 'REQUEST_URI' => '/echo', - 'HTTP_JWT'=> 'bad jwt', + 'HTTP_AUTHORIZATION'=> 'Bearer jwt', ]); $request = Request::createFromEnvironment($env); $response = new Response(); -- cgit v1.2.3 From 3c66e56435359dc678048193e8ee239d06f79b64 Mon Sep 17 00:00:00 2001 From: VirtualTam Date: Fri, 3 Mar 2017 23:06:12 +0100 Subject: application: introduce the Shaarli\Config namespace Namespaces have been introduced with the REST API, and should be generalized to the whole codebase to manage object scope and benefit from autoloading. See: - https://secure.php.net/manual/en/language.namespaces.php - http://www.php-fig.org/psr/psr-4/ Signed-off-by: VirtualTam --- tests/api/ApiMiddlewareTest.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'tests/api/ApiMiddlewareTest.php') diff --git a/tests/api/ApiMiddlewareTest.php b/tests/api/ApiMiddlewareTest.php index d9753b1d..23a56b1c 100644 --- a/tests/api/ApiMiddlewareTest.php +++ b/tests/api/ApiMiddlewareTest.php @@ -1,7 +1,8 @@ conf = new \ConfigManager('tests/utils/config/configJson.json.php'); + $this->conf = new ConfigManager('tests/utils/config/configJson.json.php'); $this->conf->set('api.secret', 'NapoleonWasALizard'); $this->refDB = new \ReferenceLinkDB(); -- cgit v1.2.3