tests/Session/Middleware/AuthenticateSessionTest.php - 13.x - githubmirror/framework

tests/Session/Middleware/AuthenticateSessionTest.php
357 строк14 KB
Jason McCreary
[13.x] Mockery cleanup (#61117)
10 авг 2026, 20:23
10 авг 2026, 20:232ee40ee
<?php

namespace Illuminate\Tests\Session\Middleware;

use BadMethodCallException;
use Illuminate\Auth\AuthenticationException;
use Illuminate\Contracts\Auth\Factory as AuthFactory;
use Illuminate\Http\Request;
use Illuminate\Session\ArraySessionHandler;
use Illuminate\Session\Middleware\AuthenticateSession;
use Illuminate\Session\Store;
use Mockery;
use PHPUnit\Framework\TestCase;

class AuthenticateSessionTest extends TestCase
{
    public function test_handle_without_session()
    {
        $request = new Request;
        $next = fn () => 'next-1';

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->shouldReceive('viaRemember')->never();

        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, $next);
        $this->assertSame('next-1', $response);
    }

    public function test_handle_with_session_without_request_user()
    {
        $request = new Request;

        // set session:
        $request->setLaravelSession(new Store('name', new ArraySessionHandler(1)));

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->shouldReceive('viaRemember')->never();

        $next = fn () => 'next-2';
        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, $next);
        $this->assertSame('next-2', $response);
    }

    public function test_handle_with_session_without_auth_password()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return null;
            }
        };

        $request = new Request;

        // set session:
        $request->setLaravelSession(new Store('name', new ArraySessionHandler(1)));
        // set a password-less user:
        $request->setUserResolver(fn () => $user);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->shouldReceive('viaRemember')->never();

        $next = fn () => 'next-3';
        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, $next);

        $this->assertSame('next-3', $response);
    }

    public function test_handle_with_session_with_user_auth_password_on_request_via_remember_false()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        $request = new Request;
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(false);
        $authFactory->expects('getDefaultDriver')->times(3)->andReturn('web');
        $authFactory->expects('user')->andReturn(null);
        // expected MAC for current password when storing in session:
        $authFactory->expects('hashPasswordForCookie')->times(2)->with('my-pass-(*&^%$#!@')->andReturn('mac:my-pass-(*&^%$#!@');

        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, fn () => 'next-4');

        $this->assertSame('mac:my-pass-(*&^%$#!@', $session->get('password_hash_web'));
        $this->assertSame('next-4', $response);
    }

    public function test_handle_with_invalid_password_hash()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        $request = new Request(cookies: ['recaller-name' => 'a|b|invalid-mac']);
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $session->put('a', '1');
        $session->put('b', '2');
        // set session:
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(true);
        $authFactory->expects('getRecallerName')->andReturn('recaller-name');
        $authFactory->expects('logoutCurrentDevice')->andReturn(null);
        $authFactory->expects('getDefaultDriver')->andReturn('web');
        // expected MAC for current password (won't match cookie):
        $authFactory->expects('hashPasswordForCookie')->with('my-pass-(*&^%$#!@')->andReturn('mac:my-pass-(*&^%$#!@');

        $this->assertNotNull($session->get('a'));
        $this->assertNotNull($session->get('b'));
        AuthenticateSession::redirectUsing(fn ($request) => 'i-wanna-go-home');

        // act:
        $middleware = new AuthenticateSession($authFactory);

        $message = '';
        try {
            $middleware->handle($request, fn () => 'next-7');
        } catch (AuthenticationException $e) {
            $message = $e->getMessage();
            $this->assertSame('i-wanna-go-home', $e->redirectTo($request));
        }
        $this->assertSame('Unauthenticated.', $message);

        // ensure session is flushed:
        $this->assertNull($session->get('a'));
        $this->assertNull($session->get('b'));
    }

    public function test_handle_with_invalid_incookie_password_hash_via_remember_true()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        $request = new Request(cookies: ['recaller-name' => 'a|b|invalid-mac']);
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $session->put('a', '1');
        $session->put('b', '2');
        // set session:
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(true);
        $authFactory->expects('getRecallerName')->andReturn('recaller-name');
        $authFactory->expects('logoutCurrentDevice');
        $authFactory->expects('getDefaultDriver')->andReturn('web');
        // expected MAC for current password (won't match cookie):
        $authFactory->expects('hashPasswordForCookie')->with('my-pass-(*&^%$#!@')->andReturn('mac:my-pass-(*&^%$#!@');

        $middleware = new AuthenticateSession($authFactory);
        // act:
        try {
            $message = '';
            $middleware->handle($request, fn () => 'next-6');
        } catch (AuthenticationException $e) {
            $message = $e->getMessage();
        }
        $this->assertSame('Unauthenticated.', $message);

        // ensure session is flushed
        $this->assertNull($session->get('password_hash_web'));
        $this->assertNull($session->get('a'));
        $this->assertNull($session->get('b'));
    }

    public function test_handle_with_valid_incookie_invalid_insession_hash_via_remember_true()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        $request = new Request(cookies: ['recaller-name' => 'a|b|mac:my-pass-(*&^%$#!@']);
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $session->put('a', '1');
        $session->put('b', '2');
        $session->put('password_hash_web', 'invalid-password');
        // set session on the request:
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(true);
        $authFactory->expects('getRecallerName')->andReturn('recaller-name');
        $authFactory->expects('logoutCurrentDevice')->andReturn(null);
        $authFactory->expects('getDefaultDriver')->times(3)->andReturn('web');
        // expected MAC for current password (matches cookie but not session):
        $authFactory->expects('hashPasswordForCookie')->times(2)->with('my-pass-(*&^%$#!@')->andReturn('mac:my-pass-(*&^%$#!@');

        // act:
        $middleware = new AuthenticateSession($authFactory);
        try {
            $message = '';
            $middleware->handle($request, fn () => 'next-7');
        } catch (AuthenticationException $e) {
            $message = $e->getMessage();
        }
        $this->assertSame('Unauthenticated.', $message);

        // ensure session is flushed:
        $this->assertNull($session->get('password_hash_web'));
        $this->assertNull($session->get('a'));
        $this->assertNull($session->get('b'));
    }

    public function test_handle_with_valid_password_in_session_cookie_is_empty_guard_has_user()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        $request = new Request(cookies: ['recaller-name' => 'a|b']);
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $session->put('a', '1');
        $session->put('b', '2');
        $session->put('password_hash_web', 'mac:my-pass-(*&^%$#!@');
        // set session on the request:
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(false);
        $authFactory->shouldReceive('getRecallerName')->never();
        $authFactory->shouldReceive('logoutCurrentDevice')->never();
        $authFactory->expects('getDefaultDriver')->times(3)->andReturn('web');
        $authFactory->expects('user')->andReturn($user);
        // expected MAC for current password:
        $authFactory->expects('hashPasswordForCookie')->times(2)->with('my-pass-(*&^%$#!@')->andReturn('mac:my-pass-(*&^%$#!@');

        // act:
        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, fn () => 'next-8');

        $this->assertSame('next-8', $response);
        // ensure session is flushed:
        $this->assertSame('mac:my-pass-(*&^%$#!@', $session->get('password_hash_web'));
        $this->assertSame('1', $session->get('a'));
        $this->assertSame('2', $session->get('b'));
    }

    public function test_handle_with_old_format_cookie_for_backward_compatibility()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        // Cookie contains OLD format (raw password hash, not HMAC)
        $request = new Request(cookies: ['recaller-name' => 'a|b|my-pass-(*&^%$#!@']);
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $session->put('a', '1');
        $session->put('b', '2');
        // Session also contains old format for this test
        $session->put('password_hash_web', 'my-pass-(*&^%$#!@');
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(true);
        $authFactory->expects('getRecallerName')->andReturn('recaller-name');
        $authFactory->expects('getDefaultDriver')->times(3)->andReturn('web');
        $authFactory->expects('user')->andReturn($user);
        // The HMAC won't match the old format, but fallback to raw hash should work
        $authFactory->expects('hashPasswordForCookie')->times(3)->with('my-pass-(*&^%$#!@')->andReturn('mac:my-pass-(*&^%$#!@');

        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, fn () => 'next-9');

        // Should succeed because of backward compatibility fallback
        $this->assertSame('next-9', $response);
        // Session should be updated to new format (HMAC)
        $this->assertSame('mac:my-pass-(*&^%$#!@', $session->get('password_hash_web'));
        $this->assertSame('1', $session->get('a'));
        $this->assertSame('2', $session->get('b'));
    }

    public function test_handle_with_old_format_cookie_and_legacy_guard()
    {
        $user = new class
        {
            public function getAuthPassword()
            {
                return 'my-pass-(*&^%$#!@';
            }
        };

        // Cookie contains OLD format (raw password hash, not HMAC)
        $request = new Request(cookies: ['recaller-name' => 'a|b|my-pass-(*&^%$#!@']);
        $request->setUserResolver(fn () => $user);

        $session = new Store('name', new ArraySessionHandler(1));
        $session->put('a', '1');
        $session->put('b', '2');
        // Session also contains old format for this test
        $session->put('password_hash_web', 'my-pass-(*&^%$#!@');
        $request->setLaravelSession($session);

        $authFactory = Mockery::mock(AuthFactory::class);
        $authFactory->expects('viaRemember')->andReturn(true);
        $authFactory->expects('getRecallerName')->andReturn('recaller-name');
        $authFactory->expects('getDefaultDriver')->times(3)->andReturn('web');
        $authFactory->expects('user')->andReturn($user);
        // For legacy guards without hashPasswordForCookie method, we use fallback to raw hash
        $authFactory->expects('hashPasswordForCookie')->times(3)->andThrowExceptions([new BadMethodCallException]);

        $middleware = new AuthenticateSession($authFactory);
        $response = $middleware->handle($request, fn () => 'next-9');

        // Should succeed because of backward compatibility fallback
        $this->assertSame('next-9', $response);
        // Session should stay intact
        $this->assertSame('my-pass-(*&^%$#!@', $session->get('password_hash_web'));
        $this->assertSame('1', $session->get('a'));
        $this->assertSame('2', $session->get('b'));
    }
}