Объединены сущности для авторизации посредством JWT токенов и токенов, выданных через oAuth2.

Все действия, связанные с аккаунтами, теперь вызываются через url `/api/v1/accounts/<id>/<action>`.
Добавлена вменяемая система разграничения прав на основе RBAC.
Теперь oAuth2 токены генерируются как случайная строка в 40 символов длинной, а не UUID.
Исправлен баг с неправильным временем жизни токена в ответе успешного запроса аутентификации.
Теперь все unit тесты можно успешно прогнать без наличия интернета.

tests/codeception/api/unit/models/profile/AcceptRulesFormTest.php

@@ -1,26 +0,0 @@
-<?php
-namespace codeception\api\unit\models\profile;
-
-use api\models\profile\AcceptRulesForm;
-use common\models\Account;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-use const common\LATEST_RULES_VERSION;
-
-class AcceptRulesFormTest extends TestCase {
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class,
-        ];
-    }
-
-    public function testAgreeWithLatestRules() {
-        /** @var Account $account */
-        $account = Account::findOne($this->tester->grabFixture('accounts', 'account-with-old-rules-version'));
-        $model = new AcceptRulesForm($account);
-        $this->assertTrue($model->agreeWithLatestRules());
-        $this->assertEquals(LATEST_RULES_VERSION, $account->rules_agreement_version);
-    }
-
-}

tests/codeception/api/unit/models/profile/ChangeEmail/ConfirmNewEmailFormTest.php

@@ -1,53 +0,0 @@
-<?php
-namespace codeception\api\unit\models\profile\ChangeEmail;
-
-use api\models\profile\ChangeEmail\ConfirmNewEmailForm;
-use common\models\Account;
-use common\models\EmailActivation;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-use tests\codeception\common\fixtures\EmailActivationFixture;
-
-class ConfirmNewEmailFormTest extends TestCase {
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class,
-            'emailActivations' => EmailActivationFixture::class,
-        ];
-    }
-
-    public function testChangeEmail() {
-        /** @var Account $account */
-        $account = Account::findOne($this->getAccountId());
-        $newEmailConfirmationFixture = $this->tester->grabFixture('emailActivations', 'newEmailConfirmation');
-        $model = new ConfirmNewEmailForm($account, [
-            'key' => $newEmailConfirmationFixture['key'],
-        ]);
-        $this->assertTrue($model->changeEmail());
-        $this->assertNull(EmailActivation::findOne([
-            'account_id' => $account->id,
-            'type' => EmailActivation::TYPE_NEW_EMAIL_CONFIRMATION,
-        ]));
-        $data = unserialize($newEmailConfirmationFixture['_data']);
-        $this->assertEquals($data['newEmail'], $account->email);
-        $this->tester->canSeeAmqpMessageIsCreated('events');
-    }
-
-    public function testCreateTask() {
-        /** @var Account $account */
-        $account = Account::findOne($this->getAccountId());
-        $model = new ConfirmNewEmailForm($account);
-        $model->createTask(1, 'test1@ely.by', 'test@ely.by');
-        $message = $this->tester->grabLastSentAmqpMessage('events');
-        $body = json_decode($message->getBody(), true);
-        $this->assertEquals(1, $body['accountId']);
-        $this->assertEquals('test1@ely.by', $body['newEmail']);
-        $this->assertEquals('test@ely.by', $body['oldEmail']);
-    }
-
-    private function getAccountId() {
-        return $this->tester->grabFixture('accounts', 'account-with-change-email-finish-state')['id'];
-    }
-
-}

tests/codeception/api/unit/models/profile/ChangeEmail/InitStateFormTest.php

@@ -1,45 +0,0 @@
-<?php
-namespace codeception\api\unit\models\profile\ChangeEmail;
-
-use api\models\profile\ChangeEmail\InitStateForm;
-use common\models\Account;
-use common\models\confirmations\CurrentEmailConfirmation;
-use common\models\EmailActivation;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-use tests\codeception\common\fixtures\EmailActivationFixture;
-
-class InitStateFormTest extends TestCase {
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class,
-            'emailActivations' => EmailActivationFixture::class,
-        ];
-    }
-
-    public function testCreateCode() {
-        /** @var Account $account */
-        $account = $this->tester->grabFixture('accounts', 'admin');
-        $model = new InitStateForm($account);
-        $activationModel = $model->createCode();
-        $this->assertInstanceOf(CurrentEmailConfirmation::class, $activationModel);
-        $this->assertEquals($account->id, $activationModel->account_id);
-        $this->assertNotNull(EmailActivation::findOne($activationModel->key));
-    }
-
-    public function testSendCurrentEmailConfirmation() {
-        /** @var Account $account */
-        $account = $this->tester->grabFixture('accounts', 'admin');
-        $model = new InitStateForm($account, [
-            'password' => 'password_0',
-        ]);
-        $this->assertTrue($model->sendCurrentEmailConfirmation());
-        $this->assertTrue(EmailActivation::find()->andWhere([
-            'account_id' => $account->id,
-            'type' => EmailActivation::TYPE_CURRENT_EMAIL_CONFIRMATION,
-        ])->exists());
-        $this->tester->canSeeEmailIsSent();
-    }
-
-}

tests/codeception/api/unit/models/profile/ChangeEmail/NewEmailFormTest.php

@@ -1,51 +0,0 @@
-<?php
-namespace codeception\api\unit\models\profile\ChangeEmail;
-
-use api\models\profile\ChangeEmail\NewEmailForm;
-use common\models\Account;
-use common\models\confirmations\NewEmailConfirmation;
-use common\models\EmailActivation;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-use tests\codeception\common\fixtures\EmailActivationFixture;
-
-class NewEmailFormTest extends TestCase {
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class,
-            'emailActivations' => EmailActivationFixture::class,
-        ];
-    }
-
-    public function testCreateCode() {
-        /** @var Account $account */
-        $account = $this->tester->grabFixture('accounts', 'admin');
-        $model = new NewEmailForm($account);
-        $model->email = 'my-new-email@ely.by';
-        $activationModel = $model->createCode();
-        $this->assertInstanceOf(NewEmailConfirmation::class, $activationModel);
-        $this->assertEquals($account->id, $activationModel->account_id);
-        $this->assertEquals($model->email, $activationModel->newEmail);
-        $this->assertNotNull(EmailActivation::findOne($activationModel->key));
-    }
-
-    public function testSendNewEmailConfirmation() {
-        /** @var Account $account */
-        $account = $this->tester->grabFixture('accounts', 'account-with-change-email-init-state');
-        /** @var NewEmailForm $model */
-        $key = $this->tester->grabFixture('emailActivations', 'currentChangeEmailConfirmation')['key'];
-        $model = new NewEmailForm($account, [
-            'key' => $key,
-            'email' => 'my-new-email@ely.by',
-        ]);
-        $this->assertTrue($model->sendNewEmailConfirmation());
-        $this->assertNull(EmailActivation::findOne($key));
-        $this->assertNotNull(EmailActivation::findOne([
-            'account_id' => $account->id,
-            'type' => EmailActivation::TYPE_NEW_EMAIL_CONFIRMATION,
-        ]));
-        $this->tester->canSeeEmailIsSent();
-    }
-
-}

tests/codeception/api/unit/models/profile/ChangeLanguageFormTest.php

@@ -1,26 +0,0 @@
-<?php
-namespace codeception\api\unit\models\profile;
-
-use api\models\profile\ChangeLanguageForm;
-use common\models\Account;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-
-class ChangeLanguageFormTest extends TestCase {
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class
-        ];
-    }
-
-    public function testApplyLanguage() {
-        /** @var Account $account */
-        $account = $this->tester->grabFixture('accounts', 'admin');
-        $model = new ChangeLanguageForm($account);
-        $model->lang = 'ru';
-        $this->assertTrue($model->applyLanguage());
-        $this->assertEquals('ru', $account->lang);
-    }
-
-}

tests/codeception/api/unit/models/profile/ChangePasswordFormTest.php

@@ -1,135 +0,0 @@
-<?php
-namespace tests\codeception\api\models\profile;
-
-use api\components\User\Component;
-use api\models\AccountIdentity;
-use api\models\profile\ChangePasswordForm;
-use Codeception\Specify;
-use common\models\Account;
-use common\models\AccountSession;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-use tests\codeception\common\fixtures\AccountSessionFixture;
-use Yii;
-
-class ChangePasswordFormTest extends TestCase {
-    use Specify;
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class,
-            'accountSessions' => AccountSessionFixture::class,
-        ];
-    }
-
-    public function testValidatePasswordAndRePasswordMatch() {
-        $this->specify('error.rePassword_does_not_match expected if passwords not match', function() {
-            $account = new Account();
-            $account->setPassword('12345678');
-            $model = new ChangePasswordForm($account, [
-                'password' => '12345678',
-                'newPassword' => 'my-new-password',
-                'newRePassword' => 'another-password',
-            ]);
-            $model->validatePasswordAndRePasswordMatch('newRePassword');
-            expect($model->getErrors('newRePassword'))->equals(['error.rePassword_does_not_match']);
-        });
-
-        $this->specify('no errors expected if passwords are valid', function() {
-            $account = new Account();
-            $account->setPassword('12345678');
-            $model = new ChangePasswordForm($account, [
-                'password' => '12345678',
-                'newPassword' => 'my-new-password',
-                'newRePassword' => 'my-new-password',
-            ]);
-            $model->validatePasswordAndRePasswordMatch('newRePassword');
-            expect($model->getErrors('newRePassword'))->isEmpty();
-        });
-
-        $this->specify('error.rePassword_does_not_match expected even if there are errors on other attributes', function() {
-            // this is very important, because password change flow may be combined of two steps
-            // therefore we need to validate password sameness before we will validate current account password
-            $account = new Account();
-            $account->setPassword('12345678');
-            $model = new ChangePasswordForm($account, [
-                'newPassword' => 'my-new-password',
-                'newRePassword' => 'another-password',
-            ]);
-            $model->validate();
-            expect($model->getErrors('newRePassword'))->equals(['error.rePassword_does_not_match']);
-        });
-    }
-
-    public function testChangePassword() {
-        $this->specify('successfully change password with modern hash strategy', function() {
-            /** @var Account $account */
-            $account = Account::findOne($this->tester->grabFixture('accounts', 'admin')['id']);
-            $model = new ChangePasswordForm($account, [
-                'password' => 'password_0',
-                'newPassword' => 'my-new-password',
-                'newRePassword' => 'my-new-password',
-            ]);
-
-            $callTime = time();
-            expect('form should return true', $model->changePassword())->true();
-            expect('new password should be successfully stored into account', $account->validatePassword('my-new-password'))->true();
-            expect('password change time updated', $account->password_changed_at)->greaterOrEquals($callTime);
-        });
-
-        $this->specify('successfully change password with legacy hash strategy', function() {
-            /** @var Account $account */
-            $account = Account::findOne($this->tester->grabFixture('accounts', 'user-with-old-password-type')['id']);
-            $model = new ChangePasswordForm($account, [
-                'password' => '12345678',
-                'newPassword' => 'my-new-password',
-                'newRePassword' => 'my-new-password',
-            ]);
-
-            $callTime = time();
-            expect($model->changePassword())->true();
-            expect($account->validatePassword('my-new-password'))->true();
-            expect($account->password_changed_at)->greaterOrEquals($callTime);
-            expect($account->password_hash_strategy)->equals(Account::PASS_HASH_STRATEGY_YII2);
-        });
-    }
-
-    public function testChangePasswordWithLogout() {
-        /** @var Component|\PHPUnit_Framework_MockObject_MockObject $component */
-        $component = $this->getMockBuilder(Component::class)
-            ->setMethods(['getActiveSession', 'terminateSessions'])
-            ->setConstructorArgs([[
-                'identityClass' => AccountIdentity::class,
-                'enableSession' => false,
-                'loginUrl' => null,
-                'secret' => 'secret',
-            ]])
-            ->getMock();
-
-        /** @var AccountSession $session */
-        $session = AccountSession::findOne($this->tester->grabFixture('accountSessions', 'admin2')['id']);
-
-        $component
-            ->expects($this->any())
-            ->method('getActiveSession')
-            ->will($this->returnValue($session));
-
-        $component
-            ->expects($this->once())
-            ->method('terminateSessions');
-
-        Yii::$app->set('user', $component);
-
-        /** @var Account $account */
-        $account = $this->tester->grabFixture('accounts', 'admin');
-        $model = new ChangePasswordForm($account, [
-            'password' => 'password_0',
-            'newPassword' => 'my-new-password',
-            'newRePassword' => 'my-new-password',
-            'logoutAll' => true,
-        ]);
-
-        $this->assertTrue($model->changePassword());
-    }
-
-}

tests/codeception/api/unit/models/profile/ChangeUsernameFormTest.php

@@ -1,91 +0,0 @@
-<?php
-namespace tests\codeception\api\models\profile;
-
-use api\models\AccountIdentity;
-use api\models\profile\ChangeUsernameForm;
-use Codeception\Specify;
-use common\models\Account;
-use common\models\UsernameHistory;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\fixtures\AccountFixture;
-use tests\codeception\common\fixtures\UsernameHistoryFixture;
-use Yii;
-
-class ChangeUsernameFormTest extends TestCase {
-    use Specify;
-
-    public function _fixtures() {
-        return [
-            'accounts' => AccountFixture::class,
-            'history' => UsernameHistoryFixture::class,
-        ];
-    }
-
-    public function setUp() {
-        parent::setUp();
-        Yii::$app->user->setIdentity($this->getAccount());
-    }
-
-    public function testChange() {
-        $model = new ChangeUsernameForm($this->getAccount(), [
-            'password' => 'password_0',
-            'username' => 'my_new_nickname',
-        ]);
-        $this->assertTrue($model->change());
-        $this->assertEquals('my_new_nickname', Account::findOne($this->getAccountId())->username);
-        $this->assertInstanceOf(UsernameHistory::class, UsernameHistory::findOne(['username' => 'my_new_nickname']));
-        $this->tester->canSeeAmqpMessageIsCreated('events');
-    }
-
-    public function testChangeWithoutChange() {
-        $account = $this->getAccount();
-        $username = $account->username;
-        $model = new ChangeUsernameForm($account, [
-            'password' => 'password_0',
-            'username' => $username,
-        ]);
-        $callTime = time();
-        $this->assertTrue($model->change());
-        $this->assertNull(UsernameHistory::findOne([
-            'AND',
-            'username' => $username,
-            ['>=', 'applied_in', $callTime],
-        ]), 'no new UsernameHistory record, if we don\'t change username');
-        $this->tester->cantSeeAmqpMessageIsCreated('events');
-    }
-
-    public function testChangeCase() {
-        $newUsername = mb_strtoupper($this->tester->grabFixture('accounts', 'admin')['username']);
-        $model = new ChangeUsernameForm($this->getAccount(), [
-            'password' => 'password_0',
-            'username' => $newUsername,
-        ]);
-        $this->assertTrue($model->change());
-        $this->assertEquals($newUsername, Account::findOne($this->getAccountId())->username);
-        $this->assertInstanceOf(
-            UsernameHistory::class,
-            UsernameHistory::findOne(['username' => $newUsername]),
-            'username should change, if we change case of some letters'
-        );
-        $this->tester->canSeeAmqpMessageIsCreated('events');
-    }
-
-    public function testCreateTask() {
-        $model = new ChangeUsernameForm($this->getAccount());
-        $model->createEventTask(1, 'test1', 'test');
-        $message = $this->tester->grabLastSentAmqpMessage('events');
-        $body = json_decode($message->getBody(), true);
-        $this->assertEquals(1, $body['accountId']);
-        $this->assertEquals('test1', $body['newUsername']);
-        $this->assertEquals('test', $body['oldUsername']);
-    }
-
-    private function getAccount(): AccountIdentity {
-        return AccountIdentity::findOne($this->getAccountId());
-    }
-
-    private function getAccountId() {
-        return $this->tester->grabFixture('accounts', 'admin')->id;
-    }
-
-}

tests/codeception/api/unit/models/profile/TwoFactorAuthFormTest.php

@@ -1,208 +0,0 @@
-<?php
-namespace tests\codeception\api\unit\models\profile;
-
-use api\components\User\Component;
-use api\models\AccountIdentity;
-use api\models\profile\TwoFactorAuthForm;
-use common\helpers\Error as E;
-use common\models\Account;
-use OTPHP\TOTP;
-use tests\codeception\api\unit\TestCase;
-use tests\codeception\common\_support\ProtectedCaller;
-use Yii;
-
-class TwoFactorAuthFormTest extends TestCase {
-    use ProtectedCaller;
-
-    public function testGetCredentials() {
-        /** @var Account|\PHPUnit_Framework_MockObject_MockObject $account */
-        $account = $this->getMockBuilder(Account::class)
-            ->setMethods(['save'])
-            ->getMock();
-
-        $account->expects($this->once())
-            ->method('save')
-            ->willReturn(true);
-
-        $account->email = 'mock@email.com';
-        $account->otp_secret = null;
-
-        /** @var TwoFactorAuthForm|\PHPUnit_Framework_MockObject_MockObject $model */
-        $model = $this->getMockBuilder(TwoFactorAuthForm::class)
-            ->setConstructorArgs([$account])
-            ->setMethods(['drawQrCode'])
-            ->getMock();
-
-        $model->expects($this->once())
-            ->method('drawQrCode')
-            ->willReturn('<_/>');
-
-        $result = $model->getCredentials();
-        $this->assertTrue(is_array($result));
-        $this->assertArrayHasKey('qr', $result);
-        $this->assertArrayHasKey('uri', $result);
-        $this->assertArrayHasKey('secret', $result);
-        $this->assertNotNull($account->otp_secret);
-        $this->assertEquals($account->otp_secret, $result['secret']);
-        $this->assertEquals('data:image/svg+xml,<_/>', $result['qr']);
-
-        /** @var Account|\PHPUnit_Framework_MockObject_MockObject $account */
-        $account = $this->getMockBuilder(Account::class)
-            ->setMethods(['save'])
-            ->getMock();
-
-        $account->expects($this->never())
-            ->method('save');
-
-        $account->email = 'mock@email.com';
-        $account->otp_secret = 'some valid totp secret value';
-
-        /** @var TwoFactorAuthForm|\PHPUnit_Framework_MockObject_MockObject $model */
-        $model = $this->getMockBuilder(TwoFactorAuthForm::class)
-            ->setConstructorArgs([$account])
-            ->setMethods(['drawQrCode'])
-            ->getMock();
-
-        $model->expects($this->once())
-            ->method('drawQrCode')
-            ->willReturn('this is qr code, trust me');
-
-        $result = $model->getCredentials();
-        $this->assertEquals('some valid totp secret value', $result['secret']);
-    }
-
-    public function testActivate() {
-        /** @var Component|\PHPUnit_Framework_MockObject_MockObject $component */
-        $component = $this->getMockBuilder(Component::class)
-            ->setMethods(['terminateSessions'])
-            ->setConstructorArgs([[
-                'identityClass' => AccountIdentity::class,
-                'enableSession' => false,
-                'loginUrl' => null,
-                'secret' => 'secret',
-            ]])
-            ->getMock();
-
-        $component
-            ->expects($this->once())
-            ->method('terminateSessions');
-
-        Yii::$app->set('user', $component);
-
-        /** @var Account|\PHPUnit_Framework_MockObject_MockObject $account */
-        $account = $this->getMockBuilder(Account::class)
-            ->setMethods(['save'])
-            ->getMock();
-
-        $account->expects($this->once())
-            ->method('save')
-            ->willReturn(true);
-
-        $account->is_otp_enabled = false;
-        $account->otp_secret = 'mock secret';
-
-        /** @var TwoFactorAuthForm|\PHPUnit_Framework_MockObject_MockObject $model */
-        $model = $this->getMockBuilder(TwoFactorAuthForm::class)
-            ->setMethods(['validate'])
-            ->setConstructorArgs([$account, ['scenario' => TwoFactorAuthForm::SCENARIO_ACTIVATE]])
-            ->getMock();
-
-        $model->expects($this->once())
-            ->method('validate')
-            ->willReturn(true);
-
-        $this->assertTrue($model->activate());
-        $this->assertTrue($account->is_otp_enabled);
-    }
-
-    public function testDisable() {
-        /** @var Account|\PHPUnit_Framework_MockObject_MockObject $account */
-        $account = $this->getMockBuilder(Account::class)
-            ->setMethods(['save'])
-            ->getMock();
-
-        $account->expects($this->once())
-            ->method('save')
-            ->willReturn(true);
-
-        $account->is_otp_enabled = true;
-        $account->otp_secret = 'mock secret';
-
-        /** @var TwoFactorAuthForm|\PHPUnit_Framework_MockObject_MockObject $model */
-        $model = $this->getMockBuilder(TwoFactorAuthForm::class)
-            ->setMethods(['validate'])
-            ->setConstructorArgs([$account, ['scenario' => TwoFactorAuthForm::SCENARIO_DISABLE]])
-            ->getMock();
-
-        $model->expects($this->once())
-            ->method('validate')
-            ->willReturn(true);
-
-        $this->assertTrue($model->disable());
-        $this->assertNull($account->otp_secret);
-        $this->assertFalse($account->is_otp_enabled);
-    }
-
-    public function testValidateOtpDisabled() {
-        $account = new Account();
-        $account->is_otp_enabled = true;
-        $model = new TwoFactorAuthForm($account);
-        $model->validateOtpDisabled('account');
-        $this->assertEquals([E::OTP_ALREADY_ENABLED], $model->getErrors('account'));
-
-        $account = new Account();
-        $account->is_otp_enabled = false;
-        $model = new TwoFactorAuthForm($account);
-        $model->validateOtpDisabled('account');
-        $this->assertEmpty($model->getErrors('account'));
-    }
-
-    public function testValidateOtpEnabled() {
-        $account = new Account();
-        $account->is_otp_enabled = false;
-        $model = new TwoFactorAuthForm($account);
-        $model->validateOtpEnabled('account');
-        $this->assertEquals([E::OTP_NOT_ENABLED], $model->getErrors('account'));
-
-        $account = new Account();
-        $account->is_otp_enabled = true;
-        $model = new TwoFactorAuthForm($account);
-        $model->validateOtpEnabled('account');
-        $this->assertEmpty($model->getErrors('account'));
-    }
-
-    public function testGetTotp() {
-        $account = new Account();
-        $account->otp_secret = 'mock secret';
-        $account->email = 'check@this.email';
-
-        $model = new TwoFactorAuthForm($account);
-        $totp = $model->getTotp();
-        $this->assertInstanceOf(TOTP::class, $totp);
-        $this->assertEquals('check@this.email', $totp->getLabel());
-        $this->assertEquals('mock secret', $totp->getSecret());
-        $this->assertEquals('Ely.by', $totp->getIssuer());
-    }
-
-    public function testSetOtpSecret() {
-        /** @var Account|\PHPUnit_Framework_MockObject_MockObject $account */
-        $account = $this->getMockBuilder(Account::class)
-            ->setMethods(['save'])
-            ->getMock();
-
-        $account->expects($this->exactly(2))
-            ->method('save')
-            ->willReturn(true);
-
-        $model = new TwoFactorAuthForm($account);
-        $this->callProtected($model, 'setOtpSecret');
-        $this->assertEquals(24, strlen($model->getAccount()->otp_secret));
-        $this->assertSame(strtoupper($model->getAccount()->otp_secret), $model->getAccount()->otp_secret);
-
-        $model = new TwoFactorAuthForm($account);
-        $this->callProtected($model, 'setOtpSecret', 25);
-        $this->assertEquals(25, strlen($model->getAccount()->otp_secret));
-        $this->assertSame(strtoupper($model->getAccount()->otp_secret), $model->getAccount()->otp_secret);
-    }
-
-}