mirror of
https://github.com/elyby/accounts.git
synced 2024-12-13 17:09:00 +05:30
dd2c4bc413
Все действия, связанные с аккаунтами, теперь вызываются через url `/api/v1/accounts/<id>/<action>`. Добавлена вменяемая система разграничения прав на основе RBAC. Теперь oAuth2 токены генерируются как случайная строка в 40 символов длинной, а не UUID. Исправлен баг с неправильным временем жизни токена в ответе успешного запроса аутентификации. Теперь все unit тесты можно успешно прогнать без наличия интернета.
121 lines
3.7 KiB
PHP
121 lines
3.7 KiB
PHP
<?php
|
||
namespace tests\codeception\api\oauth;
|
||
|
||
use tests\codeception\api\_pages\OauthRoute;
|
||
use tests\codeception\api\functional\_steps\OauthSteps;
|
||
use tests\codeception\api\FunctionalTester;
|
||
|
||
class ClientCredentialsCest {
|
||
|
||
/**
|
||
* @var OauthRoute
|
||
*/
|
||
private $route;
|
||
|
||
public function _before(FunctionalTester $I) {
|
||
$this->route = new OauthRoute($I);
|
||
}
|
||
|
||
public function testIssueTokenWithWrongArgs(FunctionalTester $I) {
|
||
$I->wantTo('check behavior on on request without any credentials');
|
||
$this->route->issueToken($this->buildParams());
|
||
$I->canSeeResponseCodeIs(400);
|
||
$I->canSeeResponseContainsJson([
|
||
'error' => 'invalid_request',
|
||
]);
|
||
|
||
$I->wantTo('check behavior on passing invalid client_id');
|
||
$this->route->issueToken($this->buildParams(
|
||
'invalid-client',
|
||
'invalid-secret',
|
||
['invalid-scope']
|
||
));
|
||
$I->canSeeResponseCodeIs(401);
|
||
$I->canSeeResponseContainsJson([
|
||
'error' => 'invalid_client',
|
||
]);
|
||
|
||
$I->wantTo('check behavior on passing invalid client_secret');
|
||
$this->route->issueToken($this->buildParams(
|
||
'ely',
|
||
'invalid-secret',
|
||
['invalid-scope']
|
||
));
|
||
$I->canSeeResponseCodeIs(401);
|
||
$I->canSeeResponseContainsJson([
|
||
'error' => 'invalid_client',
|
||
]);
|
||
|
||
$I->wantTo('check behavior on passing invalid client_secret');
|
||
$this->route->issueToken($this->buildParams(
|
||
'ely',
|
||
'invalid-secret',
|
||
['invalid-scope']
|
||
));
|
||
$I->canSeeResponseCodeIs(401);
|
||
$I->canSeeResponseContainsJson([
|
||
'error' => 'invalid_client',
|
||
]);
|
||
}
|
||
|
||
public function testIssueTokenWithPublicScopes(OauthSteps $I) {
|
||
// TODO: у нас пока нет публичных скоупов, поэтому тест прогоняется с пустым набором
|
||
$this->route->issueToken($this->buildParams(
|
||
'ely',
|
||
'ZuM1vGchJz-9_UZ5HC3H3Z9Hg5PzdbkM',
|
||
[]
|
||
));
|
||
$I->canSeeResponseCodeIs(200);
|
||
$I->canSeeResponseIsJson();
|
||
$I->canSeeResponseContainsJson([
|
||
'token_type' => 'Bearer',
|
||
]);
|
||
$I->canSeeResponseJsonMatchesJsonPath('$.access_token');
|
||
$I->canSeeResponseJsonMatchesJsonPath('$.expires_in');
|
||
}
|
||
|
||
public function testIssueTokenWithInternalScopes(OauthSteps $I) {
|
||
$this->route->issueToken($this->buildParams(
|
||
'ely',
|
||
'ZuM1vGchJz-9_UZ5HC3H3Z9Hg5PzdbkM',
|
||
['account_block']
|
||
));
|
||
$I->canSeeResponseCodeIs(400);
|
||
$I->canSeeResponseIsJson();
|
||
$I->canSeeResponseContainsJson([
|
||
'error' => 'invalid_scope',
|
||
]);
|
||
|
||
$this->route->issueToken($this->buildParams(
|
||
'trusted-client',
|
||
'tXBbyvMcyaOgHMOAXBpN2EC7uFoJAaL9',
|
||
['account_block']
|
||
));
|
||
$I->canSeeResponseCodeIs(200);
|
||
$I->canSeeResponseIsJson();
|
||
$I->canSeeResponseContainsJson([
|
||
'token_type' => 'Bearer',
|
||
]);
|
||
$I->canSeeResponseJsonMatchesJsonPath('$.access_token');
|
||
$I->canSeeResponseJsonMatchesJsonPath('$.expires_in');
|
||
}
|
||
|
||
private function buildParams($clientId = null, $clientSecret = null, array $scopes = null) {
|
||
$params = ['grant_type' => 'client_credentials'];
|
||
if ($clientId !== null) {
|
||
$params['client_id'] = $clientId;
|
||
}
|
||
|
||
if ($clientSecret !== null) {
|
||
$params['client_secret'] = $clientSecret;
|
||
}
|
||
|
||
if ($scopes !== null) {
|
||
$params['scope'] = implode(',', $scopes);
|
||
}
|
||
|
||
return $params;
|
||
}
|
||
|
||
}
|