Jonny Barnes
faf8e5c1ec
An Opus code review of the branch caught two real bugs the test suite
structurally couldn't see:
- /revocation and /introspect were never added to bootstrap/app.php's
CSRF except list, so both were fully broken (403) for any real
external client, despite every feature test passing — CSRF
verification is short-circuited entirely while running tests.
Verified live against the running app before and after the fix, and
added a regression test that asserts against the actual configured
exemptions rather than relying on request-time behavior that tests
can't exercise.
- An array-shaped `token` param (e.g. token[]=a&token[]=b) crashed
both endpoints with a 500, since this app promotes PHP warnings
("Array to string conversion") to exceptions. Fixed at the shared
root, MicropubToken::findActive(), which also closes the same latent
hole in VerifyMicropubToken's access_token param that predates this
branch. Verified live and covered with regression tests.
Also applied the review's lower-severity findings: added the missing
introspection_endpoint Link header and metadata test assertions,
removed the now-dead is_string($scopes) array branch in the Micropub
handlers and media controller (scope is unconditionally a string from
the DB now, this guarded against a JWT-array-claim shape that can no
longer occur), dropped a redundant #[Table] model attribute, sized
token_hash to its actual 64-char length, and removed a one-off inline
style in the admin view.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
88 lines
2.7 KiB
PHP
88 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\MicropubToken;
|
|
use App\Services\TokenService;
|
|
use PHPUnit\Framework\Attributes\Test;
|
|
use Tests\TestCase;
|
|
|
|
class TokenServiceTest extends TestCase
|
|
{
|
|
/**
|
|
* Given the token is dependent on a random value and stored only as a
|
|
* hash, to test, we shall create a token, and then verify it.
|
|
*/
|
|
#[Test]
|
|
public function tokenservice_creates_valid_tokens(): void
|
|
{
|
|
$tokenService = new TokenService;
|
|
$data = [
|
|
'me' => 'https://example.org',
|
|
'client_id' => 'https://quill.p3k.io',
|
|
'scope' => 'post',
|
|
];
|
|
$token = $tokenService->getNewToken($data);
|
|
|
|
$response = $this->get('/api/post', ['HTTP_Authorization' => 'Bearer '.$token]);
|
|
|
|
$response->assertJson([
|
|
'response' => 'token',
|
|
'token' => [
|
|
'me' => $data['me'],
|
|
'client_id' => $data['client_id'],
|
|
'scope' => $data['scope'],
|
|
],
|
|
]);
|
|
}
|
|
|
|
#[Test]
|
|
public function unknown_tokens_are_not_valid(): void
|
|
{
|
|
$response = $this->get('/api/post', ['HTTP_Authorization' => 'Bearer '.bin2hex(random_bytes(32))]);
|
|
|
|
$response->assertJson([
|
|
'response' => 'error',
|
|
'error' => 'invalid_token',
|
|
'error_description' => 'The provided token did not pass validation',
|
|
]);
|
|
}
|
|
|
|
#[Test]
|
|
public function revoked_tokens_are_not_valid(): void
|
|
{
|
|
$tokenService = new TokenService;
|
|
$data = [
|
|
'me' => 'https://example.org',
|
|
'client_id' => 'https://quill.p3k.io',
|
|
'scope' => 'post',
|
|
];
|
|
$token = $tokenService->getNewToken($data);
|
|
|
|
MicropubToken::where('token_hash', hash('sha256', $token))->firstOrFail()->revoke();
|
|
|
|
$response = $this->get('/api/post', ['HTTP_Authorization' => 'Bearer '.$token]);
|
|
|
|
$response->assertJson([
|
|
'response' => 'error',
|
|
'error' => 'invalid_token',
|
|
'error_description' => 'The provided token did not pass validation',
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Request input for a "string" field can be sent as an array
|
|
* (e.g. token[]=a&token[]=b). Casting that to string throws in this app
|
|
* (warnings are promoted to exceptions), so findActive() must guard
|
|
* against it rather than assume its caller already validated the type.
|
|
*/
|
|
#[Test]
|
|
public function find_active_treats_non_string_input_as_absent(): void
|
|
{
|
|
$this->assertNull(MicropubToken::findActive(['a', 'b']));
|
|
$this->assertNull(MicropubToken::findActive(null));
|
|
$this->assertNull(MicropubToken::findActive(123));
|
|
}
|
|
}
|