Merge pull request #24189 from owncloud/pluggable-auth
Pluggable authremotes/origin/ceph-wait-for-http
Thomas Müller
10 years ago
commit
efa545f8f0
@ -0,0 +1,78 @@ |
||||
Feature: auth |
||||
|
||||
Background: |
||||
Given user "user0" exists |
||||
Given a new client token is used |
||||
|
||||
|
||||
# FILES APP |
||||
|
||||
Scenario: access files app anonymously |
||||
When requesting "/index.php/apps/files" with "GET" |
||||
Then the HTTP status code should be "401" |
||||
|
||||
Scenario: access files app with basic auth |
||||
When requesting "/index.php/apps/files" with "GET" using basic auth |
||||
Then the HTTP status code should be "200" |
||||
|
||||
Scenario: access files app with basic token auth |
||||
When requesting "/index.php/apps/files" with "GET" using basic token auth |
||||
Then the HTTP status code should be "200" |
||||
|
||||
Scenario: access files app with a client token |
||||
When requesting "/index.php/apps/files" with "GET" using a client token |
||||
Then the HTTP status code should be "200" |
||||
|
||||
Scenario: access files app with browser session |
||||
Given a new browser session is started |
||||
When requesting "/index.php/apps/files" with "GET" using browser session |
||||
Then the HTTP status code should be "200" |
||||
|
||||
|
||||
# WebDAV |
||||
|
||||
Scenario: using WebDAV anonymously |
||||
When requesting "/remote.php/webdav" with "PROPFIND" |
||||
Then the HTTP status code should be "401" |
||||
|
||||
Scenario: using WebDAV with basic auth |
||||
When requesting "/remote.php/webdav" with "PROPFIND" using basic auth |
||||
Then the HTTP status code should be "207" |
||||
|
||||
Scenario: using WebDAV with token auth |
||||
When requesting "/remote.php/webdav" with "PROPFIND" using basic token auth |
||||
Then the HTTP status code should be "207" |
||||
|
||||
# DAV token auth is not possible yet |
||||
#Scenario: using WebDAV with a client token |
||||
# When requesting "/remote.php/webdav" with "PROPFIND" using a client token |
||||
# Then the HTTP status code should be "207" |
||||
|
||||
Scenario: using WebDAV with browser session |
||||
Given a new browser session is started |
||||
When requesting "/remote.php/webdav" with "PROPFIND" using browser session |
||||
Then the HTTP status code should be "207" |
||||
|
||||
|
||||
# OCS |
||||
|
||||
Scenario: using OCS anonymously |
||||
When requesting "/ocs/v1.php/apps/files_sharing/api/v1/remote_shares" with "GET" |
||||
Then the OCS status code should be "997" |
||||
|
||||
Scenario: using OCS with basic auth |
||||
When requesting "/ocs/v1.php/apps/files_sharing/api/v1/remote_shares" with "GET" using basic auth |
||||
Then the OCS status code should be "100" |
||||
|
||||
Scenario: using OCS with token auth |
||||
When requesting "/ocs/v1.php/apps/files_sharing/api/v1/remote_shares" with "GET" using basic token auth |
||||
Then the OCS status code should be "100" |
||||
|
||||
Scenario: using OCS with client token |
||||
When requesting "/ocs/v1.php/apps/files_sharing/api/v1/remote_shares" with "GET" using a client token |
||||
Then the OCS status code should be "100" |
||||
|
||||
Scenario: using OCS with browser session |
||||
Given a new browser session is started |
||||
When requesting "/ocs/v1.php/apps/files_sharing/api/v1/remote_shares" with "GET" using browser session |
||||
Then the OCS status code should be "100" |
||||
@ -0,0 +1,117 @@ |
||||
<?php |
||||
|
||||
use GuzzleHttp\Client; |
||||
use GuzzleHttp\Exception\ClientException; |
||||
|
||||
require __DIR__ . '/../../vendor/autoload.php'; |
||||
|
||||
trait Auth { |
||||
|
||||
private $clientToken; |
||||
|
||||
/** @BeforeScenario */ |
||||
public function tearUpScenario() { |
||||
$this->client = new Client(); |
||||
$this->responseXml = ''; |
||||
} |
||||
|
||||
/** |
||||
* @When requesting :url with :method |
||||
*/ |
||||
public function requestingWith($url, $method) { |
||||
$this->sendRequest($url, $method); |
||||
} |
||||
|
||||
private function sendRequest($url, $method, $authHeader = null, $useCookies = false) { |
||||
$fullUrl = substr($this->baseUrl, 0, -5) . $url; |
||||
try { |
||||
if ($useCookies) { |
||||
$request = $this->client->createRequest($method, $fullUrl, [ |
||||
'cookies' => $this->cookieJar, |
||||
]); |
||||
} else { |
||||
$request = $this->client->createRequest($method, $fullUrl); |
||||
} |
||||
if ($authHeader) { |
||||
$request->setHeader('Authorization', $authHeader); |
||||
} |
||||
$request->setHeader('OCS_APIREQUEST', 'true'); |
||||
$request->setHeader('requesttoken', $this->requestToken); |
||||
$this->response = $this->client->send($request); |
||||
} catch (ClientException $ex) { |
||||
$this->response = $ex->getResponse(); |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* @Given a new client token is used |
||||
*/ |
||||
public function aNewClientTokenIsUsed() { |
||||
$client = new Client(); |
||||
$resp = $client->post(substr($this->baseUrl, 0, -5) . '/token/generate', [ |
||||
'json' => [ |
||||
'user' => 'user0', |
||||
'password' => '123456', |
||||
] |
||||
]); |
||||
$this->clientToken = json_decode($resp->getBody()->getContents())->token; |
||||
} |
||||
|
||||
/** |
||||
* @When requesting :url with :method using basic auth |
||||
*/ |
||||
public function requestingWithBasicAuth($url, $method) { |
||||
$this->sendRequest($url, $method, 'basic ' . base64_encode('user0:123456')); |
||||
} |
||||
|
||||
/** |
||||
* @When requesting :url with :method using basic token auth |
||||
*/ |
||||
public function requestingWithBasicTokenAuth($url, $method) { |
||||
$this->sendRequest($url, $method, 'basic ' . base64_encode('user0:' . $this->clientToken)); |
||||
} |
||||
|
||||
/** |
||||
* @When requesting :url with :method using a client token |
||||
*/ |
||||
public function requestingWithUsingAClientToken($url, $method) { |
||||
$this->sendRequest($url, $method, 'token ' . $this->clientToken); |
||||
} |
||||
|
||||
/** |
||||
* @When requesting :url with :method using browser session |
||||
*/ |
||||
public function requestingWithBrowserSession($url, $method) { |
||||
$this->sendRequest($url, $method, null, true); |
||||
} |
||||
|
||||
/** |
||||
* @Given a new browser session is started |
||||
*/ |
||||
public function aNewBrowserSessionIsStarted() { |
||||
$loginUrl = substr($this->baseUrl, 0, -5) . '/login'; |
||||
// Request a new session and extract CSRF token |
||||
$client = new Client(); |
||||
$response = $client->get( |
||||
$loginUrl, [ |
||||
'cookies' => $this->cookieJar, |
||||
] |
||||
); |
||||
$this->extracRequestTokenFromResponse($response); |
||||
|
||||
// Login and extract new token |
||||
$client = new Client(); |
||||
$response = $client->post( |
||||
$loginUrl, [ |
||||
'body' => [ |
||||
'user' => 'user0', |
||||
'password' => '123456', |
||||
'requesttoken' => $this->requestToken, |
||||
], |
||||
'cookies' => $this->cookieJar, |
||||
] |
||||
); |
||||
$this->extracRequestTokenFromResponse($response); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,90 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Core\Controller; |
||||
|
||||
use OC\AppFramework\Http; |
||||
use OC\Authentication\Token\DefaultTokenProvider; |
||||
use OC\Authentication\Token\IToken; |
||||
use OC\User\Manager; |
||||
use OCP\AppFramework\Controller; |
||||
use OCP\AppFramework\Http\JSONResponse; |
||||
use OCP\AppFramework\Http\Response; |
||||
use OCP\IRequest; |
||||
use OCP\Security\ISecureRandom; |
||||
|
||||
class TokenController extends Controller { |
||||
|
||||
/** @var Manager */ |
||||
private $userManager; |
||||
|
||||
/** @var DefaultTokenProvider */ |
||||
private $tokenProvider; |
||||
|
||||
/** @var ISecureRandom */ |
||||
private $secureRandom; |
||||
|
||||
/** |
||||
* @param string $appName |
||||
* @param IRequest $request |
||||
* @param Manager $userManager |
||||
* @param DefaultTokenProvider $tokenProvider |
||||
* @param ISecureRandom $secureRandom |
||||
*/ |
||||
public function __construct($appName, IRequest $request, Manager $userManager, DefaultTokenProvider $tokenProvider, |
||||
ISecureRandom $secureRandom) { |
||||
parent::__construct($appName, $request); |
||||
$this->userManager = $userManager; |
||||
$this->tokenProvider = $tokenProvider; |
||||
$this->secureRandom = $secureRandom; |
||||
} |
||||
|
||||
/** |
||||
* Generate a new access token clients can authenticate with |
||||
* |
||||
* @PublicPage |
||||
* @NoCSRFRequired |
||||
* |
||||
* @param string $user |
||||
* @param string $password |
||||
* @param string $name the name of the client |
||||
* @return JSONResponse |
||||
*/ |
||||
public function generateToken($user, $password, $name = 'unknown client') { |
||||
if (is_null($user) || is_null($password)) { |
||||
$response = new Response(); |
||||
$response->setStatus(Http::STATUS_UNPROCESSABLE_ENTITY); |
||||
return $response; |
||||
} |
||||
if ($this->userManager->checkPassword($user, $password) === false) { |
||||
$response = new Response(); |
||||
$response->setStatus(Http::STATUS_UNAUTHORIZED); |
||||
return $response; |
||||
} |
||||
$token = $this->secureRandom->generate(128); |
||||
$this->tokenProvider->generateToken($token, $user, $password, $name, IToken::PERMANENT_TOKEN); |
||||
return [ |
||||
'token' => $token, |
||||
]; |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,29 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Exceptions; |
||||
|
||||
use Exception; |
||||
|
||||
class InvalidTokenException extends Exception { |
||||
|
||||
} |
||||
@ -0,0 +1,81 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Token; |
||||
|
||||
use OCP\AppFramework\Db\Entity; |
||||
|
||||
/** |
||||
* @method void setId(int $id) |
||||
* @method void setUid(string $uid); |
||||
* @method void setPassword(string $password) |
||||
* @method string getPassword() |
||||
* @method void setName(string $name) |
||||
* @method string getName() |
||||
* @method void setToken(string $token) |
||||
* @method string getToken() |
||||
* @method void setType(string $type) |
||||
* @method int getType() |
||||
* @method void setLastActivity(int $lastActivity) |
||||
* @method int getLastActivity() |
||||
*/ |
||||
class DefaultToken extends Entity implements IToken { |
||||
|
||||
/** |
||||
* @var string user UID |
||||
*/ |
||||
protected $uid; |
||||
|
||||
/** |
||||
* @var string encrypted user password |
||||
*/ |
||||
protected $password; |
||||
|
||||
/** |
||||
* @var string token name (e.g. browser/OS) |
||||
*/ |
||||
protected $name; |
||||
|
||||
/** |
||||
* @var string |
||||
*/ |
||||
protected $token; |
||||
|
||||
/** |
||||
* @var int |
||||
*/ |
||||
protected $type; |
||||
|
||||
/** |
||||
* @var int |
||||
*/ |
||||
protected $lastActivity; |
||||
|
||||
public function getId() { |
||||
return $this->id; |
||||
} |
||||
|
||||
public function getUID() { |
||||
return $this->uid; |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,36 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Token; |
||||
|
||||
use OC; |
||||
use OC\BackgroundJob\Job; |
||||
|
||||
class DefaultTokenCleanupJob extends Job { |
||||
|
||||
protected function run($argument) { |
||||
/* @var $provider DefaultTokenProvider */ |
||||
$provider = OC::$server->query('OC\Authentication\Token\DefaultTokenProvider'); |
||||
$provider->invalidateOldTokens(); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,86 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Token; |
||||
|
||||
use OCP\AppFramework\Db\DoesNotExistException; |
||||
use OCP\AppFramework\Db\Mapper; |
||||
use OCP\DB\QueryBuilder\IQueryBuilder; |
||||
use OCP\IDBConnection; |
||||
|
||||
class DefaultTokenMapper extends Mapper { |
||||
|
||||
public function __construct(IDBConnection $db) { |
||||
parent::__construct($db, 'authtoken'); |
||||
} |
||||
|
||||
/** |
||||
* Invalidate (delete) a given token |
||||
* |
||||
* @param string $token |
||||
*/ |
||||
public function invalidate($token) { |
||||
$qb = $this->db->getQueryBuilder(); |
||||
$qb->delete('authtoken') |
||||
->andWhere($qb->expr()->eq('token', $qb->createParameter('token'))) |
||||
->setParameter('token', $token) |
||||
->execute(); |
||||
} |
||||
|
||||
/** |
||||
* @param int $olderThan |
||||
*/ |
||||
public function invalidateOld($olderThan) { |
||||
/* @var $qb IQueryBuilder */ |
||||
$qb = $this->db->getQueryBuilder(); |
||||
$qb->delete('authtoken') |
||||
->where($qb->expr()->lt('last_activity', $qb->createParameter('last_activity'))) |
||||
->andWhere($qb->expr()->eq('type', $qb->createParameter('type'))) |
||||
->setParameter('last_activity', $olderThan, IQueryBuilder::PARAM_INT) |
||||
->setParameter('type', IToken::TEMPORARY_TOKEN, IQueryBuilder::PARAM_INT) |
||||
->execute(); |
||||
} |
||||
|
||||
/** |
||||
* Get the user UID for the given token |
||||
* |
||||
* @param string $token |
||||
* @throws DoesNotExistException |
||||
* @return DefaultToken |
||||
*/ |
||||
public function getToken($token) { |
||||
/* @var $qb IQueryBuilder */ |
||||
$qb = $this->db->getQueryBuilder(); |
||||
$result = $qb->select('id', 'uid', 'password', 'name', 'type', 'token', 'last_activity') |
||||
->from('authtoken') |
||||
->where($qb->expr()->eq('token', $qb->createParameter('token'))) |
||||
->setParameter('token', $token) |
||||
->execute(); |
||||
|
||||
$data = $result->fetch(); |
||||
if ($data === false) { |
||||
throw new DoesNotExistException('token does not exist'); |
||||
} |
||||
return DefaultToken::fromRow($data); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,205 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Token; |
||||
|
||||
use Exception; |
||||
use OC\Authentication\Exceptions\InvalidTokenException; |
||||
use OCP\AppFramework\Db\DoesNotExistException; |
||||
use OCP\AppFramework\Utility\ITimeFactory; |
||||
use OCP\IConfig; |
||||
use OCP\ILogger; |
||||
use OCP\Security\ICrypto; |
||||
|
||||
class DefaultTokenProvider implements IProvider { |
||||
|
||||
/** @var DefaultTokenMapper */ |
||||
private $mapper; |
||||
|
||||
/** @var ICrypto */ |
||||
private $crypto; |
||||
|
||||
/** @var IConfig */ |
||||
private $config; |
||||
|
||||
/** @var ILogger $logger */ |
||||
private $logger; |
||||
|
||||
/** @var ITimeFactory $time */ |
||||
private $time; |
||||
|
||||
/** |
||||
* @param DefaultTokenMapper $mapper |
||||
* @param ICrypto $crypto |
||||
* @param IConfig $config |
||||
* @param ILogger $logger |
||||
* @param ITimeFactory $time |
||||
*/ |
||||
public function __construct(DefaultTokenMapper $mapper, ICrypto $crypto, IConfig $config, ILogger $logger, ITimeFactory $time) { |
||||
$this->mapper = $mapper; |
||||
$this->crypto = $crypto; |
||||
$this->config = $config; |
||||
$this->logger = $logger; |
||||
$this->time = $time; |
||||
} |
||||
|
||||
/** |
||||
* Create and persist a new token |
||||
* |
||||
* @param string $token |
||||
* @param string $uid |
||||
* @param string $password |
||||
* @param string $name |
||||
* @param int $type token type |
||||
* @return DefaultToken |
||||
*/ |
||||
public function generateToken($token, $uid, $password, $name, $type = IToken::TEMPORARY_TOKEN) { |
||||
$dbToken = new DefaultToken(); |
||||
$dbToken->setUid($uid); |
||||
$dbToken->setPassword($this->encryptPassword($password, $token)); |
||||
$dbToken->setName($name); |
||||
$dbToken->setToken($this->hashToken($token)); |
||||
$dbToken->setType($type); |
||||
$dbToken->setLastActivity($this->time->getTime()); |
||||
|
||||
$this->mapper->insert($dbToken); |
||||
|
||||
return $dbToken; |
||||
} |
||||
|
||||
/** |
||||
* Update token activity timestamp |
||||
* |
||||
* @throws InvalidTokenException |
||||
* @param IToken $token |
||||
*/ |
||||
public function updateToken(IToken $token) { |
||||
if (!($token instanceof DefaultToken)) { |
||||
throw new InvalidTokenException(); |
||||
} |
||||
/** @var DefaultToken $token */ |
||||
$token->setLastActivity($this->time->getTime()); |
||||
|
||||
$this->mapper->update($token); |
||||
} |
||||
|
||||
/** |
||||
* @param string $token |
||||
* @throws InvalidTokenException |
||||
* @return DefaultToken |
||||
*/ |
||||
public function getToken($token) { |
||||
try { |
||||
return $this->mapper->getToken($this->hashToken($token)); |
||||
} catch (DoesNotExistException $ex) { |
||||
throw new InvalidTokenException(); |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* @param DefaultToken $savedToken |
||||
* @param string $token session token |
||||
* @return string |
||||
*/ |
||||
public function getPassword(DefaultToken $savedToken, $token) { |
||||
return $this->decryptPassword($savedToken->getPassword(), $token); |
||||
} |
||||
|
||||
/** |
||||
* Invalidate (delete) the given session token |
||||
* |
||||
* @param string $token |
||||
*/ |
||||
public function invalidateToken($token) { |
||||
$this->mapper->invalidate($this->hashToken($token)); |
||||
} |
||||
|
||||
/** |
||||
* Invalidate (delete) old session tokens |
||||
*/ |
||||
public function invalidateOldTokens() { |
||||
$olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24); |
||||
$this->logger->info('Invalidating tokens older than ' . date('c', $olderThan)); |
||||
$this->mapper->invalidateOld($olderThan); |
||||
} |
||||
|
||||
/** |
||||
* @param string $token |
||||
* @throws InvalidTokenException |
||||
* @return DefaultToken user UID |
||||
*/ |
||||
public function validateToken($token) { |
||||
$this->logger->debug('validating default token <' . $token . '>'); |
||||
try { |
||||
$dbToken = $this->mapper->getToken($this->hashToken($token)); |
||||
$this->logger->debug('valid token for ' . $dbToken->getUID()); |
||||
return $dbToken; |
||||
} catch (DoesNotExistException $ex) { |
||||
$this->logger->warning('invalid token'); |
||||
throw new InvalidTokenException(); |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* @param string $token |
||||
* @return string |
||||
*/ |
||||
private function hashToken($token) { |
||||
$secret = $this->config->getSystemValue('secret'); |
||||
return hash('sha512', $token . $secret); |
||||
} |
||||
|
||||
/** |
||||
* Encrypt the given password |
||||
* |
||||
* The token is used as key |
||||
* |
||||
* @param string $password |
||||
* @param string $token |
||||
* @return string encrypted password |
||||
*/ |
||||
private function encryptPassword($password, $token) { |
||||
$secret = $this->config->getSystemValue('secret'); |
||||
return $this->crypto->encrypt($password, $token . $secret); |
||||
} |
||||
|
||||
/** |
||||
* Decrypt the given password |
||||
* |
||||
* The token is used as key |
||||
* |
||||
* @param string $password |
||||
* @param string $token |
||||
* @return string the decrypted key |
||||
*/ |
||||
private function decryptPassword($password, $token) { |
||||
$secret = $this->config->getSystemValue('secret'); |
||||
try { |
||||
return $this->crypto->decrypt($password, $token . $secret); |
||||
} catch (Exception $ex) { |
||||
// Delete the invalid token |
||||
$this->invalidateToken($token); |
||||
throw new InvalidTokenException(); |
||||
} |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,42 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Token; |
||||
|
||||
use OC\Authentication\Exceptions\InvalidTokenException; |
||||
|
||||
interface IProvider { |
||||
|
||||
/** |
||||
* @param string $token |
||||
* @throws InvalidTokenException |
||||
* @return IToken |
||||
*/ |
||||
public function validateToken($token); |
||||
|
||||
/** |
||||
* Update token activity timestamp |
||||
* |
||||
* @param IToken $token |
||||
*/ |
||||
public function updateToken(IToken $token); |
||||
} |
||||
@ -0,0 +1,46 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Authentication\Token; |
||||
|
||||
/** |
||||
* @since 9.1.0 |
||||
*/ |
||||
interface IToken { |
||||
|
||||
const TEMPORARY_TOKEN = 0; |
||||
const PERMANENT_TOKEN = 1; |
||||
|
||||
/** |
||||
* Get the token ID |
||||
* |
||||
* @return string |
||||
*/ |
||||
public function getId(); |
||||
|
||||
/** |
||||
* Get the user UID |
||||
* |
||||
* @return string |
||||
*/ |
||||
public function getUID(); |
||||
} |
||||
@ -0,0 +1,94 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace OC\Core\Controller; |
||||
|
||||
use OC\AppFramework\Http; |
||||
use OCP\AppFramework\Http\Response; |
||||
use Test\TestCase; |
||||
|
||||
class TokenControllerTest extends TestCase { |
||||
|
||||
/** \OC\Core\Controller\TokenController */ |
||||
private $tokenController; |
||||
private $request; |
||||
private $userManager; |
||||
private $tokenProvider; |
||||
private $secureRandom; |
||||
|
||||
protected function setUp() { |
||||
parent::setUp(); |
||||
|
||||
$this->request = $this->getMock('\OCP\IRequest'); |
||||
$this->userManager = $this->getMockBuilder('\OC\User\Manager') |
||||
->disableOriginalConstructor() |
||||
->getMock(); |
||||
$this->tokenProvider = $this->getMockBuilder('\OC\Authentication\Token\DefaultTokenProvider') |
||||
->disableOriginalConstructor() |
||||
->getMock(); |
||||
$this->secureRandom = $this->getMock('\OCP\Security\ISecureRandom'); |
||||
|
||||
$this->tokenController = new TokenController('core', $this->request, $this->userManager, $this->tokenProvider, |
||||
$this->secureRandom); |
||||
} |
||||
|
||||
public function testWithoutCredentials() { |
||||
$expected = new Response(); |
||||
$expected->setStatus(Http::STATUS_UNPROCESSABLE_ENTITY); |
||||
|
||||
$actual = $this->tokenController->generateToken(null, null); |
||||
|
||||
$this->assertEquals($expected, $actual); |
||||
} |
||||
|
||||
public function testWithInvalidCredentials() { |
||||
$this->userManager->expects($this->once()) |
||||
->method('checkPassword') |
||||
->with('john', 'passme') |
||||
->will($this->returnValue(false)); |
||||
$expected = new Response(); |
||||
$expected->setStatus(Http::STATUS_UNAUTHORIZED); |
||||
|
||||
$actual = $this->tokenController->generateToken('john', 'passme'); |
||||
|
||||
$this->assertEquals($expected, $actual); |
||||
} |
||||
|
||||
public function testWithValidCredentials() { |
||||
$this->userManager->expects($this->once()) |
||||
->method('checkPassword') |
||||
->with('john', '123456') |
||||
->will($this->returnValue(true)); |
||||
$this->secureRandom->expects($this->once()) |
||||
->method('generate') |
||||
->with(128) |
||||
->will($this->returnValue('verysecurerandomtoken')); |
||||
$expected = [ |
||||
'token' => 'verysecurerandomtoken' |
||||
]; |
||||
|
||||
$actual = $this->tokenController->generateToken('john', '123456'); |
||||
|
||||
$this->assertEquals($expected, $actual); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,57 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace Test\Authentication\Token; |
||||
|
||||
use OC\Authentication\Token\DefaultTokenCleanupJob; |
||||
use Test\TestCase; |
||||
|
||||
class DefaultTokenCleanupJobTest extends TestCase { |
||||
|
||||
/** @var DefaultTokenCleanupJob */ |
||||
private $job; |
||||
private $tokenProvider; |
||||
|
||||
protected function setUp() { |
||||
parent::setUp(); |
||||
|
||||
$this->tokenProvider = $this->getMockBuilder('\OC\Authentication\Token\DefaultTokenProvider') |
||||
->disableOriginalConstructor() |
||||
->getMock(); |
||||
$this->overwriteService('\OC\Authentication\Token\DefaultTokenProvider', $this->tokenProvider); |
||||
$this->job = new DefaultTokenCleanupJob(); |
||||
} |
||||
|
||||
protected function tearDown() { |
||||
parent::tearDown(); |
||||
|
||||
$this->restoreService('\OC\Authentication\Token\DefaultTokenProvider'); |
||||
} |
||||
|
||||
public function testRun() { |
||||
$this->tokenProvider->expects($this->once()) |
||||
->method('invalidateOldTokens') |
||||
->with(); |
||||
$this->invokePrivate($this->job, 'run', [null]); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,144 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace Test\Authentication\Token; |
||||
|
||||
use OC; |
||||
use OC\Authentication\Token\DefaultToken; |
||||
use OC\Authentication\Token\DefaultTokenMapper; |
||||
use OC\Authentication\Token\IToken; |
||||
use OCP\DB\QueryBuilder\IQueryBuilder; |
||||
use Test\TestCase; |
||||
|
||||
/** |
||||
* Class DefaultTokenMapperTest |
||||
* |
||||
* @group DB |
||||
* @package Test\Authentication |
||||
*/ |
||||
class DefaultTokenMapperTest extends TestCase { |
||||
|
||||
/** @var DefaultTokenMapper */ |
||||
private $mapper; |
||||
private $dbConnection; |
||||
private $time; |
||||
|
||||
protected function setUp() { |
||||
parent::setUp(); |
||||
|
||||
$this->dbConnection = OC::$server->getDatabaseConnection(); |
||||
$this->time = time(); |
||||
$this->resetDatabase(); |
||||
|
||||
$this->mapper = new DefaultTokenMapper($this->dbConnection); |
||||
} |
||||
|
||||
private function resetDatabase() { |
||||
$qb = $this->dbConnection->getQueryBuilder(); |
||||
$qb->delete('authtoken')->execute(); |
||||
$qb->insert('authtoken')->values([ |
||||
'uid' => $qb->createNamedParameter('user1'), |
||||
'password' => $qb->createNamedParameter('a75c7116460c082912d8f6860a850904|3nz5qbG1nNSLLi6V|c55365a0e54cfdfac4a175bcf11a7612aea74492277bba6e5d96a24497fa9272488787cb2f3ad34d8b9b8060934fce02f008d371df3ff3848f4aa61944851ff0'), |
||||
'name' => $qb->createNamedParameter('Firefox on Linux'), |
||||
'token' => $qb->createNamedParameter('9c5a2e661482b65597408a6bb6c4a3d1af36337381872ac56e445a06cdb7fea2b1039db707545c11027a4966919918b19d875a8b774840b18c6cbb7ae56fe206'), |
||||
'type' => $qb->createNamedParameter(IToken::TEMPORARY_TOKEN), |
||||
'last_activity' => $qb->createNamedParameter($this->time - 120, IQueryBuilder::PARAM_INT), // Two minutes ago |
||||
])->execute(); |
||||
$qb->insert('authtoken')->values([ |
||||
'uid' => $qb->createNamedParameter('user2'), |
||||
'password' => $qb->createNamedParameter('971a337057853344700bbeccf836519f|UwOQwyb34sJHtqPV|036d4890f8c21d17bbc7b88072d8ef049a5c832a38e97f3e3d5f9186e896c2593aee16883f617322fa242728d0236ff32d163caeb4bd45e14ca002c57a88665f'), |
||||
'name' => $qb->createNamedParameter('Firefox on Android'), |
||||
'token' => $qb->createNamedParameter('1504445f1524fc801035448a95681a9378ba2e83930c814546c56e5d6ebde221198792fd900c88ed5ead0555780dad1ebce3370d7e154941cd5de87eb419899b'), |
||||
'type' => $qb->createNamedParameter(IToken::TEMPORARY_TOKEN), |
||||
'last_activity' => $qb->createNamedParameter($this->time - 60 * 60 * 24 * 3, IQueryBuilder::PARAM_INT), // Three days ago |
||||
])->execute(); |
||||
$qb->insert('authtoken')->values([ |
||||
'uid' => $qb->createNamedParameter('user1'), |
||||
'password' => $qb->createNamedParameter('063de945d6f6b26862d9b6f40652f2d5|DZ/z520tfdXPtd0T|395f6b89be8d9d605e409e20b9d9abe477fde1be38a3223f9e508f979bf906e50d9eaa4dca983ca4fb22a241eb696c3f98654e7775f78c4caf13108f98642b53'), |
||||
'name' => $qb->createNamedParameter('Iceweasel on Linux'), |
||||
'token' => $qb->createNamedParameter('47af8697ba590fb82579b5f1b3b6e8066773a62100abbe0db09a289a62f5d980dc300fa3d98b01d7228468d1ab05c1aa14c8d14bd5b6eee9cdf1ac14864680c3'), |
||||
'type' => $qb->createNamedParameter(IToken::TEMPORARY_TOKEN), |
||||
'last_activity' => $qb->createNamedParameter($this->time - 120, IQueryBuilder::PARAM_INT), // Two minutes ago |
||||
])->execute(); |
||||
} |
||||
|
||||
private function getNumberOfTokens() { |
||||
$qb = $this->dbConnection->getQueryBuilder(); |
||||
$result = $qb->select($qb->createFunction('count(*) as `count`')) |
||||
->from('authtoken') |
||||
->execute() |
||||
->fetch(); |
||||
return (int) $result['count']; |
||||
} |
||||
|
||||
public function testInvalidate() { |
||||
$token = '9c5a2e661482b65597408a6bb6c4a3d1af36337381872ac56e445a06cdb7fea2b1039db707545c11027a4966919918b19d875a8b774840b18c6cbb7ae56fe206'; |
||||
|
||||
$this->mapper->invalidate($token); |
||||
|
||||
$this->assertSame(2, $this->getNumberOfTokens()); |
||||
} |
||||
|
||||
public function testInvalidateInvalid() { |
||||
$token = 'youwontfindthisoneinthedatabase'; |
||||
|
||||
$this->mapper->invalidate($token); |
||||
|
||||
$this->assertSame(3, $this->getNumberOfTokens()); |
||||
} |
||||
|
||||
public function testInvalidateOld() { |
||||
$olderThan = $this->time - 60 * 60; // One hour |
||||
|
||||
$this->mapper->invalidateOld($olderThan); |
||||
|
||||
$this->assertSame(2, $this->getNumberOfTokens()); |
||||
} |
||||
|
||||
public function testGetToken() { |
||||
$token = '1504445f1524fc801035448a95681a9378ba2e83930c814546c56e5d6ebde221198792fd900c88ed5ead0555780dad1ebce3370d7e154941cd5de87eb419899b'; |
||||
$token = new DefaultToken(); |
||||
$token->setUid('user2'); |
||||
$token->setPassword('971a337057853344700bbeccf836519f|UwOQwyb34sJHtqPV|036d4890f8c21d17bbc7b88072d8ef049a5c832a38e97f3e3d5f9186e896c2593aee16883f617322fa242728d0236ff32d163caeb4bd45e14ca002c57a88665f'); |
||||
$token->setName('Firefox on Android'); |
||||
$token->setToken('1504445f1524fc801035448a95681a9378ba2e83930c814546c56e5d6ebde221198792fd900c88ed5ead0555780dad1ebce3370d7e154941cd5de87eb419899b'); |
||||
$token->setType(IToken::TEMPORARY_TOKEN); |
||||
$token->setLastActivity($this->time - 60 * 60 * 24 * 3); |
||||
|
||||
$dbToken = $this->mapper->getToken($token->getToken()); |
||||
|
||||
$token->setId($dbToken->getId()); // We don't know the ID |
||||
$token->resetUpdatedFields(); |
||||
|
||||
$this->assertEquals($token, $dbToken); |
||||
} |
||||
|
||||
/** |
||||
* @expectedException \OCP\AppFramework\Db\DoesNotExistException |
||||
*/ |
||||
public function testGetInvalidToken() { |
||||
$token = 'thisisaninvalidtokenthatisnotinthedatabase'; |
||||
|
||||
$this->mapper->getToken($token); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,199 @@ |
||||
<?php |
||||
|
||||
/** |
||||
* @author Christoph Wurst <christoph@owncloud.com> |
||||
* |
||||
* @copyright Copyright (c) 2016, ownCloud, Inc. |
||||
* @license AGPL-3.0 |
||||
* |
||||
* This code is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License, version 3, |
||||
* as published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License, version 3, |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/> |
||||
* |
||||
*/ |
||||
|
||||
namespace Test\Authentication\Token; |
||||
|
||||
use OC\Authentication\Token\DefaultToken; |
||||
use OC\Authentication\Token\DefaultTokenProvider; |
||||
use OC\Authentication\Token\IToken; |
||||
use OCP\AppFramework\Db\DoesNotExistException; |
||||
use Test\TestCase; |
||||
|
||||
class DefaultTokenProviderTest extends TestCase { |
||||
|
||||
/** @var DefaultTokenProvider */ |
||||
private $tokenProvider; |
||||
private $mapper; |
||||
private $crypto; |
||||
private $config; |
||||
private $logger; |
||||
private $timeFactory; |
||||
private $time; |
||||
|
||||
protected function setUp() { |
||||
parent::setUp(); |
||||
|
||||
$this->mapper = $this->getMockBuilder('\OC\Authentication\Token\DefaultTokenMapper') |
||||
->disableOriginalConstructor() |
||||
->getMock(); |
||||
$this->crypto = $this->getMock('\OCP\Security\ICrypto'); |
||||
$this->config = $this->getMock('\OCP\IConfig'); |
||||
$this->logger = $this->getMock('\OCP\ILogger'); |
||||
$this->timeFactory = $this->getMock('\OCP\AppFramework\Utility\ITimeFactory'); |
||||
$this->time = 1313131; |
||||
$this->timeFactory->expects($this->any()) |
||||
->method('getTime') |
||||
->will($this->returnValue($this->time)); |
||||
|
||||
$this->tokenProvider = new DefaultTokenProvider($this->mapper, $this->crypto, $this->config, $this->logger, |
||||
$this->timeFactory); |
||||
} |
||||
|
||||
public function testGenerateToken() { |
||||
$token = 'token'; |
||||
$uid = 'user'; |
||||
$password = 'passme'; |
||||
$name = 'Some browser'; |
||||
$type = IToken::PERMANENT_TOKEN; |
||||
|
||||
$toInsert = new DefaultToken(); |
||||
$toInsert->setUid($uid); |
||||
$toInsert->setPassword('encryptedpassword'); |
||||
$toInsert->setName($name); |
||||
$toInsert->setToken(hash('sha512', $token . '1f4h9s')); |
||||
$toInsert->setType($type); |
||||
$toInsert->setLastActivity($this->time); |
||||
|
||||
$this->config->expects($this->any()) |
||||
->method('getSystemValue') |
||||
->with('secret') |
||||
->will($this->returnValue('1f4h9s')); |
||||
$this->crypto->expects($this->once()) |
||||
->method('encrypt') |
||||
->with($password, $token . '1f4h9s') |
||||
->will($this->returnValue('encryptedpassword')); |
||||
$this->mapper->expects($this->once()) |
||||
->method('insert') |
||||
->with($this->equalTo($toInsert)); |
||||
|
||||
$actual = $this->tokenProvider->generateToken($token, $uid, $password, $name, $type); |
||||
|
||||
$this->assertEquals($toInsert, $actual); |
||||
} |
||||
|
||||
public function testUpdateToken() { |
||||
$tk = new DefaultToken(); |
||||
$this->mapper->expects($this->once()) |
||||
->method('update') |
||||
->with($tk); |
||||
|
||||
$this->tokenProvider->updateToken($tk); |
||||
|
||||
$this->assertEquals($this->time, $tk->getLastActivity()); |
||||
} |
||||
|
||||
public function testGetPassword() { |
||||
$token = 'token1234'; |
||||
$tk = new DefaultToken(); |
||||
$tk->setPassword('someencryptedvalue'); |
||||
$this->config->expects($this->once()) |
||||
->method('getSystemValue') |
||||
->with('secret') |
||||
->will($this->returnValue('1f4h9s')); |
||||
$this->crypto->expects($this->once()) |
||||
->method('decrypt') |
||||
->with('someencryptedvalue', $token . '1f4h9s') |
||||
->will($this->returnValue('passme')); |
||||
|
||||
$actual = $this->tokenProvider->getPassword($tk, $token); |
||||
|
||||
$this->assertEquals('passme', $actual); |
||||
} |
||||
|
||||
/** |
||||
* @expectedException \OC\Authentication\Exceptions\InvalidTokenException |
||||
*/ |
||||
public function testGetPasswordDeletesInvalidToken() { |
||||
$token = 'token1234'; |
||||
$tk = new DefaultToken(); |
||||
$tk->setPassword('someencryptedvalue'); |
||||
/* @var $tokenProvider DefaultTokenProvider */ |
||||
$tokenProvider = $this->getMockBuilder('\OC\Authentication\Token\DefaultTokenProvider') |
||||
->setMethods([ |
||||
'invalidateToken' |
||||
]) |
||||
->setConstructorArgs([$this->mapper, $this->crypto, $this->config, $this->logger, |
||||
$this->timeFactory]) |
||||
->getMock(); |
||||
$this->config->expects($this->once()) |
||||
->method('getSystemValue') |
||||
->with('secret') |
||||
->will($this->returnValue('1f4h9s')); |
||||
$this->crypto->expects($this->once()) |
||||
->method('decrypt') |
||||
->with('someencryptedvalue', $token . '1f4h9s') |
||||
->will($this->throwException(new \Exception('some crypto error occurred'))); |
||||
$tokenProvider->expects($this->once()) |
||||
->method('invalidateToken') |
||||
->with($token); |
||||
|
||||
$tokenProvider->getPassword($tk, $token); |
||||
} |
||||
|
||||
public function testInvalidateToken() { |
||||
$this->mapper->expects($this->once()) |
||||
->method('invalidate') |
||||
->with(hash('sha512', 'token7')); |
||||
|
||||
$this->tokenProvider->invalidateToken('token7'); |
||||
} |
||||
|
||||
public function testInvalidateOldTokens() { |
||||
$defaultSessionLifetime = 60 * 60 * 24; |
||||
$this->config->expects($this->once()) |
||||
->method('getSystemValue') |
||||
->with('session_lifetime', $defaultSessionLifetime) |
||||
->will($this->returnValue(150)); |
||||
$this->mapper->expects($this->once()) |
||||
->method('invalidateOld') |
||||
->with($this->time - 150); |
||||
|
||||
$this->tokenProvider->invalidateOldTokens(); |
||||
} |
||||
|
||||
public function testValidateToken() { |
||||
$token = 'sometoken'; |
||||
$dbToken = new DefaultToken(); |
||||
$this->mapper->expects($this->once()) |
||||
->method('getToken') |
||||
->with(hash('sha512', $token)) |
||||
->will($this->returnValue($dbToken)); |
||||
|
||||
$actual = $this->tokenProvider->validateToken($token); |
||||
|
||||
$this->assertEquals($dbToken, $actual); |
||||
} |
||||
|
||||
/** |
||||
* @expectedException \OC\Authentication\Exceptions\InvalidTokenException |
||||
*/ |
||||
public function testValidateInvalidToken() { |
||||
$token = 'sometoken'; |
||||
$this->mapper->expects($this->once()) |
||||
->method('getToken') |
||||
->with(hash('sha512', $token)) |
||||
->will($this->throwException(new DoesNotExistException(''))); |
||||
|
||||
$this->tokenProvider->validateToken($token); |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue