608 lines
23 KiB
PHP
608 lines
23 KiB
PHP
<?php
|
|
|
|
namespace Tests\Unit;
|
|
|
|
use CodeIgniter\Test\CIUnitTestCase;
|
|
use App\Helpers\JWTToken;
|
|
use App\Filters\AuthJWT;
|
|
use Firebase\JWT\JWT;
|
|
use CodeIgniter\HTTP\IncomingRequest;
|
|
|
|
class HRAuthenticationTest extends CIUnitTestCase
|
|
{
|
|
private string $jwtSecret = 'test-secret-key-for-unit-tests';
|
|
private int $tokenTimeout = 1800; // 30 minutes
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
putenv("JWT_SECRET={$this->jwtSecret}");
|
|
putenv("TOKENTIMEOUT={$this->tokenTimeout}");
|
|
|
|
$_ENV['JWT_SECRET'] = $this->jwtSecret;
|
|
$_SERVER['JWT_SECRET'] = $this->jwtSecret;
|
|
}
|
|
|
|
protected function tearDown(): void
|
|
{
|
|
putenv('JWT_SECRET');
|
|
putenv('TOKENTIMEOUT');
|
|
unset($_ENV['JWT_SECRET'], $_SERVER['JWT_SECRET']);
|
|
|
|
parent::tearDown();
|
|
}
|
|
|
|
// ── Helpers ──
|
|
|
|
private function createToken(array $payload, string $algo = 'HS512'): string
|
|
{
|
|
return JWT::encode($payload, $this->jwtSecret, $algo);
|
|
}
|
|
|
|
private function bearerHeader(array $payload): string
|
|
{
|
|
return 'Bearer ' . $this->createToken($payload);
|
|
}
|
|
|
|
private function createMockRequest(string $authHeader): IncomingRequest
|
|
{
|
|
$request = $this->createMock(IncomingRequest::class);
|
|
$request->method('getHeaderLine')
|
|
->with('Authorization')
|
|
->willReturn($authHeader);
|
|
|
|
return $request;
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 1. validateJWT — Header Format Validation
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testValidateJWT_RejectsEmptyHeader()
|
|
{
|
|
$result = JWTToken::validateJWT('');
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid Authorization header', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsMissingBearerPrefix()
|
|
{
|
|
$token = $this->createToken(['id' => 1]);
|
|
|
|
$result = JWTToken::validateJWT($token);
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid Authorization header', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsBasicAuthScheme()
|
|
{
|
|
$result = JWTToken::validateJWT('Basic dXNlcjpwYXNz');
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid Authorization header', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsBearerWithExtraSpaces()
|
|
{
|
|
$token = $this->createToken(['id' => 1]);
|
|
|
|
$result = JWTToken::validateJWT("Bearer $token");
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid Authorization header', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_BearerIsCaseSensitive()
|
|
{
|
|
$token = $this->createToken(['id' => 1]);
|
|
|
|
$result = JWTToken::validateJWT("bearer $token");
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid Authorization header', $result['message']);
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 2. validateJWT — JWT Structure Validation
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testValidateJWT_RejectsMalformedJWT_TwoParts()
|
|
{
|
|
$result = JWTToken::validateJWT('Bearer header.payload');
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Malformed JWT', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsMalformedJWT_FourParts()
|
|
{
|
|
$result = JWTToken::validateJWT('Bearer a.b.c.d');
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Malformed JWT', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsMalformedJWT_SinglePart()
|
|
{
|
|
$result = JWTToken::validateJWT('Bearer notajwt');
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Malformed JWT', $result['message']);
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 3. validateJWT — Algorithm Security
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testValidateJWT_RejectsNoneAlgorithm()
|
|
{
|
|
$header = base64_encode(json_encode(['alg' => 'none', 'typ' => 'JWT']));
|
|
$payload = base64_encode(json_encode(['id' => 1]));
|
|
$fakeToken = "$header.$payload.";
|
|
|
|
$result = JWTToken::validateJWT("Bearer $fakeToken");
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid or unsupported JWT algorithm', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsMissingAlgorithm()
|
|
{
|
|
$header = base64_encode(json_encode(['typ' => 'JWT']));
|
|
$payload = base64_encode(json_encode(['id' => 1]));
|
|
$fakeToken = "$header.$payload.fakesig";
|
|
|
|
$result = JWTToken::validateJWT("Bearer $fakeToken");
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid or unsupported JWT algorithm', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsHS256Algorithm()
|
|
{
|
|
$token = JWT::encode(['id' => 1], $this->jwtSecret, 'HS256');
|
|
|
|
$result = JWTToken::validateJWT("Bearer $token");
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid or unsupported JWT algorithm', $result['message']);
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 4. validateJWT — Signature Validation
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testValidateJWT_RejectsTokenSignedWithWrongSecret()
|
|
{
|
|
$token = JWT::encode(['id' => 1, 'pre_hr_id' => 5], 'attacker-secret', 'HS512');
|
|
|
|
$result = JWTToken::validateJWT("Bearer $token");
|
|
|
|
$this->assertFalse($result['status']);
|
|
$this->assertEquals('Invalid token signature', $result['message']);
|
|
}
|
|
|
|
public function testValidateJWT_RejectsTamperedPayload()
|
|
{
|
|
$token = $this->createToken(['id' => 1, 'pre_hr_id' => 5]);
|
|
$parts = explode('.', $token);
|
|
|
|
// Attacker tampers payload to escalate to a different branch
|
|
$parts[1] = rtrim(base64_encode(json_encode(['id' => 1, 'pre_hr_id' => 999])), '=');
|
|
$tampered = implode('.', $parts);
|
|
|
|
$result = JWTToken::validateJWT("Bearer $tampered");
|
|
|
|
$this->assertFalse($result['status']);
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 5. validateJWT — Valid Token Decoding
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testValidateJWT_AcceptsValidHRToken()
|
|
{
|
|
$payload = [
|
|
'id' => 10,
|
|
'pre_hr_id' => 5,
|
|
'pre_client_id' => md5('1'),
|
|
'pre_branch_id' => 1,
|
|
'post_client_id' => md5('2'),
|
|
'allowed_modules' => '["dashboard","reports"]',
|
|
];
|
|
|
|
$result = JWTToken::validateJWT($this->bearerHeader($payload));
|
|
|
|
$this->assertTrue($result['status']);
|
|
$this->assertArrayHasKey('decoded', $result);
|
|
$this->assertEquals(5, $result['decoded']['pre_hr_id']);
|
|
$this->assertEquals(10, $result['decoded']['id']);
|
|
$this->assertEquals(1, $result['decoded']['pre_branch_id']);
|
|
}
|
|
|
|
public function testValidateJWT_AcceptsValidEmployeeToken()
|
|
{
|
|
$payload = [
|
|
'id' => 1,
|
|
'emp_code' => 'EMP001',
|
|
'token_type' => 'pre',
|
|
];
|
|
|
|
$result = JWTToken::validateJWT($this->bearerHeader($payload));
|
|
|
|
$this->assertTrue($result['status']);
|
|
$this->assertEquals('EMP001', $result['decoded']['emp_code']);
|
|
}
|
|
|
|
public function testValidateJWT_PreservesAllPayloadFields()
|
|
{
|
|
$payload = [
|
|
'id' => 10,
|
|
'pre_hr_id' => 5,
|
|
'pre_client_id' => 'hashed_client',
|
|
'pre_branch_id' => 3,
|
|
'post_client_id' => 'hashed_post',
|
|
'allowed_modules' => '["m1"]',
|
|
];
|
|
|
|
$result = JWTToken::validateJWT($this->bearerHeader($payload));
|
|
$decoded = $result['decoded'];
|
|
|
|
$this->assertEquals($payload['pre_hr_id'], $decoded['pre_hr_id']);
|
|
$this->assertEquals($payload['pre_branch_id'], $decoded['pre_branch_id']);
|
|
$this->assertEquals($payload['pre_client_id'], $decoded['pre_client_id']);
|
|
$this->assertEquals($payload['post_client_id'], $decoded['post_client_id']);
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 6. Token Differentiation (HR vs Employee)
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testHRToken_DoesNotContainEmpCode()
|
|
{
|
|
$hrPayload = ['id' => 10, 'pre_hr_id' => 5, 'pre_branch_id' => 1];
|
|
|
|
$result = JWTToken::validateJWT($this->bearerHeader($hrPayload));
|
|
|
|
$this->assertTrue($result['status']);
|
|
$this->assertArrayNotHasKey('emp_code', $result['decoded']);
|
|
}
|
|
|
|
public function testEmployeeToken_ContainsEmpCode()
|
|
{
|
|
$empPayload = ['id' => 1, 'emp_code' => 'EMP001'];
|
|
|
|
$result = JWTToken::validateJWT($this->bearerHeader($empPayload));
|
|
|
|
$this->assertTrue($result['status']);
|
|
$this->assertArrayHasKey('emp_code', $result['decoded']);
|
|
}
|
|
|
|
public function testFilterRoutesHRToLevelContactModel()
|
|
{
|
|
$decoded = ['id' => 10, 'pre_hr_id' => 5, 'pre_branch_id' => 1];
|
|
|
|
$this->assertFalse(isset($decoded['emp_code']), 'HR token should NOT have emp_code');
|
|
$id = $decoded['pre_hr_id'] ?? null;
|
|
$this->assertEquals(5, $id, 'HR lookup should use pre_hr_id');
|
|
}
|
|
|
|
public function testFilterRoutesEmployeeToEmployeeModel()
|
|
{
|
|
$decoded = ['id' => 1, 'emp_code' => 'EMP001'];
|
|
|
|
$this->assertTrue(isset($decoded['emp_code']), 'Employee token should have emp_code');
|
|
$id = $decoded['id'] ?? null;
|
|
$this->assertEquals(1, $id, 'Employee lookup should use id');
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 7. Multi-Branch Token Generation
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testEachBranchGetsUniqueToken()
|
|
{
|
|
$clientId = md5('42');
|
|
$branches = [
|
|
['id' => 10, 'pre_hr_id' => 5, 'pre_client_id' => $clientId, 'pre_branch_id' => 1],
|
|
['id' => 11, 'pre_hr_id' => 6, 'pre_client_id' => $clientId, 'pre_branch_id' => 2],
|
|
['id' => 12, 'pre_hr_id' => 7, 'pre_client_id' => $clientId, 'pre_branch_id' => 3],
|
|
];
|
|
|
|
$tokens = [];
|
|
foreach ($branches as $branch) {
|
|
$token = $this->createToken($branch);
|
|
$result = JWTToken::validateJWT("Bearer $token");
|
|
|
|
$this->assertTrue($result['status']);
|
|
$this->assertEquals($clientId, $result['decoded']['pre_client_id']);
|
|
$tokens[] = $token;
|
|
}
|
|
|
|
$this->assertCount(3, array_unique($tokens), 'Each branch must produce a distinct token');
|
|
}
|
|
|
|
public function testBranchTokensDecodeToCorrectBranchId()
|
|
{
|
|
$branchIds = [1, 2, 3];
|
|
|
|
foreach ($branchIds as $i => $branchId) {
|
|
$payload = [
|
|
'id' => 10 + $i,
|
|
'pre_hr_id' => 5 + $i,
|
|
'pre_branch_id' => $branchId,
|
|
];
|
|
|
|
$result = JWTToken::validateJWT($this->bearerHeader($payload));
|
|
|
|
$this->assertTrue($result['status']);
|
|
$this->assertEquals($branchId, $result['decoded']['pre_branch_id']);
|
|
}
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 8. Sliding Expiration Logic
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testTokenTimeoutEnvIsReadable()
|
|
{
|
|
$this->assertEquals($this->tokenTimeout, (int)getenv('TOKENTIMEOUT'));
|
|
}
|
|
|
|
public function testNewExpiryIsInTheFuture()
|
|
{
|
|
$before = time();
|
|
$newExpiry = time() + (int)getenv('TOKENTIMEOUT');
|
|
|
|
$this->assertGreaterThanOrEqual($before + $this->tokenTimeout, $newExpiry);
|
|
}
|
|
|
|
public function testActiveTokenPassesExpiryCheck()
|
|
{
|
|
$tokenTimeOut = time() + 600;
|
|
|
|
$this->assertGreaterThan(time(), $tokenTimeOut, 'Active token_time_out must be in the future');
|
|
}
|
|
|
|
public function testExpiredTokenFailsExpiryCheck()
|
|
{
|
|
$tokenTimeOut = time() - 1;
|
|
|
|
$this->assertLessThanOrEqual(time(), $tokenTimeOut, 'Expired token_time_out must be <= current time');
|
|
}
|
|
|
|
public function testNullExpiryFailsExpiryCheck()
|
|
{
|
|
$tokenTimeOut = null;
|
|
|
|
$this->assertTrue($tokenTimeOut <= time(), 'null token_time_out should fail the expiry check');
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 9. Multi-Branch Refresh Logic (the fix)
|
|
// ═══════════════════════════════════════════════
|
|
|
|
public function testBranchRefresh_UsesMobileWhenAvailable()
|
|
{
|
|
$user = ['mobile' => '9876543210', 'email' => 'hr@test.com'];
|
|
|
|
$field = !empty($user['mobile']) ? 'mobile' : 'email';
|
|
|
|
$this->assertEquals('mobile', $field);
|
|
$this->assertEquals('9876543210', $user[$field]);
|
|
}
|
|
|
|
public function testBranchRefresh_FallsBackToEmailWhenMobileEmpty()
|
|
{
|
|
$user = ['mobile' => '', 'email' => 'hr@test.com'];
|
|
|
|
$field = !empty($user['mobile']) ? 'mobile' : 'email';
|
|
|
|
$this->assertEquals('email', $field);
|
|
$this->assertEquals('hr@test.com', $user[$field]);
|
|
}
|
|
|
|
public function testBranchRefresh_FallsBackToEmailWhenMobileNull()
|
|
{
|
|
$user = ['mobile' => null, 'email' => 'hr@test.com'];
|
|
|
|
$field = !empty($user['mobile']) ? 'mobile' : 'email';
|
|
|
|
$this->assertEquals('email', $field);
|
|
}
|
|
|
|
public function testBranchRefresh_HRUserTakesMultiBranchPath()
|
|
{
|
|
$decoded = ['id' => 10, 'pre_hr_id' => 5, 'pre_branch_id' => 1];
|
|
|
|
$isMultiBranch = !isset($decoded['emp_code']);
|
|
|
|
$this->assertTrue($isMultiBranch, 'HR user (no emp_code) should take the multi-branch refresh path');
|
|
}
|
|
|
|
public function testBranchRefresh_EmployeeTakesSingleRowPath()
|
|
{
|
|
$decoded = ['id' => 1, 'emp_code' => 'EMP001'];
|
|
|
|
$isSingleRow = isset($decoded['emp_code']);
|
|
|
|
$this->assertTrue($isSingleRow, 'Employee (with emp_code) should take the single-row refresh path');
|
|
}
|
|
|
|
/**
|
|
* Simulates the branch-switching scenario to verify the refresh logic
|
|
* targets all branches, not just the active one.
|
|
*/
|
|
public function testBranchRefresh_SimulateMultiBranchExpiryUpdate()
|
|
{
|
|
$sameMobile = '9876543210';
|
|
|
|
// Three level_contacts rows for the same HR person across branches
|
|
$branchRows = [
|
|
['id' => 5, 'mobile' => $sameMobile, 'email' => 'hr@test.com', 'contact_type' => 'client', 'is_active' => 1, 'token_time_out' => time() + 1800],
|
|
['id' => 6, 'mobile' => $sameMobile, 'email' => 'hr@test.com', 'contact_type' => 'client', 'is_active' => 1, 'token_time_out' => time() + 1800],
|
|
['id' => 7, 'mobile' => $sameMobile, 'email' => 'hr@test.com', 'contact_type' => 'client', 'is_active' => 1, 'token_time_out' => time() + 1800],
|
|
];
|
|
|
|
// User is on Branch A (id=5). AuthJWT decoded token says pre_hr_id = 5.
|
|
$currentUser = $branchRows[0];
|
|
$decoded = ['id' => 10, 'pre_hr_id' => 5, 'pre_branch_id' => 1];
|
|
|
|
// The filter's multi-branch refresh logic:
|
|
$field = !empty($currentUser['mobile']) ? 'mobile' : 'email';
|
|
$newExpiry = time() + $this->tokenTimeout;
|
|
|
|
// Simulate: update all rows where $field matches (same as the WHERE clause in AuthJWT)
|
|
$updatedRows = array_filter($branchRows, function ($row) use ($field, $currentUser) {
|
|
return $row[$field] === $currentUser[$field]
|
|
&& $row['contact_type'] === 'client'
|
|
&& $row['is_active'] === 1;
|
|
});
|
|
|
|
foreach ($updatedRows as &$row) {
|
|
$row['token_time_out'] = $newExpiry;
|
|
}
|
|
unset($row);
|
|
|
|
// ALL three branches must have the new expiry
|
|
$this->assertCount(3, $updatedRows, 'All three branch rows should be updated');
|
|
foreach ($updatedRows as $row) {
|
|
$this->assertEquals($newExpiry, $row['token_time_out']);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Contrast test: the old single-row logic would only update one branch.
|
|
*/
|
|
public function testBranchRefresh_OldLogicWouldLeaveOtherBranchesStale()
|
|
{
|
|
$loginTime = time();
|
|
$timeout = $this->tokenTimeout;
|
|
$sameMobile = '9876543210';
|
|
|
|
$branchRows = [
|
|
['id' => 5, 'mobile' => $sameMobile, 'token_time_out' => $loginTime + $timeout],
|
|
['id' => 6, 'mobile' => $sameMobile, 'token_time_out' => $loginTime + $timeout],
|
|
['id' => 7, 'mobile' => $sameMobile, 'token_time_out' => $loginTime + $timeout],
|
|
];
|
|
|
|
// Simulate 20 minutes of activity on Branch A only (old single-row logic)
|
|
$simulatedNow = $loginTime + 1200; // 20 min later
|
|
$branchRows[0]['token_time_out'] = $simulatedNow + $timeout; // only branch A refreshed
|
|
|
|
// Branch B and C still have the original login-time expiry
|
|
$this->assertEquals($loginTime + $timeout, $branchRows[1]['token_time_out']);
|
|
$this->assertEquals($loginTime + $timeout, $branchRows[2]['token_time_out']);
|
|
|
|
// After 31 minutes, Branch B and C would be expired
|
|
$switchTime = $loginTime + 1860; // 31 min later
|
|
$this->assertLessThanOrEqual($switchTime, $branchRows[1]['token_time_out'],
|
|
'OLD logic: Branch B would have expired by the time user switches');
|
|
$this->assertLessThanOrEqual($switchTime, $branchRows[2]['token_time_out'],
|
|
'OLD logic: Branch C would have expired by the time user switches');
|
|
|
|
// But Branch A is still alive
|
|
$this->assertGreaterThan($switchTime, $branchRows[0]['token_time_out'],
|
|
'Branch A stays alive because it was actively refreshed');
|
|
}
|
|
|
|
/**
|
|
* Proves the new logic keeps all branches alive.
|
|
*/
|
|
public function testBranchRefresh_NewLogicKeepsAllBranchesAlive()
|
|
{
|
|
$loginTime = time();
|
|
$timeout = $this->tokenTimeout;
|
|
$sameMobile = '9876543210';
|
|
|
|
$branchRows = [
|
|
['id' => 5, 'mobile' => $sameMobile, 'token_time_out' => $loginTime + $timeout],
|
|
['id' => 6, 'mobile' => $sameMobile, 'token_time_out' => $loginTime + $timeout],
|
|
['id' => 7, 'mobile' => $sameMobile, 'token_time_out' => $loginTime + $timeout],
|
|
];
|
|
|
|
// Simulate 20 minutes of activity on Branch A (new multi-branch logic)
|
|
$simulatedNow = $loginTime + 1200;
|
|
$newExpiry = $simulatedNow + $timeout;
|
|
|
|
// New logic refreshes ALL rows with same mobile
|
|
foreach ($branchRows as &$row) {
|
|
if ($row['mobile'] === $sameMobile) {
|
|
$row['token_time_out'] = $newExpiry;
|
|
}
|
|
}
|
|
unset($row);
|
|
|
|
// After 31 minutes from login, ALL branches are still alive
|
|
$switchTime = $loginTime + 1860;
|
|
|
|
foreach ($branchRows as $i => $row) {
|
|
$this->assertGreaterThan($switchTime, $row['token_time_out'],
|
|
"NEW logic: Branch id={$row['id']} should still be alive after switching");
|
|
}
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════
|
|
// 10. AuthJWT Filter — Rejection Tests
|
|
// ═══════════════════════════════════════════════
|
|
|
|
private function createFilter(): AuthJWT
|
|
{
|
|
// AuthJWT has require_once('../vendor/autoload.php') which resolves
|
|
// relative to CWD. In Apache CWD is public/, in PHPUnit it's the
|
|
// project root. Temporarily switch CWD so the require resolves.
|
|
$cwd = getcwd();
|
|
chdir(PUBLICPATH);
|
|
try {
|
|
return new AuthJWT();
|
|
} finally {
|
|
chdir($cwd);
|
|
}
|
|
}
|
|
|
|
public function testFilter_RejectsMissingAuthHeader()
|
|
{
|
|
$filter = $this->createFilter();
|
|
$request = $this->createMockRequest('');
|
|
|
|
$result = $filter->before($request);
|
|
|
|
$this->assertNotTrue($result, 'Filter must reject requests without Authorization header');
|
|
}
|
|
|
|
public function testFilter_RejectsInvalidJWT()
|
|
{
|
|
$filter = $this->createFilter();
|
|
$request = $this->createMockRequest('Bearer not.a.valid-jwt');
|
|
|
|
$result = $filter->before($request);
|
|
|
|
$this->assertNotTrue($result, 'Filter must reject requests with an invalid JWT');
|
|
}
|
|
|
|
public function testFilter_RejectsTokenWithoutId()
|
|
{
|
|
$token = $this->createToken(['name' => 'no-id-field']);
|
|
$filter = $this->createFilter();
|
|
$request = $this->createMockRequest("Bearer $token");
|
|
|
|
$result = $filter->before($request);
|
|
|
|
$this->assertNotTrue($result, 'Filter must reject tokens without an id field');
|
|
}
|
|
|
|
public function testFilter_RejectsWrongAlgorithmToken()
|
|
{
|
|
$token = JWT::encode(['id' => 1], $this->jwtSecret, 'HS256');
|
|
$filter = $this->createFilter();
|
|
$request = $this->createMockRequest("Bearer $token");
|
|
|
|
$result = $filter->before($request);
|
|
|
|
$this->assertNotTrue($result, 'Filter must reject tokens using non-HS512 algorithms');
|
|
}
|
|
}
|