mirror of https://github.com/pixelfed/pixelfed
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
2.2 KiB
PHP
72 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Unit;
|
|
|
|
use App\Http\Controllers\OAuth\OobAuthorizationController;
|
|
use Laravel\Passport\Bridge\Client;
|
|
use League\OAuth2\Server\RequestTypes\AuthorizationRequest;
|
|
use PHPUnit\Framework\Attributes\Test;
|
|
use ReflectionMethod;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* isOutOfBandRequest() must detect an OOB client even when redirect_uri is
|
|
* omitted on the authorize request (RFC 6749 §3.1.2.3), in which case the
|
|
* league server leaves the auth request's redirect URI null.
|
|
*/
|
|
class OobAuthorizationTest extends TestCase
|
|
{
|
|
private function isOob(AuthorizationRequest $req): bool
|
|
{
|
|
$controller = app(OobAuthorizationController::class);
|
|
$m = new ReflectionMethod($controller, 'isOutOfBandRequest');
|
|
$m->setAccessible(true);
|
|
|
|
return $m->invoke($controller, $req);
|
|
}
|
|
|
|
private function authRequest(?string $redirectUri, array $registered): AuthorizationRequest
|
|
{
|
|
$client = new Client('cid', 'Test App', $registered);
|
|
$req = new AuthorizationRequest;
|
|
$req->setClient($client);
|
|
$req->setRedirectUri($redirectUri);
|
|
|
|
return $req;
|
|
}
|
|
|
|
#[Test]
|
|
public function it_detects_oob_when_redirect_uri_is_explicitly_set(): void
|
|
{
|
|
$req = $this->authRequest('urn:ietf:wg:oauth:2.0:oob', ['urn:ietf:wg:oauth:2.0:oob']);
|
|
|
|
$this->assertTrue($this->isOob($req));
|
|
}
|
|
|
|
#[Test]
|
|
public function it_detects_oob_when_redirect_uri_is_omitted_for_oob_only_client(): void
|
|
{
|
|
// redirect_uri omitted -> null on the auth request; client registered
|
|
// only the OOB URI.
|
|
$req = $this->authRequest(null, ['urn:ietf:wg:oauth:2.0:oob']);
|
|
|
|
$this->assertTrue($this->isOob($req));
|
|
}
|
|
|
|
#[Test]
|
|
public function it_does_not_treat_a_normal_http_client_as_oob(): void
|
|
{
|
|
$req = $this->authRequest('https://app.example/callback', ['https://app.example/callback']);
|
|
|
|
$this->assertFalse($this->isOob($req));
|
|
}
|
|
|
|
#[Test]
|
|
public function it_does_not_treat_an_omitted_redirect_for_a_multi_uri_client_as_oob(): void
|
|
{
|
|
$req = $this->authRequest(null, ['urn:ietf:wg:oauth:2.0:oob', 'https://app.example/callback']);
|
|
|
|
$this->assertFalse($this->isOob($req));
|
|
}
|
|
}
|