View | Details | Raw Unified | Return to bug 30962
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/password_validation.t (-1 / +258 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
#
4
# This file is part of Koha
5
#
6
# Koha is free software; you can redistribute it and/or modify it
7
# under the terms of the GNU General Public License as published by
8
# the Free Software Foundation; either version 3 of the License, or
9
# (at your option) any later version.
10
#
11
# Koha is distributed in the hope that it will be useful, but
12
# WITHOUT ANY WARRANTY; without even the implied warranty of
13
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14
# GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License
17
# along with Koha; if not, see <http://www.gnu.org/licenses>.
18
19
use Modern::Perl;
20
21
use Test::More tests => 7;
22
use Test::Mojo;
23
use Test::Warn;
24
use Mojo::JWT;
25
use Crypt::OpenSSL::RSA;
26
27
use t::lib::TestBuilder;
28
use t::lib::Mocks;
29
30
use Koha::Database;
31
use Koha::AuthUtils;
32
use C4::Auth;
33
use Data::Dumper;
34
35
my $schema  = Koha::Database->new->schema;
36
my $builder = t::lib::TestBuilder->new;
37
38
# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
39
# this affects the other REST api tests
40
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
41
42
my $remote_address = '127.0.0.1';
43
44
subtest 'password validation - success' => sub {
45
    plan tests => 3;
46
47
    $schema->storage->txn_begin;
48
49
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 1 } );
50
    my $patron = Koha::Patrons->find($borrowernumber);
51
    my $userid = $patron->userid;
52
53
    my $t = Test::Mojo->new('Koha::REST::V1');
54
55
    my $json = {
56
        "username" => $userid,
57
        "password" => "test",
58
    };
59
60
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => $json );
61
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
62
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
63
64
    my $resp = $t->request_ok($tx);
65
    $resp->content_is('');
66
    $resp->status_is(204);
67
68
    $schema->storage->txn_rollback;
69
};
70
71
subtest 'password validation - account lock out' => sub {
72
    plan tests => 6;
73
74
    $schema->storage->txn_begin;
75
76
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 1 } );
77
    my $patron = Koha::Patrons->find($borrowernumber);
78
    my $userid = $patron->userid;
79
80
    my $t = Test::Mojo->new('Koha::REST::V1');
81
82
    t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
83
84
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => { "username" => $userid, "password" => "bad"} );
85
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
86
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
87
    my $resp = $t->request_ok($tx);
88
    $resp->json_is('/error' => 'Validation failed');
89
    $resp->status_is(400);
90
91
    my $tx2 = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => { "username" => $userid, "password" => "test"} );
92
    $tx2->req->cookies( { name => 'CGISESSID', value => $session_id } );
93
    $tx2->req->env( { REMOTE_ADDR => $remote_address } );
94
    my $resp2 = $t->request_ok($tx2);
95
    $resp2->json_is('/error' => 'Validation failed');
96
    $resp2->status_is(400);
97
98
    $schema->storage->txn_rollback;
99
};
100
101
102
subtest 'password validation - bad username' => sub {
103
    plan tests => 3;
104
105
    $schema->storage->txn_begin;
106
107
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 1 } );
108
    my $patron = Koha::Patrons->find($borrowernumber);
109
    my $userid = $patron->userid;
110
111
    my $t = Test::Mojo->new('Koha::REST::V1');
112
113
    my $json = {
114
        "username" => '1234567890abcdefghijklmnopqrstuvwxyz@koha-community.org',
115
        "password" => "test",
116
    };
117
118
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => $json );
119
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
120
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
121
122
    my $resp = $t->request_ok($tx);
123
    $resp->json_is('/error' => 'Validation failed');
124
    $resp->status_is(400);
125
126
    $schema->storage->txn_rollback;
127
};
128
129
subtest 'password validation - bad password' => sub {
130
    plan tests => 3;
131
132
    $schema->storage->txn_begin;
133
134
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 1 } );
135
    my $patron = Koha::Patrons->find($borrowernumber);
136
    my $userid = $patron->userid;
137
138
    my $t = Test::Mojo->new('Koha::REST::V1');
139
140
    my $json = {
141
        "username" => $userid,
142
        "password" => "bad",
143
    };
144
145
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => $json );
146
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
147
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
148
149
    my $resp = $t->request_ok($tx);
150
    $resp->json_is('/error' => 'Validation failed');
151
    $resp->status_is(400);
152
153
    $schema->storage->txn_rollback;
154
};
155
156
subtest 'password validation - syntax error in payload' => sub {
157
    plan tests => 3;
158
159
    $schema->storage->txn_begin;
160
161
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 1 } );
162
    my $patron = Koha::Patrons->find($borrowernumber);
163
    my $userid = $patron->userid;
164
165
    my $t = Test::Mojo->new('Koha::REST::V1');
166
167
    my $json = {
168
        "username" => $userid,
169
        "password2" => "test",
170
    };
171
172
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => $json );
173
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
174
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
175
176
    my $resp = $t->request_ok($tx);
177
    $resp->json_is('' => {"errors" => [{"message" => "Properties not allowed: password2.","path" => "\/body"}],"status" => 400} );
178
    $resp->status_is(400);
179
180
    $schema->storage->txn_rollback;
181
};
182
183
subtest 'password validation - unauthorized user' => sub {
184
    plan tests => 3;
185
186
    $schema->storage->txn_begin;
187
188
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 0 } );
189
    my $patron = Koha::Patrons->find($borrowernumber);
190
    my $userid = $patron->userid;
191
192
    my $t = Test::Mojo->new('Koha::REST::V1');
193
194
    my $json = {
195
        "username" => $userid,
196
        "password" => "test",
197
    };
198
199
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => $json );
200
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
201
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
202
203
    my $resp = $t->request_ok($tx);
204
    $resp->json_is('/error' => 'Authorization failure. Missing required permission(s).');
205
    $resp->status_is(403);
206
207
    $schema->storage->txn_rollback;
208
};
209
210
subtest 'password validation - unauthenticated user' => sub {
211
    plan tests => 3;
212
213
    $schema->storage->txn_begin;
214
215
    my ( $borrowernumber, $session_id ) = create_user_and_session( { authorized => 0 } );
216
    my $patron = Koha::Patrons->find($borrowernumber);
217
    my $userid = $patron->userid;
218
219
    my $t = Test::Mojo->new('Koha::REST::V1');
220
221
    my $json = {
222
        "username" => $userid,
223
        "password" => "test",
224
    };
225
226
    my $tx = $t->ua->build_tx( POST => "/api/v1/auth/password/validation", json => $json );
227
    #$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
228
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
229
230
    my $resp = $t->request_ok($tx);
231
    $resp->json_is('/error' => 'Authentication failure.');
232
    $resp->status_is(401);
233
234
    $schema->storage->txn_rollback;
235
};
236
237
sub create_user_and_session {
238
239
    my $args  = shift;
240
    my $flags = ( $args->{authorized} ) ? 1 : 0;
241
242
    my $password = Koha::AuthUtils::hash_password('test');
243
    my $user = $builder->build(
244
        {   source => 'Borrower',
245
            value  => { flags => $flags, password => $password }
246
        }
247
    );
248
249
    # Create a session for the authorized user
250
    my $session = C4::Auth::get_session('');
251
    $session->param( 'number',   $user->{borrowernumber} );
252
    $session->param( 'id',       $user->{userid} );
253
    $session->param( 'ip',       $remote_address );
254
    $session->param( 'lasttime', time() );
255
    $session->flush;
256
257
    return ( $user->{borrowernumber}, $session->id );
258
}

Return to bug 30962