backend/tests/auth_header_contract.phpPHP
<?php
declare(strict_types=1);
use Machweis\Backend\Auth\AuthGuard;
use Machweis\Backend\Auth\TokenService;
use Machweis\Backend\Config;
use Machweis\Backend\Request;
require dirname(__DIR__) . '/src/autoload.php';
$htaccess = file_get_contents(dirname(__DIR__) . '/deployment/public-root/.htaccess');
assert(is_string($htaccess));
assert(str_contains($htaccess, 'E=HTTP_AUTHORIZATION:%1'));
assert(str_contains($htaccess, 'SetEnvIfNoCase Authorization'));
$config = new Config('test', false, '', 3306, '', '', '', [], false, str_repeat('x', 32), 60, 3600);
$tokens = new TokenService($config);
$access = $tokens->issueAccess(['sub' => 'user-id', 'tid' => 'tenant-id', 'role' => 'owner']);
$guard = new AuthGuard($tokens);
$originalServer = $_SERVER;
$originalEnvironment = [
'HTTP_AUTHORIZATION' => getenv('HTTP_AUTHORIZATION'),
'REDIRECT_HTTP_AUTHORIZATION' => getenv('REDIRECT_HTTP_AUTHORIZATION'),
'REDIRECT_REDIRECT_HTTP_AUTHORIZATION' => getenv('REDIRECT_REDIRECT_HTTP_AUTHORIZATION'),
];
try {
$_SERVER['REQUEST_METHOD'] = 'GET';
$_SERVER['REQUEST_URI'] = '/api/v1/auth/me';
unset($_SERVER['Authorization']);
putenv('HTTP_AUTHORIZATION');
putenv('REDIRECT_HTTP_AUTHORIZATION');
putenv('REDIRECT_REDIRECT_HTTP_AUTHORIZATION');
unset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']);
$_SERVER['HTTP_AUTHORIZATION'] = 'Bearer ' . $access;
$identity = $guard->requireIdentity(Request::fromGlobals());
assert($identity['sub'] === 'user-id');
assert($identity['tid'] === 'tenant-id');
unset($_SERVER['HTTP_AUTHORIZATION']);
$_SERVER['REDIRECT_HTTP_AUTHORIZATION'] = 'Bearer ' . $access;
$redirectedIdentity = $guard->requireIdentity(Request::fromGlobals());
assert($redirectedIdentity['sub'] === 'user-id');
assert($redirectedIdentity['role'] === 'owner');
unset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']);
$_SERVER['REDIRECT_REDIRECT_HTTP_AUTHORIZATION'] = 'Bearer ' . $access;
$doubleRedirectIdentity = $guard->requireIdentity(Request::fromGlobals());
assert($doubleRedirectIdentity['tid'] === 'tenant-id');
unset($_SERVER['REDIRECT_REDIRECT_HTTP_AUTHORIZATION']);
putenv('HTTP_AUTHORIZATION=Bearer ' . $access);
$environmentIdentity = $guard->requireIdentity(Request::fromGlobals());
assert($environmentIdentity['role'] === 'owner');
} finally {
$_SERVER = $originalServer;
foreach ($originalEnvironment as $name => $value) {
putenv($value === false ? $name : $name . '=' . $value);
}
}
fwrite(STDOUT, "auth_header_contract: OK\n");