backend/tests/web_session_contract.phpPHP
<?php
declare(strict_types=1);
use Machweis\Backend\Auth\AuthGuard;
use Machweis\Backend\Auth\TokenService;
use Machweis\Backend\Config;
use Machweis\Backend\Kernel;
use Machweis\Backend\Logger;
use Machweis\Backend\Request;
require dirname(__DIR__) . '/src/autoload.php';
$config = new Config('test', false, '', 3306, '', '', '', [], false, str_repeat('x', 32), 60, 3600);
$tokens = new TokenService($config);
$access = $tokens->issueAccess(['sub' => 'user-id', 'tid' => 'tenant-id', 'role' => 'owner']);
$guard = new AuthGuard($tokens);
$identity = $guard->requireIdentity(new Request('GET', '/api/v1/web/auth/me', ['cookie' => 'machweis_access=' . rawurlencode($access) . '; machweis_csrf=csrf-token']));
assert($identity['sub'] === 'user-id');
assert($identity['tid'] === 'tenant-id');
$kernel = file_get_contents(dirname(__DIR__) . '/src/Kernel.php');
assert(is_string($kernel));
assert(str_contains($kernel, '/api/v1/web/auth/login'));
assert(str_contains($kernel, 'HttpOnly'));
assert(str_contains($kernel, 'SameSite=Lax'));
assert(str_contains($kernel, 'csrf_failed'));
assert(str_contains($kernel, 'X-CSRF-Token'));
$requiresCsrf = new ReflectionMethod(Machweis\Backend\Kernel::class, 'requiresCsrf');
$staleCookie = new Request('POST', '/api/v1/web/auth/login', ['cookie' => 'machweis_access=stale']);
assert($requiresCsrf->invoke(new Kernel($config, new Logger('test')), $staleCookie) === false);
$protectedRequest = new Request('POST', '/api/v1/company-profile', ['cookie' => 'machweis_access=stale']);
assert($requiresCsrf->invoke(new Kernel($config, new Logger('test')), $protectedRequest) === true);
fwrite(STDOUT, "web_session_contract: OK\n");