tests/phpunit/includes/auth/AuthManagerTest.php

   1 <?php
   2
   3 namespace MediaWiki\Auth;
   4
   5 use Config;
   6 use MediaWiki\Block\DatabaseBlock;
   7 use MediaWiki\Session\SessionInfo;
   8 use MediaWiki\Session\UserInfo;
   9 use Psr\Log\LoggerInterface;
  10 use Psr\Log\LogLevel;
  11 use StatusValue;
  12 use WebRequest;
  13 use Wikimedia\ScopedCallback;
  14 use Wikimedia\TestingAccessWrapper;
  15
  16 /**
  17  * @group AuthManager
  18  * @group Database
  19  * @covers \MediaWiki\Auth\AuthManager
  20  */
  21 class AuthManagerTest extends \MediaWikiTestCase {
  22         /** @var WebRequest */
  23         protected $request;
  24         /** @var Config */
  25         protected $config;
  26         /** @var LoggerInterface */
  27         protected $logger;
  28
  29         protected $preauthMocks = [];
  30         protected $primaryauthMocks = [];
  31         protected $secondaryauthMocks = [];
  32
  33         /** @var AuthManager */
  34         protected $manager;
  35         /** @var TestingAccessWrapper */
  36         protected $managerPriv;
  37
  38         /**
  39          * Sets a mock on a hook
  40          * @param string $hook
  41          * @param object $expect From $this->once(), $this->never(), etc.
  42          * @return object $mock->expects( $expect )->method( ... ).
  43          */
  44         protected function hook( $hook, $expect ) {
  45                 $mock = $this->getMockBuilder( __CLASS__ )
  46                         ->setMethods( [ "on$hook" ] )
  47                         ->getMock();
  48                 $this->setTemporaryHook( $hook, $mock );
  49                 return $mock->expects( $expect )->method( "on$hook" );
  50         }
  51
  52         /**
  53          * Unsets a hook
  54          * @param string $hook
  55          */
  56         protected function unhook( $hook ) {
  57                 global $wgHooks;
  58                 $wgHooks[$hook] = [];
  59         }
  60
  61         /**
  62          * Ensure a value is a clean Message object
  63          * @param string|Message $key
  64          * @param array $params
  65          * @return Message
  66          */
  67         protected function message( $key, $params = [] ) {
  68                 if ( $key === null ) {
  69                         return null;
  70                 }
  71                 if ( $key instanceof \MessageSpecifier ) {
  72                         $params = $key->getParams();
  73                         $key = $key->getKey();
  74                 }
  75                 return new \Message( $key, $params, \Language::factory( 'en' ) );
  76         }
  77
  78         /**
  79          * Test two AuthenticationResponses for equality.  We don't want to use regular assertEquals
  80          * because that recursively compares members, which leads to false negatives if e.g. Language
  81          * caches are reset.
  82          *
  83          * @param AuthenticationResponse $response1
  84          * @param AuthenticationResponse $response2
  85          * @param string $msg
  86          * @return bool
  87          */
  88         private function assertResponseEquals(
  89                 AuthenticationResponse $expected, AuthenticationResponse $actual, $msg = ''
  90         ) {
  91                 foreach ( ( new \ReflectionClass( $expected ) )->getProperties() as $prop ) {
  92                         $name = $prop->getName();
  93                         $usedMsg = ltrim( "$msg ($name)" );
  94                         if ( $name === 'message' && $expected->message ) {
  95                                 $this->assertSame( $expected->message->serialize(), $actual->message->serialize(),
  96                                         $usedMsg );
  97                         } else {
  98                                 $this->assertEquals( $expected->$name, $actual->$name, $usedMsg );
  99                         }
 100                 }
 101         }
 102
 103         /**
 104          * Initialize the AuthManagerConfig variable in $this->config
 105          *
 106          * Uses data from the various 'mocks' fields.
 107          */
 108         protected function initializeConfig() {
 109                 $config = [
 110                         'preauth' => [
 111                         ],
 112                         'primaryauth' => [
 113                         ],
 114                         'secondaryauth' => [
 115                         ],
 116                 ];
 117
 118                 foreach ( [ 'preauth', 'primaryauth', 'secondaryauth' ] as $type ) {
 119                         $key = $type . 'Mocks';
 120                         foreach ( $this->$key as $mock ) {
 121                                 $config[$type][$mock->getUniqueId()] = [ 'factory' => function () use ( $mock ) {
 122                                         return $mock;
 123                                 } ];
 124                         }
 125                 }
 126
 127                 $this->config->set( 'AuthManagerConfig', $config );
 128                 $this->config->set( 'LanguageCode', 'en' );
 129                 $this->config->set( 'NewUserLog', false );
 130         }
 131
 132         /**
 133          * Initialize $this->manager
 134          * @param bool $regen Force a call to $this->initializeConfig()
 135          */
 136         protected function initializeManager( $regen = false ) {
 137                 if ( $regen || !$this->config ) {
 138                         $this->config = new \HashConfig();
 139                 }
 140                 if ( $regen || !$this->request ) {
 141                         $this->request = new \FauxRequest();
 142                 }
 143                 if ( !$this->logger ) {
 144                         $this->logger = new \TestLogger();
 145                 }
 146
 147                 if ( $regen || !$this->config->has( 'AuthManagerConfig' ) ) {
 148                         $this->initializeConfig();
 149                 }
 150                 $this->manager = new AuthManager( $this->request, $this->config );
 151                 $this->manager->setLogger( $this->logger );
 152                 $this->managerPriv = TestingAccessWrapper::newFromObject( $this->manager );
 153         }
 154
 155         /**
 156          * Setup SessionManager with a mock session provider
 157          * @param bool|null $canChangeUser If non-null, canChangeUser will be mocked to return this
 158          * @param array $methods Additional methods to mock
 159          * @return array (MediaWiki\Session\SessionProvider, ScopedCallback)
 160          */
 161         protected function getMockSessionProvider( $canChangeUser = null, array $methods = [] ) {
 162                 if ( !$this->config ) {
 163                         $this->config = new \HashConfig();
 164                         $this->initializeConfig();
 165                 }
 166                 $this->config->set( 'ObjectCacheSessionExpiry', 100 );
 167
 168                 $methods[] = '__toString';
 169                 $methods[] = 'describe';
 170                 if ( $canChangeUser !== null ) {
 171                         $methods[] = 'canChangeUser';
 172                 }
 173                 $provider = $this->getMockBuilder( \DummySessionProvider::class )
 174                         ->setMethods( $methods )
 175                         ->getMock();
 176                 $provider->expects( $this->any() )->method( '__toString' )
 177                         ->will( $this->returnValue( 'MockSessionProvider' ) );
 178                 $provider->expects( $this->any() )->method( 'describe' )
 179                         ->will( $this->returnValue( 'MockSessionProvider sessions' ) );
 180                 if ( $canChangeUser !== null ) {
 181                         $provider->expects( $this->any() )->method( 'canChangeUser' )
 182                                 ->will( $this->returnValue( $canChangeUser ) );
 183                 }
 184                 $this->config->set( 'SessionProviders', [
 185                         [ 'factory' => function () use ( $provider ) {
 186                                 return $provider;
 187                         } ],
 188                 ] );
 189
 190                 $manager = new \MediaWiki\Session\SessionManager( [
 191                         'config' => $this->config,
 192                         'logger' => new \Psr\Log\NullLogger(),
 193                         'store' => new \HashBagOStuff(),
 194                 ] );
 195                 TestingAccessWrapper::newFromObject( $manager )->getProvider( (string)$provider );
 196
 197                 $reset = \MediaWiki\Session\TestUtils::setSessionManagerSingleton( $manager );
 198
 199                 if ( $this->request ) {
 200                         $manager->getSessionForRequest( $this->request );
 201                 }
 202
 203                 return [ $provider, $reset ];
 204         }
 205
 206         public function testSingleton() {
 207                 // Temporarily clear out the global singleton, if any, to test creating
 208                 // one.
 209                 $rProp = new \ReflectionProperty( AuthManager::class, 'instance' );
 210                 $rProp->setAccessible( true );
 211                 $old = $rProp->getValue();
 212                 $cb = new ScopedCallback( [ $rProp, 'setValue' ], [ $old ] );
 213                 $rProp->setValue( null );
 214
 215                 $singleton = AuthManager::singleton();
 216                 $this->assertInstanceOf( AuthManager::class, AuthManager::singleton() );
 217                 $this->assertSame( $singleton, AuthManager::singleton() );
 218                 $this->assertSame( \RequestContext::getMain()->getRequest(), $singleton->getRequest() );
 219                 $this->assertSame(
 220                         \RequestContext::getMain()->getConfig(),
 221                         TestingAccessWrapper::newFromObject( $singleton )->config
 222                 );
 223         }
 224
 225         public function testCanAuthenticateNow() {
 226                 $this->initializeManager();
 227
 228                 list( $provider, $reset ) = $this->getMockSessionProvider( false );
 229                 $this->assertFalse( $this->manager->canAuthenticateNow() );
 230                 ScopedCallback::consume( $reset );
 231
 232                 list( $provider, $reset ) = $this->getMockSessionProvider( true );
 233                 $this->assertTrue( $this->manager->canAuthenticateNow() );
 234                 ScopedCallback::consume( $reset );
 235         }
 236
 237         public function testNormalizeUsername() {
 238                 $mocks = [
 239                         $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class ),
 240                         $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class ),
 241                         $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class ),
 242                         $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class ),
 243                 ];
 244                 foreach ( $mocks as $key => $mock ) {
 245                         $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( $key ) );
 246                 }
 247                 $mocks[0]->expects( $this->once() )->method( 'providerNormalizeUsername' )
 248                         ->with( $this->identicalTo( 'XYZ' ) )
 249                         ->willReturn( 'Foo' );
 250                 $mocks[1]->expects( $this->once() )->method( 'providerNormalizeUsername' )
 251                         ->with( $this->identicalTo( 'XYZ' ) )
 252                         ->willReturn( 'Foo' );
 253                 $mocks[2]->expects( $this->once() )->method( 'providerNormalizeUsername' )
 254                         ->with( $this->identicalTo( 'XYZ' ) )
 255                         ->willReturn( null );
 256                 $mocks[3]->expects( $this->once() )->method( 'providerNormalizeUsername' )
 257                         ->with( $this->identicalTo( 'XYZ' ) )
 258                         ->willReturn( 'Bar!' );
 259
 260                 $this->primaryauthMocks = $mocks;
 261
 262                 $this->initializeManager();
 263
 264                 $this->assertSame( [ 'Foo', 'Bar!' ], $this->manager->normalizeUsername( 'XYZ' ) );
 265         }
 266
 267         /**
 268          * @dataProvider provideSecuritySensitiveOperationStatus
 269          * @param bool $mutableSession
 270          */
 271         public function testSecuritySensitiveOperationStatus( $mutableSession ) {
 272                 $this->logger = new \Psr\Log\NullLogger();
 273                 $user = \User::newFromName( 'UTSysop' );
 274                 $provideUser = null;
 275                 $reauth = $mutableSession ? AuthManager::SEC_REAUTH : AuthManager::SEC_FAIL;
 276
 277                 list( $provider, $reset ) = $this->getMockSessionProvider(
 278                         $mutableSession, [ 'provideSessionInfo' ]
 279                 );
 280                 $provider->expects( $this->any() )->method( 'provideSessionInfo' )
 281                         ->will( $this->returnCallback( function () use ( $provider, &$provideUser ) {
 282                                 return new SessionInfo( SessionInfo::MIN_PRIORITY, [
 283                                         'provider' => $provider,
 284                                         'id' => \DummySessionProvider::ID,
 285                                         'persisted' => true,
 286                                         'userInfo' => UserInfo::newFromUser( $provideUser, true )
 287                                 ] );
 288                         } ) );
 289                 $this->initializeManager();
 290
 291                 $this->config->set( 'ReauthenticateTime', [] );
 292                 $this->config->set( 'AllowSecuritySensitiveOperationIfCannotReauthenticate', [] );
 293                 $provideUser = new \User;
 294                 $session = $provider->getManager()->getSessionForRequest( $this->request );
 295                 $this->assertSame( 0, $session->getUser()->getId(), 'sanity check' );
 296
 297                 // Anonymous user => reauth
 298                 $session->set( 'AuthManager:lastAuthId', 0 );
 299                 $session->set( 'AuthManager:lastAuthTimestamp', time() - 5 );
 300                 $this->assertSame( $reauth, $this->manager->securitySensitiveOperationStatus( 'foo' ) );
 301
 302                 $provideUser = $user;
 303                 $session = $provider->getManager()->getSessionForRequest( $this->request );
 304                 $this->assertSame( $user->getId(), $session->getUser()->getId(), 'sanity check' );
 305
 306                 // Error for no default (only gets thrown for non-anonymous user)
 307                 $session->set( 'AuthManager:lastAuthId', $user->getId() + 1 );
 308                 $session->set( 'AuthManager:lastAuthTimestamp', time() - 5 );
 309                 try {
 310                         $this->manager->securitySensitiveOperationStatus( 'foo' );
 311                         $this->fail( 'Expected exception not thrown' );
 312                 } catch ( \UnexpectedValueException $ex ) {
 313                         $this->assertSame(
 314                                 $mutableSession
 315                                         ? '$wgReauthenticateTime lacks a default'
 316                                         : '$wgAllowSecuritySensitiveOperationIfCannotReauthenticate lacks a default',
 317                                 $ex->getMessage()
 318                         );
 319                 }
 320
 321                 if ( $mutableSession ) {
 322                         $this->config->set( 'ReauthenticateTime', [
 323                                 'test' => 100,
 324                                 'test2' => -1,
 325                                 'default' => 10,
 326                         ] );
 327
 328                         // Mismatched user ID
 329                         $session->set( 'AuthManager:lastAuthId', $user->getId() + 1 );
 330                         $session->set( 'AuthManager:lastAuthTimestamp', time() - 5 );
 331                         $this->assertSame(
 332                                 AuthManager::SEC_REAUTH, $this->manager->securitySensitiveOperationStatus( 'foo' )
 333                         );
 334                         $this->assertSame(
 335                                 AuthManager::SEC_REAUTH, $this->manager->securitySensitiveOperationStatus( 'test' )
 336                         );
 337                         $this->assertSame(
 338                                 AuthManager::SEC_OK, $this->manager->securitySensitiveOperationStatus( 'test2' )
 339                         );
 340
 341                         // Missing time
 342                         $session->set( 'AuthManager:lastAuthId', $user->getId() );
 343                         $session->set( 'AuthManager:lastAuthTimestamp', null );
 344                         $this->assertSame(
 345                                 AuthManager::SEC_REAUTH, $this->manager->securitySensitiveOperationStatus( 'foo' )
 346                         );
 347                         $this->assertSame(
 348                                 AuthManager::SEC_REAUTH, $this->manager->securitySensitiveOperationStatus( 'test' )
 349                         );
 350                         $this->assertSame(
 351                                 AuthManager::SEC_OK, $this->manager->securitySensitiveOperationStatus( 'test2' )
 352                         );
 353
 354                         // Recent enough to pass
 355                         $session->set( 'AuthManager:lastAuthTimestamp', time() - 5 );
 356                         $this->assertSame(
 357                                 AuthManager::SEC_OK, $this->manager->securitySensitiveOperationStatus( 'foo' )
 358                         );
 359
 360                         // Not recent enough to pass
 361                         $session->set( 'AuthManager:lastAuthTimestamp', time() - 20 );
 362                         $this->assertSame(
 363                                 AuthManager::SEC_REAUTH, $this->manager->securitySensitiveOperationStatus( 'foo' )
 364                         );
 365                         // But recent enough for the 'test' operation
 366                         $this->assertSame(
 367                                 AuthManager::SEC_OK, $this->manager->securitySensitiveOperationStatus( 'test' )
 368                         );
 369                 } else {
 370                         $this->config->set( 'AllowSecuritySensitiveOperationIfCannotReauthenticate', [
 371                                 'test' => false,
 372                                 'default' => true,
 373                         ] );
 374
 375                         $this->assertEquals(
 376                                 AuthManager::SEC_OK, $this->manager->securitySensitiveOperationStatus( 'foo' )
 377                         );
 378
 379                         $this->assertEquals(
 380                                 AuthManager::SEC_FAIL, $this->manager->securitySensitiveOperationStatus( 'test' )
 381                         );
 382                 }
 383
 384                 // Test hook, all three possible values
 385                 foreach ( [
 386                         AuthManager::SEC_OK => AuthManager::SEC_OK,
 387                         AuthManager::SEC_REAUTH => $reauth,
 388                         AuthManager::SEC_FAIL => AuthManager::SEC_FAIL,
 389                 ] as $hook => $expect ) {
 390                         $this->hook( 'SecuritySensitiveOperationStatus', $this->exactly( 2 ) )
 391                                 ->with(
 392                                         $this->anything(),
 393                                         $this->anything(),
 394                                         $this->callback( function ( $s ) use ( $session ) {
 395                                                 return $s->getId() === $session->getId();
 396                                         } ),
 397                                         $mutableSession ? $this->equalTo( 500, 1 ) : $this->equalTo( -1 )
 398                                 )
 399                                 ->will( $this->returnCallback( function ( &$v ) use ( $hook ) {
 400                                         $v = $hook;
 401                                         return true;
 402                                 } ) );
 403                         $session->set( 'AuthManager:lastAuthTimestamp', time() - 500 );
 404                         $this->assertEquals(
 405                                 $expect, $this->manager->securitySensitiveOperationStatus( 'test' ), "hook $hook"
 406                         );
 407                         $this->assertEquals(
 408                                 $expect, $this->manager->securitySensitiveOperationStatus( 'test2' ), "hook $hook"
 409                         );
 410                         $this->unhook( 'SecuritySensitiveOperationStatus' );
 411                 }
 412
 413                 ScopedCallback::consume( $reset );
 414         }
 415
 416         public function onSecuritySensitiveOperationStatus( &$status, $operation, $session, $time ) {
 417         }
 418
 419         public static function provideSecuritySensitiveOperationStatus() {
 420                 return [
 421                         [ true ],
 422                         [ false ],
 423                 ];
 424         }
 425
 426         /**
 427          * @dataProvider provideUserCanAuthenticate
 428          * @param bool $primary1Can
 429          * @param bool $primary2Can
 430          * @param bool $expect
 431          */
 432         public function testUserCanAuthenticate( $primary1Can, $primary2Can, $expect ) {
 433                 $mock1 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 434                 $mock1->expects( $this->any() )->method( 'getUniqueId' )
 435                         ->will( $this->returnValue( 'primary1' ) );
 436                 $mock1->expects( $this->any() )->method( 'testUserCanAuthenticate' )
 437                         ->with( $this->equalTo( 'UTSysop' ) )
 438                         ->will( $this->returnValue( $primary1Can ) );
 439                 $mock2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 440                 $mock2->expects( $this->any() )->method( 'getUniqueId' )
 441                         ->will( $this->returnValue( 'primary2' ) );
 442                 $mock2->expects( $this->any() )->method( 'testUserCanAuthenticate' )
 443                         ->with( $this->equalTo( 'UTSysop' ) )
 444                         ->will( $this->returnValue( $primary2Can ) );
 445                 $this->primaryauthMocks = [ $mock1, $mock2 ];
 446
 447                 $this->initializeManager( true );
 448                 $this->assertSame( $expect, $this->manager->userCanAuthenticate( 'UTSysop' ) );
 449         }
 450
 451         public static function provideUserCanAuthenticate() {
 452                 return [
 453                         [ false, false, false ],
 454                         [ true, false, true ],
 455                         [ false, true, true ],
 456                         [ true, true, true ],
 457                 ];
 458         }
 459
 460         public function testRevokeAccessForUser() {
 461                 $this->initializeManager();
 462
 463                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 464                 $mock->expects( $this->any() )->method( 'getUniqueId' )
 465                         ->will( $this->returnValue( 'primary' ) );
 466                 $mock->expects( $this->once() )->method( 'providerRevokeAccessForUser' )
 467                         ->with( $this->equalTo( 'UTSysop' ) );
 468                 $this->primaryauthMocks = [ $mock ];
 469
 470                 $this->initializeManager( true );
 471                 $this->logger->setCollect( true );
 472
 473                 $this->manager->revokeAccessForUser( 'UTSysop' );
 474
 475                 $this->assertSame( [
 476                         [ LogLevel::INFO, 'Revoking access for {user}' ],
 477                 ], $this->logger->getBuffer() );
 478         }
 479
 480         public function testProviderCreation() {
 481                 $mocks = [
 482                         'pre' => $this->getMockForAbstractClass( PreAuthenticationProvider::class ),
 483                         'primary' => $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class ),
 484                         'secondary' => $this->getMockForAbstractClass( SecondaryAuthenticationProvider::class ),
 485                 ];
 486                 foreach ( $mocks as $key => $mock ) {
 487                         $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( $key ) );
 488                         $mock->expects( $this->once() )->method( 'setLogger' );
 489                         $mock->expects( $this->once() )->method( 'setManager' );
 490                         $mock->expects( $this->once() )->method( 'setConfig' );
 491                 }
 492                 $this->preauthMocks = [ $mocks['pre'] ];
 493                 $this->primaryauthMocks = [ $mocks['primary'] ];
 494                 $this->secondaryauthMocks = [ $mocks['secondary'] ];
 495
 496                 // Normal operation
 497                 $this->initializeManager();
 498                 $this->assertSame(
 499                         $mocks['primary'],
 500                         $this->managerPriv->getAuthenticationProvider( 'primary' )
 501                 );
 502                 $this->assertSame(
 503                         $mocks['secondary'],
 504                         $this->managerPriv->getAuthenticationProvider( 'secondary' )
 505                 );
 506                 $this->assertSame(
 507                         $mocks['pre'],
 508                         $this->managerPriv->getAuthenticationProvider( 'pre' )
 509                 );
 510                 $this->assertSame(
 511                         [ 'pre' => $mocks['pre'] ],
 512                         $this->managerPriv->getPreAuthenticationProviders()
 513                 );
 514                 $this->assertSame(
 515                         [ 'primary' => $mocks['primary'] ],
 516                         $this->managerPriv->getPrimaryAuthenticationProviders()
 517                 );
 518                 $this->assertSame(
 519                         [ 'secondary' => $mocks['secondary'] ],
 520                         $this->managerPriv->getSecondaryAuthenticationProviders()
 521                 );
 522
 523                 // Duplicate IDs
 524                 $mock1 = $this->getMockForAbstractClass( PreAuthenticationProvider::class );
 525                 $mock2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 526                 $mock1->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
 527                 $mock2->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
 528                 $this->preauthMocks = [ $mock1 ];
 529                 $this->primaryauthMocks = [ $mock2 ];
 530                 $this->secondaryauthMocks = [];
 531                 $this->initializeManager( true );
 532                 try {
 533                         $this->managerPriv->getAuthenticationProvider( 'Y' );
 534                         $this->fail( 'Expected exception not thrown' );
 535                 } catch ( \RuntimeException $ex ) {
 536                         $class1 = get_class( $mock1 );
 537                         $class2 = get_class( $mock2 );
 538                         $this->assertSame(
 539                                 "Duplicate specifications for id X (classes $class1 and $class2)", $ex->getMessage()
 540                         );
 541                 }
 542
 543                 // Wrong classes
 544                 $mock = $this->getMockForAbstractClass( AuthenticationProvider::class );
 545                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
 546                 $class = get_class( $mock );
 547                 $this->preauthMocks = [ $mock ];
 548                 $this->primaryauthMocks = [ $mock ];
 549                 $this->secondaryauthMocks = [ $mock ];
 550                 $this->initializeManager( true );
 551                 try {
 552                         $this->managerPriv->getPreAuthenticationProviders();
 553                         $this->fail( 'Expected exception not thrown' );
 554                 } catch ( \RuntimeException $ex ) {
 555                         $this->assertSame(
 556                                 "Expected instance of MediaWiki\\Auth\\PreAuthenticationProvider, got $class",
 557                                 $ex->getMessage()
 558                         );
 559                 }
 560                 try {
 561                         $this->managerPriv->getPrimaryAuthenticationProviders();
 562                         $this->fail( 'Expected exception not thrown' );
 563                 } catch ( \RuntimeException $ex ) {
 564                         $this->assertSame(
 565                                 "Expected instance of MediaWiki\\Auth\\PrimaryAuthenticationProvider, got $class",
 566                                 $ex->getMessage()
 567                         );
 568                 }
 569                 try {
 570                         $this->managerPriv->getSecondaryAuthenticationProviders();
 571                         $this->fail( 'Expected exception not thrown' );
 572                 } catch ( \RuntimeException $ex ) {
 573                         $this->assertSame(
 574                                 "Expected instance of MediaWiki\\Auth\\SecondaryAuthenticationProvider, got $class",
 575                                 $ex->getMessage()
 576                         );
 577                 }
 578
 579                 // Sorting
 580                 $mock1 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 581                 $mock2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 582                 $mock3 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 583                 $mock1->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'A' ) );
 584                 $mock2->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'B' ) );
 585                 $mock3->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'C' ) );
 586                 $this->preauthMocks = [];
 587                 $this->primaryauthMocks = [ $mock1, $mock2, $mock3 ];
 588                 $this->secondaryauthMocks = [];
 589                 $this->initializeConfig();
 590                 $config = $this->config->get( 'AuthManagerConfig' );
 591
 592                 $this->initializeManager( false );
 593                 $this->assertSame(
 594                         [ 'A' => $mock1, 'B' => $mock2, 'C' => $mock3 ],
 595                         $this->managerPriv->getPrimaryAuthenticationProviders(),
 596                         'sanity check'
 597                 );
 598
 599                 $config['primaryauth']['A']['sort'] = 100;
 600                 $config['primaryauth']['C']['sort'] = -1;
 601                 $this->config->set( 'AuthManagerConfig', $config );
 602                 $this->initializeManager( false );
 603                 $this->assertSame(
 604                         [ 'C' => $mock3, 'B' => $mock2, 'A' => $mock1 ],
 605                         $this->managerPriv->getPrimaryAuthenticationProviders()
 606                 );
 607         }
 608
 609         /**
 610          * @dataProvider provideSetDefaultUserOptions
 611          */
 612         public function testSetDefaultUserOptions(
 613                 $contLang, $useContextLang, $expectedLang, $expectedVariant
 614         ) {
 615                 $this->initializeManager();
 616
 617                 $this->setContentLang( $contLang );
 618                 $context = \RequestContext::getMain();
 619                 $reset = new ScopedCallback( [ $context, 'setLanguage' ], [ $context->getLanguage() ] );
 620                 $context->setLanguage( 'de' );
 621
 622                 $user = \User::newFromName( self::usernameForCreation() );
 623                 $user->addToDatabase();
 624                 $oldToken = $user->getToken();
 625                 $this->managerPriv->setDefaultUserOptions( $user, $useContextLang );
 626                 $user->saveSettings();
 627                 $this->assertNotEquals( $oldToken, $user->getToken() );
 628                 $this->assertSame( $expectedLang, $user->getOption( 'language' ) );
 629                 $this->assertSame( $expectedVariant, $user->getOption( 'variant' ) );
 630         }
 631
 632         public function provideSetDefaultUserOptions() {
 633                 return [
 634                         [ 'zh', false, 'zh', 'zh' ],
 635                         [ 'zh', true, 'de', 'zh' ],
 636                         [ 'fr', true, 'de', null ],
 637                 ];
 638         }
 639
 640         public function testForcePrimaryAuthenticationProviders() {
 641                 $mockA = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 642                 $mockB = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 643                 $mockB2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
 644                 $mockA->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'A' ) );
 645                 $mockB->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'B' ) );
 646                 $mockB2->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'B' ) );
 647                 $this->primaryauthMocks = [ $mockA ];
 648
 649                 $this->logger = new \TestLogger( true );
 650
 651                 // Test without first initializing the configured providers
 652                 $this->initializeManager();
 653                 $this->manager->forcePrimaryAuthenticationProviders( [ $mockB ], 'testing' );
 654                 $this->assertSame(
 655                         [ 'B' => $mockB ], $this->managerPriv->getPrimaryAuthenticationProviders()
 656                 );
 657                 $this->assertSame( null, $this->managerPriv->getAuthenticationProvider( 'A' ) );
 658                 $this->assertSame( $mockB, $this->managerPriv->getAuthenticationProvider( 'B' ) );
 659                 $this->assertSame( [
 660                         [ LogLevel::WARNING, 'Overriding AuthManager primary authn because testing' ],
 661                 ], $this->logger->getBuffer() );
 662                 $this->logger->clearBuffer();
 663
 664                 // Test with first initializing the configured providers
 665                 $this->initializeManager();
 666                 $this->assertSame( $mockA, $this->managerPriv->getAuthenticationProvider( 'A' ) );
 667                 $this->assertSame( null, $this->managerPriv->getAuthenticationProvider( 'B' ) );
 668                 $this->request->getSession()->setSecret( 'AuthManager::authnState', 'test' );
 669                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState', 'test' );
 670                 $this->manager->forcePrimaryAuthenticationProviders( [ $mockB ], 'testing' );
 671                 $this->assertSame(
 672                         [ 'B' => $mockB ], $this->managerPriv->getPrimaryAuthenticationProviders()
 673                 );
 674                 $this->assertSame( null, $this->managerPriv->getAuthenticationProvider( 'A' ) );
 675                 $this->assertSame( $mockB, $this->managerPriv->getAuthenticationProvider( 'B' ) );
 676                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::authnState' ) );
 677                 $this->assertNull(
 678                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
 679                 );
 680                 $this->assertSame( [
 681                         [ LogLevel::WARNING, 'Overriding AuthManager primary authn because testing' ],
 682                         [
 683                                 LogLevel::WARNING,
 684                                 'PrimaryAuthenticationProviders have already been accessed! I hope nothing breaks.'
 685                         ],
 686                 ], $this->logger->getBuffer() );
 687                 $this->logger->clearBuffer();
 688
 689                 // Test duplicate IDs
 690                 $this->initializeManager();
 691                 try {
 692                         $this->manager->forcePrimaryAuthenticationProviders( [ $mockB, $mockB2 ], 'testing' );
 693                         $this->fail( 'Expected exception not thrown' );
 694                 } catch ( \RuntimeException $ex ) {
 695                         $class1 = get_class( $mockB );
 696                         $class2 = get_class( $mockB2 );
 697                         $this->assertSame(
 698                                 "Duplicate specifications for id B (classes $class2 and $class1)", $ex->getMessage()
 699                         );
 700                 }
 701
 702                 // Wrong classes
 703                 $mock = $this->getMockForAbstractClass( AuthenticationProvider::class );
 704                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
 705                 $class = get_class( $mock );
 706                 try {
 707                         $this->manager->forcePrimaryAuthenticationProviders( [ $mock ], 'testing' );
 708                         $this->fail( 'Expected exception not thrown' );
 709                 } catch ( \RuntimeException $ex ) {
 710                         $this->assertSame(
 711                                 "Expected instance of MediaWiki\\Auth\\PrimaryAuthenticationProvider, got $class",
 712                                 $ex->getMessage()
 713                         );
 714                 }
 715         }
 716
 717         public function testBeginAuthentication() {
 718                 $this->initializeManager();
 719
 720                 // Immutable session
 721                 list( $provider, $reset ) = $this->getMockSessionProvider( false );
 722                 $this->hook( 'UserLoggedIn', $this->never() );
 723                 $this->request->getSession()->setSecret( 'AuthManager::authnState', 'test' );
 724                 try {
 725                         $this->manager->beginAuthentication( [], 'http://localhost/' );
 726                         $this->fail( 'Expected exception not thrown' );
 727                 } catch ( \LogicException $ex ) {
 728                         $this->assertSame( 'Authentication is not possible now', $ex->getMessage() );
 729                 }
 730                 $this->unhook( 'UserLoggedIn' );
 731                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::authnState' ) );
 732                 ScopedCallback::consume( $reset );
 733                 $this->initializeManager( true );
 734
 735                 // CreatedAccountAuthenticationRequest
 736                 $user = \User::newFromName( 'UTSysop' );
 737                 $reqs = [
 738                         new CreatedAccountAuthenticationRequest( $user->getId(), $user->getName() )
 739                 ];
 740                 $this->hook( 'UserLoggedIn', $this->never() );
 741                 try {
 742                         $this->manager->beginAuthentication( $reqs, 'http://localhost/' );
 743                         $this->fail( 'Expected exception not thrown' );
 744                 } catch ( \LogicException $ex ) {
 745                         $this->assertSame(
 746                                 'CreatedAccountAuthenticationRequests are only valid on the same AuthManager ' .
 747                                         'that created the account',
 748                                 $ex->getMessage()
 749                         );
 750                 }
 751                 $this->unhook( 'UserLoggedIn' );
 752
 753                 $this->request->getSession()->clear();
 754                 $this->request->getSession()->setSecret( 'AuthManager::authnState', 'test' );
 755                 $this->managerPriv->createdAccountAuthenticationRequests = [ $reqs[0] ];
 756                 $this->hook( 'UserLoggedIn', $this->once() )
 757                         ->with( $this->callback( function ( $u ) use ( $user ) {
 758                                 return $user->getId() === $u->getId() && $user->getName() === $u->getName();
 759                         } ) );
 760                 $this->hook( 'AuthManagerLoginAuthenticateAudit', $this->once() );
 761                 $this->logger->setCollect( true );
 762                 $ret = $this->manager->beginAuthentication( $reqs, 'http://localhost/' );
 763                 $this->logger->setCollect( false );
 764                 $this->unhook( 'UserLoggedIn' );
 765                 $this->unhook( 'AuthManagerLoginAuthenticateAudit' );
 766                 $this->assertSame( AuthenticationResponse::PASS, $ret->status );
 767                 $this->assertSame( $user->getName(), $ret->username );
 768                 $this->assertSame( $user->getId(), $this->request->getSessionData( 'AuthManager:lastAuthId' ) );
 769                 $this->assertEquals(
 770                         time(), $this->request->getSessionData( 'AuthManager:lastAuthTimestamp' ),
 771                         'timestamp ±1', 1
 772                 );
 773                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::authnState' ) );
 774                 $this->assertSame( $user->getId(), $this->request->getSession()->getUser()->getId() );
 775                 $this->assertSame( [
 776                         [ LogLevel::INFO, 'Logging in {user} after account creation' ],
 777                 ], $this->logger->getBuffer() );
 778         }
 779
 780         public function testCreateFromLogin() {
 781                 $user = \User::newFromName( 'UTSysop' );
 782                 $req1 = $this->createMock( AuthenticationRequest::class );
 783                 $req2 = $this->createMock( AuthenticationRequest::class );
 784                 $req3 = $this->createMock( AuthenticationRequest::class );
 785                 $userReq = new UsernameAuthenticationRequest;
 786                 $userReq->username = 'UTDummy';
 787
 788                 $req1->returnToUrl = 'http://localhost/';
 789                 $req2->returnToUrl = 'http://localhost/';
 790                 $req3->returnToUrl = 'http://localhost/';
 791                 $req3->username = 'UTDummy';
 792                 $userReq->returnToUrl = 'http://localhost/';
 793
 794                 // Passing one into beginAuthentication(), and an immediate FAIL
 795                 $primary = $this->getMockForAbstractClass( AbstractPrimaryAuthenticationProvider::class );
 796                 $this->primaryauthMocks = [ $primary ];
 797                 $this->initializeManager( true );
 798                 $res = AuthenticationResponse::newFail( wfMessage( 'foo' ) );
 799                 $res->createRequest = $req1;
 800                 $primary->expects( $this->any() )->method( 'beginPrimaryAuthentication' )
 801                         ->will( $this->returnValue( $res ) );
 802                 $createReq = new CreateFromLoginAuthenticationRequest(
 803                         null, [ $req2->getUniqueId() => $req2 ]
 804                 );
 805                 $this->logger->setCollect( true );
 806                 $ret = $this->manager->beginAuthentication( [ $createReq ], 'http://localhost/' );
 807                 $this->logger->setCollect( false );
 808                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
 809                 $this->assertInstanceOf( CreateFromLoginAuthenticationRequest::class, $ret->createRequest );
 810                 $this->assertSame( $req1, $ret->createRequest->createRequest );
 811                 $this->assertEquals( [ $req2->getUniqueId() => $req2 ], $ret->createRequest->maybeLink );
 812
 813                 // UI, then FAIL in beginAuthentication()
 814                 $primary = $this->getMockBuilder( AbstractPrimaryAuthenticationProvider::class )
 815                         ->setMethods( [ 'continuePrimaryAuthentication' ] )
 816                         ->getMockForAbstractClass();
 817                 $this->primaryauthMocks = [ $primary ];
 818                 $this->initializeManager( true );
 819                 $primary->expects( $this->any() )->method( 'beginPrimaryAuthentication' )
 820                         ->will( $this->returnValue(
 821                                 AuthenticationResponse::newUI( [ $req1 ], wfMessage( 'foo' ) )
 822                         ) );
 823                 $res = AuthenticationResponse::newFail( wfMessage( 'foo' ) );
 824                 $res->createRequest = $req2;
 825                 $primary->expects( $this->any() )->method( 'continuePrimaryAuthentication' )
 826                         ->will( $this->returnValue( $res ) );
 827                 $this->logger->setCollect( true );
 828                 $ret = $this->manager->beginAuthentication( [], 'http://localhost/' );
 829                 $this->assertSame( AuthenticationResponse::UI, $ret->status, 'sanity check' );
 830                 $ret = $this->manager->continueAuthentication( [] );
 831                 $this->logger->setCollect( false );
 832                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
 833                 $this->assertInstanceOf( CreateFromLoginAuthenticationRequest::class, $ret->createRequest );
 834                 $this->assertSame( $req2, $ret->createRequest->createRequest );
 835                 $this->assertEquals( [], $ret->createRequest->maybeLink );
 836
 837                 // Pass into beginAccountCreation(), see that maybeLink and createRequest get copied
 838                 $primary = $this->getMockForAbstractClass( AbstractPrimaryAuthenticationProvider::class );
 839                 $this->primaryauthMocks = [ $primary ];
 840                 $this->initializeManager( true );
 841                 $createReq = new CreateFromLoginAuthenticationRequest( $req3, [ $req2 ] );
 842                 $createReq->returnToUrl = 'http://localhost/';
 843                 $createReq->username = 'UTDummy';
 844                 $res = AuthenticationResponse::newUI( [ $req1 ], wfMessage( 'foo' ) );
 845                 $primary->expects( $this->any() )->method( 'beginPrimaryAccountCreation' )
 846                         ->with( $this->anything(), $this->anything(), [ $userReq, $createReq, $req3 ] )
 847                         ->will( $this->returnValue( $res ) );
 848                 $primary->expects( $this->any() )->method( 'accountCreationType' )
 849                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
 850                 $this->logger->setCollect( true );
 851                 $ret = $this->manager->beginAccountCreation(
 852                         $user, [ $userReq, $createReq ], 'http://localhost/'
 853                 );
 854                 $this->logger->setCollect( false );
 855                 $this->assertSame( AuthenticationResponse::UI, $ret->status );
 856                 $state = $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' );
 857                 $this->assertNotNull( $state );
 858                 $this->assertEquals( [ $userReq, $createReq, $req3 ], $state['reqs'] );
 859                 $this->assertEquals( [ $req2 ], $state['maybeLink'] );
 860         }
 861
 862         /**
 863          * @dataProvider provideAuthentication
 864          * @param StatusValue $preResponse
 865          * @param array $primaryResponses
 866          * @param array $secondaryResponses
 867          * @param array $managerResponses
 868          * @param bool $link Whether the primary authentication provider is a "link" provider
 869          */
 870         public function testAuthentication(
 871                 StatusValue $preResponse, array $primaryResponses, array $secondaryResponses,
 872                 array $managerResponses, $link = false
 873         ) {
 874                 $this->initializeManager();
 875                 $user = \User::newFromName( 'UTSysop' );
 876                 $id = $user->getId();
 877                 $name = $user->getName();
 878
 879                 // Set up lots of mocks...
 880                 $req = new RememberMeAuthenticationRequest;
 881                 $req->rememberMe = (bool)rand( 0, 1 );
 882                 $req->pre = $preResponse;
 883                 $req->primary = $primaryResponses;
 884                 $req->secondary = $secondaryResponses;
 885                 $mocks = [];
 886                 foreach ( [ 'pre', 'primary', 'secondary' ] as $key ) {
 887                         $class = ucfirst( $key ) . 'AuthenticationProvider';
 888                         $mocks[$key] = $this->getMockForAbstractClass(
 889                                 "MediaWiki\\Auth\\$class", [], "Mock$class"
 890                         );
 891                         $mocks[$key]->expects( $this->any() )->method( 'getUniqueId' )
 892                                 ->will( $this->returnValue( $key ) );
 893                         $mocks[$key . '2'] = $this->getMockForAbstractClass( "MediaWiki\\Auth\\$class" );
 894                         $mocks[$key . '2']->expects( $this->any() )->method( 'getUniqueId' )
 895                                 ->will( $this->returnValue( $key . '2' ) );
 896                         $mocks[$key . '3'] = $this->getMockForAbstractClass( "MediaWiki\\Auth\\$class" );
 897                         $mocks[$key . '3']->expects( $this->any() )->method( 'getUniqueId' )
 898                                 ->will( $this->returnValue( $key . '3' ) );
 899                 }
 900                 foreach ( $mocks as $mock ) {
 901                         $mock->expects( $this->any() )->method( 'getAuthenticationRequests' )
 902                                 ->will( $this->returnValue( [] ) );
 903                 }
 904
 905                 $mocks['pre']->expects( $this->once() )->method( 'testForAuthentication' )
 906                         ->will( $this->returnCallback( function ( $reqs ) use ( $req ) {
 907                                 $this->assertContains( $req, $reqs );
 908                                 return $req->pre;
 909                         } ) );
 910
 911                 $ct = count( $req->primary );
 912                 $callback = $this->returnCallback( function ( $reqs ) use ( $req ) {
 913                         $this->assertContains( $req, $reqs );
 914                         return array_shift( $req->primary );
 915                 } );
 916                 $mocks['primary']->expects( $this->exactly( min( 1, $ct ) ) )
 917                         ->method( 'beginPrimaryAuthentication' )
 918                         ->will( $callback );
 919                 $mocks['primary']->expects( $this->exactly( max( 0, $ct - 1 ) ) )
 920                         ->method( 'continuePrimaryAuthentication' )
 921                         ->will( $callback );
 922                 if ( $link ) {
 923                         $mocks['primary']->expects( $this->any() )->method( 'accountCreationType' )
 924                                 ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
 925                 }
 926
 927                 $ct = count( $req->secondary );
 928                 $callback = $this->returnCallback( function ( $user, $reqs ) use ( $id, $name, $req ) {
 929                         $this->assertSame( $id, $user->getId() );
 930                         $this->assertSame( $name, $user->getName() );
 931                         $this->assertContains( $req, $reqs );
 932                         return array_shift( $req->secondary );
 933                 } );
 934                 $mocks['secondary']->expects( $this->exactly( min( 1, $ct ) ) )
 935                         ->method( 'beginSecondaryAuthentication' )
 936                         ->will( $callback );
 937                 $mocks['secondary']->expects( $this->exactly( max( 0, $ct - 1 ) ) )
 938                         ->method( 'continueSecondaryAuthentication' )
 939                         ->will( $callback );
 940
 941                 $abstain = AuthenticationResponse::newAbstain();
 942                 $mocks['pre2']->expects( $this->atMost( 1 ) )->method( 'testForAuthentication' )
 943                         ->will( $this->returnValue( StatusValue::newGood() ) );
 944                 $mocks['primary2']->expects( $this->atMost( 1 ) )->method( 'beginPrimaryAuthentication' )
 945                                 ->will( $this->returnValue( $abstain ) );
 946                 $mocks['primary2']->expects( $this->never() )->method( 'continuePrimaryAuthentication' );
 947                 $mocks['secondary2']->expects( $this->atMost( 1 ) )->method( 'beginSecondaryAuthentication' )
 948                                 ->will( $this->returnValue( $abstain ) );
 949                 $mocks['secondary2']->expects( $this->never() )->method( 'continueSecondaryAuthentication' );
 950                 $mocks['secondary3']->expects( $this->atMost( 1 ) )->method( 'beginSecondaryAuthentication' )
 951                                 ->will( $this->returnValue( $abstain ) );
 952                 $mocks['secondary3']->expects( $this->never() )->method( 'continueSecondaryAuthentication' );
 953
 954                 $this->preauthMocks = [ $mocks['pre'], $mocks['pre2'] ];
 955                 $this->primaryauthMocks = [ $mocks['primary'], $mocks['primary2'] ];
 956                 $this->secondaryauthMocks = [
 957                         $mocks['secondary3'], $mocks['secondary'], $mocks['secondary2'],
 958                         // So linking happens
 959                         new ConfirmLinkSecondaryAuthenticationProvider,
 960                 ];
 961                 $this->initializeManager( true );
 962                 $this->logger->setCollect( true );
 963
 964                 $constraint = \PHPUnit_Framework_Assert::logicalOr(
 965                         $this->equalTo( AuthenticationResponse::PASS ),
 966                         $this->equalTo( AuthenticationResponse::FAIL )
 967                 );
 968                 $providers = array_filter(
 969                         array_merge(
 970                                 $this->preauthMocks, $this->primaryauthMocks, $this->secondaryauthMocks
 971                         ),
 972                         function ( $p ) {
 973                                 return is_callable( [ $p, 'expects' ] );
 974                         }
 975                 );
 976                 foreach ( $providers as $p ) {
 977                         $p->postCalled = false;
 978                         $p->expects( $this->atMost( 1 ) )->method( 'postAuthentication' )
 979                                 ->willReturnCallback( function ( $user, $response ) use ( $constraint, $p ) {
 980                                         if ( $user !== null ) {
 981                                                 $this->assertInstanceOf( \User::class, $user );
 982                                                 $this->assertSame( 'UTSysop', $user->getName() );
 983                                         }
 984                                         $this->assertInstanceOf( AuthenticationResponse::class, $response );
 985                                         $this->assertThat( $response->status, $constraint );
 986                                         $p->postCalled = $response->status;
 987                                 } );
 988                 }
 989
 990                 $session = $this->request->getSession();
 991                 $session->setRememberUser( !$req->rememberMe );
 992
 993                 foreach ( $managerResponses as $i => $response ) {
 994                         $success = $response instanceof AuthenticationResponse &&
 995                                 $response->status === AuthenticationResponse::PASS;
 996                         if ( $success ) {
 997                                 $this->hook( 'UserLoggedIn', $this->once() )
 998                                         ->with( $this->callback( function ( $user ) use ( $id, $name ) {
 999                                                 return $user->getId() === $id && $user->getName() === $name;
1000                                         } ) );
1001                         } else {
1002                                 $this->hook( 'UserLoggedIn', $this->never() );
1003                         }
1004                         if ( $success || (
1005                                         $response instanceof AuthenticationResponse &&
1006                                         $response->status === AuthenticationResponse::FAIL &&
1007                                         $response->message->getKey() !== 'authmanager-authn-not-in-progress' &&
1008                                         $response->message->getKey() !== 'authmanager-authn-no-primary'
1009                                 )
1010                         ) {
1011                                 $this->hook( 'AuthManagerLoginAuthenticateAudit', $this->once() );
1012                         } else {
1013                                 $this->hook( 'AuthManagerLoginAuthenticateAudit', $this->never() );
1014                         }
1015
1016                         $ex = null;
1017                         try {
1018                                 if ( !$i ) {
1019                                         $ret = $this->manager->beginAuthentication( [ $req ], 'http://localhost/' );
1020                                 } else {
1021                                         $ret = $this->manager->continueAuthentication( [ $req ] );
1022                                 }
1023                                 if ( $response instanceof \Exception ) {
1024                                         $this->fail( 'Expected exception not thrown', "Response $i" );
1025                                 }
1026                         } catch ( \Exception $ex ) {
1027                                 if ( !$response instanceof \Exception ) {
1028                                         throw $ex;
1029                                 }
1030                                 $this->assertEquals( $response->getMessage(), $ex->getMessage(), "Response $i, exception" );
1031                                 $this->assertNull( $session->getSecret( 'AuthManager::authnState' ),
1032                                         "Response $i, exception, session state" );
1033                                 $this->unhook( 'UserLoggedIn' );
1034                                 $this->unhook( 'AuthManagerLoginAuthenticateAudit' );
1035                                 return;
1036                         }
1037
1038                         $this->unhook( 'UserLoggedIn' );
1039                         $this->unhook( 'AuthManagerLoginAuthenticateAudit' );
1040
1041                         $this->assertSame( 'http://localhost/', $req->returnToUrl );
1042
1043                         $ret->message = $this->message( $ret->message );
1044                         $this->assertResponseEquals( $response, $ret, "Response $i, response" );
1045                         if ( $success ) {
1046                                 $this->assertSame( $id, $session->getUser()->getId(),
1047                                         "Response $i, authn" );
1048                         } else {
1049                                 $this->assertSame( 0, $session->getUser()->getId(),
1050                                         "Response $i, authn" );
1051                         }
1052                         if ( $success || $response->status === AuthenticationResponse::FAIL ) {
1053                                 $this->assertNull( $session->getSecret( 'AuthManager::authnState' ),
1054                                         "Response $i, session state" );
1055                                 foreach ( $providers as $p ) {
1056                                         $this->assertSame( $response->status, $p->postCalled,
1057                                                 "Response $i, post-auth callback called" );
1058                                 }
1059                         } else {
1060                                 $this->assertNotNull( $session->getSecret( 'AuthManager::authnState' ),
1061                                         "Response $i, session state" );
1062                                 foreach ( $ret->neededRequests as $neededReq ) {
1063                                         $this->assertEquals( AuthManager::ACTION_LOGIN, $neededReq->action,
1064                                                 "Response $i, neededRequest action" );
1065                                 }
1066                                 $this->assertEquals(
1067                                         $ret->neededRequests,
1068                                         $this->manager->getAuthenticationRequests( AuthManager::ACTION_LOGIN_CONTINUE ),
1069                                         "Response $i, continuation check"
1070                                 );
1071                                 foreach ( $providers as $p ) {
1072                                         $this->assertFalse( $p->postCalled, "Response $i, post-auth callback not called" );
1073                                 }
1074                         }
1075
1076                         $state = $session->getSecret( 'AuthManager::authnState' );
1077                         $maybeLink = $state['maybeLink'] ?? [];
1078                         if ( $link && $response->status === AuthenticationResponse::RESTART ) {
1079                                 $this->assertEquals(
1080                                         $response->createRequest->maybeLink,
1081                                         $maybeLink,
1082                                         "Response $i, maybeLink"
1083                                 );
1084                         } else {
1085                                 $this->assertEquals( [], $maybeLink, "Response $i, maybeLink" );
1086                         }
1087                 }
1088
1089                 if ( $success ) {
1090                         $this->assertSame( $req->rememberMe, $session->shouldRememberUser(),
1091                                 'rememberMe checkbox had effect' );
1092                 } else {
1093                         $this->assertNotSame( $req->rememberMe, $session->shouldRememberUser(),
1094                                 'rememberMe checkbox wasn\'t applied' );
1095                 }
1096         }
1097
1098         public function provideAuthentication() {
1099                 $rememberReq = new RememberMeAuthenticationRequest;
1100                 $rememberReq->action = AuthManager::ACTION_LOGIN;
1101
1102                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
1103                 $req->foobar = 'baz';
1104                 $restartResponse = AuthenticationResponse::newRestart(
1105                         $this->message( 'authmanager-authn-no-local-user' )
1106                 );
1107                 $restartResponse->neededRequests = [ $rememberReq ];
1108
1109                 $restartResponse2Pass = AuthenticationResponse::newPass( null );
1110                 $restartResponse2Pass->linkRequest = $req;
1111                 $restartResponse2 = AuthenticationResponse::newRestart(
1112                         $this->message( 'authmanager-authn-no-local-user-link' )
1113                 );
1114                 $restartResponse2->createRequest = new CreateFromLoginAuthenticationRequest(
1115                         null, [ $req->getUniqueId() => $req ]
1116                 );
1117                 $restartResponse2->createRequest->action = AuthManager::ACTION_LOGIN;
1118                 $restartResponse2->neededRequests = [ $rememberReq, $restartResponse2->createRequest ];
1119
1120                 $userName = 'UTSysop';
1121
1122                 return [
1123                         'Failure in pre-auth' => [
1124                                 StatusValue::newFatal( 'fail-from-pre' ),
1125                                 [],
1126                                 [],
1127                                 [
1128                                         AuthenticationResponse::newFail( $this->message( 'fail-from-pre' ) ),
1129                                         AuthenticationResponse::newFail(
1130                                                 $this->message( 'authmanager-authn-not-in-progress' )
1131                                         ),
1132                                 ]
1133                         ],
1134                         'Failure in primary' => [
1135                                 StatusValue::newGood(),
1136                                 $tmp = [
1137                                         AuthenticationResponse::newFail( $this->message( 'fail-from-primary' ) ),
1138                                 ],
1139                                 [],
1140                                 $tmp
1141                         ],
1142                         'All primary abstain' => [
1143                                 StatusValue::newGood(),
1144                                 [
1145                                         AuthenticationResponse::newAbstain(),
1146                                 ],
1147                                 [],
1148                                 [
1149                                         AuthenticationResponse::newFail( $this->message( 'authmanager-authn-no-primary' ) )
1150                                 ]
1151                         ],
1152                         'Primary UI, then redirect, then fail' => [
1153                                 StatusValue::newGood(),
1154                                 $tmp = [
1155                                         AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
1156                                         AuthenticationResponse::newRedirect( [ $req ], '/foo.html', [ 'foo' => 'bar' ] ),
1157                                         AuthenticationResponse::newFail( $this->message( 'fail-in-primary-continue' ) ),
1158                                 ],
1159                                 [],
1160                                 $tmp
1161                         ],
1162                         'Primary redirect, then abstain' => [
1163                                 StatusValue::newGood(),
1164                                 [
1165                                         $tmp = AuthenticationResponse::newRedirect(
1166                                                 [ $req ], '/foo.html', [ 'foo' => 'bar' ]
1167                                         ),
1168                                         AuthenticationResponse::newAbstain(),
1169                                 ],
1170                                 [],
1171                                 [
1172                                         $tmp,
1173                                         new \DomainException(
1174                                                 'MockPrimaryAuthenticationProvider::continuePrimaryAuthentication() returned ABSTAIN'
1175                                         )
1176                                 ]
1177                         ],
1178                         'Primary UI, then pass with no local user' => [
1179                                 StatusValue::newGood(),
1180                                 [
1181                                         $tmp = AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
1182                                         AuthenticationResponse::newPass( null ),
1183                                 ],
1184                                 [],
1185                                 [
1186                                         $tmp,
1187                                         $restartResponse,
1188                                 ]
1189                         ],
1190                         'Primary UI, then pass with no local user (link type)' => [
1191                                 StatusValue::newGood(),
1192                                 [
1193                                         $tmp = AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
1194                                         $restartResponse2Pass,
1195                                 ],
1196                                 [],
1197                                 [
1198                                         $tmp,
1199                                         $restartResponse2,
1200                                 ],
1201                                 true
1202                         ],
1203                         'Primary pass with invalid username' => [
1204                                 StatusValue::newGood(),
1205                                 [
1206                                         AuthenticationResponse::newPass( '<>' ),
1207                                 ],
1208                                 [],
1209                                 [
1210                                         new \DomainException( 'MockPrimaryAuthenticationProvider returned an invalid username: <>' ),
1211                                 ]
1212                         ],
1213                         'Secondary fail' => [
1214                                 StatusValue::newGood(),
1215                                 [
1216                                         AuthenticationResponse::newPass( $userName ),
1217                                 ],
1218                                 $tmp = [
1219                                         AuthenticationResponse::newFail( $this->message( 'fail-in-secondary' ) ),
1220                                 ],
1221                                 $tmp
1222                         ],
1223                         'Secondary UI, then abstain' => [
1224                                 StatusValue::newGood(),
1225                                 [
1226                                         AuthenticationResponse::newPass( $userName ),
1227                                 ],
1228                                 [
1229                                         $tmp = AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
1230                                         AuthenticationResponse::newAbstain()
1231                                 ],
1232                                 [
1233                                         $tmp,
1234                                         AuthenticationResponse::newPass( $userName ),
1235                                 ]
1236                         ],
1237                         'Secondary pass' => [
1238                                 StatusValue::newGood(),
1239                                 [
1240                                         AuthenticationResponse::newPass( $userName ),
1241                                 ],
1242                                 [
1243                                         AuthenticationResponse::newPass()
1244                                 ],
1245                                 [
1246                                         AuthenticationResponse::newPass( $userName ),
1247                                 ]
1248                         ],
1249                 ];
1250         }
1251
1252         /**
1253          * @dataProvider provideUserExists
1254          * @param bool $primary1Exists
1255          * @param bool $primary2Exists
1256          * @param bool $expect
1257          */
1258         public function testUserExists( $primary1Exists, $primary2Exists, $expect ) {
1259                 $mock1 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1260                 $mock1->expects( $this->any() )->method( 'getUniqueId' )
1261                         ->will( $this->returnValue( 'primary1' ) );
1262                 $mock1->expects( $this->any() )->method( 'testUserExists' )
1263                         ->with( $this->equalTo( 'UTSysop' ) )
1264                         ->will( $this->returnValue( $primary1Exists ) );
1265                 $mock2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1266                 $mock2->expects( $this->any() )->method( 'getUniqueId' )
1267                         ->will( $this->returnValue( 'primary2' ) );
1268                 $mock2->expects( $this->any() )->method( 'testUserExists' )
1269                         ->with( $this->equalTo( 'UTSysop' ) )
1270                         ->will( $this->returnValue( $primary2Exists ) );
1271                 $this->primaryauthMocks = [ $mock1, $mock2 ];
1272
1273                 $this->initializeManager( true );
1274                 $this->assertSame( $expect, $this->manager->userExists( 'UTSysop' ) );
1275         }
1276
1277         public static function provideUserExists() {
1278                 return [
1279                         [ false, false, false ],
1280                         [ true, false, true ],
1281                         [ false, true, true ],
1282                         [ true, true, true ],
1283                 ];
1284         }
1285
1286         /**
1287          * @dataProvider provideAllowsAuthenticationDataChange
1288          * @param StatusValue $primaryReturn
1289          * @param StatusValue $secondaryReturn
1290          * @param Status $expect
1291          */
1292         public function testAllowsAuthenticationDataChange( $primaryReturn, $secondaryReturn, $expect ) {
1293                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
1294
1295                 $mock1 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1296                 $mock1->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( '1' ) );
1297                 $mock1->expects( $this->any() )->method( 'providerAllowsAuthenticationDataChange' )
1298                         ->with( $this->equalTo( $req ) )
1299                         ->will( $this->returnValue( $primaryReturn ) );
1300                 $mock2 = $this->getMockForAbstractClass( SecondaryAuthenticationProvider::class );
1301                 $mock2->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( '2' ) );
1302                 $mock2->expects( $this->any() )->method( 'providerAllowsAuthenticationDataChange' )
1303                         ->with( $this->equalTo( $req ) )
1304                         ->will( $this->returnValue( $secondaryReturn ) );
1305
1306                 $this->primaryauthMocks = [ $mock1 ];
1307                 $this->secondaryauthMocks = [ $mock2 ];
1308                 $this->initializeManager( true );
1309                 $this->assertEquals( $expect, $this->manager->allowsAuthenticationDataChange( $req ) );
1310         }
1311
1312         public static function provideAllowsAuthenticationDataChange() {
1313                 $ignored = \Status::newGood( 'ignored' );
1314                 $ignored->warning( 'authmanager-change-not-supported' );
1315
1316                 $okFromPrimary = StatusValue::newGood();
1317                 $okFromPrimary->warning( 'warning-from-primary' );
1318                 $okFromSecondary = StatusValue::newGood();
1319                 $okFromSecondary->warning( 'warning-from-secondary' );
1320
1321                 return [
1322                         [
1323                                 StatusValue::newGood(),
1324                                 StatusValue::newGood(),
1325                                 \Status::newGood(),
1326                         ],
1327                         [
1328                                 StatusValue::newGood(),
1329                                 StatusValue::newGood( 'ignore' ),
1330                                 \Status::newGood(),
1331                         ],
1332                         [
1333                                 StatusValue::newGood( 'ignored' ),
1334                                 StatusValue::newGood(),
1335                                 \Status::newGood(),
1336                         ],
1337                         [
1338                                 StatusValue::newGood( 'ignored' ),
1339                                 StatusValue::newGood( 'ignored' ),
1340                                 $ignored,
1341                         ],
1342                         [
1343                                 StatusValue::newFatal( 'fail from primary' ),
1344                                 StatusValue::newGood(),
1345                                 \Status::newFatal( 'fail from primary' ),
1346                         ],
1347                         [
1348                                 $okFromPrimary,
1349                                 StatusValue::newGood(),
1350                                 \Status::wrap( $okFromPrimary ),
1351                         ],
1352                         [
1353                                 StatusValue::newGood(),
1354                                 StatusValue::newFatal( 'fail from secondary' ),
1355                                 \Status::newFatal( 'fail from secondary' ),
1356                         ],
1357                         [
1358                                 StatusValue::newGood(),
1359                                 $okFromSecondary,
1360                                 \Status::wrap( $okFromSecondary ),
1361                         ],
1362                 ];
1363         }
1364
1365         public function testChangeAuthenticationData() {
1366                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
1367                 $req->username = 'UTSysop';
1368
1369                 $mock1 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1370                 $mock1->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( '1' ) );
1371                 $mock1->expects( $this->once() )->method( 'providerChangeAuthenticationData' )
1372                         ->with( $this->equalTo( $req ) );
1373                 $mock2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1374                 $mock2->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( '2' ) );
1375                 $mock2->expects( $this->once() )->method( 'providerChangeAuthenticationData' )
1376                         ->with( $this->equalTo( $req ) );
1377
1378                 $this->primaryauthMocks = [ $mock1, $mock2 ];
1379                 $this->initializeManager( true );
1380                 $this->logger->setCollect( true );
1381                 $this->manager->changeAuthenticationData( $req );
1382                 $this->assertSame( [
1383                         [ LogLevel::INFO, 'Changing authentication data for {user} class {what}' ],
1384                 ], $this->logger->getBuffer() );
1385         }
1386
1387         public function testCanCreateAccounts() {
1388                 $types = [
1389                         PrimaryAuthenticationProvider::TYPE_CREATE => true,
1390                         PrimaryAuthenticationProvider::TYPE_LINK => true,
1391                         PrimaryAuthenticationProvider::TYPE_NONE => false,
1392                 ];
1393
1394                 foreach ( $types as $type => $can ) {
1395                         $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1396                         $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( $type ) );
1397                         $mock->expects( $this->any() )->method( 'accountCreationType' )
1398                                 ->will( $this->returnValue( $type ) );
1399                         $this->primaryauthMocks = [ $mock ];
1400                         $this->initializeManager( true );
1401                         $this->assertSame( $can, $this->manager->canCreateAccounts(), $type );
1402                 }
1403         }
1404
1405         public function testCheckAccountCreatePermissions() {
1406                 $this->initializeManager( true );
1407
1408                 $this->setGroupPermissions( '*', 'createaccount', true );
1409                 $this->assertEquals(
1410                         \Status::newGood(),
1411                         $this->manager->checkAccountCreatePermissions( new \User )
1412                 );
1413
1414                 $readOnlyMode = \MediaWiki\MediaWikiServices::getInstance()->getReadOnlyMode();
1415                 $readOnlyMode->setReason( 'Because' );
1416                 $this->assertEquals(
1417                         \Status::newFatal( wfMessage( 'readonlytext', 'Because' ) ),
1418                         $this->manager->checkAccountCreatePermissions( new \User )
1419                 );
1420                 $readOnlyMode->setReason( false );
1421
1422                 $this->setGroupPermissions( '*', 'createaccount', false );
1423                 $status = $this->manager->checkAccountCreatePermissions( new \User );
1424                 $this->assertFalse( $status->isOK() );
1425                 $this->assertTrue( $status->hasMessage( 'badaccess-groups' ) );
1426                 $this->setGroupPermissions( '*', 'createaccount', true );
1427
1428                 $user = \User::newFromName( 'UTBlockee' );
1429                 if ( $user->getID() == 0 ) {
1430                         $user->addToDatabase();
1431                         \TestUser::setPasswordForUser( $user, 'UTBlockeePassword' );
1432                         $user->saveSettings();
1433                 }
1434                 $oldBlock = DatabaseBlock::newFromTarget( 'UTBlockee' );
1435                 if ( $oldBlock ) {
1436                         // An old block will prevent our new one from saving.
1437                         $oldBlock->delete();
1438                 }
1439                 $blockOptions = [
1440                         'address' => 'UTBlockee',
1441                         'user' => $user->getID(),
1442                         'by' => $this->getTestSysop()->getUser()->getId(),
1443                         'reason' => __METHOD__,
1444                         'expiry' => time() + 100500,
1445                         'createAccount' => true,
1446                 ];
1447                 $block = new DatabaseBlock( $blockOptions );
1448                 $block->insert();
1449                 $this->resetServices();
1450                 $status = $this->manager->checkAccountCreatePermissions( $user );
1451                 $this->assertFalse( $status->isOK() );
1452                 $this->assertTrue( $status->hasMessage( 'cantcreateaccount-text' ) );
1453
1454                 $blockOptions = [
1455                         'address' => '127.0.0.0/24',
1456                         'by' => $this->getTestSysop()->getUser()->getId(),
1457                         'reason' => __METHOD__,
1458                         'expiry' => time() + 100500,
1459                         'createAccount' => true,
1460                 ];
1461                 $block = new DatabaseBlock( $blockOptions );
1462                 $block->insert();
1463                 $scopeVariable = new ScopedCallback( [ $block, 'delete' ] );
1464                 $status = $this->manager->checkAccountCreatePermissions( new \User );
1465                 $this->assertFalse( $status->isOK() );
1466                 $this->assertTrue( $status->hasMessage( 'cantcreateaccount-range-text' ) );
1467                 ScopedCallback::consume( $scopeVariable );
1468
1469                 $this->setMwGlobals( [
1470                         'wgEnableDnsBlacklist' => true,
1471                         'wgDnsBlacklistUrls' => [
1472                                 'local.wmftest.net', // This will resolve for every subdomain, which works to test "listed?"
1473                         ],
1474                         'wgProxyWhitelist' => [],
1475                 ] );
1476                 $status = $this->manager->checkAccountCreatePermissions( new \User );
1477                 $this->assertFalse( $status->isOK() );
1478                 $this->assertTrue( $status->hasMessage( 'sorbs_create_account_reason' ) );
1479                 $this->setMwGlobals( 'wgProxyWhitelist', [ '127.0.0.1' ] );
1480                 $status = $this->manager->checkAccountCreatePermissions( new \User );
1481                 $this->assertTrue( $status->isGood() );
1482         }
1483
1484         /**
1485          * @param string $uniq
1486          * @return string
1487          */
1488         private static function usernameForCreation( $uniq = '' ) {
1489                 $i = 0;
1490                 do {
1491                         $username = "UTAuthManagerTestAccountCreation" . $uniq . ++$i;
1492                 } while ( \User::newFromName( $username )->getId() !== 0 );
1493                 return $username;
1494         }
1495
1496         public function testCanCreateAccount() {
1497                 $username = self::usernameForCreation();
1498                 $this->initializeManager();
1499
1500                 $this->assertEquals(
1501                         \Status::newFatal( 'authmanager-create-disabled' ),
1502                         $this->manager->canCreateAccount( $username )
1503                 );
1504
1505                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1506                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1507                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1508                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1509                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( true ) );
1510                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1511                         ->will( $this->returnValue( StatusValue::newGood() ) );
1512                 $this->primaryauthMocks = [ $mock ];
1513                 $this->initializeManager( true );
1514
1515                 $this->assertEquals(
1516                         \Status::newFatal( 'userexists' ),
1517                         $this->manager->canCreateAccount( $username )
1518                 );
1519
1520                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1521                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1522                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1523                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1524                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( false ) );
1525                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1526                         ->will( $this->returnValue( StatusValue::newGood() ) );
1527                 $this->primaryauthMocks = [ $mock ];
1528                 $this->initializeManager( true );
1529
1530                 $this->assertEquals(
1531                         \Status::newFatal( 'noname' ),
1532                         $this->manager->canCreateAccount( $username . '<>' )
1533                 );
1534
1535                 $this->assertEquals(
1536                         \Status::newFatal( 'userexists' ),
1537                         $this->manager->canCreateAccount( 'UTSysop' )
1538                 );
1539
1540                 $this->assertEquals(
1541                         \Status::newGood(),
1542                         $this->manager->canCreateAccount( $username )
1543                 );
1544
1545                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1546                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1547                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1548                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1549                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( false ) );
1550                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1551                         ->will( $this->returnValue( StatusValue::newFatal( 'fail' ) ) );
1552                 $this->primaryauthMocks = [ $mock ];
1553                 $this->initializeManager( true );
1554
1555                 $this->assertEquals(
1556                         \Status::newFatal( 'fail' ),
1557                         $this->manager->canCreateAccount( $username )
1558                 );
1559         }
1560
1561         public function testBeginAccountCreation() {
1562                 $creator = \User::newFromName( 'UTSysop' );
1563                 $userReq = new UsernameAuthenticationRequest;
1564                 $this->logger = new \TestLogger( false, function ( $message, $level ) {
1565                         return $level === LogLevel::DEBUG ? null : $message;
1566                 } );
1567                 $this->initializeManager();
1568
1569                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState', 'test' );
1570                 $this->hook( 'LocalUserCreated', $this->never() );
1571                 try {
1572                         $this->manager->beginAccountCreation(
1573                                 $creator, [], 'http://localhost/'
1574                         );
1575                         $this->fail( 'Expected exception not thrown' );
1576                 } catch ( \LogicException $ex ) {
1577                         $this->assertEquals( 'Account creation is not possible', $ex->getMessage() );
1578                 }
1579                 $this->unhook( 'LocalUserCreated' );
1580                 $this->assertNull(
1581                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1582                 );
1583
1584                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1585                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1586                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1587                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1588                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( true ) );
1589                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1590                         ->will( $this->returnValue( StatusValue::newGood() ) );
1591                 $this->primaryauthMocks = [ $mock ];
1592                 $this->initializeManager( true );
1593
1594                 $this->hook( 'LocalUserCreated', $this->never() );
1595                 $ret = $this->manager->beginAccountCreation( $creator, [], 'http://localhost/' );
1596                 $this->unhook( 'LocalUserCreated' );
1597                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1598                 $this->assertSame( 'noname', $ret->message->getKey() );
1599
1600                 $this->hook( 'LocalUserCreated', $this->never() );
1601                 $userReq->username = self::usernameForCreation();
1602                 $userReq2 = new UsernameAuthenticationRequest;
1603                 $userReq2->username = $userReq->username . 'X';
1604                 $ret = $this->manager->beginAccountCreation(
1605                         $creator, [ $userReq, $userReq2 ], 'http://localhost/'
1606                 );
1607                 $this->unhook( 'LocalUserCreated' );
1608                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1609                 $this->assertSame( 'noname', $ret->message->getKey() );
1610
1611                 $this->hook( 'LocalUserCreated', $this->never() );
1612                 $readOnlyMode = \MediaWiki\MediaWikiServices::getInstance()->getReadOnlyMode();
1613                 $readOnlyMode->setReason( 'Because' );
1614                 $userReq->username = self::usernameForCreation();
1615                 $ret = $this->manager->beginAccountCreation( $creator, [ $userReq ], 'http://localhost/' );
1616                 $this->unhook( 'LocalUserCreated' );
1617                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1618                 $this->assertSame( 'readonlytext', $ret->message->getKey() );
1619                 $this->assertSame( [ 'Because' ], $ret->message->getParams() );
1620                 $readOnlyMode->setReason( false );
1621
1622                 $this->hook( 'LocalUserCreated', $this->never() );
1623                 $userReq->username = self::usernameForCreation();
1624                 $ret = $this->manager->beginAccountCreation( $creator, [ $userReq ], 'http://localhost/' );
1625                 $this->unhook( 'LocalUserCreated' );
1626                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1627                 $this->assertSame( 'userexists', $ret->message->getKey() );
1628
1629                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1630                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1631                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1632                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1633                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( false ) );
1634                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1635                         ->will( $this->returnValue( StatusValue::newFatal( 'fail' ) ) );
1636                 $this->primaryauthMocks = [ $mock ];
1637                 $this->initializeManager( true );
1638
1639                 $this->hook( 'LocalUserCreated', $this->never() );
1640                 $userReq->username = self::usernameForCreation();
1641                 $ret = $this->manager->beginAccountCreation( $creator, [ $userReq ], 'http://localhost/' );
1642                 $this->unhook( 'LocalUserCreated' );
1643                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1644                 $this->assertSame( 'fail', $ret->message->getKey() );
1645
1646                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1647                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1648                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1649                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1650                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( false ) );
1651                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1652                         ->will( $this->returnValue( StatusValue::newGood() ) );
1653                 $this->primaryauthMocks = [ $mock ];
1654                 $this->initializeManager( true );
1655
1656                 $this->hook( 'LocalUserCreated', $this->never() );
1657                 $userReq->username = self::usernameForCreation() . '<>';
1658                 $ret = $this->manager->beginAccountCreation( $creator, [ $userReq ], 'http://localhost/' );
1659                 $this->unhook( 'LocalUserCreated' );
1660                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1661                 $this->assertSame( 'noname', $ret->message->getKey() );
1662
1663                 $this->hook( 'LocalUserCreated', $this->never() );
1664                 $userReq->username = $creator->getName();
1665                 $ret = $this->manager->beginAccountCreation( $creator, [ $userReq ], 'http://localhost/' );
1666                 $this->unhook( 'LocalUserCreated' );
1667                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1668                 $this->assertSame( 'userexists', $ret->message->getKey() );
1669
1670                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1671                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1672                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1673                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1674                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( false ) );
1675                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
1676                         ->will( $this->returnValue( StatusValue::newGood() ) );
1677                 $mock->expects( $this->any() )->method( 'testForAccountCreation' )
1678                         ->will( $this->returnValue( StatusValue::newFatal( 'fail' ) ) );
1679                 $this->primaryauthMocks = [ $mock ];
1680                 $this->initializeManager( true );
1681
1682                 $req = $this->getMockBuilder( UserDataAuthenticationRequest::class )
1683                         ->setMethods( [ 'populateUser' ] )
1684                         ->getMock();
1685                 $req->expects( $this->any() )->method( 'populateUser' )
1686                         ->willReturn( \StatusValue::newFatal( 'populatefail' ) );
1687                 $userReq->username = self::usernameForCreation();
1688                 $ret = $this->manager->beginAccountCreation(
1689                         $creator, [ $userReq, $req ], 'http://localhost/'
1690                 );
1691                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1692                 $this->assertSame( 'populatefail', $ret->message->getKey() );
1693
1694                 $req = new UserDataAuthenticationRequest;
1695                 $userReq->username = self::usernameForCreation();
1696
1697                 $ret = $this->manager->beginAccountCreation(
1698                         $creator, [ $userReq, $req ], 'http://localhost/'
1699                 );
1700                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1701                 $this->assertSame( 'fail', $ret->message->getKey() );
1702
1703                 $this->manager->beginAccountCreation(
1704                         \User::newFromName( $userReq->username ), [ $userReq, $req ], 'http://localhost/'
1705                 );
1706                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1707                 $this->assertSame( 'fail', $ret->message->getKey() );
1708         }
1709
1710         public function testContinueAccountCreation() {
1711                 $creator = \User::newFromName( 'UTSysop' );
1712                 $username = self::usernameForCreation();
1713                 $this->logger = new \TestLogger( false, function ( $message, $level ) {
1714                         return $level === LogLevel::DEBUG ? null : $message;
1715                 } );
1716                 $this->initializeManager();
1717
1718                 $session = [
1719                         'userid' => 0,
1720                         'username' => $username,
1721                         'creatorid' => 0,
1722                         'creatorname' => $username,
1723                         'reqs' => [],
1724                         'primary' => null,
1725                         'primaryResponse' => null,
1726                         'secondary' => [],
1727                         'ranPreTests' => true,
1728                 ];
1729
1730                 $this->hook( 'LocalUserCreated', $this->never() );
1731                 try {
1732                         $this->manager->continueAccountCreation( [] );
1733                         $this->fail( 'Expected exception not thrown' );
1734                 } catch ( \LogicException $ex ) {
1735                         $this->assertEquals( 'Account creation is not possible', $ex->getMessage() );
1736                 }
1737                 $this->unhook( 'LocalUserCreated' );
1738
1739                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
1740                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
1741                 $mock->expects( $this->any() )->method( 'accountCreationType' )
1742                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1743                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( false ) );
1744                 $mock->expects( $this->any() )->method( 'beginPrimaryAccountCreation' )->will(
1745                         $this->returnValue( AuthenticationResponse::newFail( $this->message( 'fail' ) ) )
1746                 );
1747                 $this->primaryauthMocks = [ $mock ];
1748                 $this->initializeManager( true );
1749
1750                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState', null );
1751                 $this->hook( 'LocalUserCreated', $this->never() );
1752                 $ret = $this->manager->continueAccountCreation( [] );
1753                 $this->unhook( 'LocalUserCreated' );
1754                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1755                 $this->assertSame( 'authmanager-create-not-in-progress', $ret->message->getKey() );
1756
1757                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState',
1758                         [ 'username' => "$username<>" ] + $session );
1759                 $this->hook( 'LocalUserCreated', $this->never() );
1760                 $ret = $this->manager->continueAccountCreation( [] );
1761                 $this->unhook( 'LocalUserCreated' );
1762                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1763                 $this->assertSame( 'noname', $ret->message->getKey() );
1764                 $this->assertNull(
1765                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1766                 );
1767
1768                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState', $session );
1769                 $this->hook( 'LocalUserCreated', $this->never() );
1770                 $cache = \ObjectCache::getLocalClusterInstance();
1771                 $lock = $cache->getScopedLock( $cache->makeGlobalKey( 'account', md5( $username ) ) );
1772                 $ret = $this->manager->continueAccountCreation( [] );
1773                 unset( $lock );
1774                 $this->unhook( 'LocalUserCreated' );
1775                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1776                 $this->assertSame( 'usernameinprogress', $ret->message->getKey() );
1777                 // This error shouldn't remove the existing session, because the
1778                 // raced-with process "owns" it.
1779                 $this->assertSame(
1780                         $session, $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1781                 );
1782
1783                 $this->hook( 'LocalUserCreated', $this->never() );
1784                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState',
1785                         [ 'username' => $creator->getName() ] + $session );
1786                 $readOnlyMode = \MediaWiki\MediaWikiServices::getInstance()->getReadOnlyMode();
1787                 $readOnlyMode->setReason( 'Because' );
1788                 $ret = $this->manager->continueAccountCreation( [] );
1789                 $this->unhook( 'LocalUserCreated' );
1790                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1791                 $this->assertSame( 'readonlytext', $ret->message->getKey() );
1792                 $this->assertSame( [ 'Because' ], $ret->message->getParams() );
1793                 $readOnlyMode->setReason( false );
1794
1795                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState',
1796                         [ 'username' => $creator->getName() ] + $session );
1797                 $this->hook( 'LocalUserCreated', $this->never() );
1798                 $ret = $this->manager->continueAccountCreation( [] );
1799                 $this->unhook( 'LocalUserCreated' );
1800                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1801                 $this->assertSame( 'userexists', $ret->message->getKey() );
1802                 $this->assertNull(
1803                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1804                 );
1805
1806                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState',
1807                         [ 'userid' => $creator->getId() ] + $session );
1808                 $this->hook( 'LocalUserCreated', $this->never() );
1809                 try {
1810                         $ret = $this->manager->continueAccountCreation( [] );
1811                         $this->fail( 'Expected exception not thrown' );
1812                 } catch ( \UnexpectedValueException $ex ) {
1813                         $this->assertEquals( "User \"{$username}\" should exist now, but doesn't!", $ex->getMessage() );
1814                 }
1815                 $this->unhook( 'LocalUserCreated' );
1816                 $this->assertNull(
1817                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1818                 );
1819
1820                 $id = $creator->getId();
1821                 $name = $creator->getName();
1822                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState',
1823                         [ 'username' => $name, 'userid' => $id + 1 ] + $session );
1824                 $this->hook( 'LocalUserCreated', $this->never() );
1825                 try {
1826                         $ret = $this->manager->continueAccountCreation( [] );
1827                         $this->fail( 'Expected exception not thrown' );
1828                 } catch ( \UnexpectedValueException $ex ) {
1829                         $this->assertEquals(
1830                                 "User \"{$name}\" exists, but ID $id !== " . ( $id + 1 ) . '!', $ex->getMessage()
1831                         );
1832                 }
1833                 $this->unhook( 'LocalUserCreated' );
1834                 $this->assertNull(
1835                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1836                 );
1837
1838                 $req = $this->getMockBuilder( UserDataAuthenticationRequest::class )
1839                         ->setMethods( [ 'populateUser' ] )
1840                         ->getMock();
1841                 $req->expects( $this->any() )->method( 'populateUser' )
1842                         ->willReturn( \StatusValue::newFatal( 'populatefail' ) );
1843                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState',
1844                         [ 'reqs' => [ $req ] ] + $session );
1845                 $ret = $this->manager->continueAccountCreation( [] );
1846                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
1847                 $this->assertSame( 'populatefail', $ret->message->getKey() );
1848                 $this->assertNull(
1849                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' )
1850                 );
1851         }
1852
1853         /**
1854          * @dataProvider provideAccountCreation
1855          * @param StatusValue $preTest
1856          * @param StatusValue $primaryTest
1857          * @param StatusValue $secondaryTest
1858          * @param array $primaryResponses
1859          * @param array $secondaryResponses
1860          * @param array $managerResponses
1861          */
1862         public function testAccountCreation(
1863                 StatusValue $preTest, $primaryTest, $secondaryTest,
1864                 array $primaryResponses, array $secondaryResponses, array $managerResponses
1865         ) {
1866                 $creator = \User::newFromName( 'UTSysop' );
1867                 $username = self::usernameForCreation();
1868
1869                 $this->initializeManager();
1870
1871                 // Set up lots of mocks...
1872                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
1873                 $req->preTest = $preTest;
1874                 $req->primaryTest = $primaryTest;
1875                 $req->secondaryTest = $secondaryTest;
1876                 $req->primary = $primaryResponses;
1877                 $req->secondary = $secondaryResponses;
1878                 $mocks = [];
1879                 foreach ( [ 'pre', 'primary', 'secondary' ] as $key ) {
1880                         $class = ucfirst( $key ) . 'AuthenticationProvider';
1881                         $mocks[$key] = $this->getMockForAbstractClass(
1882                                 "MediaWiki\\Auth\\$class", [], "Mock$class"
1883                         );
1884                         $mocks[$key]->expects( $this->any() )->method( 'getUniqueId' )
1885                                 ->will( $this->returnValue( $key ) );
1886                         $mocks[$key]->expects( $this->any() )->method( 'testUserForCreation' )
1887                                 ->will( $this->returnValue( StatusValue::newGood() ) );
1888                         $mocks[$key]->expects( $this->any() )->method( 'testForAccountCreation' )
1889                                 ->will( $this->returnCallback(
1890                                         function ( $user, $creatorIn, $reqs )
1891                                                 use ( $username, $creator, $req, $key )
1892                                         {
1893                                                 $this->assertSame( $username, $user->getName() );
1894                                                 $this->assertSame( $creator->getId(), $creatorIn->getId() );
1895                                                 $this->assertSame( $creator->getName(), $creatorIn->getName() );
1896                                                 $foundReq = false;
1897                                                 foreach ( $reqs as $r ) {
1898                                                         $this->assertSame( $username, $r->username );
1899                                                         $foundReq = $foundReq || get_class( $r ) === get_class( $req );
1900                                                 }
1901                                                 $this->assertTrue( $foundReq, '$reqs contains $req' );
1902                                                 $k = $key . 'Test';
1903                                                 return $req->$k;
1904                                         }
1905                                 ) );
1906
1907                         for ( $i = 2; $i <= 3; $i++ ) {
1908                                 $mocks[$key . $i] = $this->getMockForAbstractClass( "MediaWiki\\Auth\\$class" );
1909                                 $mocks[$key . $i]->expects( $this->any() )->method( 'getUniqueId' )
1910                                         ->will( $this->returnValue( $key . $i ) );
1911                                 $mocks[$key . $i]->expects( $this->any() )->method( 'testUserForCreation' )
1912                                         ->will( $this->returnValue( StatusValue::newGood() ) );
1913                                 $mocks[$key . $i]->expects( $this->atMost( 1 ) )->method( 'testForAccountCreation' )
1914                                         ->will( $this->returnValue( StatusValue::newGood() ) );
1915                         }
1916                 }
1917
1918                 $mocks['primary']->expects( $this->any() )->method( 'accountCreationType' )
1919                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
1920                 $mocks['primary']->expects( $this->any() )->method( 'testUserExists' )
1921                         ->will( $this->returnValue( false ) );
1922                 $ct = count( $req->primary );
1923                 $callback = $this->returnCallback( function ( $user, $creator, $reqs ) use ( $username, $req ) {
1924                         $this->assertSame( $username, $user->getName() );
1925                         $this->assertSame( 'UTSysop', $creator->getName() );
1926                         $foundReq = false;
1927                         foreach ( $reqs as $r ) {
1928                                 $this->assertSame( $username, $r->username );
1929                                 $foundReq = $foundReq || get_class( $r ) === get_class( $req );
1930                         }
1931                         $this->assertTrue( $foundReq, '$reqs contains $req' );
1932                         return array_shift( $req->primary );
1933                 } );
1934                 $mocks['primary']->expects( $this->exactly( min( 1, $ct ) ) )
1935                         ->method( 'beginPrimaryAccountCreation' )
1936                         ->will( $callback );
1937                 $mocks['primary']->expects( $this->exactly( max( 0, $ct - 1 ) ) )
1938                         ->method( 'continuePrimaryAccountCreation' )
1939                         ->will( $callback );
1940
1941                 $ct = count( $req->secondary );
1942                 $callback = $this->returnCallback( function ( $user, $creator, $reqs ) use ( $username, $req ) {
1943                         $this->assertSame( $username, $user->getName() );
1944                         $this->assertSame( 'UTSysop', $creator->getName() );
1945                         $foundReq = false;
1946                         foreach ( $reqs as $r ) {
1947                                 $this->assertSame( $username, $r->username );
1948                                 $foundReq = $foundReq || get_class( $r ) === get_class( $req );
1949                         }
1950                         $this->assertTrue( $foundReq, '$reqs contains $req' );
1951                         return array_shift( $req->secondary );
1952                 } );
1953                 $mocks['secondary']->expects( $this->exactly( min( 1, $ct ) ) )
1954                         ->method( 'beginSecondaryAccountCreation' )
1955                         ->will( $callback );
1956                 $mocks['secondary']->expects( $this->exactly( max( 0, $ct - 1 ) ) )
1957                         ->method( 'continueSecondaryAccountCreation' )
1958                         ->will( $callback );
1959
1960                 $abstain = AuthenticationResponse::newAbstain();
1961                 $mocks['primary2']->expects( $this->any() )->method( 'accountCreationType' )
1962                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
1963                 $mocks['primary2']->expects( $this->any() )->method( 'testUserExists' )
1964                         ->will( $this->returnValue( false ) );
1965                 $mocks['primary2']->expects( $this->atMost( 1 ) )->method( 'beginPrimaryAccountCreation' )
1966                         ->will( $this->returnValue( $abstain ) );
1967                 $mocks['primary2']->expects( $this->never() )->method( 'continuePrimaryAccountCreation' );
1968                 $mocks['primary3']->expects( $this->any() )->method( 'accountCreationType' )
1969                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_NONE ) );
1970                 $mocks['primary3']->expects( $this->any() )->method( 'testUserExists' )
1971                         ->will( $this->returnValue( false ) );
1972                 $mocks['primary3']->expects( $this->never() )->method( 'beginPrimaryAccountCreation' );
1973                 $mocks['primary3']->expects( $this->never() )->method( 'continuePrimaryAccountCreation' );
1974                 $mocks['secondary2']->expects( $this->atMost( 1 ) )
1975                         ->method( 'beginSecondaryAccountCreation' )
1976                         ->will( $this->returnValue( $abstain ) );
1977                 $mocks['secondary2']->expects( $this->never() )->method( 'continueSecondaryAccountCreation' );
1978                 $mocks['secondary3']->expects( $this->atMost( 1 ) )
1979                         ->method( 'beginSecondaryAccountCreation' )
1980                         ->will( $this->returnValue( $abstain ) );
1981                 $mocks['secondary3']->expects( $this->never() )->method( 'continueSecondaryAccountCreation' );
1982
1983                 $this->preauthMocks = [ $mocks['pre'], $mocks['pre2'] ];
1984                 $this->primaryauthMocks = [ $mocks['primary3'], $mocks['primary'], $mocks['primary2'] ];
1985                 $this->secondaryauthMocks = [
1986                         $mocks['secondary3'], $mocks['secondary'], $mocks['secondary2']
1987                 ];
1988
1989                 $this->logger = new \TestLogger( true, function ( $message, $level ) {
1990                         return $level === LogLevel::DEBUG ? null : $message;
1991                 } );
1992                 $expectLog = [];
1993                 $this->initializeManager( true );
1994
1995                 $constraint = \PHPUnit_Framework_Assert::logicalOr(
1996                         $this->equalTo( AuthenticationResponse::PASS ),
1997                         $this->equalTo( AuthenticationResponse::FAIL )
1998                 );
1999                 $providers = array_merge(
2000                         $this->preauthMocks, $this->primaryauthMocks, $this->secondaryauthMocks
2001                 );
2002                 foreach ( $providers as $p ) {
2003                         $p->postCalled = false;
2004                         $p->expects( $this->atMost( 1 ) )->method( 'postAccountCreation' )
2005                                 ->willReturnCallback( function ( $user, $creator, $response )
2006                                         use ( $constraint, $p, $username )
2007                                 {
2008                                         $this->assertInstanceOf( \User::class, $user );
2009                                         $this->assertSame( $username, $user->getName() );
2010                                         $this->assertSame( 'UTSysop', $creator->getName() );
2011                                         $this->assertInstanceOf( AuthenticationResponse::class, $response );
2012                                         $this->assertThat( $response->status, $constraint );
2013                                         $p->postCalled = $response->status;
2014                                 } );
2015                 }
2016
2017                 // We're testing with $wgNewUserLog = false, so assert that it worked
2018                 $dbw = wfGetDB( DB_MASTER );
2019                 $maxLogId = $dbw->selectField( 'logging', 'MAX(log_id)', [ 'log_type' => 'newusers' ] );
2020
2021                 $first = true;
2022                 $created = false;
2023                 foreach ( $managerResponses as $i => $response ) {
2024                         $success = $response instanceof AuthenticationResponse &&
2025                                 $response->status === AuthenticationResponse::PASS;
2026                         if ( $i === 'created' ) {
2027                                 $created = true;
2028                                 $this->hook( 'LocalUserCreated', $this->once() )
2029                                         ->with(
2030                                                 $this->callback( function ( $user ) use ( $username ) {
2031                                                         return $user->getName() === $username;
2032                                                 } ),
2033                                                 $this->equalTo( false )
2034                                         );
2035                                 $expectLog[] = [ LogLevel::INFO, "Creating user {user} during account creation" ];
2036                         } else {
2037                                 $this->hook( 'LocalUserCreated', $this->never() );
2038                         }
2039
2040                         $ex = null;
2041                         try {
2042                                 if ( $first ) {
2043                                         $userReq = new UsernameAuthenticationRequest;
2044                                         $userReq->username = $username;
2045                                         $ret = $this->manager->beginAccountCreation(
2046                                                 $creator, [ $userReq, $req ], 'http://localhost/'
2047                                         );
2048                                 } else {
2049                                         $ret = $this->manager->continueAccountCreation( [ $req ] );
2050                                 }
2051                                 if ( $response instanceof \Exception ) {
2052                                         $this->fail( 'Expected exception not thrown', "Response $i" );
2053                                 }
2054                         } catch ( \Exception $ex ) {
2055                                 if ( !$response instanceof \Exception ) {
2056                                         throw $ex;
2057                                 }
2058                                 $this->assertEquals( $response->getMessage(), $ex->getMessage(), "Response $i, exception" );
2059                                 $this->assertNull(
2060                                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' ),
2061                                         "Response $i, exception, session state"
2062                                 );
2063                                 $this->unhook( 'LocalUserCreated' );
2064                                 return;
2065                         }
2066
2067                         $this->unhook( 'LocalUserCreated' );
2068
2069                         $this->assertSame( 'http://localhost/', $req->returnToUrl );
2070
2071                         if ( $success ) {
2072                                 $this->assertNotNull( $ret->loginRequest, "Response $i, login marker" );
2073                                 $this->assertContains(
2074                                         $ret->loginRequest, $this->managerPriv->createdAccountAuthenticationRequests,
2075                                         "Response $i, login marker"
2076                                 );
2077
2078                                 $expectLog[] = [
2079                                         LogLevel::INFO,
2080                                         "MediaWiki\Auth\AuthManager::continueAccountCreation: Account creation succeeded for {user}"
2081                                 ];
2082
2083                                 // Set some fields in the expected $response that we couldn't
2084                                 // know in provideAccountCreation().
2085                                 $response->username = $username;
2086                                 $response->loginRequest = $ret->loginRequest;
2087                         } else {
2088                                 $this->assertNull( $ret->loginRequest, "Response $i, login marker" );
2089                                 $this->assertSame( [], $this->managerPriv->createdAccountAuthenticationRequests,
2090                                         "Response $i, login marker" );
2091                         }
2092                         $ret->message = $this->message( $ret->message );
2093                         $this->assertResponseEquals( $response, $ret, "Response $i, response" );
2094                         if ( $success || $response->status === AuthenticationResponse::FAIL ) {
2095                                 $this->assertNull(
2096                                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' ),
2097                                         "Response $i, session state"
2098                                 );
2099                                 foreach ( $providers as $p ) {
2100                                         $this->assertSame( $response->status, $p->postCalled,
2101                                                 "Response $i, post-auth callback called" );
2102                                 }
2103                         } else {
2104                                 $this->assertNotNull(
2105                                         $this->request->getSession()->getSecret( 'AuthManager::accountCreationState' ),
2106                                         "Response $i, session state"
2107                                 );
2108                                 foreach ( $ret->neededRequests as $neededReq ) {
2109                                         $this->assertEquals( AuthManager::ACTION_CREATE, $neededReq->action,
2110                                                 "Response $i, neededRequest action" );
2111                                 }
2112                                 $this->assertEquals(
2113                                         $ret->neededRequests,
2114                                         $this->manager->getAuthenticationRequests( AuthManager::ACTION_CREATE_CONTINUE ),
2115                                         "Response $i, continuation check"
2116                                 );
2117                                 foreach ( $providers as $p ) {
2118                                         $this->assertFalse( $p->postCalled, "Response $i, post-auth callback not called" );
2119                                 }
2120                         }
2121
2122                         if ( $created ) {
2123                                 $this->assertNotEquals( 0, \User::idFromName( $username ) );
2124                         } else {
2125                                 $this->assertEquals( 0, \User::idFromName( $username ) );
2126                         }
2127
2128                         $first = false;
2129                 }
2130
2131                 $this->assertSame( $expectLog, $this->logger->getBuffer() );
2132
2133                 $this->assertSame(
2134                         $maxLogId,
2135                         $dbw->selectField( 'logging', 'MAX(log_id)', [ 'log_type' => 'newusers' ] )
2136                 );
2137         }
2138
2139         public function provideAccountCreation() {
2140                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
2141                 $good = StatusValue::newGood();
2142
2143                 return [
2144                         'Pre-creation test fail in pre' => [
2145                                 StatusValue::newFatal( 'fail-from-pre' ), $good, $good,
2146                                 [],
2147                                 [],
2148                                 [
2149                                         AuthenticationResponse::newFail( $this->message( 'fail-from-pre' ) ),
2150                                 ]
2151                         ],
2152                         'Pre-creation test fail in primary' => [
2153                                 $good, StatusValue::newFatal( 'fail-from-primary' ), $good,
2154                                 [],
2155                                 [],
2156                                 [
2157                                         AuthenticationResponse::newFail( $this->message( 'fail-from-primary' ) ),
2158                                 ]
2159                         ],
2160                         'Pre-creation test fail in secondary' => [
2161                                 $good, $good, StatusValue::newFatal( 'fail-from-secondary' ),
2162                                 [],
2163                                 [],
2164                                 [
2165                                         AuthenticationResponse::newFail( $this->message( 'fail-from-secondary' ) ),
2166                                 ]
2167                         ],
2168                         'Failure in primary' => [
2169                                 $good, $good, $good,
2170                                 $tmp = [
2171                                         AuthenticationResponse::newFail( $this->message( 'fail-from-primary' ) ),
2172                                 ],
2173                                 [],
2174                                 $tmp
2175                         ],
2176                         'All primary abstain' => [
2177                                 $good, $good, $good,
2178                                 [
2179                                         AuthenticationResponse::newAbstain(),
2180                                 ],
2181                                 [],
2182                                 [
2183                                         AuthenticationResponse::newFail( $this->message( 'authmanager-create-no-primary' ) )
2184                                 ]
2185                         ],
2186                         'Primary UI, then redirect, then fail' => [
2187                                 $good, $good, $good,
2188                                 $tmp = [
2189                                         AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
2190                                         AuthenticationResponse::newRedirect( [ $req ], '/foo.html', [ 'foo' => 'bar' ] ),
2191                                         AuthenticationResponse::newFail( $this->message( 'fail-in-primary-continue' ) ),
2192                                 ],
2193                                 [],
2194                                 $tmp
2195                         ],
2196                         'Primary redirect, then abstain' => [
2197                                 $good, $good, $good,
2198                                 [
2199                                         $tmp = AuthenticationResponse::newRedirect(
2200                                                 [ $req ], '/foo.html', [ 'foo' => 'bar' ]
2201                                         ),
2202                                         AuthenticationResponse::newAbstain(),
2203                                 ],
2204                                 [],
2205                                 [
2206                                         $tmp,
2207                                         new \DomainException(
2208                                                 'MockPrimaryAuthenticationProvider::continuePrimaryAccountCreation() returned ABSTAIN'
2209                                         )
2210                                 ]
2211                         ],
2212                         'Primary UI, then pass; secondary abstain' => [
2213                                 $good, $good, $good,
2214                                 [
2215                                         $tmp1 = AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
2216                                         AuthenticationResponse::newPass(),
2217                                 ],
2218                                 [
2219                                         AuthenticationResponse::newAbstain(),
2220                                 ],
2221                                 [
2222                                         $tmp1,
2223                                         'created' => AuthenticationResponse::newPass( '' ),
2224                                 ]
2225                         ],
2226                         'Primary pass; secondary UI then pass' => [
2227                                 $good, $good, $good,
2228                                 [
2229                                         AuthenticationResponse::newPass( '' ),
2230                                 ],
2231                                 [
2232                                         $tmp1 = AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
2233                                         AuthenticationResponse::newPass( '' ),
2234                                 ],
2235                                 [
2236                                         'created' => $tmp1,
2237                                         AuthenticationResponse::newPass( '' ),
2238                                 ]
2239                         ],
2240                         'Primary pass; secondary fail' => [
2241                                 $good, $good, $good,
2242                                 [
2243                                         AuthenticationResponse::newPass(),
2244                                 ],
2245                                 [
2246                                         AuthenticationResponse::newFail( $this->message( '...' ) ),
2247                                 ],
2248                                 [
2249                                         'created' => new \DomainException(
2250                                                 'MockSecondaryAuthenticationProvider::beginSecondaryAccountCreation() returned FAIL. ' .
2251                                                         'Secondary providers are not allowed to fail account creation, ' .
2252                                                         'that should have been done via testForAccountCreation().'
2253                                         )
2254                                 ]
2255                         ],
2256                 ];
2257         }
2258
2259         /**
2260          * @dataProvider provideAccountCreationLogging
2261          * @param bool $isAnon
2262          * @param string|null $logSubtype
2263          */
2264         public function testAccountCreationLogging( $isAnon, $logSubtype ) {
2265                 $creator = $isAnon ? new \User : \User::newFromName( 'UTSysop' );
2266                 $username = self::usernameForCreation();
2267
2268                 $this->initializeManager();
2269
2270                 // Set up lots of mocks...
2271                 $mock = $this->getMockForAbstractClass(
2272                         \MediaWiki\Auth\PrimaryAuthenticationProvider::class, []
2273                 );
2274                 $mock->expects( $this->any() )->method( 'getUniqueId' )
2275                         ->will( $this->returnValue( 'primary' ) );
2276                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
2277                         ->will( $this->returnValue( StatusValue::newGood() ) );
2278                 $mock->expects( $this->any() )->method( 'testForAccountCreation' )
2279                         ->will( $this->returnValue( StatusValue::newGood() ) );
2280                 $mock->expects( $this->any() )->method( 'accountCreationType' )
2281                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
2282                 $mock->expects( $this->any() )->method( 'testUserExists' )
2283                         ->will( $this->returnValue( false ) );
2284                 $mock->expects( $this->any() )->method( 'beginPrimaryAccountCreation' )
2285                         ->will( $this->returnValue( AuthenticationResponse::newPass( $username ) ) );
2286                 $mock->expects( $this->any() )->method( 'finishAccountCreation' )
2287                         ->will( $this->returnValue( $logSubtype ) );
2288
2289                 $this->primaryauthMocks = [ $mock ];
2290                 $this->initializeManager( true );
2291                 $this->logger->setCollect( true );
2292
2293                 $this->config->set( 'NewUserLog', true );
2294
2295                 $dbw = wfGetDB( DB_MASTER );
2296                 $maxLogId = $dbw->selectField( 'logging', 'MAX(log_id)', [ 'log_type' => 'newusers' ] );
2297
2298                 $userReq = new UsernameAuthenticationRequest;
2299                 $userReq->username = $username;
2300                 $reasonReq = new CreationReasonAuthenticationRequest;
2301                 $reasonReq->reason = $this->toString();
2302                 $ret = $this->manager->beginAccountCreation(
2303                         $creator, [ $userReq, $reasonReq ], 'http://localhost/'
2304                 );
2305
2306                 $this->assertSame( AuthenticationResponse::PASS, $ret->status );
2307
2308                 $user = \User::newFromName( $username );
2309                 $this->assertNotEquals( 0, $user->getId(), 'sanity check' );
2310                 $this->assertNotEquals( $creator->getId(), $user->getId(), 'sanity check' );
2311
2312                 $data = \DatabaseLogEntry::getSelectQueryData();
2313                 $rows = iterator_to_array( $dbw->select(
2314                         $data['tables'],
2315                         $data['fields'],
2316                         [
2317                                 'log_id > ' . (int)$maxLogId,
2318                                 'log_type' => 'newusers'
2319                         ] + $data['conds'],
2320                         __METHOD__,
2321                         $data['options'],
2322                         $data['join_conds']
2323                 ) );
2324                 $this->assertCount( 1, $rows );
2325                 $entry = \DatabaseLogEntry::newFromRow( reset( $rows ) );
2326
2327                 $this->assertSame( $logSubtype ?: ( $isAnon ? 'create' : 'create2' ), $entry->getSubtype() );
2328                 $this->assertSame(
2329                         $isAnon ? $user->getId() : $creator->getId(),
2330                         $entry->getPerformer()->getId()
2331                 );
2332                 $this->assertSame(
2333                         $isAnon ? $user->getName() : $creator->getName(),
2334                         $entry->getPerformer()->getName()
2335                 );
2336                 $this->assertSame( $user->getUserPage()->getFullText(), $entry->getTarget()->getFullText() );
2337                 $this->assertSame( [ '4::userid' => $user->getId() ], $entry->getParameters() );
2338                 $this->assertSame( $this->toString(), $entry->getComment() );
2339         }
2340
2341         public static function provideAccountCreationLogging() {
2342                 return [
2343                         [ true, null ],
2344                         [ true, 'foobar' ],
2345                         [ false, null ],
2346                         [ false, 'byemail' ],
2347                 ];
2348         }
2349
2350         public function testAutoAccountCreation() {
2351                 // PHPUnit seems to have a bug where it will call the ->with()
2352                 // callbacks for our hooks again after the test is run (WTF?), which
2353                 // breaks here because $username no longer matches $user by the end of
2354                 // the testing.
2355                 $workaroundPHPUnitBug = false;
2356
2357                 $username = self::usernameForCreation();
2358                 $expectedSource = AuthManager::AUTOCREATE_SOURCE_SESSION;
2359                 $this->initializeManager();
2360
2361                 $this->setGroupPermissions( '*', 'createaccount', true );
2362                 $this->setGroupPermissions( '*', 'autocreateaccount', false );
2363
2364                 $this->mergeMwGlobalArrayValue( 'wgObjectCaches',
2365                         [ __METHOD__ => [ 'class' => 'HashBagOStuff' ] ] );
2366                 $this->setMwGlobals( [ 'wgMainCacheType' => __METHOD__ ] );
2367
2368                 // Set up lots of mocks...
2369                 $mocks = [];
2370                 foreach ( [ 'pre', 'primary', 'secondary' ] as $key ) {
2371                         $class = ucfirst( $key ) . 'AuthenticationProvider';
2372                         $mocks[$key] = $this->getMockForAbstractClass( "MediaWiki\\Auth\\$class" );
2373                         $mocks[$key]->expects( $this->any() )->method( 'getUniqueId' )
2374                                 ->will( $this->returnValue( $key ) );
2375                 }
2376
2377                 $good = StatusValue::newGood();
2378                 $ok = StatusValue::newFatal( 'ok' );
2379                 $callback = $this->callback( function ( $user ) use ( &$username, &$workaroundPHPUnitBug ) {
2380                         return $workaroundPHPUnitBug || $user->getName() === $username;
2381                 } );
2382                 $callback2 = $this->callback(
2383                         function ( $source ) use ( &$expectedSource, &$workaroundPHPUnitBug ) {
2384                                 return $workaroundPHPUnitBug || $source === $expectedSource;
2385                         }
2386                 );
2387
2388                 $mocks['pre']->expects( $this->exactly( 13 ) )->method( 'testUserForCreation' )
2389                         ->with( $callback, $callback2 )
2390                         ->will( $this->onConsecutiveCalls(
2391                                 $ok, $ok, $ok, // For testing permissions
2392                                 StatusValue::newFatal( 'fail-in-pre' ), $good, $good,
2393                                 $good, // backoff test
2394                                 $good, // addToDatabase fails test
2395                                 $good, // addToDatabase throws test
2396                                 $good, // addToDatabase exists test
2397                                 $good, $good, $good // success
2398                         ) );
2399
2400                 $mocks['primary']->expects( $this->any() )->method( 'accountCreationType' )
2401                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
2402                 $mocks['primary']->expects( $this->any() )->method( 'testUserExists' )
2403                         ->will( $this->returnValue( true ) );
2404                 $mocks['primary']->expects( $this->exactly( 9 ) )->method( 'testUserForCreation' )
2405                         ->with( $callback, $callback2 )
2406                         ->will( $this->onConsecutiveCalls(
2407                                 StatusValue::newFatal( 'fail-in-primary' ), $good,
2408                                 $good, // backoff test
2409                                 $good, // addToDatabase fails test
2410                                 $good, // addToDatabase throws test
2411                                 $good, // addToDatabase exists test
2412                                 $good, $good, $good
2413                         ) );
2414                 $mocks['primary']->expects( $this->exactly( 3 ) )->method( 'autoCreatedAccount' )
2415                         ->with( $callback, $callback2 );
2416
2417                 $mocks['secondary']->expects( $this->exactly( 8 ) )->method( 'testUserForCreation' )
2418                         ->with( $callback, $callback2 )
2419                         ->will( $this->onConsecutiveCalls(
2420                                 StatusValue::newFatal( 'fail-in-secondary' ),
2421                                 $good, // backoff test
2422                                 $good, // addToDatabase fails test
2423                                 $good, // addToDatabase throws test
2424                                 $good, // addToDatabase exists test
2425                                 $good, $good, $good
2426                         ) );
2427                 $mocks['secondary']->expects( $this->exactly( 3 ) )->method( 'autoCreatedAccount' )
2428                         ->with( $callback, $callback2 );
2429
2430                 $this->preauthMocks = [ $mocks['pre'] ];
2431                 $this->primaryauthMocks = [ $mocks['primary'] ];
2432                 $this->secondaryauthMocks = [ $mocks['secondary'] ];
2433                 $this->initializeManager( true );
2434                 $session = $this->request->getSession();
2435
2436                 $logger = new \TestLogger( true, function ( $m ) {
2437                         $m = str_replace( 'MediaWiki\\Auth\\AuthManager::autoCreateUser: ', '', $m );
2438                         return $m;
2439                 } );
2440                 $this->manager->setLogger( $logger );
2441
2442                 try {
2443                         $user = \User::newFromName( 'UTSysop' );
2444                         $this->manager->autoCreateUser( $user, 'InvalidSource', true );
2445                         $this->fail( 'Expected exception not thrown' );
2446                 } catch ( \InvalidArgumentException $ex ) {
2447                         $this->assertSame( 'Unknown auto-creation source: InvalidSource', $ex->getMessage() );
2448                 }
2449
2450                 // First, check an existing user
2451                 $session->clear();
2452                 $user = \User::newFromName( 'UTSysop' );
2453                 $this->hook( 'LocalUserCreated', $this->never() );
2454                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2455                 $this->unhook( 'LocalUserCreated' );
2456                 $expect = \Status::newGood();
2457                 $expect->warning( 'userexists' );
2458                 $this->assertEquals( $expect, $ret );
2459                 $this->assertNotEquals( 0, $user->getId() );
2460                 $this->assertSame( 'UTSysop', $user->getName() );
2461                 $this->assertEquals( $user->getId(), $session->getUser()->getId() );
2462                 $this->assertSame( [
2463                         [ LogLevel::DEBUG, '{username} already exists locally' ],
2464                 ], $logger->getBuffer() );
2465                 $logger->clearBuffer();
2466
2467                 $session->clear();
2468                 $user = \User::newFromName( 'UTSysop' );
2469                 $this->hook( 'LocalUserCreated', $this->never() );
2470                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, false );
2471                 $this->unhook( 'LocalUserCreated' );
2472                 $expect = \Status::newGood();
2473                 $expect->warning( 'userexists' );
2474                 $this->assertEquals( $expect, $ret );
2475                 $this->assertNotEquals( 0, $user->getId() );
2476                 $this->assertSame( 'UTSysop', $user->getName() );
2477                 $this->assertEquals( 0, $session->getUser()->getId() );
2478                 $this->assertSame( [
2479                         [ LogLevel::DEBUG, '{username} already exists locally' ],
2480                 ], $logger->getBuffer() );
2481                 $logger->clearBuffer();
2482
2483                 // Wiki is read-only
2484                 $session->clear();
2485                 $this->hook( 'LocalUserCreated', $this->never() );
2486                 $readOnlyMode = \MediaWiki\MediaWikiServices::getInstance()->getReadOnlyMode();
2487                 $readOnlyMode->setReason( 'Because' );
2488                 $user = \User::newFromName( $username );
2489                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2490                 $this->unhook( 'LocalUserCreated' );
2491                 $this->assertEquals( \Status::newFatal( wfMessage( 'readonlytext', 'Because' ) ), $ret );
2492                 $this->assertEquals( 0, $user->getId() );
2493                 $this->assertNotEquals( $username, $user->getName() );
2494                 $this->assertEquals( 0, $session->getUser()->getId() );
2495                 $this->assertSame( [
2496                         [ LogLevel::DEBUG, 'denied by wfReadOnly(): {reason}' ],
2497                 ], $logger->getBuffer() );
2498                 $logger->clearBuffer();
2499                 $readOnlyMode->setReason( false );
2500
2501                 // Session blacklisted
2502                 $session->clear();
2503                 $session->set( 'AuthManager::AutoCreateBlacklist', 'test' );
2504                 $user = \User::newFromName( $username );
2505                 $this->hook( 'LocalUserCreated', $this->never() );
2506                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2507                 $this->unhook( 'LocalUserCreated' );
2508                 $this->assertEquals( \Status::newFatal( 'test' ), $ret );
2509                 $this->assertEquals( 0, $user->getId() );
2510                 $this->assertNotEquals( $username, $user->getName() );
2511                 $this->assertEquals( 0, $session->getUser()->getId() );
2512                 $this->assertSame( [
2513                         [ LogLevel::DEBUG, 'blacklisted in session {sessionid}' ],
2514                 ], $logger->getBuffer() );
2515                 $logger->clearBuffer();
2516
2517                 $session->clear();
2518                 $session->set( 'AuthManager::AutoCreateBlacklist', StatusValue::newFatal( 'test2' ) );
2519                 $user = \User::newFromName( $username );
2520                 $this->hook( 'LocalUserCreated', $this->never() );
2521                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2522                 $this->unhook( 'LocalUserCreated' );
2523                 $this->assertEquals( \Status::newFatal( 'test2' ), $ret );
2524                 $this->assertEquals( 0, $user->getId() );
2525                 $this->assertNotEquals( $username, $user->getName() );
2526                 $this->assertEquals( 0, $session->getUser()->getId() );
2527                 $this->assertSame( [
2528                         [ LogLevel::DEBUG, 'blacklisted in session {sessionid}' ],
2529                 ], $logger->getBuffer() );
2530                 $logger->clearBuffer();
2531
2532                 // Uncreatable name
2533                 $session->clear();
2534                 $user = \User::newFromName( $username . '@' );
2535                 $this->hook( 'LocalUserCreated', $this->never() );
2536                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2537                 $this->unhook( 'LocalUserCreated' );
2538                 $this->assertEquals( \Status::newFatal( 'noname' ), $ret );
2539                 $this->assertEquals( 0, $user->getId() );
2540                 $this->assertNotEquals( $username . '@', $user->getId() );
2541                 $this->assertEquals( 0, $session->getUser()->getId() );
2542                 $this->assertSame( [
2543                         [ LogLevel::DEBUG, 'name "{username}" is not creatable' ],
2544                 ], $logger->getBuffer() );
2545                 $logger->clearBuffer();
2546                 $this->assertSame( 'noname', $session->get( 'AuthManager::AutoCreateBlacklist' ) );
2547
2548                 // IP unable to create accounts
2549                 $this->setGroupPermissions( '*', 'createaccount', false );
2550                 $this->setGroupPermissions( '*', 'autocreateaccount', false );
2551                 $session->clear();
2552                 $user = \User::newFromName( $username );
2553                 $this->hook( 'LocalUserCreated', $this->never() );
2554                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2555                 $this->unhook( 'LocalUserCreated' );
2556                 $this->assertEquals( \Status::newFatal( 'authmanager-autocreate-noperm' ), $ret );
2557                 $this->assertEquals( 0, $user->getId() );
2558                 $this->assertNotEquals( $username, $user->getName() );
2559                 $this->assertEquals( 0, $session->getUser()->getId() );
2560                 $this->assertSame( [
2561                         [ LogLevel::DEBUG, 'IP lacks the ability to create or autocreate accounts' ],
2562                 ], $logger->getBuffer() );
2563                 $logger->clearBuffer();
2564                 $this->assertSame(
2565                         'authmanager-autocreate-noperm', $session->get( 'AuthManager::AutoCreateBlacklist' )
2566                 );
2567
2568                 // maintenance scripts always work
2569                 $expectedSource = AuthManager::AUTOCREATE_SOURCE_MAINT;
2570                 $this->setGroupPermissions( '*', 'createaccount', false );
2571                 $this->setGroupPermissions( '*', 'autocreateaccount', false );
2572                 $session->clear();
2573                 $user = \User::newFromName( $username );
2574                 $this->hook( 'LocalUserCreated', $this->never() );
2575                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_MAINT, true );
2576                 $this->unhook( 'LocalUserCreated' );
2577                 $this->assertEquals( \Status::newFatal( 'ok' ), $ret );
2578
2579                 // Test that both permutations of permissions are allowed
2580                 // (this hits the two "ok" entries in $mocks['pre'])
2581                 $expectedSource = AuthManager::AUTOCREATE_SOURCE_SESSION;
2582                 $this->setGroupPermissions( '*', 'createaccount', false );
2583                 $this->setGroupPermissions( '*', 'autocreateaccount', true );
2584                 $session->clear();
2585                 $user = \User::newFromName( $username );
2586                 $this->hook( 'LocalUserCreated', $this->never() );
2587                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2588                 $this->unhook( 'LocalUserCreated' );
2589                 $this->assertEquals( \Status::newFatal( 'ok' ), $ret );
2590
2591                 $this->setGroupPermissions( '*', 'createaccount', true );
2592                 $this->setGroupPermissions( '*', 'autocreateaccount', false );
2593                 $session->clear();
2594                 $user = \User::newFromName( $username );
2595                 $this->hook( 'LocalUserCreated', $this->never() );
2596                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2597                 $this->unhook( 'LocalUserCreated' );
2598                 $this->assertEquals( \Status::newFatal( 'ok' ), $ret );
2599                 $logger->clearBuffer();
2600
2601                 // Test lock fail
2602                 $session->clear();
2603                 $user = \User::newFromName( $username );
2604                 $this->hook( 'LocalUserCreated', $this->never() );
2605                 $cache = \ObjectCache::getLocalClusterInstance();
2606                 $lock = $cache->getScopedLock( $cache->makeGlobalKey( 'account', md5( $username ) ) );
2607                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2608                 unset( $lock );
2609                 $this->unhook( 'LocalUserCreated' );
2610                 $this->assertEquals( \Status::newFatal( 'usernameinprogress' ), $ret );
2611                 $this->assertEquals( 0, $user->getId() );
2612                 $this->assertNotEquals( $username, $user->getName() );
2613                 $this->assertEquals( 0, $session->getUser()->getId() );
2614                 $this->assertSame( [
2615                         [ LogLevel::DEBUG, 'Could not acquire account creation lock' ],
2616                 ], $logger->getBuffer() );
2617                 $logger->clearBuffer();
2618
2619                 // Test pre-authentication provider fail
2620                 $session->clear();
2621                 $user = \User::newFromName( $username );
2622                 $this->hook( 'LocalUserCreated', $this->never() );
2623                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2624                 $this->unhook( 'LocalUserCreated' );
2625                 $this->assertEquals( \Status::newFatal( 'fail-in-pre' ), $ret );
2626                 $this->assertEquals( 0, $user->getId() );
2627                 $this->assertNotEquals( $username, $user->getName() );
2628                 $this->assertEquals( 0, $session->getUser()->getId() );
2629                 $this->assertSame( [
2630                         [ LogLevel::DEBUG, 'Provider denied creation of {username}: {reason}' ],
2631                 ], $logger->getBuffer() );
2632                 $logger->clearBuffer();
2633                 $this->assertEquals(
2634                         StatusValue::newFatal( 'fail-in-pre' ), $session->get( 'AuthManager::AutoCreateBlacklist' )
2635                 );
2636
2637                 $session->clear();
2638                 $user = \User::newFromName( $username );
2639                 $this->hook( 'LocalUserCreated', $this->never() );
2640                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2641                 $this->unhook( 'LocalUserCreated' );
2642                 $this->assertEquals( \Status::newFatal( 'fail-in-primary' ), $ret );
2643                 $this->assertEquals( 0, $user->getId() );
2644                 $this->assertNotEquals( $username, $user->getName() );
2645                 $this->assertEquals( 0, $session->getUser()->getId() );
2646                 $this->assertSame( [
2647                         [ LogLevel::DEBUG, 'Provider denied creation of {username}: {reason}' ],
2648                 ], $logger->getBuffer() );
2649                 $logger->clearBuffer();
2650                 $this->assertEquals(
2651                         StatusValue::newFatal( 'fail-in-primary' ), $session->get( 'AuthManager::AutoCreateBlacklist' )
2652                 );
2653
2654                 $session->clear();
2655                 $user = \User::newFromName( $username );
2656                 $this->hook( 'LocalUserCreated', $this->never() );
2657                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2658                 $this->unhook( 'LocalUserCreated' );
2659                 $this->assertEquals( \Status::newFatal( 'fail-in-secondary' ), $ret );
2660                 $this->assertEquals( 0, $user->getId() );
2661                 $this->assertNotEquals( $username, $user->getName() );
2662                 $this->assertEquals( 0, $session->getUser()->getId() );
2663                 $this->assertSame( [
2664                         [ LogLevel::DEBUG, 'Provider denied creation of {username}: {reason}' ],
2665                 ], $logger->getBuffer() );
2666                 $logger->clearBuffer();
2667                 $this->assertEquals(
2668                         StatusValue::newFatal( 'fail-in-secondary' ), $session->get( 'AuthManager::AutoCreateBlacklist' )
2669                 );
2670
2671                 // Test backoff
2672                 $cache = \ObjectCache::getLocalClusterInstance();
2673                 $backoffKey = $cache->makeKey( 'AuthManager', 'autocreate-failed', md5( $username ) );
2674                 $cache->set( $backoffKey, true );
2675                 $session->clear();
2676                 $user = \User::newFromName( $username );
2677                 $this->hook( 'LocalUserCreated', $this->never() );
2678                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2679                 $this->unhook( 'LocalUserCreated' );
2680                 $this->assertEquals( \Status::newFatal( 'authmanager-autocreate-exception' ), $ret );
2681                 $this->assertEquals( 0, $user->getId() );
2682                 $this->assertNotEquals( $username, $user->getName() );
2683                 $this->assertEquals( 0, $session->getUser()->getId() );
2684                 $this->assertSame( [
2685                         [ LogLevel::DEBUG, '{username} denied by prior creation attempt failures' ],
2686                 ], $logger->getBuffer() );
2687                 $logger->clearBuffer();
2688                 $this->assertSame( null, $session->get( 'AuthManager::AutoCreateBlacklist' ) );
2689                 $cache->delete( $backoffKey );
2690
2691                 // Test addToDatabase fails
2692                 $session->clear();
2693                 $user = $this->getMockBuilder( \User::class )
2694                         ->setMethods( [ 'addToDatabase' ] )->getMock();
2695                 $user->expects( $this->once() )->method( 'addToDatabase' )
2696                         ->will( $this->returnValue( \Status::newFatal( 'because' ) ) );
2697                 $user->setName( $username );
2698                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2699                 $this->assertEquals( \Status::newFatal( 'because' ), $ret );
2700                 $this->assertEquals( 0, $user->getId() );
2701                 $this->assertNotEquals( $username, $user->getName() );
2702                 $this->assertEquals( 0, $session->getUser()->getId() );
2703                 $this->assertSame( [
2704                         [ LogLevel::INFO, 'creating new user ({username}) - from: {from}' ],
2705                         [ LogLevel::ERROR, '{username} failed with message {msg}' ],
2706                 ], $logger->getBuffer() );
2707                 $logger->clearBuffer();
2708                 $this->assertSame( null, $session->get( 'AuthManager::AutoCreateBlacklist' ) );
2709
2710                 // Test addToDatabase throws an exception
2711                 $cache = \ObjectCache::getLocalClusterInstance();
2712                 $backoffKey = $cache->makeKey( 'AuthManager', 'autocreate-failed', md5( $username ) );
2713                 $this->assertFalse( $cache->get( $backoffKey ), 'sanity check' );
2714                 $session->clear();
2715                 $user = $this->getMockBuilder( \User::class )
2716                         ->setMethods( [ 'addToDatabase' ] )->getMock();
2717                 $user->expects( $this->once() )->method( 'addToDatabase' )
2718                         ->will( $this->throwException( new \Exception( 'Excepted' ) ) );
2719                 $user->setName( $username );
2720                 try {
2721                         $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2722                         $this->fail( 'Expected exception not thrown' );
2723                 } catch ( \Exception $ex ) {
2724                         $this->assertSame( 'Excepted', $ex->getMessage() );
2725                 }
2726                 $this->assertEquals( 0, $user->getId() );
2727                 $this->assertEquals( 0, $session->getUser()->getId() );
2728                 $this->assertSame( [
2729                         [ LogLevel::INFO, 'creating new user ({username}) - from: {from}' ],
2730                         [ LogLevel::ERROR, '{username} failed with exception {exception}' ],
2731                 ], $logger->getBuffer() );
2732                 $logger->clearBuffer();
2733                 $this->assertSame( null, $session->get( 'AuthManager::AutoCreateBlacklist' ) );
2734                 $this->assertNotEquals( false, $cache->get( $backoffKey ) );
2735                 $cache->delete( $backoffKey );
2736
2737                 // Test addToDatabase fails because the user already exists.
2738                 $session->clear();
2739                 $user = $this->getMockBuilder( \User::class )
2740                         ->setMethods( [ 'addToDatabase' ] )->getMock();
2741                 $user->expects( $this->once() )->method( 'addToDatabase' )
2742                         ->will( $this->returnCallback( function () use ( $username, &$user ) {
2743                                 $oldUser = \User::newFromName( $username );
2744                                 $status = $oldUser->addToDatabase();
2745                                 $this->assertTrue( $status->isOK(), 'sanity check' );
2746                                 $user->setId( $oldUser->getId() );
2747                                 return \Status::newFatal( 'userexists' );
2748                         } ) );
2749                 $user->setName( $username );
2750                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2751                 $expect = \Status::newGood();
2752                 $expect->warning( 'userexists' );
2753                 $this->assertEquals( $expect, $ret );
2754                 $this->assertNotEquals( 0, $user->getId() );
2755                 $this->assertEquals( $username, $user->getName() );
2756                 $this->assertEquals( $user->getId(), $session->getUser()->getId() );
2757                 $this->assertSame( [
2758                         [ LogLevel::INFO, 'creating new user ({username}) - from: {from}' ],
2759                         [ LogLevel::INFO, '{username} already exists locally (race)' ],
2760                 ], $logger->getBuffer() );
2761                 $logger->clearBuffer();
2762                 $this->assertSame( null, $session->get( 'AuthManager::AutoCreateBlacklist' ) );
2763
2764                 // Success!
2765                 $session->clear();
2766                 $username = self::usernameForCreation();
2767                 $user = \User::newFromName( $username );
2768                 $this->hook( 'LocalUserCreated', $this->once() )
2769                         ->with( $callback, $this->equalTo( true ) );
2770                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, true );
2771                 $this->unhook( 'LocalUserCreated' );
2772                 $this->assertEquals( \Status::newGood(), $ret );
2773                 $this->assertNotEquals( 0, $user->getId() );
2774                 $this->assertEquals( $username, $user->getName() );
2775                 $this->assertEquals( $user->getId(), $session->getUser()->getId() );
2776                 $this->assertSame( [
2777                         [ LogLevel::INFO, 'creating new user ({username}) - from: {from}' ],
2778                 ], $logger->getBuffer() );
2779                 $logger->clearBuffer();
2780
2781                 $dbw = wfGetDB( DB_MASTER );
2782                 $maxLogId = $dbw->selectField( 'logging', 'MAX(log_id)', [ 'log_type' => 'newusers' ] );
2783                 $session->clear();
2784                 $username = self::usernameForCreation();
2785                 $user = \User::newFromName( $username );
2786                 $this->hook( 'LocalUserCreated', $this->once() )
2787                         ->with( $callback, $this->equalTo( true ) );
2788                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, false );
2789                 $this->unhook( 'LocalUserCreated' );
2790                 $this->assertEquals( \Status::newGood(), $ret );
2791                 $this->assertNotEquals( 0, $user->getId() );
2792                 $this->assertEquals( $username, $user->getName() );
2793                 $this->assertEquals( 0, $session->getUser()->getId() );
2794                 $this->assertSame( [
2795                         [ LogLevel::INFO, 'creating new user ({username}) - from: {from}' ],
2796                 ], $logger->getBuffer() );
2797                 $logger->clearBuffer();
2798                 $this->assertSame(
2799                         $maxLogId,
2800                         $dbw->selectField( 'logging', 'MAX(log_id)', [ 'log_type' => 'newusers' ] )
2801                 );
2802
2803                 $this->config->set( 'NewUserLog', true );
2804                 $session->clear();
2805                 $username = self::usernameForCreation();
2806                 $user = \User::newFromName( $username );
2807                 $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_SESSION, false );
2808                 $this->assertEquals( \Status::newGood(), $ret );
2809                 $logger->clearBuffer();
2810
2811                 $data = \DatabaseLogEntry::getSelectQueryData();
2812                 $rows = iterator_to_array( $dbw->select(
2813                         $data['tables'],
2814                         $data['fields'],
2815                         [
2816                                 'log_id > ' . (int)$maxLogId,
2817                                 'log_type' => 'newusers'
2818                         ] + $data['conds'],
2819                         __METHOD__,
2820                         $data['options'],
2821                         $data['join_conds']
2822                 ) );
2823                 $this->assertCount( 1, $rows );
2824                 $entry = \DatabaseLogEntry::newFromRow( reset( $rows ) );
2825
2826                 $this->assertSame( 'autocreate', $entry->getSubtype() );
2827                 $this->assertSame( $user->getId(), $entry->getPerformer()->getId() );
2828                 $this->assertSame( $user->getName(), $entry->getPerformer()->getName() );
2829                 $this->assertSame( $user->getUserPage()->getFullText(), $entry->getTarget()->getFullText() );
2830                 $this->assertSame( [ '4::userid' => $user->getId() ], $entry->getParameters() );
2831
2832                 $workaroundPHPUnitBug = true;
2833         }
2834
2835         /**
2836          * @dataProvider provideGetAuthenticationRequests
2837          * @param string $action
2838          * @param array $expect
2839          * @param array $state
2840          */
2841         public function testGetAuthenticationRequests( $action, $expect, $state = [] ) {
2842                 $makeReq = function ( $key ) use ( $action ) {
2843                         $req = $this->createMock( AuthenticationRequest::class );
2844                         $req->expects( $this->any() )->method( 'getUniqueId' )
2845                                 ->will( $this->returnValue( $key ) );
2846                         $req->action = $action === AuthManager::ACTION_UNLINK ? AuthManager::ACTION_REMOVE : $action;
2847                         $req->key = $key;
2848                         return $req;
2849                 };
2850                 $cmpReqs = function ( $a, $b ) {
2851                         $ret = strcmp( get_class( $a ), get_class( $b ) );
2852                         if ( !$ret ) {
2853                                 $ret = strcmp( $a->key, $b->key );
2854                         }
2855                         return $ret;
2856                 };
2857
2858                 $good = StatusValue::newGood();
2859
2860                 $mocks = [];
2861                 foreach ( [ 'pre', 'primary', 'secondary' ] as $key ) {
2862                         $class = ucfirst( $key ) . 'AuthenticationProvider';
2863                         $mocks[$key] = $this->getMockBuilder( "MediaWiki\\Auth\\$class" )
2864                                 ->setMethods( [
2865                                         'getUniqueId', 'getAuthenticationRequests', 'providerAllowsAuthenticationDataChange',
2866                                 ] )
2867                                 ->getMockForAbstractClass();
2868                         $mocks[$key]->expects( $this->any() )->method( 'getUniqueId' )
2869                                 ->will( $this->returnValue( $key ) );
2870                         $mocks[$key]->expects( $this->any() )->method( 'getAuthenticationRequests' )
2871                                 ->will( $this->returnCallback( function ( $action ) use ( $key, $makeReq ) {
2872                                         return [ $makeReq( "$key-$action" ), $makeReq( 'generic' ) ];
2873                                 } ) );
2874                         $mocks[$key]->expects( $this->any() )->method( 'providerAllowsAuthenticationDataChange' )
2875                                 ->will( $this->returnValue( $good ) );
2876                 }
2877
2878                 $primaries = [];
2879                 foreach ( [
2880                         PrimaryAuthenticationProvider::TYPE_NONE,
2881                         PrimaryAuthenticationProvider::TYPE_CREATE,
2882                         PrimaryAuthenticationProvider::TYPE_LINK
2883                 ] as $type ) {
2884                         $class = 'PrimaryAuthenticationProvider';
2885                         $mocks["primary-$type"] = $this->getMockBuilder( "MediaWiki\\Auth\\$class" )
2886                                 ->setMethods( [
2887                                         'getUniqueId', 'accountCreationType', 'getAuthenticationRequests',
2888                                         'providerAllowsAuthenticationDataChange',
2889                                 ] )
2890                                 ->getMockForAbstractClass();
2891                         $mocks["primary-$type"]->expects( $this->any() )->method( 'getUniqueId' )
2892                                 ->will( $this->returnValue( "primary-$type" ) );
2893                         $mocks["primary-$type"]->expects( $this->any() )->method( 'accountCreationType' )
2894                                 ->will( $this->returnValue( $type ) );
2895                         $mocks["primary-$type"]->expects( $this->any() )->method( 'getAuthenticationRequests' )
2896                                 ->will( $this->returnCallback( function ( $action ) use ( $type, $makeReq ) {
2897                                         return [ $makeReq( "primary-$type-$action" ), $makeReq( 'generic' ) ];
2898                                 } ) );
2899                         $mocks["primary-$type"]->expects( $this->any() )
2900                                 ->method( 'providerAllowsAuthenticationDataChange' )
2901                                 ->will( $this->returnValue( $good ) );
2902                         $this->primaryauthMocks[] = $mocks["primary-$type"];
2903                 }
2904
2905                 $mocks['primary2'] = $this->getMockBuilder( PrimaryAuthenticationProvider::class )
2906                         ->setMethods( [
2907                                 'getUniqueId', 'accountCreationType', 'getAuthenticationRequests',
2908                                 'providerAllowsAuthenticationDataChange',
2909                         ] )
2910                         ->getMockForAbstractClass();
2911                 $mocks['primary2']->expects( $this->any() )->method( 'getUniqueId' )
2912                         ->will( $this->returnValue( 'primary2' ) );
2913                 $mocks['primary2']->expects( $this->any() )->method( 'accountCreationType' )
2914                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
2915                 $mocks['primary2']->expects( $this->any() )->method( 'getAuthenticationRequests' )
2916                         ->will( $this->returnValue( [] ) );
2917                 $mocks['primary2']->expects( $this->any() )
2918                         ->method( 'providerAllowsAuthenticationDataChange' )
2919                         ->will( $this->returnCallback( function ( $req ) use ( $good ) {
2920                                 return $req->key === 'generic' ? StatusValue::newFatal( 'no' ) : $good;
2921                         } ) );
2922                 $this->primaryauthMocks[] = $mocks['primary2'];
2923
2924                 $this->preauthMocks = [ $mocks['pre'] ];
2925                 $this->secondaryauthMocks = [ $mocks['secondary'] ];
2926                 $this->initializeManager( true );
2927
2928                 if ( $state ) {
2929                         if ( isset( $state['continueRequests'] ) ) {
2930                                 $state['continueRequests'] = array_map( $makeReq, $state['continueRequests'] );
2931                         }
2932                         if ( $action === AuthManager::ACTION_LOGIN_CONTINUE ) {
2933                                 $this->request->getSession()->setSecret( 'AuthManager::authnState', $state );
2934                         } elseif ( $action === AuthManager::ACTION_CREATE_CONTINUE ) {
2935                                 $this->request->getSession()->setSecret( 'AuthManager::accountCreationState', $state );
2936                         } elseif ( $action === AuthManager::ACTION_LINK_CONTINUE ) {
2937                                 $this->request->getSession()->setSecret( 'AuthManager::accountLinkState', $state );
2938                         }
2939                 }
2940
2941                 $expectReqs = array_map( $makeReq, $expect );
2942                 if ( $action === AuthManager::ACTION_LOGIN ) {
2943                         $req = new RememberMeAuthenticationRequest;
2944                         $req->action = $action;
2945                         $req->required = AuthenticationRequest::REQUIRED;
2946                         $expectReqs[] = $req;
2947                 } elseif ( $action === AuthManager::ACTION_CREATE ) {
2948                         $req = new UsernameAuthenticationRequest;
2949                         $req->action = $action;
2950                         $expectReqs[] = $req;
2951                         $req = new UserDataAuthenticationRequest;
2952                         $req->action = $action;
2953                         $req->required = AuthenticationRequest::REQUIRED;
2954                         $expectReqs[] = $req;
2955                 }
2956                 usort( $expectReqs, $cmpReqs );
2957
2958                 $actual = $this->manager->getAuthenticationRequests( $action );
2959                 foreach ( $actual as $req ) {
2960                         // Don't test this here.
2961                         $req->required = AuthenticationRequest::REQUIRED;
2962                 }
2963                 usort( $actual, $cmpReqs );
2964
2965                 $this->assertEquals( $expectReqs, $actual );
2966
2967                 // Test CreationReasonAuthenticationRequest gets returned
2968                 if ( $action === AuthManager::ACTION_CREATE ) {
2969                         $req = new CreationReasonAuthenticationRequest;
2970                         $req->action = $action;
2971                         $req->required = AuthenticationRequest::REQUIRED;
2972                         $expectReqs[] = $req;
2973                         usort( $expectReqs, $cmpReqs );
2974
2975                         $actual = $this->manager->getAuthenticationRequests( $action, \User::newFromName( 'UTSysop' ) );
2976                         foreach ( $actual as $req ) {
2977                                 // Don't test this here.
2978                                 $req->required = AuthenticationRequest::REQUIRED;
2979                         }
2980                         usort( $actual, $cmpReqs );
2981
2982                         $this->assertEquals( $expectReqs, $actual );
2983                 }
2984         }
2985
2986         public static function provideGetAuthenticationRequests() {
2987                 return [
2988                         [
2989                                 AuthManager::ACTION_LOGIN,
2990                                 [ 'pre-login', 'primary-none-login', 'primary-create-login',
2991                                         'primary-link-login', 'secondary-login', 'generic' ],
2992                         ],
2993                         [
2994                                 AuthManager::ACTION_CREATE,
2995                                 [ 'pre-create', 'primary-none-create', 'primary-create-create',
2996                                         'primary-link-create', 'secondary-create', 'generic' ],
2997                         ],
2998                         [
2999                                 AuthManager::ACTION_LINK,
3000                                 [ 'primary-link-link', 'generic' ],
3001                         ],
3002                         [
3003                                 AuthManager::ACTION_CHANGE,
3004                                 [ 'primary-none-change', 'primary-create-change', 'primary-link-change',
3005                                         'secondary-change' ],
3006                         ],
3007                         [
3008                                 AuthManager::ACTION_REMOVE,
3009                                 [ 'primary-none-remove', 'primary-create-remove', 'primary-link-remove',
3010                                         'secondary-remove' ],
3011                         ],
3012                         [
3013                                 AuthManager::ACTION_UNLINK,
3014                                 [ 'primary-link-remove' ],
3015                         ],
3016                         [
3017                                 AuthManager::ACTION_LOGIN_CONTINUE,
3018                                 [],
3019                         ],
3020                         [
3021                                 AuthManager::ACTION_LOGIN_CONTINUE,
3022                                 $reqs = [ 'continue-login', 'foo', 'bar' ],
3023                                 [
3024                                         'continueRequests' => $reqs,
3025                                 ],
3026                         ],
3027                         [
3028                                 AuthManager::ACTION_CREATE_CONTINUE,
3029                                 [],
3030                         ],
3031                         [
3032                                 AuthManager::ACTION_CREATE_CONTINUE,
3033                                 $reqs = [ 'continue-create', 'foo', 'bar' ],
3034                                 [
3035                                         'continueRequests' => $reqs,
3036                                 ],
3037                         ],
3038                         [
3039                                 AuthManager::ACTION_LINK_CONTINUE,
3040                                 [],
3041                         ],
3042                         [
3043                                 AuthManager::ACTION_LINK_CONTINUE,
3044                                 $reqs = [ 'continue-link', 'foo', 'bar' ],
3045                                 [
3046                                         'continueRequests' => $reqs,
3047                                 ],
3048                         ],
3049                 ];
3050         }
3051
3052         public function testGetAuthenticationRequestsRequired() {
3053                 $makeReq = function ( $key, $required ) {
3054                         $req = $this->createMock( AuthenticationRequest::class );
3055                         $req->expects( $this->any() )->method( 'getUniqueId' )
3056                                 ->will( $this->returnValue( $key ) );
3057                         $req->action = AuthManager::ACTION_LOGIN;
3058                         $req->key = $key;
3059                         $req->required = $required;
3060                         return $req;
3061                 };
3062                 $cmpReqs = function ( $a, $b ) {
3063                         $ret = strcmp( get_class( $a ), get_class( $b ) );
3064                         if ( !$ret ) {
3065                                 $ret = strcmp( $a->key, $b->key );
3066                         }
3067                         return $ret;
3068                 };
3069
3070                 $good = StatusValue::newGood();
3071
3072                 $primary1 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3073                 $primary1->expects( $this->any() )->method( 'getUniqueId' )
3074                         ->will( $this->returnValue( 'primary1' ) );
3075                 $primary1->expects( $this->any() )->method( 'accountCreationType' )
3076                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
3077                 $primary1->expects( $this->any() )->method( 'getAuthenticationRequests' )
3078                         ->will( $this->returnCallback( function ( $action ) use ( $makeReq ) {
3079                                 return [
3080                                         $makeReq( "primary-shared", AuthenticationRequest::REQUIRED ),
3081                                         $makeReq( "required", AuthenticationRequest::REQUIRED ),
3082                                         $makeReq( "optional", AuthenticationRequest::OPTIONAL ),
3083                                         $makeReq( "foo", AuthenticationRequest::REQUIRED ),
3084                                         $makeReq( "bar", AuthenticationRequest::REQUIRED ),
3085                                         $makeReq( "baz", AuthenticationRequest::OPTIONAL ),
3086                                 ];
3087                         } ) );
3088
3089                 $primary2 = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3090                 $primary2->expects( $this->any() )->method( 'getUniqueId' )
3091                         ->will( $this->returnValue( 'primary2' ) );
3092                 $primary2->expects( $this->any() )->method( 'accountCreationType' )
3093                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
3094                 $primary2->expects( $this->any() )->method( 'getAuthenticationRequests' )
3095                         ->will( $this->returnCallback( function ( $action ) use ( $makeReq ) {
3096                                 return [
3097                                         $makeReq( "primary-shared", AuthenticationRequest::REQUIRED ),
3098                                         $makeReq( "required2", AuthenticationRequest::REQUIRED ),
3099                                         $makeReq( "optional2", AuthenticationRequest::OPTIONAL ),
3100                                 ];
3101                         } ) );
3102
3103                 $secondary = $this->getMockForAbstractClass( SecondaryAuthenticationProvider::class );
3104                 $secondary->expects( $this->any() )->method( 'getUniqueId' )
3105                         ->will( $this->returnValue( 'secondary' ) );
3106                 $secondary->expects( $this->any() )->method( 'getAuthenticationRequests' )
3107                         ->will( $this->returnCallback( function ( $action ) use ( $makeReq ) {
3108                                 return [
3109                                         $makeReq( "foo", AuthenticationRequest::OPTIONAL ),
3110                                         $makeReq( "bar", AuthenticationRequest::REQUIRED ),
3111                                         $makeReq( "baz", AuthenticationRequest::REQUIRED ),
3112                                 ];
3113                         } ) );
3114
3115                 $rememberReq = new RememberMeAuthenticationRequest;
3116                 $rememberReq->action = AuthManager::ACTION_LOGIN;
3117
3118                 $this->primaryauthMocks = [ $primary1, $primary2 ];
3119                 $this->secondaryauthMocks = [ $secondary ];
3120                 $this->initializeManager( true );
3121
3122                 $actual = $this->manager->getAuthenticationRequests( AuthManager::ACTION_LOGIN );
3123                 $expected = [
3124                         $rememberReq,
3125                         $makeReq( "primary-shared", AuthenticationRequest::PRIMARY_REQUIRED ),
3126                         $makeReq( "required", AuthenticationRequest::PRIMARY_REQUIRED ),
3127                         $makeReq( "required2", AuthenticationRequest::PRIMARY_REQUIRED ),
3128                         $makeReq( "optional", AuthenticationRequest::OPTIONAL ),
3129                         $makeReq( "optional2", AuthenticationRequest::OPTIONAL ),
3130                         $makeReq( "foo", AuthenticationRequest::PRIMARY_REQUIRED ),
3131                         $makeReq( "bar", AuthenticationRequest::REQUIRED ),
3132                         $makeReq( "baz", AuthenticationRequest::REQUIRED ),
3133                 ];
3134                 usort( $actual, $cmpReqs );
3135                 usort( $expected, $cmpReqs );
3136                 $this->assertEquals( $expected, $actual );
3137
3138                 $this->primaryauthMocks = [ $primary1 ];
3139                 $this->secondaryauthMocks = [ $secondary ];
3140                 $this->initializeManager( true );
3141
3142                 $actual = $this->manager->getAuthenticationRequests( AuthManager::ACTION_LOGIN );
3143                 $expected = [
3144                         $rememberReq,
3145                         $makeReq( "primary-shared", AuthenticationRequest::PRIMARY_REQUIRED ),
3146                         $makeReq( "required", AuthenticationRequest::PRIMARY_REQUIRED ),
3147                         $makeReq( "optional", AuthenticationRequest::OPTIONAL ),
3148                         $makeReq( "foo", AuthenticationRequest::PRIMARY_REQUIRED ),
3149                         $makeReq( "bar", AuthenticationRequest::REQUIRED ),
3150                         $makeReq( "baz", AuthenticationRequest::REQUIRED ),
3151                 ];
3152                 usort( $actual, $cmpReqs );
3153                 usort( $expected, $cmpReqs );
3154                 $this->assertEquals( $expected, $actual );
3155         }
3156
3157         public function testAllowsPropertyChange() {
3158                 $mocks = [];
3159                 foreach ( [ 'primary', 'secondary' ] as $key ) {
3160                         $class = ucfirst( $key ) . 'AuthenticationProvider';
3161                         $mocks[$key] = $this->getMockForAbstractClass( "MediaWiki\\Auth\\$class" );
3162                         $mocks[$key]->expects( $this->any() )->method( 'getUniqueId' )
3163                                 ->will( $this->returnValue( $key ) );
3164                         $mocks[$key]->expects( $this->any() )->method( 'providerAllowsPropertyChange' )
3165                                 ->will( $this->returnCallback( function ( $prop ) use ( $key ) {
3166                                         return $prop !== $key;
3167                                 } ) );
3168                 }
3169
3170                 $this->primaryauthMocks = [ $mocks['primary'] ];
3171                 $this->secondaryauthMocks = [ $mocks['secondary'] ];
3172                 $this->initializeManager( true );
3173
3174                 $this->assertTrue( $this->manager->allowsPropertyChange( 'foo' ) );
3175                 $this->assertFalse( $this->manager->allowsPropertyChange( 'primary' ) );
3176                 $this->assertFalse( $this->manager->allowsPropertyChange( 'secondary' ) );
3177         }
3178
3179         public function testAutoCreateOnLogin() {
3180                 $username = self::usernameForCreation();
3181
3182                 $req = $this->createMock( AuthenticationRequest::class );
3183
3184                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3185                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'primary' ) );
3186                 $mock->expects( $this->any() )->method( 'beginPrimaryAuthentication' )
3187                         ->will( $this->returnValue( AuthenticationResponse::newPass( $username ) ) );
3188                 $mock->expects( $this->any() )->method( 'accountCreationType' )
3189                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
3190                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( true ) );
3191                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
3192                         ->will( $this->returnValue( StatusValue::newGood() ) );
3193
3194                 $mock2 = $this->getMockForAbstractClass( SecondaryAuthenticationProvider::class );
3195                 $mock2->expects( $this->any() )->method( 'getUniqueId' )
3196                         ->will( $this->returnValue( 'secondary' ) );
3197                 $mock2->expects( $this->any() )->method( 'beginSecondaryAuthentication' )->will(
3198                         $this->returnValue(
3199                                 AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) )
3200                         )
3201                 );
3202                 $mock2->expects( $this->any() )->method( 'continueSecondaryAuthentication' )
3203                         ->will( $this->returnValue( AuthenticationResponse::newAbstain() ) );
3204                 $mock2->expects( $this->any() )->method( 'testUserForCreation' )
3205                         ->will( $this->returnValue( StatusValue::newGood() ) );
3206
3207                 $this->primaryauthMocks = [ $mock ];
3208                 $this->secondaryauthMocks = [ $mock2 ];
3209                 $this->initializeManager( true );
3210                 $this->manager->setLogger( new \Psr\Log\NullLogger() );
3211                 $session = $this->request->getSession();
3212                 $session->clear();
3213
3214                 $this->assertSame( 0, \User::newFromName( $username )->getId(),
3215                         'sanity check' );
3216
3217                 $callback = $this->callback( function ( $user ) use ( $username ) {
3218                         return $user->getName() === $username;
3219                 } );
3220
3221                 $this->hook( 'UserLoggedIn', $this->never() );
3222                 $this->hook( 'LocalUserCreated', $this->once() )->with( $callback, $this->equalTo( true ) );
3223                 $ret = $this->manager->beginAuthentication( [], 'http://localhost/' );
3224                 $this->unhook( 'LocalUserCreated' );
3225                 $this->unhook( 'UserLoggedIn' );
3226                 $this->assertSame( AuthenticationResponse::UI, $ret->status );
3227
3228                 $id = (int)\User::newFromName( $username )->getId();
3229                 $this->assertNotSame( 0, \User::newFromName( $username )->getId() );
3230                 $this->assertSame( 0, $session->getUser()->getId() );
3231
3232                 $this->hook( 'UserLoggedIn', $this->once() )->with( $callback );
3233                 $this->hook( 'LocalUserCreated', $this->never() );
3234                 $ret = $this->manager->continueAuthentication( [] );
3235                 $this->unhook( 'LocalUserCreated' );
3236                 $this->unhook( 'UserLoggedIn' );
3237                 $this->assertSame( AuthenticationResponse::PASS, $ret->status );
3238                 $this->assertSame( $username, $ret->username );
3239                 $this->assertSame( $id, $session->getUser()->getId() );
3240         }
3241
3242         public function testAutoCreateFailOnLogin() {
3243                 $username = self::usernameForCreation();
3244
3245                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3246                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'primary' ) );
3247                 $mock->expects( $this->any() )->method( 'beginPrimaryAuthentication' )
3248                         ->will( $this->returnValue( AuthenticationResponse::newPass( $username ) ) );
3249                 $mock->expects( $this->any() )->method( 'accountCreationType' )
3250                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
3251                 $mock->expects( $this->any() )->method( 'testUserExists' )->will( $this->returnValue( true ) );
3252                 $mock->expects( $this->any() )->method( 'testUserForCreation' )
3253                         ->will( $this->returnValue( StatusValue::newFatal( 'fail-from-primary' ) ) );
3254
3255                 $this->primaryauthMocks = [ $mock ];
3256                 $this->initializeManager( true );
3257                 $this->manager->setLogger( new \Psr\Log\NullLogger() );
3258                 $session = $this->request->getSession();
3259                 $session->clear();
3260
3261                 $this->assertSame( 0, $session->getUser()->getId(),
3262                         'sanity check' );
3263                 $this->assertSame( 0, \User::newFromName( $username )->getId(),
3264                         'sanity check' );
3265
3266                 $this->hook( 'UserLoggedIn', $this->never() );
3267                 $this->hook( 'LocalUserCreated', $this->never() );
3268                 $ret = $this->manager->beginAuthentication( [], 'http://localhost/' );
3269                 $this->unhook( 'LocalUserCreated' );
3270                 $this->unhook( 'UserLoggedIn' );
3271                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
3272                 $this->assertSame( 'authmanager-authn-autocreate-failed', $ret->message->getKey() );
3273
3274                 $this->assertSame( 0, \User::newFromName( $username )->getId() );
3275                 $this->assertSame( 0, $session->getUser()->getId() );
3276         }
3277
3278         public function testAuthenticationSessionData() {
3279                 $this->initializeManager( true );
3280
3281                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'foo' ) );
3282                 $this->manager->setAuthenticationSessionData( 'foo', 'foo!' );
3283                 $this->manager->setAuthenticationSessionData( 'bar', 'bar!' );
3284                 $this->assertSame( 'foo!', $this->manager->getAuthenticationSessionData( 'foo' ) );
3285                 $this->assertSame( 'bar!', $this->manager->getAuthenticationSessionData( 'bar' ) );
3286                 $this->manager->removeAuthenticationSessionData( 'foo' );
3287                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'foo' ) );
3288                 $this->assertSame( 'bar!', $this->manager->getAuthenticationSessionData( 'bar' ) );
3289                 $this->manager->removeAuthenticationSessionData( 'bar' );
3290                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'bar' ) );
3291
3292                 $this->manager->setAuthenticationSessionData( 'foo', 'foo!' );
3293                 $this->manager->setAuthenticationSessionData( 'bar', 'bar!' );
3294                 $this->manager->removeAuthenticationSessionData( null );
3295                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'foo' ) );
3296                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'bar' ) );
3297         }
3298
3299         public function testCanLinkAccounts() {
3300                 $types = [
3301                         PrimaryAuthenticationProvider::TYPE_CREATE => true,
3302                         PrimaryAuthenticationProvider::TYPE_LINK => true,
3303                         PrimaryAuthenticationProvider::TYPE_NONE => false,
3304                 ];
3305
3306                 foreach ( $types as $type => $can ) {
3307                         $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3308                         $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( $type ) );
3309                         $mock->expects( $this->any() )->method( 'accountCreationType' )
3310                                 ->will( $this->returnValue( $type ) );
3311                         $this->primaryauthMocks = [ $mock ];
3312                         $this->initializeManager( true );
3313                         $this->assertSame( $can, $this->manager->canCreateAccounts(), $type );
3314                 }
3315         }
3316
3317         public function testBeginAccountLink() {
3318                 $user = \User::newFromName( 'UTSysop' );
3319                 $this->initializeManager();
3320
3321                 $this->request->getSession()->setSecret( 'AuthManager::accountLinkState', 'test' );
3322                 try {
3323                         $this->manager->beginAccountLink( $user, [], 'http://localhost/' );
3324                         $this->fail( 'Expected exception not thrown' );
3325                 } catch ( \LogicException $ex ) {
3326                         $this->assertEquals( 'Account linking is not possible', $ex->getMessage() );
3327                 }
3328                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::accountLinkState' ) );
3329
3330                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3331                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
3332                 $mock->expects( $this->any() )->method( 'accountCreationType' )
3333                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
3334                 $this->primaryauthMocks = [ $mock ];
3335                 $this->initializeManager( true );
3336
3337                 $ret = $this->manager->beginAccountLink( new \User, [], 'http://localhost/' );
3338                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
3339                 $this->assertSame( 'noname', $ret->message->getKey() );
3340
3341                 $ret = $this->manager->beginAccountLink(
3342                         \User::newFromName( 'UTDoesNotExist' ), [], 'http://localhost/'
3343                 );
3344                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
3345                 $this->assertSame( 'authmanager-userdoesnotexist', $ret->message->getKey() );
3346         }
3347
3348         public function testContinueAccountLink() {
3349                 $user = \User::newFromName( 'UTSysop' );
3350                 $this->initializeManager();
3351
3352                 $session = [
3353                         'userid' => $user->getId(),
3354                         'username' => $user->getName(),
3355                         'primary' => 'X',
3356                 ];
3357
3358                 try {
3359                         $this->manager->continueAccountLink( [] );
3360                         $this->fail( 'Expected exception not thrown' );
3361                 } catch ( \LogicException $ex ) {
3362                         $this->assertEquals( 'Account linking is not possible', $ex->getMessage() );
3363                 }
3364
3365                 $mock = $this->getMockForAbstractClass( PrimaryAuthenticationProvider::class );
3366                 $mock->expects( $this->any() )->method( 'getUniqueId' )->will( $this->returnValue( 'X' ) );
3367                 $mock->expects( $this->any() )->method( 'accountCreationType' )
3368                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
3369                 $mock->expects( $this->any() )->method( 'beginPrimaryAccountLink' )->will(
3370                         $this->returnValue( AuthenticationResponse::newFail( $this->message( 'fail' ) ) )
3371                 );
3372                 $this->primaryauthMocks = [ $mock ];
3373                 $this->initializeManager( true );
3374
3375                 $this->request->getSession()->setSecret( 'AuthManager::accountLinkState', null );
3376                 $ret = $this->manager->continueAccountLink( [] );
3377                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
3378                 $this->assertSame( 'authmanager-link-not-in-progress', $ret->message->getKey() );
3379
3380                 $this->request->getSession()->setSecret( 'AuthManager::accountLinkState',
3381                         [ 'username' => $user->getName() . '<>' ] + $session );
3382                 $ret = $this->manager->continueAccountLink( [] );
3383                 $this->assertSame( AuthenticationResponse::FAIL, $ret->status );
3384                 $this->assertSame( 'noname', $ret->message->getKey() );
3385                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::accountLinkState' ) );
3386
3387                 $id = $user->getId();
3388                 $this->request->getSession()->setSecret( 'AuthManager::accountLinkState',
3389                         [ 'userid' => $id + 1 ] + $session );
3390                 try {
3391                         $ret = $this->manager->continueAccountLink( [] );
3392                         $this->fail( 'Expected exception not thrown' );
3393                 } catch ( \UnexpectedValueException $ex ) {
3394                         $this->assertEquals(
3395                                 "User \"{$user->getName()}\" is valid, but ID $id !== " . ( $id + 1 ) . '!',
3396                                 $ex->getMessage()
3397                         );
3398                 }
3399                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::accountLinkState' ) );
3400         }
3401
3402         /**
3403          * @dataProvider provideAccountLink
3404          * @param StatusValue $preTest
3405          * @param array $primaryResponses
3406          * @param array $managerResponses
3407          */
3408         public function testAccountLink(
3409                 StatusValue $preTest, array $primaryResponses, array $managerResponses
3410         ) {
3411                 $user = \User::newFromName( 'UTSysop' );
3412
3413                 $this->initializeManager();
3414
3415                 // Set up lots of mocks...
3416                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
3417                 $req->primary = $primaryResponses;
3418                 $mocks = [];
3419
3420                 foreach ( [ 'pre', 'primary' ] as $key ) {
3421                         $class = ucfirst( $key ) . 'AuthenticationProvider';
3422                         $mocks[$key] = $this->getMockForAbstractClass(
3423                                 "MediaWiki\\Auth\\$class", [], "Mock$class"
3424                         );
3425                         $mocks[$key]->expects( $this->any() )->method( 'getUniqueId' )
3426                                 ->will( $this->returnValue( $key ) );
3427
3428                         for ( $i = 2; $i <= 3; $i++ ) {
3429                                 $mocks[$key . $i] = $this->getMockForAbstractClass(
3430                                         "MediaWiki\\Auth\\$class", [], "Mock$class"
3431                                 );
3432                                 $mocks[$key . $i]->expects( $this->any() )->method( 'getUniqueId' )
3433                                         ->will( $this->returnValue( $key . $i ) );
3434                         }
3435                 }
3436
3437                 $mocks['pre']->expects( $this->any() )->method( 'testForAccountLink' )
3438                         ->will( $this->returnCallback(
3439                                 function ( $u )
3440                                         use ( $user, $preTest )
3441                                 {
3442                                         $this->assertSame( $user->getId(), $u->getId() );
3443                                         $this->assertSame( $user->getName(), $u->getName() );
3444                                         return $preTest;
3445                                 }
3446                         ) );
3447
3448                 $mocks['pre2']->expects( $this->atMost( 1 ) )->method( 'testForAccountLink' )
3449                         ->will( $this->returnValue( StatusValue::newGood() ) );
3450
3451                 $mocks['primary']->expects( $this->any() )->method( 'accountCreationType' )
3452                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
3453                 $ct = count( $req->primary );
3454                 $callback = $this->returnCallback( function ( $u, $reqs ) use ( $user, $req ) {
3455                         $this->assertSame( $user->getId(), $u->getId() );
3456                         $this->assertSame( $user->getName(), $u->getName() );
3457                         $foundReq = false;
3458                         foreach ( $reqs as $r ) {
3459                                 $this->assertSame( $user->getName(), $r->username );
3460                                 $foundReq = $foundReq || get_class( $r ) === get_class( $req );
3461                         }
3462                         $this->assertTrue( $foundReq, '$reqs contains $req' );
3463                         return array_shift( $req->primary );
3464                 } );
3465                 $mocks['primary']->expects( $this->exactly( min( 1, $ct ) ) )
3466                         ->method( 'beginPrimaryAccountLink' )
3467                         ->will( $callback );
3468                 $mocks['primary']->expects( $this->exactly( max( 0, $ct - 1 ) ) )
3469                         ->method( 'continuePrimaryAccountLink' )
3470                         ->will( $callback );
3471
3472                 $abstain = AuthenticationResponse::newAbstain();
3473                 $mocks['primary2']->expects( $this->any() )->method( 'accountCreationType' )
3474                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_LINK ) );
3475                 $mocks['primary2']->expects( $this->atMost( 1 ) )->method( 'beginPrimaryAccountLink' )
3476                         ->will( $this->returnValue( $abstain ) );
3477                 $mocks['primary2']->expects( $this->never() )->method( 'continuePrimaryAccountLink' );
3478                 $mocks['primary3']->expects( $this->any() )->method( 'accountCreationType' )
3479                         ->will( $this->returnValue( PrimaryAuthenticationProvider::TYPE_CREATE ) );
3480                 $mocks['primary3']->expects( $this->never() )->method( 'beginPrimaryAccountLink' );
3481                 $mocks['primary3']->expects( $this->never() )->method( 'continuePrimaryAccountLink' );
3482
3483                 $this->preauthMocks = [ $mocks['pre'], $mocks['pre2'] ];
3484                 $this->primaryauthMocks = [ $mocks['primary3'], $mocks['primary2'], $mocks['primary'] ];
3485                 $this->logger = new \TestLogger( true, function ( $message, $level ) {
3486                         return $level === LogLevel::DEBUG ? null : $message;
3487                 } );
3488                 $this->initializeManager( true );
3489
3490                 $constraint = \PHPUnit_Framework_Assert::logicalOr(
3491                         $this->equalTo( AuthenticationResponse::PASS ),
3492                         $this->equalTo( AuthenticationResponse::FAIL )
3493                 );
3494                 $providers = array_merge( $this->preauthMocks, $this->primaryauthMocks );
3495                 foreach ( $providers as $p ) {
3496                         $p->postCalled = false;
3497                         $p->expects( $this->atMost( 1 ) )->method( 'postAccountLink' )
3498                                 ->willReturnCallback( function ( $user, $response ) use ( $constraint, $p ) {
3499                                         $this->assertInstanceOf( \User::class, $user );
3500                                         $this->assertSame( 'UTSysop', $user->getName() );
3501                                         $this->assertInstanceOf( AuthenticationResponse::class, $response );
3502                                         $this->assertThat( $response->status, $constraint );
3503                                         $p->postCalled = $response->status;
3504                                 } );
3505                 }
3506
3507                 $first = true;
3508                 $created = false;
3509                 $expectLog = [];
3510                 foreach ( $managerResponses as $i => $response ) {
3511                         if ( $response instanceof AuthenticationResponse &&
3512                                 $response->status === AuthenticationResponse::PASS
3513                         ) {
3514                                 $expectLog[] = [ LogLevel::INFO, 'Account linked to {user} by primary' ];
3515                         }
3516
3517                         $ex = null;
3518                         try {
3519                                 if ( $first ) {
3520                                         $ret = $this->manager->beginAccountLink( $user, [ $req ], 'http://localhost/' );
3521                                 } else {
3522                                         $ret = $this->manager->continueAccountLink( [ $req ] );
3523                                 }
3524                                 if ( $response instanceof \Exception ) {
3525                                         $this->fail( 'Expected exception not thrown', "Response $i" );
3526                                 }
3527                         } catch ( \Exception $ex ) {
3528                                 if ( !$response instanceof \Exception ) {
3529                                         throw $ex;
3530                                 }
3531                                 $this->assertEquals( $response->getMessage(), $ex->getMessage(), "Response $i, exception" );
3532                                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::accountLinkState' ),
3533                                         "Response $i, exception, session state" );
3534                                 return;
3535                         }
3536
3537                         $this->assertSame( 'http://localhost/', $req->returnToUrl );
3538
3539                         $ret->message = $this->message( $ret->message );
3540                         $this->assertResponseEquals( $response, $ret, "Response $i, response" );
3541                         if ( $response->status === AuthenticationResponse::PASS ||
3542                                 $response->status === AuthenticationResponse::FAIL
3543                         ) {
3544                                 $this->assertNull( $this->request->getSession()->getSecret( 'AuthManager::accountLinkState' ),
3545                                         "Response $i, session state" );
3546                                 foreach ( $providers as $p ) {
3547                                         $this->assertSame( $response->status, $p->postCalled,
3548                                                 "Response $i, post-auth callback called" );
3549                                 }
3550                         } else {
3551                                 $this->assertNotNull(
3552                                         $this->request->getSession()->getSecret( 'AuthManager::accountLinkState' ),
3553                                         "Response $i, session state"
3554                                 );
3555                                 foreach ( $ret->neededRequests as $neededReq ) {
3556                                         $this->assertEquals( AuthManager::ACTION_LINK, $neededReq->action,
3557                                                 "Response $i, neededRequest action" );
3558                                 }
3559                                 $this->assertEquals(
3560                                         $ret->neededRequests,
3561                                         $this->manager->getAuthenticationRequests( AuthManager::ACTION_LINK_CONTINUE ),
3562                                         "Response $i, continuation check"
3563                                 );
3564                                 foreach ( $providers as $p ) {
3565                                         $this->assertFalse( $p->postCalled, "Response $i, post-auth callback not called" );
3566                                 }
3567                         }
3568
3569                         $first = false;
3570                 }
3571
3572                 $this->assertSame( $expectLog, $this->logger->getBuffer() );
3573         }
3574
3575         public function provideAccountLink() {
3576                 $req = $this->getMockForAbstractClass( AuthenticationRequest::class );
3577                 $good = StatusValue::newGood();
3578
3579                 return [
3580                         'Pre-link test fail in pre' => [
3581                                 StatusValue::newFatal( 'fail-from-pre' ),
3582                                 [],
3583                                 [
3584                                         AuthenticationResponse::newFail( $this->message( 'fail-from-pre' ) ),
3585                                 ]
3586                         ],
3587                         'Failure in primary' => [
3588                                 $good,
3589                                 $tmp = [
3590                                         AuthenticationResponse::newFail( $this->message( 'fail-from-primary' ) ),
3591                                 ],
3592                                 $tmp
3593                         ],
3594                         'All primary abstain' => [
3595                                 $good,
3596                                 [
3597                                         AuthenticationResponse::newAbstain(),
3598                                 ],
3599                                 [
3600                                         AuthenticationResponse::newFail( $this->message( 'authmanager-link-no-primary' ) )
3601                                 ]
3602                         ],
3603                         'Primary UI, then redirect, then fail' => [
3604                                 $good,
3605                                 $tmp = [
3606                                         AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
3607                                         AuthenticationResponse::newRedirect( [ $req ], '/foo.html', [ 'foo' => 'bar' ] ),
3608                                         AuthenticationResponse::newFail( $this->message( 'fail-in-primary-continue' ) ),
3609                                 ],
3610                                 $tmp
3611                         ],
3612                         'Primary redirect, then abstain' => [
3613                                 $good,
3614                                 [
3615                                         $tmp = AuthenticationResponse::newRedirect(
3616                                                 [ $req ], '/foo.html', [ 'foo' => 'bar' ]
3617                                         ),
3618                                         AuthenticationResponse::newAbstain(),
3619                                 ],
3620                                 [
3621                                         $tmp,
3622                                         new \DomainException(
3623                                                 'MockPrimaryAuthenticationProvider::continuePrimaryAccountLink() returned ABSTAIN'
3624                                         )
3625                                 ]
3626                         ],
3627                         'Primary UI, then pass' => [
3628                                 $good,
3629                                 [
3630                                         $tmp1 = AuthenticationResponse::newUI( [ $req ], $this->message( '...' ) ),
3631                                         AuthenticationResponse::newPass(),
3632                                 ],
3633                                 [
3634                                         $tmp1,
3635                                         AuthenticationResponse::newPass( '' ),
3636                                 ]
3637                         ],
3638                         'Primary pass' => [
3639                                 $good,
3640                                 [
3641                                         AuthenticationResponse::newPass( '' ),
3642                                 ],
3643                                 [
3644                                         AuthenticationResponse::newPass( '' ),
3645                                 ]
3646                         ],
3647                 ];
3648         }
3649 }