tests/phpunit/includes/auth/TemporaryPasswordPrimaryAuthenticationProviderTest.php

   1 <?php
   2
   3 namespace MediaWiki\Auth;
   4
   5 use MediaWiki\MediaWikiServices;
   6 use Wikimedia\ScopedCallback;
   7 use Wikimedia\TestingAccessWrapper;
   8
   9 /**
  10  * @group AuthManager
  11  * @group Database
  12  * @covers \MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider
  13  */
  14 class TemporaryPasswordPrimaryAuthenticationProviderTest extends \MediaWikiTestCase {
  15
  16         private $manager = null;
  17         private $config = null;
  18         private $validity = null;
  19
  20         /**
  21          * Get an instance of the provider
  22          *
  23          * $provider->checkPasswordValidity is mocked to return $this->validity,
  24          * because we don't need to test that here.
  25          *
  26          * @param array $params
  27          * @return TemporaryPasswordPrimaryAuthenticationProvider
  28          */
  29         protected function getProvider( $params = [] ) {
  30                 if ( !$this->config ) {
  31                         $this->config = new \HashConfig( [
  32                                 'EmailEnabled' => true,
  33                         ] );
  34                 }
  35                 $config = new \MultiConfig( [
  36                         $this->config,
  37                         MediaWikiServices::getInstance()->getMainConfig()
  38                 ] );
  39
  40                 if ( !$this->manager ) {
  41                         $this->manager = new AuthManager( new \FauxRequest(), $config );
  42                 }
  43                 $this->validity = \Status::newGood();
  44
  45                 $mockedMethods[] = 'checkPasswordValidity';
  46                 $provider = $this->getMockBuilder( TemporaryPasswordPrimaryAuthenticationProvider::class )
  47                         ->setMethods( $mockedMethods )
  48                         ->setConstructorArgs( [ $params ] )
  49                         ->getMock();
  50                 $provider->expects( $this->any() )->method( 'checkPasswordValidity' )
  51                         ->will( $this->returnCallback( function () {
  52                                 return $this->validity;
  53                         } ) );
  54                 $provider->setConfig( $config );
  55                 $provider->setLogger( new \Psr\Log\NullLogger() );
  56                 $provider->setManager( $this->manager );
  57
  58                 return $provider;
  59         }
  60
  61         protected function hookMailer( $func = null ) {
  62                 \Hooks::clear( 'AlternateUserMailer' );
  63                 if ( $func ) {
  64                         \Hooks::register( 'AlternateUserMailer', $func );
  65                         // Safety
  66                         \Hooks::register( 'AlternateUserMailer', function () {
  67                                 return false;
  68                         } );
  69                 } else {
  70                         \Hooks::register( 'AlternateUserMailer', function () {
  71                                 $this->fail( 'AlternateUserMailer hook called unexpectedly' );
  72                                 return false;
  73                         } );
  74                 }
  75
  76                 return new ScopedCallback( function () {
  77                         \Hooks::clear( 'AlternateUserMailer' );
  78                         \Hooks::register( 'AlternateUserMailer', function () {
  79                                 return false;
  80                         } );
  81                 } );
  82         }
  83
  84         public function testBasics() {
  85                 $provider = new TemporaryPasswordPrimaryAuthenticationProvider();
  86
  87                 $this->assertSame(
  88                         PrimaryAuthenticationProvider::TYPE_CREATE,
  89                         $provider->accountCreationType()
  90                 );
  91
  92                 $this->assertTrue( $provider->testUserExists( 'UTSysop' ) );
  93                 $this->assertTrue( $provider->testUserExists( 'uTSysop' ) );
  94                 $this->assertFalse( $provider->testUserExists( 'DoesNotExist' ) );
  95                 $this->assertFalse( $provider->testUserExists( '<invalid>' ) );
  96
  97                 $req = new PasswordAuthenticationRequest;
  98                 $req->action = AuthManager::ACTION_CHANGE;
  99                 $req->username = '<invalid>';
 100                 $provider->providerChangeAuthenticationData( $req );
 101         }
 102
 103         public function testConfig() {
 104                 $config = new \HashConfig( [
 105                         'EnableEmail' => false,
 106                         'NewPasswordExpiry' => 100,
 107                         'PasswordReminderResendTime' => 101,
 108                 ] );
 109
 110                 $p = TestingAccessWrapper::newFromObject( new TemporaryPasswordPrimaryAuthenticationProvider() );
 111                 $p->setConfig( $config );
 112                 $this->assertSame( false, $p->emailEnabled );
 113                 $this->assertSame( 100, $p->newPasswordExpiry );
 114                 $this->assertSame( 101, $p->passwordReminderResendTime );
 115
 116                 $p = TestingAccessWrapper::newFromObject( new TemporaryPasswordPrimaryAuthenticationProvider( [
 117                         'emailEnabled' => true,
 118                         'newPasswordExpiry' => 42,
 119                         'passwordReminderResendTime' => 43,
 120                 ] ) );
 121                 $p->setConfig( $config );
 122                 $this->assertSame( true, $p->emailEnabled );
 123                 $this->assertSame( 42, $p->newPasswordExpiry );
 124                 $this->assertSame( 43, $p->passwordReminderResendTime );
 125         }
 126
 127         public function testTestUserCanAuthenticate() {
 128                 $user = self::getMutableTestUser()->getUser();
 129
 130                 $dbw = wfGetDB( DB_MASTER );
 131                 $config = MediaWikiServices::getInstance()->getMainConfig();
 132                 // A is unsalted MD5 (thus fast) ... we don't care about security here, this is test only
 133                 $passwordFactory = new \PasswordFactory( $config->get( 'PasswordConfig' ), 'A' );
 134
 135                 $pwhash = $passwordFactory->newFromPlaintext( 'password' )->toString();
 136
 137                 $provider = $this->getProvider();
 138                 $providerPriv = TestingAccessWrapper::newFromObject( $provider );
 139
 140                 $this->assertFalse( $provider->testUserCanAuthenticate( '<invalid>' ) );
 141                 $this->assertFalse( $provider->testUserCanAuthenticate( 'DoesNotExist' ) );
 142
 143                 $dbw->update(
 144                         'user',
 145                         [
 146                                 'user_newpassword' => \PasswordFactory::newInvalidPassword()->toString(),
 147                                 'user_newpass_time' => null,
 148                         ],
 149                         [ 'user_id' => $user->getId() ]
 150                 );
 151                 $this->assertFalse( $provider->testUserCanAuthenticate( $user->getName() ) );
 152
 153                 $dbw->update(
 154                         'user',
 155                         [
 156                                 'user_newpassword' => $pwhash,
 157                                 'user_newpass_time' => null,
 158                         ],
 159                         [ 'user_id' => $user->getId() ]
 160                 );
 161                 $this->assertTrue( $provider->testUserCanAuthenticate( $user->getName() ) );
 162                 $this->assertTrue( $provider->testUserCanAuthenticate( lcfirst( $user->getName() ) ) );
 163
 164                 $dbw->update(
 165                         'user',
 166                         [
 167                                 'user_newpassword' => $pwhash,
 168                                 'user_newpass_time' => $dbw->timestamp( time() - 10 ),
 169                         ],
 170                         [ 'user_id' => $user->getId() ]
 171                 );
 172                 $providerPriv->newPasswordExpiry = 100;
 173                 $this->assertTrue( $provider->testUserCanAuthenticate( $user->getName() ) );
 174                 $providerPriv->newPasswordExpiry = 1;
 175                 $this->assertFalse( $provider->testUserCanAuthenticate( $user->getName() ) );
 176
 177                 $dbw->update(
 178                         'user',
 179                         [
 180                                 'user_newpassword' => \PasswordFactory::newInvalidPassword()->toString(),
 181                                 'user_newpass_time' => null,
 182                         ],
 183                         [ 'user_id' => $user->getId() ]
 184                 );
 185         }
 186
 187         /**
 188          * @dataProvider provideGetAuthenticationRequests
 189          * @param string $action
 190          * @param array $options
 191          * @param array $expected
 192          */
 193         public function testGetAuthenticationRequests( $action, $options, $expected ) {
 194                 $actual = $this->getProvider( [ 'emailEnabled' => true ] )
 195                         ->getAuthenticationRequests( $action, $options );
 196                 foreach ( $actual as $req ) {
 197                         if ( $req instanceof TemporaryPasswordAuthenticationRequest && $req->password !== null ) {
 198                                 $req->password = 'random';
 199                         }
 200                 }
 201                 $this->assertEquals( $expected, $actual );
 202         }
 203
 204         public static function provideGetAuthenticationRequests() {
 205                 $anon = [ 'username' => null ];
 206                 $loggedIn = [ 'username' => 'UTSysop' ];
 207
 208                 return [
 209                         [ AuthManager::ACTION_LOGIN, $anon, [
 210                                 new PasswordAuthenticationRequest
 211                         ] ],
 212                         [ AuthManager::ACTION_LOGIN, $loggedIn, [
 213                                 new PasswordAuthenticationRequest
 214                         ] ],
 215                         [ AuthManager::ACTION_CREATE, $anon, [] ],
 216                         [ AuthManager::ACTION_CREATE, $loggedIn, [
 217                                 new TemporaryPasswordAuthenticationRequest( 'random' )
 218                         ] ],
 219                         [ AuthManager::ACTION_LINK, $anon, [] ],
 220                         [ AuthManager::ACTION_LINK, $loggedIn, [] ],
 221                         [ AuthManager::ACTION_CHANGE, $anon, [
 222                                 new TemporaryPasswordAuthenticationRequest( 'random' )
 223                         ] ],
 224                         [ AuthManager::ACTION_CHANGE, $loggedIn, [
 225                                 new TemporaryPasswordAuthenticationRequest( 'random' )
 226                         ] ],
 227                         [ AuthManager::ACTION_REMOVE, $anon, [
 228                                 new TemporaryPasswordAuthenticationRequest
 229                         ] ],
 230                         [ AuthManager::ACTION_REMOVE, $loggedIn, [
 231                                 new TemporaryPasswordAuthenticationRequest
 232                         ] ],
 233                 ];
 234         }
 235
 236         public function testAuthentication() {
 237                 $user = self::getMutableTestUser()->getUser();
 238
 239                 $password = 'TemporaryPassword';
 240                 $hash = ':A:' . md5( $password );
 241                 $dbw = wfGetDB( DB_MASTER );
 242                 $dbw->update(
 243                         'user',
 244                         [ 'user_newpassword' => $hash, 'user_newpass_time' => $dbw->timestamp( time() - 10 ) ],
 245                         [ 'user_id' => $user->getId() ]
 246                 );
 247
 248                 $req = new PasswordAuthenticationRequest();
 249                 $req->action = AuthManager::ACTION_LOGIN;
 250                 $reqs = [ PasswordAuthenticationRequest::class => $req ];
 251
 252                 $provider = $this->getProvider();
 253                 $providerPriv = TestingAccessWrapper::newFromObject( $provider );
 254
 255                 $providerPriv->newPasswordExpiry = 100;
 256
 257                 // General failures
 258                 $this->assertEquals(
 259                         AuthenticationResponse::newAbstain(),
 260                         $provider->beginPrimaryAuthentication( [] )
 261                 );
 262
 263                 $req->username = 'foo';
 264                 $req->password = null;
 265                 $this->assertEquals(
 266                         AuthenticationResponse::newAbstain(),
 267                         $provider->beginPrimaryAuthentication( $reqs )
 268                 );
 269
 270                 $req->username = null;
 271                 $req->password = 'bar';
 272                 $this->assertEquals(
 273                         AuthenticationResponse::newAbstain(),
 274                         $provider->beginPrimaryAuthentication( $reqs )
 275                 );
 276
 277                 $req->username = '<invalid>';
 278                 $req->password = 'WhoCares';
 279                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 280                 $this->assertEquals(
 281                         AuthenticationResponse::newAbstain(),
 282                         $provider->beginPrimaryAuthentication( $reqs )
 283                 );
 284
 285                 $req->username = 'DoesNotExist';
 286                 $req->password = 'DoesNotExist';
 287                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 288                 $this->assertEquals(
 289                         AuthenticationResponse::newAbstain(),
 290                         $provider->beginPrimaryAuthentication( $reqs )
 291                 );
 292
 293                 // Validation failure
 294                 $req->username = $user->getName();
 295                 $req->password = $password;
 296                 $this->validity = \Status::newFatal( 'arbitrary-failure' );
 297                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 298                 $this->assertEquals(
 299                         AuthenticationResponse::FAIL,
 300                         $ret->status
 301                 );
 302                 $this->assertEquals(
 303                         'arbitrary-failure',
 304                         $ret->message->getKey()
 305                 );
 306
 307                 // Successful auth
 308                 $this->manager->removeAuthenticationSessionData( null );
 309                 $this->validity = \Status::newGood();
 310                 $this->assertEquals(
 311                         AuthenticationResponse::newPass( $user->getName() ),
 312                         $provider->beginPrimaryAuthentication( $reqs )
 313                 );
 314                 $this->assertNotNull( $this->manager->getAuthenticationSessionData( 'reset-pass' ) );
 315
 316                 $this->manager->removeAuthenticationSessionData( null );
 317                 $this->validity = \Status::newGood();
 318                 $req->username = lcfirst( $user->getName() );
 319                 $this->assertEquals(
 320                         AuthenticationResponse::newPass( $user->getName() ),
 321                         $provider->beginPrimaryAuthentication( $reqs )
 322                 );
 323                 $this->assertNotNull( $this->manager->getAuthenticationSessionData( 'reset-pass' ) );
 324                 $req->username = $user->getName();
 325
 326                 // Expired password
 327                 $providerPriv->newPasswordExpiry = 1;
 328                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 329                 $this->assertEquals(
 330                         AuthenticationResponse::FAIL,
 331                         $ret->status
 332                 );
 333                 $this->assertEquals(
 334                         'wrongpassword',
 335                         $ret->message->getKey()
 336                 );
 337
 338                 // Bad password
 339                 $providerPriv->newPasswordExpiry = 100;
 340                 $this->validity = \Status::newGood();
 341                 $req->password = 'Wrong';
 342                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 343                 $this->assertEquals(
 344                         AuthenticationResponse::FAIL,
 345                         $ret->status
 346                 );
 347                 $this->assertEquals(
 348                         'wrongpassword',
 349                         $ret->message->getKey()
 350                 );
 351         }
 352
 353         /**
 354          * @dataProvider provideProviderAllowsAuthenticationDataChange
 355          * @param string $type
 356          * @param string $user
 357          * @param \Status $validity Result of the password validity check
 358          * @param \StatusValue $expect1 Expected result with $checkData = false
 359          * @param \StatusValue $expect2 Expected result with $checkData = true
 360          */
 361         public function testProviderAllowsAuthenticationDataChange( $type, $user, \Status $validity,
 362                 \StatusValue $expect1, \StatusValue $expect2
 363         ) {
 364                 if ( $type === PasswordAuthenticationRequest::class ||
 365                         $type === TemporaryPasswordAuthenticationRequest::class
 366                 ) {
 367                         $req = new $type();
 368                 } else {
 369                         $req = $this->createMock( $type );
 370                 }
 371                 $req->action = AuthManager::ACTION_CHANGE;
 372                 $req->username = $user;
 373                 $req->password = 'NewPassword';
 374
 375                 $provider = $this->getProvider();
 376                 $this->validity = $validity;
 377                 $this->assertEquals( $expect1, $provider->providerAllowsAuthenticationDataChange( $req, false ) );
 378                 $this->assertEquals( $expect2, $provider->providerAllowsAuthenticationDataChange( $req, true ) );
 379         }
 380
 381         public static function provideProviderAllowsAuthenticationDataChange() {
 382                 $err = \StatusValue::newGood();
 383                 $err->error( 'arbitrary-warning' );
 384
 385                 return [
 386                         [ AuthenticationRequest::class, 'UTSysop', \Status::newGood(),
 387                                 \StatusValue::newGood( 'ignored' ), \StatusValue::newGood( 'ignored' ) ],
 388                         [ PasswordAuthenticationRequest::class, 'UTSysop', \Status::newGood(),
 389                                 \StatusValue::newGood( 'ignored' ), \StatusValue::newGood( 'ignored' ) ],
 390                         [ TemporaryPasswordAuthenticationRequest::class, 'UTSysop', \Status::newGood(),
 391                                 \StatusValue::newGood(), \StatusValue::newGood() ],
 392                         [ TemporaryPasswordAuthenticationRequest::class, 'uTSysop', \Status::newGood(),
 393                                 \StatusValue::newGood(), \StatusValue::newGood() ],
 394                         [ TemporaryPasswordAuthenticationRequest::class, 'UTSysop', \Status::wrap( $err ),
 395                                 \StatusValue::newGood(), $err ],
 396                         [ TemporaryPasswordAuthenticationRequest::class, 'UTSysop',
 397                                 \Status::newFatal( 'arbitrary-error' ), \StatusValue::newGood(),
 398                                 \StatusValue::newFatal( 'arbitrary-error' ) ],
 399                         [ TemporaryPasswordAuthenticationRequest::class, 'DoesNotExist', \Status::newGood(),
 400                                 \StatusValue::newGood(), \StatusValue::newGood( 'ignored' ) ],
 401                         [ TemporaryPasswordAuthenticationRequest::class, '<invalid>', \Status::newGood(),
 402                                 \StatusValue::newGood(), \StatusValue::newGood( 'ignored' ) ],
 403                 ];
 404         }
 405
 406         /**
 407          * @dataProvider provideProviderChangeAuthenticationData
 408          * @param string $user
 409          * @param string $type
 410          * @param bool $changed
 411          */
 412         public function testProviderChangeAuthenticationData( $user, $type, $changed ) {
 413                 $cuser = ucfirst( $user );
 414                 $oldpass = 'OldTempPassword';
 415                 $newpass = 'NewTempPassword';
 416
 417                 $dbw = wfGetDB( DB_MASTER );
 418                 $oldHash = $dbw->selectField( 'user', 'user_newpassword', [ 'user_name' => $cuser ] );
 419                 $cb = new ScopedCallback( function () use ( $dbw, $cuser, $oldHash ) {
 420                         $dbw->update( 'user', [ 'user_newpassword' => $oldHash ], [ 'user_name' => $cuser ] );
 421                 } );
 422
 423                 $hash = ':A:' . md5( $oldpass );
 424                 $dbw->update(
 425                         'user',
 426                         [ 'user_newpassword' => $hash, 'user_newpass_time' => $dbw->timestamp( time() + 10 ) ],
 427                         [ 'user_name' => $cuser ]
 428                 );
 429
 430                 $provider = $this->getProvider();
 431
 432                 // Sanity check
 433                 $loginReq = new PasswordAuthenticationRequest();
 434                 $loginReq->action = AuthManager::ACTION_CHANGE;
 435                 $loginReq->username = $user;
 436                 $loginReq->password = $oldpass;
 437                 $loginReqs = [ PasswordAuthenticationRequest::class => $loginReq ];
 438                 $this->assertEquals(
 439                         AuthenticationResponse::newPass( $cuser ),
 440                         $provider->beginPrimaryAuthentication( $loginReqs ),
 441                         'Sanity check'
 442                 );
 443
 444                 if ( $type === PasswordAuthenticationRequest::class ||
 445                         $type === TemporaryPasswordAuthenticationRequest::class
 446                 ) {
 447                         $changeReq = new $type();
 448                 } else {
 449                         $changeReq = $this->createMock( $type );
 450                 }
 451                 $changeReq->action = AuthManager::ACTION_CHANGE;
 452                 $changeReq->username = $user;
 453                 $changeReq->password = $newpass;
 454                 $resetMailer = $this->hookMailer();
 455                 $provider->providerChangeAuthenticationData( $changeReq );
 456                 ScopedCallback::consume( $resetMailer );
 457
 458                 $loginReq->password = $oldpass;
 459                 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
 460                 $this->assertEquals(
 461                         AuthenticationResponse::FAIL,
 462                         $ret->status,
 463                         'old password should fail'
 464                 );
 465                 $this->assertEquals(
 466                         'wrongpassword',
 467                         $ret->message->getKey(),
 468                         'old password should fail'
 469                 );
 470
 471                 $loginReq->password = $newpass;
 472                 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
 473                 if ( $changed ) {
 474                         $this->assertEquals(
 475                                 AuthenticationResponse::newPass( $cuser ),
 476                                 $ret,
 477                                 'new password should pass'
 478                         );
 479                         $this->assertNotNull(
 480                                 $dbw->selectField( 'user', 'user_newpass_time', [ 'user_name' => $cuser ] )
 481                         );
 482                 } else {
 483                         $this->assertEquals(
 484                                 AuthenticationResponse::FAIL,
 485                                 $ret->status,
 486                                 'new password should fail'
 487                         );
 488                         $this->assertEquals(
 489                                 'wrongpassword',
 490                                 $ret->message->getKey(),
 491                                 'new password should fail'
 492                         );
 493                         $this->assertNull(
 494                                 $dbw->selectField( 'user', 'user_newpass_time', [ 'user_name' => $cuser ] )
 495                         );
 496                 }
 497         }
 498
 499         public static function provideProviderChangeAuthenticationData() {
 500                 return [
 501                         [ 'UTSysop', AuthenticationRequest::class, false ],
 502                         [ 'UTSysop', PasswordAuthenticationRequest::class, false ],
 503                         [ 'UTSysop', TemporaryPasswordAuthenticationRequest::class, true ],
 504                 ];
 505         }
 506
 507         public function testProviderChangeAuthenticationDataEmail() {
 508                 $user = self::getMutableTestUser()->getUser();
 509
 510                 $dbw = wfGetDB( DB_MASTER );
 511                 $dbw->update(
 512                         'user',
 513                         [ 'user_newpass_time' => $dbw->timestamp( time() - 5 * 3600 ) ],
 514                         [ 'user_id' => $user->getId() ]
 515                 );
 516
 517                 $req = TemporaryPasswordAuthenticationRequest::newRandom();
 518                 $req->username = $user->getName();
 519                 $req->mailpassword = true;
 520
 521                 $provider = $this->getProvider( [ 'emailEnabled' => false ] );
 522                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 523                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-emaildisabled' ), $status );
 524
 525                 $provider = $this->getProvider( [
 526                         'emailEnabled' => true, 'passwordReminderResendTime' => 10
 527                 ] );
 528                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 529                 $this->assertEquals( \StatusValue::newFatal( 'throttled-mailpassword', 10 ), $status );
 530
 531                 $provider = $this->getProvider( [
 532                         'emailEnabled' => true, 'passwordReminderResendTime' => 3
 533                 ] );
 534                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 535                 $this->assertFalse( $status->hasMessage( 'throttled-mailpassword' ) );
 536
 537                 $dbw->update(
 538                         'user',
 539                         [ 'user_newpass_time' => $dbw->timestamp( time() + 5 * 3600 ) ],
 540                         [ 'user_id' => $user->getId() ]
 541                 );
 542                 $provider = $this->getProvider( [
 543                         'emailEnabled' => true, 'passwordReminderResendTime' => 0
 544                 ] );
 545                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 546                 $this->assertFalse( $status->hasMessage( 'throttled-mailpassword' ) );
 547
 548                 $req->caller = null;
 549                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 550                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-nocaller' ), $status );
 551
 552                 $req->caller = '127.0.0.256';
 553                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 554                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-nosuchcaller', '127.0.0.256' ),
 555                         $status );
 556
 557                 $req->caller = '<Invalid>';
 558                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 559                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-nosuchcaller', '<Invalid>' ),
 560                         $status );
 561
 562                 $req->caller = '127.0.0.1';
 563                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 564                 $this->assertEquals( \StatusValue::newGood(), $status );
 565
 566                 $req->caller = $user->getName();
 567                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 568                 $this->assertEquals( \StatusValue::newGood(), $status );
 569
 570                 $mailed = false;
 571                 $resetMailer = $this->hookMailer( function ( $headers, $to, $from, $subject, $body )
 572                         use ( &$mailed, $req, $user )
 573                 {
 574                         $mailed = true;
 575                         $this->assertSame( $user->getEmail(), $to[0]->address );
 576                         $this->assertContains( $req->password, $body );
 577                         return false;
 578                 } );
 579                 $provider->providerChangeAuthenticationData( $req );
 580                 ScopedCallback::consume( $resetMailer );
 581                 $this->assertTrue( $mailed );
 582
 583                 $priv = TestingAccessWrapper::newFromObject( $provider );
 584                 $req->username = '<invalid>';
 585                 $status = $priv->sendPasswordResetEmail( $req );
 586                 $this->assertEquals( \Status::newFatal( 'noname' ), $status );
 587         }
 588
 589         public function testTestForAccountCreation() {
 590                 $user = \User::newFromName( 'foo' );
 591                 $req = new TemporaryPasswordAuthenticationRequest();
 592                 $req->username = 'Foo';
 593                 $req->password = 'Bar';
 594                 $reqs = [ TemporaryPasswordAuthenticationRequest::class => $req ];
 595
 596                 $provider = $this->getProvider();
 597                 $this->assertEquals(
 598                         \StatusValue::newGood(),
 599                         $provider->testForAccountCreation( $user, $user, [] ),
 600                         'No password request'
 601                 );
 602
 603                 $this->assertEquals(
 604                         \StatusValue::newGood(),
 605                         $provider->testForAccountCreation( $user, $user, $reqs ),
 606                         'Password request, validated'
 607                 );
 608
 609                 $this->validity->error( 'arbitrary warning' );
 610                 $expect = \StatusValue::newGood();
 611                 $expect->error( 'arbitrary warning' );
 612                 $this->assertEquals(
 613                         $expect,
 614                         $provider->testForAccountCreation( $user, $user, $reqs ),
 615                         'Password request, not validated'
 616                 );
 617         }
 618
 619         public function testAccountCreation() {
 620                 $resetMailer = $this->hookMailer();
 621
 622                 $user = \User::newFromName( 'Foo' );
 623
 624                 $req = new TemporaryPasswordAuthenticationRequest();
 625                 $reqs = [ TemporaryPasswordAuthenticationRequest::class => $req ];
 626
 627                 $authreq = new PasswordAuthenticationRequest();
 628                 $authreq->action = AuthManager::ACTION_CREATE;
 629                 $authreqs = [ PasswordAuthenticationRequest::class => $authreq ];
 630
 631                 $provider = $this->getProvider();
 632
 633                 $this->assertEquals(
 634                         AuthenticationResponse::newAbstain(),
 635                         $provider->beginPrimaryAccountCreation( $user, $user, [] )
 636                 );
 637
 638                 $req->username = 'foo';
 639                 $req->password = null;
 640                 $this->assertEquals(
 641                         AuthenticationResponse::newAbstain(),
 642                         $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
 643                 );
 644
 645                 $req->username = null;
 646                 $req->password = 'bar';
 647                 $this->assertEquals(
 648                         AuthenticationResponse::newAbstain(),
 649                         $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
 650                 );
 651
 652                 $req->username = 'foo';
 653                 $req->password = 'bar';
 654
 655                 $expect = AuthenticationResponse::newPass( 'Foo' );
 656                 $expect->createRequest = clone $req;
 657                 $expect->createRequest->username = 'Foo';
 658                 $this->assertEquals( $expect, $provider->beginPrimaryAccountCreation( $user, $user, $reqs ) );
 659                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'no-email' ) );
 660
 661                 $user = self::getMutableTestUser()->getUser();
 662                 $req->username = $authreq->username = $user->getName();
 663                 $req->password = $authreq->password = 'NewPassword';
 664                 $expect = AuthenticationResponse::newPass( $user->getName() );
 665                 $expect->createRequest = $req;
 666
 667                 $res2 = $provider->beginPrimaryAccountCreation( $user, $user, $reqs );
 668                 $this->assertEquals( $expect, $res2, 'Sanity check' );
 669
 670                 $ret = $provider->beginPrimaryAuthentication( $authreqs );
 671                 $this->assertEquals( AuthenticationResponse::FAIL, $ret->status, 'sanity check' );
 672
 673                 $this->assertSame( null, $provider->finishAccountCreation( $user, $user, $res2 ) );
 674
 675                 $ret = $provider->beginPrimaryAuthentication( $authreqs );
 676                 $this->assertEquals( AuthenticationResponse::PASS, $ret->status, 'new password is set' );
 677         }
 678
 679         public function testAccountCreationEmail() {
 680                 $creator = \User::newFromName( 'Foo' );
 681
 682                 $user = self::getMutableTestUser()->getUser();
 683                 $user->setEmail( null );
 684
 685                 $req = TemporaryPasswordAuthenticationRequest::newRandom();
 686                 $req->username = $user->getName();
 687                 $req->mailpassword = true;
 688
 689                 $provider = $this->getProvider( [ 'emailEnabled' => false ] );
 690                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 691                 $this->assertEquals( \StatusValue::newFatal( 'emaildisabled' ), $status );
 692
 693                 $provider = $this->getProvider( [ 'emailEnabled' => true ] );
 694                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 695                 $this->assertEquals( \StatusValue::newFatal( 'noemailcreate' ), $status );
 696
 697                 $user->setEmail( 'test@localhost.localdomain' );
 698                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 699                 $this->assertEquals( \StatusValue::newGood(), $status );
 700
 701                 $mailed = false;
 702                 $resetMailer = $this->hookMailer( function ( $headers, $to, $from, $subject, $body )
 703                         use ( &$mailed, $req )
 704                 {
 705                         $mailed = true;
 706                         $this->assertSame( 'test@localhost.localdomain', $to[0]->address );
 707                         $this->assertContains( $req->password, $body );
 708                         return false;
 709                 } );
 710
 711                 $expect = AuthenticationResponse::newPass( $user->getName() );
 712                 $expect->createRequest = clone $req;
 713                 $expect->createRequest->username = $user->getName();
 714                 $res = $provider->beginPrimaryAccountCreation( $user, $creator, [ $req ] );
 715                 $this->assertEquals( $expect, $res );
 716                 $this->assertTrue( $this->manager->getAuthenticationSessionData( 'no-email' ) );
 717                 $this->assertFalse( $mailed );
 718
 719                 $this->assertSame( 'byemail', $provider->finishAccountCreation( $user, $creator, $res ) );
 720                 $this->assertTrue( $mailed );
 721
 722                 ScopedCallback::consume( $resetMailer );
 723                 $this->assertTrue( $mailed );
 724         }
 725
 726 }