tests/phpunit/includes/auth/TemporaryPasswordPrimaryAuthenticationProviderTest.php

   1 <?php
   2
   3 namespace MediaWiki\Auth;
   4
   5 use Wikimedia\ScopedCallback;
   6
   7 /**
   8  * @group AuthManager
   9  * @group Database
  10  * @covers MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider
  11  */
  12 class TemporaryPasswordPrimaryAuthenticationProviderTest extends \MediaWikiTestCase {
  13
  14         private $manager = null;
  15         private $config = null;
  16         private $validity = null;
  17
  18         /**
  19          * Get an instance of the provider
  20          *
  21          * $provider->checkPasswordValidity is mocked to return $this->validity,
  22          * because we don't need to test that here.
  23          *
  24          * @param array $params
  25          * @return TemporaryPasswordPrimaryAuthenticationProvider
  26          */
  27         protected function getProvider( $params = [] ) {
  28                 if ( !$this->config ) {
  29                         $this->config = new \HashConfig( [
  30                                 'EmailEnabled' => true,
  31                         ] );
  32                 }
  33                 $config = new \MultiConfig( [
  34                         $this->config,
  35                         \ConfigFactory::getDefaultInstance()->makeConfig( 'main' )
  36                 ] );
  37
  38                 if ( !$this->manager ) {
  39                         $this->manager = new AuthManager( new \FauxRequest(), $config );
  40                 }
  41                 $this->validity = \Status::newGood();
  42
  43                 $mockedMethods[] = 'checkPasswordValidity';
  44                 $provider = $this->getMock(
  45                         TemporaryPasswordPrimaryAuthenticationProvider::class,
  46                         $mockedMethods,
  47                         [ $params ]
  48                 );
  49                 $provider->expects( $this->any() )->method( 'checkPasswordValidity' )
  50                         ->will( $this->returnCallback( function () {
  51                                 return $this->validity;
  52                         } ) );
  53                 $provider->setConfig( $config );
  54                 $provider->setLogger( new \Psr\Log\NullLogger() );
  55                 $provider->setManager( $this->manager );
  56
  57                 return $provider;
  58         }
  59
  60         protected function hookMailer( $func = null ) {
  61                 \Hooks::clear( 'AlternateUserMailer' );
  62                 if ( $func ) {
  63                         \Hooks::register( 'AlternateUserMailer', $func );
  64                         // Safety
  65                         \Hooks::register( 'AlternateUserMailer', function () {
  66                                 return false;
  67                         } );
  68                 } else {
  69                         \Hooks::register( 'AlternateUserMailer', function () {
  70                                 $this->fail( 'AlternateUserMailer hook called unexpectedly' );
  71                                 return false;
  72                         } );
  73                 }
  74
  75                 return new ScopedCallback( function () {
  76                         \Hooks::clear( 'AlternateUserMailer' );
  77                         \Hooks::register( 'AlternateUserMailer', function () {
  78                                 return false;
  79                         } );
  80                 } );
  81         }
  82
  83         public function testBasics() {
  84                 $provider = new TemporaryPasswordPrimaryAuthenticationProvider();
  85
  86                 $this->assertSame(
  87                         PrimaryAuthenticationProvider::TYPE_CREATE,
  88                         $provider->accountCreationType()
  89                 );
  90
  91                 $this->assertTrue( $provider->testUserExists( 'UTSysop' ) );
  92                 $this->assertTrue( $provider->testUserExists( 'uTSysop' ) );
  93                 $this->assertFalse( $provider->testUserExists( 'DoesNotExist' ) );
  94                 $this->assertFalse( $provider->testUserExists( '<invalid>' ) );
  95
  96                 $req = new PasswordAuthenticationRequest;
  97                 $req->action = AuthManager::ACTION_CHANGE;
  98                 $req->username = '<invalid>';
  99                 $provider->providerChangeAuthenticationData( $req );
 100         }
 101
 102         public function testConfig() {
 103                 $config = new \HashConfig( [
 104                         'EnableEmail' => false,
 105                         'NewPasswordExpiry' => 100,
 106                         'PasswordReminderResendTime' => 101,
 107                 ] );
 108
 109                 $p = \TestingAccessWrapper::newFromObject( new TemporaryPasswordPrimaryAuthenticationProvider() );
 110                 $p->setConfig( $config );
 111                 $this->assertSame( false, $p->emailEnabled );
 112                 $this->assertSame( 100, $p->newPasswordExpiry );
 113                 $this->assertSame( 101, $p->passwordReminderResendTime );
 114
 115                 $p = \TestingAccessWrapper::newFromObject( new TemporaryPasswordPrimaryAuthenticationProvider( [
 116                         'emailEnabled' => true,
 117                         'newPasswordExpiry' => 42,
 118                         'passwordReminderResendTime' => 43,
 119                 ] ) );
 120                 $p->setConfig( $config );
 121                 $this->assertSame( true, $p->emailEnabled );
 122                 $this->assertSame( 42, $p->newPasswordExpiry );
 123                 $this->assertSame( 43, $p->passwordReminderResendTime );
 124         }
 125
 126         public function testTestUserCanAuthenticate() {
 127                 $user = self::getMutableTestUser()->getUser();
 128
 129                 $dbw = wfGetDB( DB_MASTER );
 130
 131                 $passwordFactory = new \PasswordFactory();
 132                 $passwordFactory->init( \RequestContext::getMain()->getConfig() );
 133                 // A is unsalted MD5 (thus fast) ... we don't care about security here, this is test only
 134                 $passwordFactory->setDefaultType( 'A' );
 135                 $pwhash = $passwordFactory->newFromPlaintext( 'password' )->toString();
 136
 137                 $provider = $this->getProvider();
 138                 $providerPriv = \TestingAccessWrapper::newFromObject( $provider );
 139
 140                 $this->assertFalse( $provider->testUserCanAuthenticate( '<invalid>' ) );
 141                 $this->assertFalse( $provider->testUserCanAuthenticate( 'DoesNotExist' ) );
 142
 143                 $dbw->update(
 144                         'user',
 145                         [
 146                                 'user_newpassword' => \PasswordFactory::newInvalidPassword()->toString(),
 147                                 'user_newpass_time' => null,
 148                         ],
 149                         [ 'user_id' => $user->getId() ]
 150                 );
 151                 $this->assertFalse( $provider->testUserCanAuthenticate( $user->getName() ) );
 152
 153                 $dbw->update(
 154                         'user',
 155                         [
 156                                 'user_newpassword' => $pwhash,
 157                                 'user_newpass_time' => null,
 158                         ],
 159                         [ 'user_id' => $user->getId() ]
 160                 );
 161                 $this->assertTrue( $provider->testUserCanAuthenticate( $user->getName() ) );
 162                 $this->assertTrue( $provider->testUserCanAuthenticate( lcfirst( $user->getName() ) ) );
 163
 164                 $dbw->update(
 165                         'user',
 166                         [
 167                                 'user_newpassword' => $pwhash,
 168                                 'user_newpass_time' => $dbw->timestamp( time() - 10 ),
 169                         ],
 170                         [ 'user_id' => $user->getId() ]
 171                 );
 172                 $providerPriv->newPasswordExpiry = 100;
 173                 $this->assertTrue( $provider->testUserCanAuthenticate( $user->getName() ) );
 174                 $providerPriv->newPasswordExpiry = 1;
 175                 $this->assertFalse( $provider->testUserCanAuthenticate( $user->getName() ) );
 176
 177                 $dbw->update(
 178                         'user',
 179                         [
 180                                 'user_newpassword' => \PasswordFactory::newInvalidPassword()->toString(),
 181                                 'user_newpass_time' => null,
 182                         ],
 183                         [ 'user_id' => $user->getId() ]
 184                 );
 185         }
 186
 187         /**
 188          * @dataProvider provideGetAuthenticationRequests
 189          * @param string $action
 190          * @param array $options
 191          * @param array $expected
 192          */
 193         public function testGetAuthenticationRequests( $action, $options, $expected ) {
 194                 $actual = $this->getProvider()->getAuthenticationRequests( $action, $options );
 195                 foreach ( $actual as $req ) {
 196                         if ( $req instanceof TemporaryPasswordAuthenticationRequest && $req->password !== null ) {
 197                                 $req->password = 'random';
 198                         }
 199                 }
 200                 $this->assertEquals( $expected, $actual );
 201         }
 202
 203         public static function provideGetAuthenticationRequests() {
 204                 $anon = [ 'username' => null ];
 205                 $loggedIn = [ 'username' => 'UTSysop' ];
 206
 207                 return [
 208                         [ AuthManager::ACTION_LOGIN, $anon, [
 209                                 new PasswordAuthenticationRequest
 210                         ] ],
 211                         [ AuthManager::ACTION_LOGIN, $loggedIn, [
 212                                 new PasswordAuthenticationRequest
 213                         ] ],
 214                         [ AuthManager::ACTION_CREATE, $anon, [] ],
 215                         [ AuthManager::ACTION_CREATE, $loggedIn, [
 216                                 new TemporaryPasswordAuthenticationRequest( 'random' )
 217                         ] ],
 218                         [ AuthManager::ACTION_LINK, $anon, [] ],
 219                         [ AuthManager::ACTION_LINK, $loggedIn, [] ],
 220                         [ AuthManager::ACTION_CHANGE, $anon, [
 221                                 new TemporaryPasswordAuthenticationRequest( 'random' )
 222                         ] ],
 223                         [ AuthManager::ACTION_CHANGE, $loggedIn, [
 224                                 new TemporaryPasswordAuthenticationRequest( 'random' )
 225                         ] ],
 226                         [ AuthManager::ACTION_REMOVE, $anon, [
 227                                 new TemporaryPasswordAuthenticationRequest
 228                         ] ],
 229                         [ AuthManager::ACTION_REMOVE, $loggedIn, [
 230                                 new TemporaryPasswordAuthenticationRequest
 231                         ] ],
 232                 ];
 233         }
 234
 235         public function testAuthentication() {
 236                 $user = self::getMutableTestUser()->getUser();
 237
 238                 $password = 'TemporaryPassword';
 239                 $hash = ':A:' . md5( $password );
 240                 $dbw = wfGetDB( DB_MASTER );
 241                 $dbw->update(
 242                         'user',
 243                         [ 'user_newpassword' => $hash, 'user_newpass_time' => $dbw->timestamp( time() - 10 ) ],
 244                         [ 'user_id' => $user->getId() ]
 245                 );
 246
 247                 $req = new PasswordAuthenticationRequest();
 248                 $req->action = AuthManager::ACTION_LOGIN;
 249                 $reqs = [ PasswordAuthenticationRequest::class => $req ];
 250
 251                 $provider = $this->getProvider();
 252                 $providerPriv = \TestingAccessWrapper::newFromObject( $provider );
 253
 254                 $providerPriv->newPasswordExpiry = 100;
 255
 256                 // General failures
 257                 $this->assertEquals(
 258                         AuthenticationResponse::newAbstain(),
 259                         $provider->beginPrimaryAuthentication( [] )
 260                 );
 261
 262                 $req->username = 'foo';
 263                 $req->password = null;
 264                 $this->assertEquals(
 265                         AuthenticationResponse::newAbstain(),
 266                         $provider->beginPrimaryAuthentication( $reqs )
 267                 );
 268
 269                 $req->username = null;
 270                 $req->password = 'bar';
 271                 $this->assertEquals(
 272                         AuthenticationResponse::newAbstain(),
 273                         $provider->beginPrimaryAuthentication( $reqs )
 274                 );
 275
 276                 $req->username = '<invalid>';
 277                 $req->password = 'WhoCares';
 278                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 279                 $this->assertEquals(
 280                         AuthenticationResponse::newAbstain(),
 281                         $provider->beginPrimaryAuthentication( $reqs )
 282                 );
 283
 284                 $req->username = 'DoesNotExist';
 285                 $req->password = 'DoesNotExist';
 286                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 287                 $this->assertEquals(
 288                         AuthenticationResponse::newAbstain(),
 289                         $provider->beginPrimaryAuthentication( $reqs )
 290                 );
 291
 292                 // Validation failure
 293                 $req->username = $user->getName();
 294                 $req->password = $password;
 295                 $this->validity = \Status::newFatal( 'arbitrary-failure' );
 296                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 297                 $this->assertEquals(
 298                         AuthenticationResponse::FAIL,
 299                         $ret->status
 300                 );
 301                 $this->assertEquals(
 302                         'arbitrary-failure',
 303                         $ret->message->getKey()
 304                 );
 305
 306                 // Successful auth
 307                 $this->manager->removeAuthenticationSessionData( null );
 308                 $this->validity = \Status::newGood();
 309                 $this->assertEquals(
 310                         AuthenticationResponse::newPass( $user->getName() ),
 311                         $provider->beginPrimaryAuthentication( $reqs )
 312                 );
 313                 $this->assertNotNull( $this->manager->getAuthenticationSessionData( 'reset-pass' ) );
 314
 315                 $this->manager->removeAuthenticationSessionData( null );
 316                 $this->validity = \Status::newGood();
 317                 $req->username = lcfirst( $user->getName() );
 318                 $this->assertEquals(
 319                         AuthenticationResponse::newPass( $user->getName() ),
 320                         $provider->beginPrimaryAuthentication( $reqs )
 321                 );
 322                 $this->assertNotNull( $this->manager->getAuthenticationSessionData( 'reset-pass' ) );
 323                 $req->username = $user->getName();
 324
 325                 // Expired password
 326                 $providerPriv->newPasswordExpiry = 1;
 327                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 328                 $this->assertEquals(
 329                         AuthenticationResponse::FAIL,
 330                         $ret->status
 331                 );
 332                 $this->assertEquals(
 333                         'wrongpassword',
 334                         $ret->message->getKey()
 335                 );
 336
 337                 // Bad password
 338                 $providerPriv->newPasswordExpiry = 100;
 339                 $this->validity = \Status::newGood();
 340                 $req->password = 'Wrong';
 341                 $ret = $provider->beginPrimaryAuthentication( $reqs );
 342                 $this->assertEquals(
 343                         AuthenticationResponse::FAIL,
 344                         $ret->status
 345                 );
 346                 $this->assertEquals(
 347                         'wrongpassword',
 348                         $ret->message->getKey()
 349                 );
 350
 351         }
 352
 353         /**
 354          * @dataProvider provideProviderAllowsAuthenticationDataChange
 355          * @param string $type
 356          * @param string $user
 357          * @param \Status $validity Result of the password validity check
 358          * @param \StatusValue $expect1 Expected result with $checkData = false
 359          * @param \StatusValue $expect2 Expected result with $checkData = true
 360          */
 361         public function testProviderAllowsAuthenticationDataChange( $type, $user, \Status $validity,
 362                 \StatusValue $expect1, \StatusValue $expect2
 363         ) {
 364                 if ( $type === PasswordAuthenticationRequest::class ||
 365                         $type === TemporaryPasswordAuthenticationRequest::class
 366                 ) {
 367                         $req = new $type();
 368                 } else {
 369                         $req = $this->getMock( $type );
 370                 }
 371                 $req->action = AuthManager::ACTION_CHANGE;
 372                 $req->username = $user;
 373                 $req->password = 'NewPassword';
 374
 375                 $provider = $this->getProvider();
 376                 $this->validity = $validity;
 377                 $this->assertEquals( $expect1, $provider->providerAllowsAuthenticationDataChange( $req, false ) );
 378                 $this->assertEquals( $expect2, $provider->providerAllowsAuthenticationDataChange( $req, true ) );
 379         }
 380
 381         public static function provideProviderAllowsAuthenticationDataChange() {
 382                 $err = \StatusValue::newGood();
 383                 $err->error( 'arbitrary-warning' );
 384
 385                 return [
 386                         [ AuthenticationRequest::class, 'UTSysop', \Status::newGood(),
 387                                 \StatusValue::newGood( 'ignored' ), \StatusValue::newGood( 'ignored' ) ],
 388                         [ PasswordAuthenticationRequest::class, 'UTSysop', \Status::newGood(),
 389                                 \StatusValue::newGood( 'ignored' ), \StatusValue::newGood( 'ignored' ) ],
 390                         [ TemporaryPasswordAuthenticationRequest::class, 'UTSysop', \Status::newGood(),
 391                                 \StatusValue::newGood(), \StatusValue::newGood() ],
 392                         [ TemporaryPasswordAuthenticationRequest::class, 'uTSysop', \Status::newGood(),
 393                                 \StatusValue::newGood(), \StatusValue::newGood() ],
 394                         [ TemporaryPasswordAuthenticationRequest::class, 'UTSysop', \Status::wrap( $err ),
 395                                 \StatusValue::newGood(), $err ],
 396                         [ TemporaryPasswordAuthenticationRequest::class, 'UTSysop',
 397                                 \Status::newFatal( 'arbitrary-error' ), \StatusValue::newGood(),
 398                                 \StatusValue::newFatal( 'arbitrary-error' ) ],
 399                         [ TemporaryPasswordAuthenticationRequest::class, 'DoesNotExist', \Status::newGood(),
 400                                 \StatusValue::newGood(), \StatusValue::newGood( 'ignored' ) ],
 401                         [ TemporaryPasswordAuthenticationRequest::class, '<invalid>', \Status::newGood(),
 402                                 \StatusValue::newGood(), \StatusValue::newGood( 'ignored' ) ],
 403                 ];
 404         }
 405
 406         /**
 407          * @dataProvider provideProviderChangeAuthenticationData
 408          * @param string $user
 409          * @param string $type
 410          * @param bool $changed
 411          */
 412         public function testProviderChangeAuthenticationData( $user, $type, $changed ) {
 413                 $cuser = ucfirst( $user );
 414                 $oldpass = 'OldTempPassword';
 415                 $newpass = 'NewTempPassword';
 416
 417                 $dbw = wfGetDB( DB_MASTER );
 418                 $oldHash = $dbw->selectField( 'user', 'user_newpassword', [ 'user_name' => $cuser ] );
 419                 $cb = new ScopedCallback( function () use ( $dbw, $cuser, $oldHash ) {
 420                         $dbw->update( 'user', [ 'user_newpassword' => $oldHash ], [ 'user_name' => $cuser ] );
 421                 } );
 422
 423                 $hash = ':A:' . md5( $oldpass );
 424                 $dbw->update(
 425                         'user',
 426                         [ 'user_newpassword' => $hash, 'user_newpass_time' => $dbw->timestamp( time() + 10 ) ],
 427                         [ 'user_name' => $cuser ]
 428                 );
 429
 430                 $provider = $this->getProvider();
 431
 432                 // Sanity check
 433                 $loginReq = new PasswordAuthenticationRequest();
 434                 $loginReq->action = AuthManager::ACTION_CHANGE;
 435                 $loginReq->username = $user;
 436                 $loginReq->password = $oldpass;
 437                 $loginReqs = [ PasswordAuthenticationRequest::class => $loginReq ];
 438                 $this->assertEquals(
 439                         AuthenticationResponse::newPass( $cuser ),
 440                         $provider->beginPrimaryAuthentication( $loginReqs ),
 441                         'Sanity check'
 442                 );
 443
 444                 if ( $type === PasswordAuthenticationRequest::class ||
 445                         $type === TemporaryPasswordAuthenticationRequest::class
 446                 ) {
 447                         $changeReq = new $type();
 448                 } else {
 449                         $changeReq = $this->getMock( $type );
 450                 }
 451                 $changeReq->action = AuthManager::ACTION_CHANGE;
 452                 $changeReq->username = $user;
 453                 $changeReq->password = $newpass;
 454                 $resetMailer = $this->hookMailer();
 455                 $provider->providerChangeAuthenticationData( $changeReq );
 456                 ScopedCallback::consume( $resetMailer );
 457
 458                 $loginReq->password = $oldpass;
 459                 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
 460                 $this->assertEquals(
 461                         AuthenticationResponse::FAIL,
 462                         $ret->status,
 463                         'old password should fail'
 464                 );
 465                 $this->assertEquals(
 466                         'wrongpassword',
 467                         $ret->message->getKey(),
 468                         'old password should fail'
 469                 );
 470
 471                 $loginReq->password = $newpass;
 472                 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
 473                 if ( $changed ) {
 474                         $this->assertEquals(
 475                                 AuthenticationResponse::newPass( $cuser ),
 476                                 $ret,
 477                                 'new password should pass'
 478                         );
 479                         $this->assertNotNull(
 480                                 $dbw->selectField( 'user', 'user_newpass_time', [ 'user_name' => $cuser ] )
 481                         );
 482                 } else {
 483                         $this->assertEquals(
 484                                 AuthenticationResponse::FAIL,
 485                                 $ret->status,
 486                                 'new password should fail'
 487                         );
 488                         $this->assertEquals(
 489                                 'wrongpassword',
 490                                 $ret->message->getKey(),
 491                                 'new password should fail'
 492                         );
 493                         $this->assertNull(
 494                                 $dbw->selectField( 'user', 'user_newpass_time', [ 'user_name' => $cuser ] )
 495                         );
 496                 }
 497         }
 498
 499         public static function provideProviderChangeAuthenticationData() {
 500                 return [
 501                         [ 'UTSysop', AuthenticationRequest::class, false ],
 502                         [ 'UTSysop', PasswordAuthenticationRequest::class, false ],
 503                         [ 'UTSysop', TemporaryPasswordAuthenticationRequest::class, true ],
 504                 ];
 505         }
 506
 507         public function testProviderChangeAuthenticationDataEmail() {
 508                 $user = self::getMutableTestUser()->getUser();
 509
 510                 $dbw = wfGetDB( DB_MASTER );
 511                 $dbw->update(
 512                         'user',
 513                         [ 'user_newpass_time' => $dbw->timestamp( time() - 5 * 3600 ) ],
 514                         [ 'user_id' => $user->getId() ]
 515                 );
 516
 517                 $req = TemporaryPasswordAuthenticationRequest::newRandom();
 518                 $req->username = $user->getName();
 519                 $req->mailpassword = true;
 520
 521                 $provider = $this->getProvider( [ 'emailEnabled' => false ] );
 522                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 523                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-emaildisabled' ), $status );
 524                 $req->hasBackchannel = true;
 525                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 526                 $this->assertFalse( $status->hasMessage( 'passwordreset-emaildisabled' ) );
 527                 $req->hasBackchannel = false;
 528
 529                 $provider = $this->getProvider( [ 'passwordReminderResendTime' => 10 ] );
 530                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 531                 $this->assertEquals( \StatusValue::newFatal( 'throttled-mailpassword', 10 ), $status );
 532
 533                 $provider = $this->getProvider( [ 'passwordReminderResendTime' => 3 ] );
 534                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 535                 $this->assertFalse( $status->hasMessage( 'throttled-mailpassword' ) );
 536
 537                 $dbw->update(
 538                         'user',
 539                         [ 'user_newpass_time' => $dbw->timestamp( time() + 5 * 3600 ) ],
 540                         [ 'user_id' => $user->getId() ]
 541                 );
 542                 $provider = $this->getProvider( [ 'passwordReminderResendTime' => 0 ] );
 543                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 544                 $this->assertFalse( $status->hasMessage( 'throttled-mailpassword' ) );
 545
 546                 $req->caller = null;
 547                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 548                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-nocaller' ), $status );
 549
 550                 $req->caller = '127.0.0.256';
 551                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 552                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-nosuchcaller', '127.0.0.256' ),
 553                         $status );
 554
 555                 $req->caller = '<Invalid>';
 556                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 557                 $this->assertEquals( \StatusValue::newFatal( 'passwordreset-nosuchcaller', '<Invalid>' ),
 558                         $status );
 559
 560                 $req->caller = '127.0.0.1';
 561                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 562                 $this->assertEquals( \StatusValue::newGood(), $status );
 563
 564                 $req->caller = $user->getName();
 565                 $status = $provider->providerAllowsAuthenticationDataChange( $req, true );
 566                 $this->assertEquals( \StatusValue::newGood(), $status );
 567
 568                 $mailed = false;
 569                 $resetMailer = $this->hookMailer( function ( $headers, $to, $from, $subject, $body )
 570                         use ( &$mailed, $req, $user )
 571                 {
 572                         $mailed = true;
 573                         $this->assertSame( $user->getEmail(), $to[0]->address );
 574                         $this->assertContains( $req->password, $body );
 575                         return false;
 576                 } );
 577                 $provider->providerChangeAuthenticationData( $req );
 578                 ScopedCallback::consume( $resetMailer );
 579                 $this->assertTrue( $mailed );
 580
 581                 $priv = \TestingAccessWrapper::newFromObject( $provider );
 582                 $req->username = '<invalid>';
 583                 $status = $priv->sendPasswordResetEmail( $req );
 584                 $this->assertEquals( \Status::newFatal( 'noname' ), $status );
 585         }
 586
 587         public function testTestForAccountCreation() {
 588                 $user = \User::newFromName( 'foo' );
 589                 $req = new TemporaryPasswordAuthenticationRequest();
 590                 $req->username = 'Foo';
 591                 $req->password = 'Bar';
 592                 $reqs = [ TemporaryPasswordAuthenticationRequest::class => $req ];
 593
 594                 $provider = $this->getProvider();
 595                 $this->assertEquals(
 596                         \StatusValue::newGood(),
 597                         $provider->testForAccountCreation( $user, $user, [] ),
 598                         'No password request'
 599                 );
 600
 601                 $this->assertEquals(
 602                         \StatusValue::newGood(),
 603                         $provider->testForAccountCreation( $user, $user, $reqs ),
 604                         'Password request, validated'
 605                 );
 606
 607                 $this->validity->error( 'arbitrary warning' );
 608                 $expect = \StatusValue::newGood();
 609                 $expect->error( 'arbitrary warning' );
 610                 $this->assertEquals(
 611                         $expect,
 612                         $provider->testForAccountCreation( $user, $user, $reqs ),
 613                         'Password request, not validated'
 614                 );
 615         }
 616
 617         public function testAccountCreation() {
 618                 $resetMailer = $this->hookMailer();
 619
 620                 $user = \User::newFromName( 'Foo' );
 621
 622                 $req = new TemporaryPasswordAuthenticationRequest();
 623                 $reqs = [ TemporaryPasswordAuthenticationRequest::class => $req ];
 624
 625                 $authreq = new PasswordAuthenticationRequest();
 626                 $authreq->action = AuthManager::ACTION_CREATE;
 627                 $authreqs = [ PasswordAuthenticationRequest::class => $authreq ];
 628
 629                 $provider = $this->getProvider();
 630
 631                 $this->assertEquals(
 632                         AuthenticationResponse::newAbstain(),
 633                         $provider->beginPrimaryAccountCreation( $user, $user, [] )
 634                 );
 635
 636                 $req->username = 'foo';
 637                 $req->password = null;
 638                 $this->assertEquals(
 639                         AuthenticationResponse::newAbstain(),
 640                         $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
 641                 );
 642
 643                 $req->username = null;
 644                 $req->password = 'bar';
 645                 $this->assertEquals(
 646                         AuthenticationResponse::newAbstain(),
 647                         $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
 648                 );
 649
 650                 $req->username = 'foo';
 651                 $req->password = 'bar';
 652
 653                 $expect = AuthenticationResponse::newPass( 'Foo' );
 654                 $expect->createRequest = clone( $req );
 655                 $expect->createRequest->username = 'Foo';
 656                 $this->assertEquals( $expect, $provider->beginPrimaryAccountCreation( $user, $user, $reqs ) );
 657                 $this->assertNull( $this->manager->getAuthenticationSessionData( 'no-email' ) );
 658
 659                 $user = self::getMutableTestUser()->getUser();
 660                 $req->username = $authreq->username = $user->getName();
 661                 $req->password = $authreq->password = 'NewPassword';
 662                 $expect = AuthenticationResponse::newPass( $user->getName() );
 663                 $expect->createRequest = $req;
 664
 665                 $res2 = $provider->beginPrimaryAccountCreation( $user, $user, $reqs );
 666                 $this->assertEquals( $expect, $res2, 'Sanity check' );
 667
 668                 $ret = $provider->beginPrimaryAuthentication( $authreqs );
 669                 $this->assertEquals( AuthenticationResponse::FAIL, $ret->status, 'sanity check' );
 670
 671                 $this->assertSame( null, $provider->finishAccountCreation( $user, $user, $res2 ) );
 672
 673                 $ret = $provider->beginPrimaryAuthentication( $authreqs );
 674                 $this->assertEquals( AuthenticationResponse::PASS, $ret->status, 'new password is set' );
 675         }
 676
 677         public function testAccountCreationEmail() {
 678                 $creator = \User::newFromName( 'Foo' );
 679
 680                 $user = self::getMutableTestUser()->getUser();
 681                 $user->setEmail( null );
 682
 683                 $req = TemporaryPasswordAuthenticationRequest::newRandom();
 684                 $req->username = $user->getName();
 685                 $req->mailpassword = true;
 686
 687                 $provider = $this->getProvider( [ 'emailEnabled' => false ] );
 688                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 689                 $this->assertEquals( \StatusValue::newFatal( 'emaildisabled' ), $status );
 690                 $req->hasBackchannel = true;
 691                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 692                 $this->assertFalse( $status->hasMessage( 'emaildisabled' ) );
 693                 $req->hasBackchannel = false;
 694
 695                 $provider = $this->getProvider( [ 'emailEnabled' => true ] );
 696                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 697                 $this->assertEquals( \StatusValue::newFatal( 'noemailcreate' ), $status );
 698                 $req->hasBackchannel = true;
 699                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 700                 $this->assertFalse( $status->hasMessage( 'noemailcreate' ) );
 701                 $req->hasBackchannel = false;
 702
 703                 $user->setEmail( 'test@localhost.localdomain' );
 704                 $status = $provider->testForAccountCreation( $user, $creator, [ $req ] );
 705                 $this->assertEquals( \StatusValue::newGood(), $status );
 706
 707                 $mailed = false;
 708                 $resetMailer = $this->hookMailer( function ( $headers, $to, $from, $subject, $body )
 709                         use ( &$mailed, $req )
 710                 {
 711                         $mailed = true;
 712                         $this->assertSame( 'test@localhost.localdomain', $to[0]->address );
 713                         $this->assertContains( $req->password, $body );
 714                         return false;
 715                 } );
 716
 717                 $expect = AuthenticationResponse::newPass( $user->getName() );
 718                 $expect->createRequest = clone( $req );
 719                 $expect->createRequest->username = $user->getName();
 720                 $res = $provider->beginPrimaryAccountCreation( $user, $creator, [ $req ] );
 721                 $this->assertEquals( $expect, $res );
 722                 $this->assertTrue( $this->manager->getAuthenticationSessionData( 'no-email' ) );
 723                 $this->assertFalse( $mailed );
 724
 725                 $this->assertSame( 'byemail', $provider->finishAccountCreation( $user, $creator, $res ) );
 726                 $this->assertTrue( $mailed );
 727
 728                 ScopedCallback::consume( $resetMailer );
 729                 $this->assertTrue( $mailed );
 730         }
 731
 732 }