tests/phpunit/includes/session/CookieSessionProviderTest.php

   1 <?php
   2
   3 namespace MediaWiki\Session;
   4
   5 use MediaWikiTestCase;
   6 use User;
   7
   8 /**
   9  * @group Session
  10  * @group Database
  11  * @covers MediaWiki\Session\CookieSessionProvider
  12  */
  13 class CookieSessionProviderTest extends MediaWikiTestCase {
  14
  15         private function getConfig() {
  16                 global $wgCookieExpiration;
  17                 return new \HashConfig( array(
  18                         'CookiePrefix' => 'CookiePrefix',
  19                         'CookiePath' => 'CookiePath',
  20                         'CookieDomain' => 'CookieDomain',
  21                         'CookieSecure' => true,
  22                         'CookieHttpOnly' => true,
  23                         'SessionName' => false,
  24                         'ExtendedLoginCookies' => array( 'UserID', 'Token' ),
  25                         'ExtendedLoginCookieExpiration' => $wgCookieExpiration * 2,
  26                 ) );
  27         }
  28
  29         public function testConstructor() {
  30                 try {
  31                         new CookieSessionProvider();
  32                         $this->fail( 'Expected exception not thrown' );
  33                 } catch ( \InvalidArgumentException $ex ) {
  34                         $this->assertSame(
  35                                 'MediaWiki\\Session\\CookieSessionProvider::__construct: priority must be specified',
  36                                 $ex->getMessage()
  37                         );
  38                 }
  39
  40                 try {
  41                         new CookieSessionProvider( array( 'priority' => 'foo' ) );
  42                         $this->fail( 'Expected exception not thrown' );
  43                 } catch ( \InvalidArgumentException $ex ) {
  44                         $this->assertSame(
  45                                 'MediaWiki\\Session\\CookieSessionProvider::__construct: Invalid priority',
  46                                 $ex->getMessage()
  47                         );
  48                 }
  49                 try {
  50                         new CookieSessionProvider( array( 'priority' => SessionInfo::MIN_PRIORITY - 1 ) );
  51                         $this->fail( 'Expected exception not thrown' );
  52                 } catch ( \InvalidArgumentException $ex ) {
  53                         $this->assertSame(
  54                                 'MediaWiki\\Session\\CookieSessionProvider::__construct: Invalid priority',
  55                                 $ex->getMessage()
  56                         );
  57                 }
  58                 try {
  59                         new CookieSessionProvider( array( 'priority' => SessionInfo::MAX_PRIORITY + 1 ) );
  60                         $this->fail( 'Expected exception not thrown' );
  61                 } catch ( \InvalidArgumentException $ex ) {
  62                         $this->assertSame(
  63                                 'MediaWiki\\Session\\CookieSessionProvider::__construct: Invalid priority',
  64                                 $ex->getMessage()
  65                         );
  66                 }
  67
  68                 try {
  69                         new CookieSessionProvider( array( 'priority' => 1, 'cookieOptions' => null ) );
  70                         $this->fail( 'Expected exception not thrown' );
  71                 } catch ( \InvalidArgumentException $ex ) {
  72                         $this->assertSame(
  73                                 'MediaWiki\\Session\\CookieSessionProvider::__construct: cookieOptions must be an array',
  74                                 $ex->getMessage()
  75                         );
  76                 }
  77
  78                 $config = $this->getConfig();
  79                 $p = \TestingAccessWrapper::newFromObject(
  80                         new CookieSessionProvider( array( 'priority' => 1 ) )
  81                 );
  82                 $p->setLogger( new \TestLogger() );
  83                 $p->setConfig( $config );
  84                 $this->assertEquals( 1, $p->priority );
  85                 $this->assertEquals( array(
  86                         'callUserSetCookiesHook' => false,
  87                         'sessionName' => 'CookiePrefix_session',
  88                 ), $p->params );
  89                 $this->assertEquals( array(
  90                         'prefix' => 'CookiePrefix',
  91                         'path' => 'CookiePath',
  92                         'domain' => 'CookieDomain',
  93                         'secure' => true,
  94                         'httpOnly' => true,
  95                 ), $p->cookieOptions );
  96
  97                 $config->set( 'SessionName', 'SessionName' );
  98                 $p = \TestingAccessWrapper::newFromObject(
  99                         new CookieSessionProvider( array( 'priority' => 3 ) )
 100                 );
 101                 $p->setLogger( new \TestLogger() );
 102                 $p->setConfig( $config );
 103                 $this->assertEquals( 3, $p->priority );
 104                 $this->assertEquals( array(
 105                         'callUserSetCookiesHook' => false,
 106                         'sessionName' => 'SessionName',
 107                 ), $p->params );
 108                 $this->assertEquals( array(
 109                         'prefix' => 'CookiePrefix',
 110                         'path' => 'CookiePath',
 111                         'domain' => 'CookieDomain',
 112                         'secure' => true,
 113                         'httpOnly' => true,
 114                 ), $p->cookieOptions );
 115
 116                 $p = \TestingAccessWrapper::newFromObject( new CookieSessionProvider( array(
 117                         'priority' => 10,
 118                         'callUserSetCookiesHook' => true,
 119                         'cookieOptions' => array(
 120                                 'prefix' => 'XPrefix',
 121                                 'path' => 'XPath',
 122                                 'domain' => 'XDomain',
 123                                 'secure' => 'XSecure',
 124                                 'httpOnly' => 'XHttpOnly',
 125                         ),
 126                         'sessionName' => 'XSession',
 127                 ) ) );
 128                 $p->setLogger( new \TestLogger() );
 129                 $p->setConfig( $config );
 130                 $this->assertEquals( 10, $p->priority );
 131                 $this->assertEquals( array(
 132                         'callUserSetCookiesHook' => true,
 133                         'sessionName' => 'XSession',
 134                 ), $p->params );
 135                 $this->assertEquals( array(
 136                         'prefix' => 'XPrefix',
 137                         'path' => 'XPath',
 138                         'domain' => 'XDomain',
 139                         'secure' => 'XSecure',
 140                         'httpOnly' => 'XHttpOnly',
 141                 ), $p->cookieOptions );
 142         }
 143
 144         public function testBasics() {
 145                 $provider = new CookieSessionProvider( array( 'priority' => 10 ) );
 146
 147                 $this->assertTrue( $provider->persistsSessionID() );
 148                 $this->assertTrue( $provider->canChangeUser() );
 149
 150                 $msg = $provider->whyNoSession();
 151                 $this->assertInstanceOf( 'Message', $msg );
 152                 $this->assertSame( 'sessionprovider-nocookies', $msg->getKey() );
 153         }
 154
 155         public function testProvideSessionInfo() {
 156                 $params = array(
 157                         'priority' => 20,
 158                         'sessionName' => 'session',
 159                         'cookieOptions' => array( 'prefix' => 'x' ),
 160                 );
 161                 $provider = new CookieSessionProvider( $params );
 162                 $provider->setLogger( new \TestLogger() );
 163                 $provider->setConfig( $this->getConfig() );
 164                 $provider->setManager( new SessionManager() );
 165
 166                 $user = User::newFromName( 'UTSysop' );
 167                 $id = $user->getId();
 168                 $name = $user->getName();
 169                 $token = $user->getToken( true );
 170
 171                 $sessionId = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 172
 173                 // No data
 174                 $request = new \FauxRequest();
 175                 $info = $provider->provideSessionInfo( $request );
 176                 $this->assertNull( $info );
 177
 178                 // Session key only
 179                 $request = new \FauxRequest();
 180                 $request->setCookies( array(
 181                         'session' => $sessionId,
 182                 ), '' );
 183                 $info = $provider->provideSessionInfo( $request );
 184                 $this->assertNotNull( $info );
 185                 $this->assertSame( $params['priority'], $info->getPriority() );
 186                 $this->assertSame( $sessionId, $info->getId() );
 187                 $this->assertNull( $info->getUserInfo() );
 188                 $this->assertFalse( $info->forceHTTPS() );
 189
 190                 // User, no session key
 191                 $request = new \FauxRequest();
 192                 $request->setCookies( array(
 193                         'xUserID' => $id,
 194                         'xToken' => $token,
 195                 ), '' );
 196                 $info = $provider->provideSessionInfo( $request );
 197                 $this->assertNotNull( $info );
 198                 $this->assertSame( $params['priority'], $info->getPriority() );
 199                 $this->assertNotSame( $sessionId, $info->getId() );
 200                 $this->assertNotNull( $info->getUserInfo() );
 201                 $this->assertSame( $id, $info->getUserInfo()->getId() );
 202                 $this->assertSame( $name, $info->getUserInfo()->getName() );
 203                 $this->assertFalse( $info->forceHTTPS() );
 204
 205                 // User and session key
 206                 $request = new \FauxRequest();
 207                 $request->setCookies( array(
 208                         'session' => $sessionId,
 209                         'xUserID' => $id,
 210                         'xToken' => $token,
 211                 ), '' );
 212                 $info = $provider->provideSessionInfo( $request );
 213                 $this->assertNotNull( $info );
 214                 $this->assertSame( $params['priority'], $info->getPriority() );
 215                 $this->assertSame( $sessionId, $info->getId() );
 216                 $this->assertNotNull( $info->getUserInfo() );
 217                 $this->assertSame( $id, $info->getUserInfo()->getId() );
 218                 $this->assertSame( $name, $info->getUserInfo()->getName() );
 219                 $this->assertFalse( $info->forceHTTPS() );
 220
 221                 // User with bad token
 222                 $request = new \FauxRequest();
 223                 $request->setCookies( array(
 224                         'session' => $sessionId,
 225                         'xUserID' => $id,
 226                         'xToken' => 'BADTOKEN',
 227                 ), '' );
 228                 $info = $provider->provideSessionInfo( $request );
 229                 $this->assertNull( $info );
 230
 231                 // User id with no token
 232                 $request = new \FauxRequest();
 233                 $request->setCookies( array(
 234                         'session' => $sessionId,
 235                         'xUserID' => $id,
 236                 ), '' );
 237                 $info = $provider->provideSessionInfo( $request );
 238                 $this->assertNotNull( $info );
 239                 $this->assertSame( $params['priority'], $info->getPriority() );
 240                 $this->assertSame( $sessionId, $info->getId() );
 241                 $this->assertNotNull( $info->getUserInfo() );
 242                 $this->assertFalse( $info->getUserInfo()->isVerified() );
 243                 $this->assertSame( $id, $info->getUserInfo()->getId() );
 244                 $this->assertSame( $name, $info->getUserInfo()->getName() );
 245                 $this->assertFalse( $info->forceHTTPS() );
 246
 247                 $request = new \FauxRequest();
 248                 $request->setCookies( array(
 249                         'xUserID' => $id,
 250                 ), '' );
 251                 $info = $provider->provideSessionInfo( $request );
 252                 $this->assertNull( $info );
 253
 254                 // User and session key, with forceHTTPS flag
 255                 $request = new \FauxRequest();
 256                 $request->setCookies( array(
 257                         'session' => $sessionId,
 258                         'xUserID' => $id,
 259                         'xToken' => $token,
 260                         'forceHTTPS' => true,
 261                 ), '' );
 262                 $info = $provider->provideSessionInfo( $request );
 263                 $this->assertNotNull( $info );
 264                 $this->assertSame( $params['priority'], $info->getPriority() );
 265                 $this->assertSame( $sessionId, $info->getId() );
 266                 $this->assertNotNull( $info->getUserInfo() );
 267                 $this->assertSame( $id, $info->getUserInfo()->getId() );
 268                 $this->assertSame( $name, $info->getUserInfo()->getName() );
 269                 $this->assertTrue( $info->forceHTTPS() );
 270
 271                 // Invalid user id
 272                 $request = new \FauxRequest();
 273                 $request->setCookies( array(
 274                         'session' => $sessionId,
 275                         'xUserID' => '-1',
 276                 ), '' );
 277                 $info = $provider->provideSessionInfo( $request );
 278                 $this->assertNull( $info );
 279
 280                 // User id with matching name
 281                 $request = new \FauxRequest();
 282                 $request->setCookies( array(
 283                         'session' => $sessionId,
 284                         'xUserID' => $id,
 285                         'xUserName' => $name,
 286                 ), '' );
 287                 $info = $provider->provideSessionInfo( $request );
 288                 $this->assertNotNull( $info );
 289                 $this->assertSame( $params['priority'], $info->getPriority() );
 290                 $this->assertSame( $sessionId, $info->getId() );
 291                 $this->assertNotNull( $info->getUserInfo() );
 292                 $this->assertFalse( $info->getUserInfo()->isVerified() );
 293                 $this->assertSame( $id, $info->getUserInfo()->getId() );
 294                 $this->assertSame( $name, $info->getUserInfo()->getName() );
 295                 $this->assertFalse( $info->forceHTTPS() );
 296
 297                 // User id with wrong name
 298                 $request = new \FauxRequest();
 299                 $request->setCookies( array(
 300                         'session' => $sessionId,
 301                         'xUserID' => $id,
 302                         'xUserName' => 'Wrong',
 303                 ), '' );
 304                 $info = $provider->provideSessionInfo( $request );
 305                 $this->assertNull( $info );
 306         }
 307
 308         public function testGetVaryCookies() {
 309                 $provider = new CookieSessionProvider( array(
 310                         'priority' => 1,
 311                         'sessionName' => 'MySessionName',
 312                         'cookieOptions' => array( 'prefix' => 'MyCookiePrefix' ),
 313                 ) );
 314                 $this->assertArrayEquals( array(
 315                         'MyCookiePrefixToken',
 316                         'MyCookiePrefixLoggedOut',
 317                         'MySessionName',
 318                         'forceHTTPS',
 319                 ), $provider->getVaryCookies() );
 320         }
 321
 322         public function testSuggestLoginUsername() {
 323                 $provider = new CookieSessionProvider( array(
 324                         'priority' => 1,
 325                         'sessionName' => 'MySessionName',
 326                         'cookieOptions' => array( 'prefix' => 'x' ),
 327                 ) );
 328
 329                 $request = new \FauxRequest();
 330                 $this->assertEquals( null, $provider->suggestLoginUsername( $request ) );
 331
 332                 $request->setCookies( array(
 333                         'xUserName' => 'Example',
 334                 ), '' );
 335                 $this->assertEquals( 'Example', $provider->suggestLoginUsername( $request ) );
 336         }
 337
 338         public function testPersistSession() {
 339                 $this->setMwGlobals( array( 'wgCookieExpiration' => 100 ) );
 340
 341                 $provider = new CookieSessionProvider( array(
 342                         'priority' => 1,
 343                         'sessionName' => 'MySessionName',
 344                         'callUserSetCookiesHook' => false,
 345                         'cookieOptions' => array( 'prefix' => 'x' ),
 346                 ) );
 347                 $config = $this->getConfig();
 348                 $provider->setLogger( new \TestLogger() );
 349                 $provider->setConfig( $config );
 350                 $provider->setManager( SessionManager::singleton() );
 351
 352                 $sessionId = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 353                 $store = new \HashBagOStuff();
 354                 $user = User::newFromName( 'UTSysop' );
 355                 $anon = new User;
 356
 357                 $backend = new SessionBackend(
 358                         new SessionId( $sessionId ),
 359                         new SessionInfo( SessionInfo::MIN_PRIORITY, array(
 360                                 'provider' => $provider,
 361                                 'id' => $sessionId,
 362                                 'persisted' => true,
 363                                 'idIsSafe' => true,
 364                         ) ),
 365                         $store,
 366                         $store,
 367                         new \Psr\Log\NullLogger(),
 368                         10
 369                 );
 370                 \TestingAccessWrapper::newFromObject( $backend )->usePhpSessionHandling = false;
 371
 372                 $mock = $this->getMock( 'stdClass', array( 'onUserSetCookies' ) );
 373                 $mock->expects( $this->never() )->method( 'onUserSetCookies' );
 374                 $this->mergeMwGlobalArrayValue( 'wgHooks', array( 'UserSetCookies' => array( $mock ) ) );
 375
 376                 // Anonymous user
 377                 $backend->setUser( $anon );
 378                 $backend->setRememberUser( true );
 379                 $backend->setForceHTTPS( false );
 380                 $request = new \FauxRequest();
 381                 $provider->persistSession( $backend, $request );
 382                 $this->assertSame( $sessionId, $request->response()->getCookie( 'MySessionName' ) );
 383                 $this->assertSame( '', $request->response()->getCookie( 'xUserID' ) );
 384                 $this->assertSame( null, $request->response()->getCookie( 'xUserName' ) );
 385                 $this->assertSame( '', $request->response()->getCookie( 'xToken' ) );
 386                 $this->assertSame( '', $request->response()->getCookie( 'forceHTTPS' ) );
 387                 $this->assertSame( array(), $backend->getData() );
 388
 389                 // Logged-in user, no remember
 390                 $backend->setUser( $user );
 391                 $backend->setRememberUser( false );
 392                 $backend->setForceHTTPS( false );
 393                 $request = new \FauxRequest();
 394                 $provider->persistSession( $backend, $request );
 395                 $this->assertSame( $sessionId, $request->response()->getCookie( 'MySessionName' ) );
 396                 $this->assertSame( (string)$user->getId(), $request->response()->getCookie( 'xUserID' ) );
 397                 $this->assertSame( $user->getName(), $request->response()->getCookie( 'xUserName' ) );
 398                 $this->assertSame( '', $request->response()->getCookie( 'xToken' ) );
 399                 $this->assertSame( '', $request->response()->getCookie( 'forceHTTPS' ) );
 400                 $this->assertSame( array(), $backend->getData() );
 401
 402                 // Logged-in user, remember
 403                 $backend->setUser( $user );
 404                 $backend->setRememberUser( true );
 405                 $backend->setForceHTTPS( true );
 406                 $request = new \FauxRequest();
 407                 $time = time();
 408                 $provider->persistSession( $backend, $request );
 409                 $this->assertSame( $sessionId, $request->response()->getCookie( 'MySessionName' ) );
 410                 $this->assertSame( (string)$user->getId(), $request->response()->getCookie( 'xUserID' ) );
 411                 $this->assertSame( $user->getName(), $request->response()->getCookie( 'xUserName' ) );
 412                 $this->assertSame( $user->getToken(), $request->response()->getCookie( 'xToken' ) );
 413                 $this->assertSame( 'true', $request->response()->getCookie( 'forceHTTPS' ) );
 414                 $this->assertSame( array(), $backend->getData() );
 415         }
 416
 417         /**
 418          * @dataProvider provideCookieData
 419          * @param bool $secure
 420          * @param bool $remember
 421          */
 422         public function testCookieData( $secure, $remember ) {
 423                 $this->setMwGlobals( array(
 424                         'wgCookieExpiration' => 100,
 425                         'wgSecureLogin' => false,
 426                 ) );
 427
 428                 $provider = new CookieSessionProvider( array(
 429                         'priority' => 1,
 430                         'sessionName' => 'MySessionName',
 431                         'callUserSetCookiesHook' => false,
 432                         'cookieOptions' => array( 'prefix' => 'x' ),
 433                 ) );
 434                 $config = $this->getConfig();
 435                 $config->set( 'CookieSecure', $secure );
 436                 $provider->setLogger( new \TestLogger() );
 437                 $provider->setConfig( $config );
 438                 $provider->setManager( SessionManager::singleton() );
 439
 440                 $sessionId = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 441                 $user = User::newFromName( 'UTSysop' );
 442                 $this->assertFalse( $user->requiresHTTPS(), 'sanity check' );
 443
 444                 $backend = new SessionBackend(
 445                         new SessionId( $sessionId ),
 446                         new SessionInfo( SessionInfo::MIN_PRIORITY, array(
 447                                 'provider' => $provider,
 448                                 'id' => $sessionId,
 449                                 'persisted' => true,
 450                                 'idIsSafe' => true,
 451                         ) ),
 452                         new \EmptyBagOStuff(),
 453                         new \EmptyBagOStuff(),
 454                         new \Psr\Log\NullLogger(),
 455                         10
 456                 );
 457                 \TestingAccessWrapper::newFromObject( $backend )->usePhpSessionHandling = false;
 458                 $backend->setUser( $user );
 459                 $backend->setRememberUser( $remember );
 460                 $backend->setForceHTTPS( $secure );
 461                 $request = new \FauxRequest();
 462                 $time = time();
 463                 $provider->persistSession( $backend, $request );
 464
 465                 $defaults = array(
 466                         'expire' => (int)100,
 467                         'path' => $config->get( 'CookiePath' ),
 468                         'domain' => $config->get( 'CookieDomain' ),
 469                         'secure' => $secure,
 470                         'httpOnly' => $config->get( 'CookieHttpOnly' ),
 471                         'raw' => false,
 472                 );
 473                 $extendedExpiry = $config->get( 'ExtendedLoginCookieExpiration' );
 474                 $extendedExpiry = (int)( $extendedExpiry === null ? 0 : $extendedExpiry );
 475                 $this->assertEquals( array( 'UserID', 'Token' ), $config->get( 'ExtendedLoginCookies' ),
 476                         'sanity check' );
 477                 $expect = array(
 478                         'MySessionName' => array(
 479                                 'value' => (string)$sessionId,
 480                                 'expire' => 0,
 481                         ) + $defaults,
 482                         'xUserID' => array(
 483                                 'value' => (string)$user->getId(),
 484                                 'expire' => $extendedExpiry,
 485                         ) + $defaults,
 486                         'xUserName' => array(
 487                                 'value' => $user->getName(),
 488                         ) + $defaults,
 489                         'xToken' => array(
 490                                 'value' => $remember ? $user->getToken() : '',
 491                                 'expire' => $remember ? $extendedExpiry : -31536000,
 492                         ) + $defaults,
 493                         'forceHTTPS' => array(
 494                                 'value' => $secure ? 'true' : '',
 495                                 'secure' => false,
 496                                 'expire' => $secure ? $remember ? $defaults['expire'] : 0 : -31536000,
 497                         ) + $defaults,
 498                 );
 499                 foreach ( $expect as $key => $value ) {
 500                         $actual = $request->response()->getCookieData( $key );
 501                         if ( $actual && $actual['expire'] > 0 ) {
 502                                 // Round expiry so we don't randomly fail if the seconds ticked during the test.
 503                                 $actual['expire'] = round( $actual['expire'] - $time, -2 );
 504                         }
 505                         $this->assertEquals( $value, $actual, "Cookie $key" );
 506                 }
 507         }
 508
 509         public static function provideCookieData() {
 510                 return array(
 511                         array( false, false ),
 512                         array( false, true ),
 513                         array( true, false ),
 514                         array( true, true ),
 515                 );
 516         }
 517
 518         protected function getSentRequest() {
 519                 $sentResponse = $this->getMock( 'FauxResponse', array( 'headersSent', 'setCookie', 'header' ) );
 520                 $sentResponse->expects( $this->any() )->method( 'headersSent' )
 521                         ->will( $this->returnValue( true ) );
 522                 $sentResponse->expects( $this->never() )->method( 'setCookie' );
 523                 $sentResponse->expects( $this->never() )->method( 'header' );
 524
 525                 $sentRequest = $this->getMock( 'FauxRequest', array( 'response' ) );
 526                 $sentRequest->expects( $this->any() )->method( 'response' )
 527                         ->will( $this->returnValue( $sentResponse ) );
 528                 return $sentRequest;
 529         }
 530
 531         public function testPersistSessionWithHook() {
 532                 $that = $this;
 533
 534                 $provider = new CookieSessionProvider( array(
 535                         'priority' => 1,
 536                         'sessionName' => 'MySessionName',
 537                         'callUserSetCookiesHook' => true,
 538                         'cookieOptions' => array( 'prefix' => 'x' ),
 539                 ) );
 540                 $provider->setLogger( new \Psr\Log\NullLogger() );
 541                 $provider->setConfig( $this->getConfig() );
 542                 $provider->setManager( SessionManager::singleton() );
 543
 544                 $sessionId = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 545                 $store = new \HashBagOStuff();
 546                 $user = User::newFromName( 'UTSysop' );
 547                 $anon = new User;
 548
 549                 $backend = new SessionBackend(
 550                         new SessionId( $sessionId ),
 551                         new SessionInfo( SessionInfo::MIN_PRIORITY, array(
 552                                 'provider' => $provider,
 553                                 'id' => $sessionId,
 554                                 'persisted' => true,
 555                                 'idIsSafe' => true,
 556                         ) ),
 557                         $store,
 558                         $store,
 559                         new \Psr\Log\NullLogger(),
 560                         10
 561                 );
 562                 \TestingAccessWrapper::newFromObject( $backend )->usePhpSessionHandling = false;
 563
 564                 // Anonymous user
 565                 $mock = $this->getMock( 'stdClass', array( 'onUserSetCookies' ) );
 566                 $mock->expects( $this->never() )->method( 'onUserSetCookies' );
 567                 $this->mergeMwGlobalArrayValue( 'wgHooks', array( 'UserSetCookies' => array( $mock ) ) );
 568                 $backend->setUser( $anon );
 569                 $backend->setRememberUser( true );
 570                 $backend->setForceHTTPS( false );
 571                 $request = new \FauxRequest();
 572                 $provider->persistSession( $backend, $request );
 573                 $this->assertSame( $sessionId, $request->response()->getCookie( 'MySessionName' ) );
 574                 $this->assertSame( '', $request->response()->getCookie( 'xUserID' ) );
 575                 $this->assertSame( null, $request->response()->getCookie( 'xUserName' ) );
 576                 $this->assertSame( '', $request->response()->getCookie( 'xToken' ) );
 577                 $this->assertSame( '', $request->response()->getCookie( 'forceHTTPS' ) );
 578                 $this->assertSame( array(), $backend->getData() );
 579
 580                 $provider->persistSession( $backend, $this->getSentRequest() );
 581
 582                 // Logged-in user, no remember
 583                 $mock = $this->getMock( __CLASS__, array( 'onUserSetCookies' ) );
 584                 $mock->expects( $this->once() )->method( 'onUserSetCookies' )
 585                         ->will( $this->returnCallback( function ( $u, &$sessionData, &$cookies ) use ( $that, $user ) {
 586                                 $that->assertSame( $user, $u );
 587                                 $that->assertEquals( array(
 588                                         'wsUserID' => $user->getId(),
 589                                         'wsUserName' => $user->getName(),
 590                                         'wsToken' => $user->getToken(),
 591                                 ), $sessionData );
 592                                 $that->assertEquals( array(
 593                                         'UserID' => $user->getId(),
 594                                         'UserName' => $user->getName(),
 595                                         'Token' => false,
 596                                 ), $cookies );
 597
 598                                 $sessionData['foo'] = 'foo!';
 599                                 $cookies['bar'] = 'bar!';
 600                                 return true;
 601                         } ) );
 602                 $this->mergeMwGlobalArrayValue( 'wgHooks', array( 'UserSetCookies' => array( $mock ) ) );
 603                 $backend->setUser( $user );
 604                 $backend->setRememberUser( false );
 605                 $backend->setForceHTTPS( false );
 606                 $backend->setLoggedOutTimestamp( $loggedOut = time() );
 607                 $request = new \FauxRequest();
 608                 $provider->persistSession( $backend, $request );
 609                 $this->assertSame( $sessionId, $request->response()->getCookie( 'MySessionName' ) );
 610                 $this->assertSame( (string)$user->getId(), $request->response()->getCookie( 'xUserID' ) );
 611                 $this->assertSame( $user->getName(), $request->response()->getCookie( 'xUserName' ) );
 612                 $this->assertSame( '', $request->response()->getCookie( 'xToken' ) );
 613                 $this->assertSame( '', $request->response()->getCookie( 'forceHTTPS' ) );
 614                 $this->assertSame( 'bar!', $request->response()->getCookie( 'xbar' ) );
 615                 $this->assertSame( (string)$loggedOut, $request->response()->getCookie( 'xLoggedOut' ) );
 616                 $this->assertEquals( array(
 617                         'wsUserID' => $user->getId(),
 618                         'wsUserName' => $user->getName(),
 619                         'wsToken' => $user->getToken(),
 620                         'foo' => 'foo!',
 621                 ), $backend->getData() );
 622
 623                 $provider->persistSession( $backend, $this->getSentRequest() );
 624
 625                 // Logged-in user, remember
 626                 $mock = $this->getMock( __CLASS__, array( 'onUserSetCookies' ) );
 627                 $mock->expects( $this->once() )->method( 'onUserSetCookies' )
 628                         ->will( $this->returnCallback( function ( $u, &$sessionData, &$cookies ) use ( $that, $user ) {
 629                                 $that->assertSame( $user, $u );
 630                                 $that->assertEquals( array(
 631                                         'wsUserID' => $user->getId(),
 632                                         'wsUserName' => $user->getName(),
 633                                         'wsToken' => $user->getToken(),
 634                                 ), $sessionData );
 635                                 $that->assertEquals( array(
 636                                         'UserID' => $user->getId(),
 637                                         'UserName' => $user->getName(),
 638                                         'Token' => $user->getToken(),
 639                                 ), $cookies );
 640
 641                                 $sessionData['foo'] = 'foo 2!';
 642                                 $cookies['bar'] = 'bar 2!';
 643                                 return true;
 644                         } ) );
 645                 $this->mergeMwGlobalArrayValue( 'wgHooks', array( 'UserSetCookies' => array( $mock ) ) );
 646                 $backend->setUser( $user );
 647                 $backend->setRememberUser( true );
 648                 $backend->setForceHTTPS( true );
 649                 $backend->setLoggedOutTimestamp( 0 );
 650                 $request = new \FauxRequest();
 651                 $provider->persistSession( $backend, $request );
 652                 $this->assertSame( $sessionId, $request->response()->getCookie( 'MySessionName' ) );
 653                 $this->assertSame( (string)$user->getId(), $request->response()->getCookie( 'xUserID' ) );
 654                 $this->assertSame( $user->getName(), $request->response()->getCookie( 'xUserName' ) );
 655                 $this->assertSame( $user->getToken(), $request->response()->getCookie( 'xToken' ) );
 656                 $this->assertSame( 'true', $request->response()->getCookie( 'forceHTTPS' ) );
 657                 $this->assertSame( 'bar 2!', $request->response()->getCookie( 'xbar' ) );
 658                 $this->assertSame( null, $request->response()->getCookie( 'xLoggedOut' ) );
 659                 $this->assertEquals( array(
 660                         'wsUserID' => $user->getId(),
 661                         'wsUserName' => $user->getName(),
 662                         'wsToken' => $user->getToken(),
 663                         'foo' => 'foo 2!',
 664                 ), $backend->getData() );
 665
 666                 $provider->persistSession( $backend, $this->getSentRequest() );
 667         }
 668
 669         public function testUnpersistSession() {
 670                 $provider = new CookieSessionProvider( array(
 671                         'priority' => 1,
 672                         'sessionName' => 'MySessionName',
 673                         'cookieOptions' => array( 'prefix' => 'x' ),
 674                 ) );
 675                 $provider->setLogger( new \Psr\Log\NullLogger() );
 676                 $provider->setConfig( $this->getConfig() );
 677                 $provider->setManager( SessionManager::singleton() );
 678
 679                 $request = new \FauxRequest();
 680                 $provider->unpersistSession( $request );
 681                 $this->assertSame( '', $request->response()->getCookie( 'MySessionName' ) );
 682                 $this->assertSame( '', $request->response()->getCookie( 'xUserID' ) );
 683                 $this->assertSame( null, $request->response()->getCookie( 'xUserName' ) );
 684                 $this->assertSame( '', $request->response()->getCookie( 'xToken' ) );
 685                 $this->assertSame( '', $request->response()->getCookie( 'forceHTTPS' ) );
 686
 687                 $provider->unpersistSession( $this->getSentRequest() );
 688         }
 689
 690         public function testSetLoggedOutCookie() {
 691                 $provider = \TestingAccessWrapper::newFromObject( new CookieSessionProvider( array(
 692                         'priority' => 1,
 693                         'sessionName' => 'MySessionName',
 694                         'cookieOptions' => array( 'prefix' => 'x' ),
 695                 ) ) );
 696                 $provider->setLogger( new \Psr\Log\NullLogger() );
 697                 $provider->setConfig( $this->getConfig() );
 698                 $provider->setManager( SessionManager::singleton() );
 699
 700                 $t1 = time();
 701                 $t2 = time() - 86400 * 2;
 702
 703                 // Set it
 704                 $request = new \FauxRequest();
 705                 $provider->setLoggedOutCookie( $t1, $request );
 706                 $this->assertSame( (string)$t1, $request->response()->getCookie( 'xLoggedOut' ) );
 707
 708                 // Too old
 709                 $request = new \FauxRequest();
 710                 $provider->setLoggedOutCookie( $t2, $request );
 711                 $this->assertSame( null, $request->response()->getCookie( 'xLoggedOut' ) );
 712
 713                 // Don't reset if it's already set
 714                 $request = new \FauxRequest();
 715                 $request->setCookies( array(
 716                         'xLoggedOut' => $t1,
 717                 ), '' );
 718                 $provider->setLoggedOutCookie( $t1, $request );
 719                 $this->assertSame( null, $request->response()->getCookie( 'xLoggedOut' ) );
 720         }
 721
 722         /**
 723          * To be mocked for hooks, since PHPUnit can't otherwise mock methods that
 724          * take references.
 725          */
 726         public function onUserSetCookies( $user, &$sessionData, &$cookies ) {
 727         }
 728
 729 }