tests/phpunit/includes/user/BotPasswordTest.php

   1 <?php
   2
   3 use MediaWiki\MediaWikiServices;
   4 use MediaWiki\Session\SessionManager;
   5 use Wikimedia\ScopedCallback;
   6 use Wikimedia\TestingAccessWrapper;
   7
   8 /**
   9  * @covers BotPassword
  10  * @group Database
  11  */
  12 class BotPasswordTest extends MediaWikiTestCase {
  13
  14         /** @var TestUser */
  15         private $testUser;
  16
  17         /** @var string */
  18         private $testUserName;
  19
  20         protected function setUp() {
  21                 parent::setUp();
  22
  23                 $this->setMwGlobals( [
  24                         'wgEnableBotPasswords' => true,
  25                         'wgBotPasswordsDatabase' => false,
  26                         'wgCentralIdLookupProvider' => 'BotPasswordTest OkMock',
  27                         'wgGrantPermissions' => [
  28                                 'test' => [ 'read' => true ],
  29                         ],
  30                         'wgUserrightsInterwikiDelimiter' => '@',
  31                 ] );
  32
  33                 $this->testUser = $this->getMutableTestUser();
  34                 $this->testUserName = $this->testUser->getUser()->getName();
  35
  36                 $mock1 = $this->getMockForAbstractClass( CentralIdLookup::class );
  37                 $mock1->expects( $this->any() )->method( 'isAttached' )
  38                         ->will( $this->returnValue( true ) );
  39                 $mock1->expects( $this->any() )->method( 'lookupUserNames' )
  40                         ->will( $this->returnValue( [ $this->testUserName => 42, 'UTDummy' => 43, 'UTInvalid' => 0 ] ) );
  41                 $mock1->expects( $this->never() )->method( 'lookupCentralIds' );
  42
  43                 $mock2 = $this->getMockForAbstractClass( CentralIdLookup::class );
  44                 $mock2->expects( $this->any() )->method( 'isAttached' )
  45                         ->will( $this->returnValue( false ) );
  46                 $mock2->expects( $this->any() )->method( 'lookupUserNames' )
  47                         ->will( $this->returnArgument( 0 ) );
  48                 $mock2->expects( $this->never() )->method( 'lookupCentralIds' );
  49
  50                 $this->mergeMwGlobalArrayValue( 'wgCentralIdLookupProviders', [
  51                         'BotPasswordTest OkMock' => [ 'factory' => function () use ( $mock1 ) {
  52                                 return $mock1;
  53                         } ],
  54                         'BotPasswordTest FailMock' => [ 'factory' => function () use ( $mock2 ) {
  55                                 return $mock2;
  56                         } ],
  57                 ] );
  58
  59                 CentralIdLookup::resetCache();
  60         }
  61
  62         public function addDBData() {
  63                 $passwordFactory = MediaWikiServices::getInstance()->getPasswordFactory();
  64                 $passwordHash = $passwordFactory->newFromPlaintext( 'foobaz' );
  65
  66                 $dbw = wfGetDB( DB_MASTER );
  67                 $dbw->delete(
  68                         'bot_passwords',
  69                         [ 'bp_user' => [ 42, 43 ], 'bp_app_id' => 'BotPassword' ],
  70                         __METHOD__
  71                 );
  72                 $dbw->insert(
  73                         'bot_passwords',
  74                         [
  75                                 [
  76                                         'bp_user' => 42,
  77                                         'bp_app_id' => 'BotPassword',
  78                                         'bp_password' => $passwordHash->toString(),
  79                                         'bp_token' => 'token!',
  80                                         'bp_restrictions' => '{"IPAddresses":["127.0.0.0/8"]}',
  81                                         'bp_grants' => '["test"]',
  82                                 ],
  83                                 [
  84                                         'bp_user' => 43,
  85                                         'bp_app_id' => 'BotPassword',
  86                                         'bp_password' => $passwordHash->toString(),
  87                                         'bp_token' => 'token!',
  88                                         'bp_restrictions' => '{"IPAddresses":["127.0.0.0/8"]}',
  89                                         'bp_grants' => '["test"]',
  90                                 ],
  91                         ],
  92                         __METHOD__
  93                 );
  94         }
  95
  96         public function testBasics() {
  97                 $user = $this->testUser->getUser();
  98                 $bp = BotPassword::newFromUser( $user, 'BotPassword' );
  99                 $this->assertInstanceOf( BotPassword::class, $bp );
 100                 $this->assertTrue( $bp->isSaved() );
 101                 $this->assertSame( 42, $bp->getUserCentralId() );
 102                 $this->assertSame( 'BotPassword', $bp->getAppId() );
 103                 $this->assertSame( 'token!', trim( $bp->getToken(), " \0" ) );
 104                 $this->assertEquals( '{"IPAddresses":["127.0.0.0/8"]}', $bp->getRestrictions()->toJson() );
 105                 $this->assertSame( [ 'test' ], $bp->getGrants() );
 106
 107                 $this->assertNull( BotPassword::newFromUser( $user, 'DoesNotExist' ) );
 108
 109                 $this->setMwGlobals( [
 110                         'wgCentralIdLookupProvider' => 'BotPasswordTest FailMock'
 111                 ] );
 112                 $this->assertNull( BotPassword::newFromUser( $user, 'BotPassword' ) );
 113
 114                 $this->assertSame( '@', BotPassword::getSeparator() );
 115                 $this->setMwGlobals( [
 116                         'wgUserrightsInterwikiDelimiter' => '#',
 117                 ] );
 118                 $this->assertSame( '#', BotPassword::getSeparator() );
 119         }
 120
 121         public function testUnsaved() {
 122                 $user = $this->testUser->getUser();
 123                 $bp = BotPassword::newUnsaved( [
 124                         'user' => $user,
 125                         'appId' => 'DoesNotExist'
 126                 ] );
 127                 $this->assertInstanceOf( BotPassword::class, $bp );
 128                 $this->assertFalse( $bp->isSaved() );
 129                 $this->assertSame( 42, $bp->getUserCentralId() );
 130                 $this->assertSame( 'DoesNotExist', $bp->getAppId() );
 131                 $this->assertEquals( MWRestrictions::newDefault(), $bp->getRestrictions() );
 132                 $this->assertSame( [], $bp->getGrants() );
 133
 134                 $bp = BotPassword::newUnsaved( [
 135                         'username' => 'UTDummy',
 136                         'appId' => 'DoesNotExist2',
 137                         'restrictions' => MWRestrictions::newFromJson( '{"IPAddresses":["127.0.0.0/8"]}' ),
 138                         'grants' => [ 'test' ],
 139                 ] );
 140                 $this->assertInstanceOf( BotPassword::class, $bp );
 141                 $this->assertFalse( $bp->isSaved() );
 142                 $this->assertSame( 43, $bp->getUserCentralId() );
 143                 $this->assertSame( 'DoesNotExist2', $bp->getAppId() );
 144                 $this->assertEquals( '{"IPAddresses":["127.0.0.0/8"]}', $bp->getRestrictions()->toJson() );
 145                 $this->assertSame( [ 'test' ], $bp->getGrants() );
 146
 147                 $user = $this->testUser->getUser();
 148                 $bp = BotPassword::newUnsaved( [
 149                         'centralId' => 45,
 150                         'appId' => 'DoesNotExist'
 151                 ] );
 152                 $this->assertInstanceOf( BotPassword::class, $bp );
 153                 $this->assertFalse( $bp->isSaved() );
 154                 $this->assertSame( 45, $bp->getUserCentralId() );
 155                 $this->assertSame( 'DoesNotExist', $bp->getAppId() );
 156
 157                 $user = $this->testUser->getUser();
 158                 $bp = BotPassword::newUnsaved( [
 159                         'user' => $user,
 160                         'appId' => 'BotPassword'
 161                 ] );
 162                 $this->assertInstanceOf( BotPassword::class, $bp );
 163                 $this->assertFalse( $bp->isSaved() );
 164
 165                 $this->assertNull( BotPassword::newUnsaved( [
 166                         'user' => $user,
 167                         'appId' => '',
 168                 ] ) );
 169                 $this->assertNull( BotPassword::newUnsaved( [
 170                         'user' => $user,
 171                         'appId' => str_repeat( 'X', BotPassword::APPID_MAXLENGTH + 1 ),
 172                 ] ) );
 173                 $this->assertNull( BotPassword::newUnsaved( [
 174                         'user' => $this->testUserName,
 175                         'appId' => 'Ok',
 176                 ] ) );
 177                 $this->assertNull( BotPassword::newUnsaved( [
 178                         'username' => 'UTInvalid',
 179                         'appId' => 'Ok',
 180                 ] ) );
 181                 $this->assertNull( BotPassword::newUnsaved( [
 182                         'appId' => 'Ok',
 183                 ] ) );
 184         }
 185
 186         public function testGetPassword() {
 187                 /** @var BotPassword $bp */
 188                 $bp = TestingAccessWrapper::newFromObject( BotPassword::newFromCentralId( 42, 'BotPassword' ) );
 189
 190                 $password = $bp->getPassword();
 191                 $this->assertInstanceOf( Password::class, $password );
 192                 $this->assertTrue( $password->verify( 'foobaz' ) );
 193
 194                 $bp->centralId = 44;
 195                 $password = $bp->getPassword();
 196                 $this->assertInstanceOf( InvalidPassword::class, $password );
 197
 198                 $bp = TestingAccessWrapper::newFromObject( BotPassword::newFromCentralId( 42, 'BotPassword' ) );
 199                 $dbw = wfGetDB( DB_MASTER );
 200                 $dbw->update(
 201                         'bot_passwords',
 202                         [ 'bp_password' => 'garbage' ],
 203                         [ 'bp_user' => 42, 'bp_app_id' => 'BotPassword' ],
 204                         __METHOD__
 205                 );
 206                 $password = $bp->getPassword();
 207                 $this->assertInstanceOf( InvalidPassword::class, $password );
 208         }
 209
 210         public function testInvalidateAllPasswordsForUser() {
 211                 $bp1 = TestingAccessWrapper::newFromObject( BotPassword::newFromCentralId( 42, 'BotPassword' ) );
 212                 $bp2 = TestingAccessWrapper::newFromObject( BotPassword::newFromCentralId( 43, 'BotPassword' ) );
 213
 214                 $this->assertNotInstanceOf( InvalidPassword::class, $bp1->getPassword(), 'sanity check' );
 215                 $this->assertNotInstanceOf( InvalidPassword::class, $bp2->getPassword(), 'sanity check' );
 216                 BotPassword::invalidateAllPasswordsForUser( $this->testUserName );
 217                 $this->assertInstanceOf( InvalidPassword::class, $bp1->getPassword() );
 218                 $this->assertNotInstanceOf( InvalidPassword::class, $bp2->getPassword() );
 219
 220                 $bp = TestingAccessWrapper::newFromObject( BotPassword::newFromCentralId( 42, 'BotPassword' ) );
 221                 $this->assertInstanceOf( InvalidPassword::class, $bp->getPassword() );
 222         }
 223
 224         public function testRemoveAllPasswordsForUser() {
 225                 $this->assertNotNull( BotPassword::newFromCentralId( 42, 'BotPassword' ), 'sanity check' );
 226                 $this->assertNotNull( BotPassword::newFromCentralId( 43, 'BotPassword' ), 'sanity check' );
 227
 228                 BotPassword::removeAllPasswordsForUser( $this->testUserName );
 229
 230                 $this->assertNull( BotPassword::newFromCentralId( 42, 'BotPassword' ) );
 231                 $this->assertNotNull( BotPassword::newFromCentralId( 43, 'BotPassword' ) );
 232         }
 233
 234         /**
 235          * @dataProvider provideCanonicalizeLoginData
 236          */
 237         public function testCanonicalizeLoginData( $username, $password, $expectedResult ) {
 238                 $result = BotPassword::canonicalizeLoginData( $username, $password );
 239                 if ( is_array( $expectedResult ) ) {
 240                         $this->assertArrayEquals( $expectedResult, $result, true, true );
 241                 } else {
 242                         $this->assertSame( $expectedResult, $result );
 243                 }
 244         }
 245
 246         public function provideCanonicalizeLoginData() {
 247                 return [
 248                         [ 'user', 'pass', false ],
 249                         [ 'user', 'abc@def', false ],
 250                         [ 'legacy@user', 'pass', false ],
 251                         [ 'user@bot', '12345678901234567890123456789012',
 252                                 [ 'user@bot', '12345678901234567890123456789012' ] ],
 253                         [ 'user', 'bot@12345678901234567890123456789012',
 254                                 [ 'user@bot', '12345678901234567890123456789012' ] ],
 255                         [ 'user', 'bot@12345678901234567890123456789012345',
 256                                 [ 'user@bot', '12345678901234567890123456789012345' ] ],
 257                         [ 'user', 'bot@x@12345678901234567890123456789012',
 258                                 [ 'user@bot@x', '12345678901234567890123456789012' ] ],
 259                 ];
 260         }
 261
 262         public function testLogin() {
 263                 // Test failure when bot passwords aren't enabled
 264                 $this->setMwGlobals( 'wgEnableBotPasswords', false );
 265                 $status = BotPassword::login( "{$this->testUserName}@BotPassword", 'foobaz', new FauxRequest );
 266                 $this->assertEquals( Status::newFatal( 'botpasswords-disabled' ), $status );
 267                 $this->setMwGlobals( 'wgEnableBotPasswords', true );
 268
 269                 // Test failure when BotPasswordSessionProvider isn't configured
 270                 $manager = new SessionManager( [
 271                         'logger' => new Psr\Log\NullLogger,
 272                         'store' => new EmptyBagOStuff,
 273                 ] );
 274                 $reset = MediaWiki\Session\TestUtils::setSessionManagerSingleton( $manager );
 275                 $this->assertNull(
 276                         $manager->getProvider( MediaWiki\Session\BotPasswordSessionProvider::class ),
 277                         'sanity check'
 278                 );
 279                 $status = BotPassword::login( "{$this->testUserName}@BotPassword", 'foobaz', new FauxRequest );
 280                 $this->assertEquals( Status::newFatal( 'botpasswords-no-provider' ), $status );
 281                 ScopedCallback::consume( $reset );
 282
 283                 // Now configure BotPasswordSessionProvider for further tests...
 284                 $mainConfig = RequestContext::getMain()->getConfig();
 285                 $config = new HashConfig( [
 286                         'SessionProviders' => $mainConfig->get( 'SessionProviders' ) + [
 287                                 MediaWiki\Session\BotPasswordSessionProvider::class => [
 288                                         'class' => MediaWiki\Session\BotPasswordSessionProvider::class,
 289                                         'args' => [ [ 'priority' => 40 ] ],
 290                                 ]
 291                         ],
 292                 ] );
 293                 $manager = new SessionManager( [
 294                         'config' => new MultiConfig( [ $config, RequestContext::getMain()->getConfig() ] ),
 295                         'logger' => new Psr\Log\NullLogger,
 296                         'store' => new EmptyBagOStuff,
 297                 ] );
 298                 $reset = MediaWiki\Session\TestUtils::setSessionManagerSingleton( $manager );
 299
 300                 // No "@"-thing in the username
 301                 $status = BotPassword::login( $this->testUserName, 'foobaz', new FauxRequest );
 302                 $this->assertEquals( Status::newFatal( 'botpasswords-invalid-name', '@' ), $status );
 303
 304                 // No base user
 305                 $status = BotPassword::login( 'UTDummy@BotPassword', 'foobaz', new FauxRequest );
 306                 $this->assertEquals( Status::newFatal( 'nosuchuser', 'UTDummy' ), $status );
 307
 308                 // No bot password
 309                 $status = BotPassword::login( "{$this->testUserName}@DoesNotExist", 'foobaz', new FauxRequest );
 310                 $this->assertEquals(
 311                         Status::newFatal( 'botpasswords-not-exist', $this->testUserName, 'DoesNotExist' ),
 312                         $status
 313                 );
 314
 315                 // Failed restriction
 316                 $request = $this->getMockBuilder( FauxRequest::class )
 317                         ->setMethods( [ 'getIP' ] )
 318                         ->getMock();
 319                 $request->expects( $this->any() )->method( 'getIP' )
 320                         ->will( $this->returnValue( '10.0.0.1' ) );
 321                 $status = BotPassword::login( "{$this->testUserName}@BotPassword", 'foobaz', $request );
 322                 $this->assertEquals( Status::newFatal( 'botpasswords-restriction-failed' ), $status );
 323
 324                 // Wrong password
 325                 $status = BotPassword::login(
 326                         "{$this->testUserName}@BotPassword", $this->testUser->getPassword(), new FauxRequest );
 327                 $this->assertEquals( Status::newFatal( 'wrongpassword' ), $status );
 328
 329                 // Success!
 330                 $request = new FauxRequest;
 331                 $this->assertNotInstanceOf(
 332                         MediaWiki\Session\BotPasswordSessionProvider::class,
 333                         $request->getSession()->getProvider(),
 334                         'sanity check'
 335                 );
 336                 $status = BotPassword::login( "{$this->testUserName}@BotPassword", 'foobaz', $request );
 337                 $this->assertInstanceOf( Status::class, $status );
 338                 $this->assertTrue( $status->isGood() );
 339                 $session = $status->getValue();
 340                 $this->assertInstanceOf( MediaWiki\Session\Session::class, $session );
 341                 $this->assertInstanceOf(
 342                         MediaWiki\Session\BotPasswordSessionProvider::class, $session->getProvider()
 343                 );
 344                 $this->assertSame( $session->getId(), $request->getSession()->getId() );
 345
 346                 ScopedCallback::consume( $reset );
 347         }
 348
 349         /**
 350          * @dataProvider provideSave
 351          * @param string|null $password
 352          */
 353         public function testSave( $password ) {
 354                 $passwordFactory = MediaWikiServices::getInstance()->getPasswordFactory();
 355
 356                 $bp = BotPassword::newUnsaved( [
 357                         'centralId' => 42,
 358                         'appId' => 'TestSave',
 359                         'restrictions' => MWRestrictions::newFromJson( '{"IPAddresses":["127.0.0.0/8"]}' ),
 360                         'grants' => [ 'test' ],
 361                 ] );
 362                 $this->assertFalse( $bp->isSaved(), 'sanity check' );
 363                 $this->assertNull(
 364                         BotPassword::newFromCentralId( 42, 'TestSave', BotPassword::READ_LATEST ), 'sanity check'
 365                 );
 366
 367                 $passwordHash = $password ? $passwordFactory->newFromPlaintext( $password ) : null;
 368                 $this->assertFalse( $bp->save( 'update', $passwordHash ) );
 369                 $this->assertTrue( $bp->save( 'insert', $passwordHash ) );
 370                 $bp2 = BotPassword::newFromCentralId( 42, 'TestSave', BotPassword::READ_LATEST );
 371                 $this->assertInstanceOf( BotPassword::class, $bp2 );
 372                 $this->assertEquals( $bp->getUserCentralId(), $bp2->getUserCentralId() );
 373                 $this->assertEquals( $bp->getAppId(), $bp2->getAppId() );
 374                 $this->assertEquals( $bp->getToken(), $bp2->getToken() );
 375                 $this->assertEquals( $bp->getRestrictions(), $bp2->getRestrictions() );
 376                 $this->assertEquals( $bp->getGrants(), $bp2->getGrants() );
 377                 /** @var Password $pw */
 378                 $pw = TestingAccessWrapper::newFromObject( $bp )->getPassword();
 379                 if ( $password === null ) {
 380                         $this->assertInstanceOf( InvalidPassword::class, $pw );
 381                 } else {
 382                         $this->assertTrue( $pw->verify( $password ) );
 383                 }
 384
 385                 $token = $bp->getToken();
 386                 $this->assertEquals( 42, $bp->getUserCentralId() );
 387                 $this->assertEquals( 'TestSave', $bp->getAppId() );
 388                 $this->assertFalse( $bp->save( 'insert' ) );
 389                 $this->assertTrue( $bp->save( 'update' ) );
 390                 $this->assertNotEquals( $token, $bp->getToken() );
 391                 $bp2 = BotPassword::newFromCentralId( 42, 'TestSave', BotPassword::READ_LATEST );
 392                 $this->assertInstanceOf( BotPassword::class, $bp2 );
 393                 $this->assertEquals( $bp->getToken(), $bp2->getToken() );
 394                 /** @var Password $pw */
 395                 $pw = TestingAccessWrapper::newFromObject( $bp )->getPassword();
 396                 if ( $password === null ) {
 397                         $this->assertInstanceOf( InvalidPassword::class, $pw );
 398                 } else {
 399                         $this->assertTrue( $pw->verify( $password ) );
 400                 }
 401
 402                 $passwordHash = $passwordFactory->newFromPlaintext( 'XXX' );
 403                 $token = $bp->getToken();
 404                 $this->assertTrue( $bp->save( 'update', $passwordHash ) );
 405                 $this->assertNotEquals( $token, $bp->getToken() );
 406                 /** @var Password $pw */
 407                 $pw = TestingAccessWrapper::newFromObject( $bp )->getPassword();
 408                 $this->assertTrue( $pw->verify( 'XXX' ) );
 409
 410                 $this->assertTrue( $bp->delete() );
 411                 $this->assertFalse( $bp->isSaved() );
 412                 $this->assertNull( BotPassword::newFromCentralId( 42, 'TestSave', BotPassword::READ_LATEST ) );
 413
 414                 $this->assertFalse( $bp->save( 'foobar' ) );
 415         }
 416
 417         public static function provideSave() {
 418                 return [
 419                         [ null ],
 420                         [ 'foobar' ],
 421                 ];
 422         }
 423 }