diff --git a/core/modules/rest/lib/Drupal/rest/Tests/AuthTest.php b/core/modules/rest/lib/Drupal/rest/Tests/AuthTest.php index 316fcd5..df91419 100644 --- a/core/modules/rest/lib/Drupal/rest/Tests/AuthTest.php +++ b/core/modules/rest/lib/Drupal/rest/Tests/AuthTest.php @@ -24,7 +24,7 @@ class AuthTest extends RESTTestBase { public static function getInfo() { return array( 'name' => 'Resource authentication', - 'description' => 'Tests access to authenticated resources.', + 'description' => 'Tests authentication provider restrictions.', 'group' => 'REST', ); } @@ -33,37 +33,37 @@ public static function getInfo() { * Tests reading from an authenticated resource. */ public function testRead() { - // Define the entity types we want to test. - $entity_types = array('entity_test'); - foreach ($entity_types as $entity_type) { - $this->enableService('entity:' . $entity_type, 'GET', NULL, array('http_basic')); - - // Create an entity programmatically. - $entity = $this->entityCreate($entity_type); - $entity->save(); - - // Try to read the resource as an anonymous user, which should not work. - $response = $this->httpRequest('entity/' . $entity_type . '/' . $entity->id(), 'GET', NULL, $this->defaultMimeType); - $this->assertResponse('401', 'HTTP response code is 401 when the request is not authenticated and the user is anonymous.'); - $this->assertText(t('A fatal error occurred: No authentication credentials provided.')); - - // Create a user account that has the required permissions to read - // resources via the REST API, but the request is not authenticated. - $permissions = $this->entityPermissions($entity_type, 'view'); - $permissions[] = 'restful get entity:' . $entity_type; - $account = $this->drupalCreateUser($permissions); - $this->drupalLogin($account); - - // Try to read the resource with session cookie authentication, which is - // not enabled and should not work. - $response = $this->httpRequest('entity/' . $entity_type . '/' . $entity->id(), 'GET', NULL, $this->defaultMimeType); - $this->assertResponse('403', 'HTTP response code is 403 when the request is not authenticated.'); - - // Now read it with the Basic authentication which is enabled and should - // work. - $response = $this->basicAuthGet('entity/' . $entity_type . '/' . $entity->id(), $account->getUsername(), $account->pass_raw); - $this->assertResponse('200', 'HTTP response code is 200 for successfuly authenticated requests.'); - } + $entity_type = 'entity_test'; + + // Enable a test resource through GET method and basic HTTP authentication. + $this->enableService('entity:' . $entity_type, 'GET', NULL, array('http_basic')); + + // Create an entity programmatically. + $entity = $this->entityCreate($entity_type); + $entity->save(); + + // Try to read the resource as an anonymous user, which should not work. + $response = $this->httpRequest('entity/' . $entity_type . '/' . $entity->id(), 'GET', NULL, $this->defaultMimeType); + $this->assertResponse('401', 'HTTP response code is 401 when the request is not authenticated and the user is anonymous.'); + $this->assertText(t('A fatal error occurred: No authentication credentials provided.')); + + // Create a user account that has the required permissions to read + // resources via the REST API, but the request is authenticated + // with session cookies. + $permissions = $this->entityPermissions($entity_type, 'view'); + $permissions[] = 'restful get entity:' . $entity_type; + $account = $this->drupalCreateUser($permissions); + $this->drupalLogin($account); + + // Try to read the resource with session cookie authentication, which is + // not enabled and should not work. + $response = $this->httpRequest('entity/' . $entity_type . '/' . $entity->id(), 'GET', NULL, $this->defaultMimeType); + $this->assertResponse('403', 'HTTP response code is 403 when the request is not authenticated.'); + + // Now read it with the Basic authentication which is enabled and should + // work. + $response = $this->basicAuthGet('entity/' . $entity_type . '/' . $entity->id(), $account->getUsername(), $account->pass_raw); + $this->assertResponse('200', 'HTTP response code is 200 for successfuly authenticated requests.'); } /**