From 93ed1bbd295ebce92b98797f172133be9d59ee4a Mon Sep 17 00:00:00 2001 From: Justin Winter Date: Thu, 7 Dec 2017 11:07:20 -0500 Subject: [PATCH] refactored a bit # Conflicts: # core/modules/user/tests/src/Functional/RestRegisterUserTest.php # Conflicts: # core/modules/user/tests/src/Functional/RestRegisterUserTest.php --- .../tests/src/Functional/RestRegisterUserTest.php | 321 +++++++++++++++++++++ 1 file changed, 321 insertions(+) create mode 100644 core/modules/user/tests/src/Functional/RestRegisterUserTest.php diff --git a/core/modules/user/tests/src/Functional/RestRegisterUserTest.php b/core/modules/user/tests/src/Functional/RestRegisterUserTest.php new file mode 100644 index 0000000000..0a9c157aa9 --- /dev/null +++ b/core/modules/user/tests/src/Functional/RestRegisterUserTest.php @@ -0,0 +1,321 @@ +provisionResource([static::$format], $auth); + + $this->setUpAuthorization('POST'); + } + + /** + * Tests that only anonymous users can register users. + */ + public function testRegisterUser() { + + $config = $this->config('user.settings'); + + // Test out different setting User Registration and Email Verification. + // Allow visitors to register with no email verification. + $config->set('register', USER_REGISTER_VISITORS); + $config->set('verify_mail', 0); + $config->save(); + $user = $this->registerUser('Palmer.Eldritch'); + $this->assertFalse($user->isBlocked()); + $this->assertFalse(empty($user->getPassword())); + $email_count = count($this->drupalGetMails()); + + $this->assertEquals($email_count, 0); + + // Attempt to register without sending a password. + $response = $this->registerRequest('Rick.Deckard', FALSE); + $this->assertResourceErrorResponse(422, "No password provided.", $response); + + // Attempt to register with a password when e-mail verification is on. + $config->set('register', USER_REGISTER_VISITORS); + $config->set('verify_mail', 1); + $config->save(); + $response = $this->registerRequest('Estraven', TRUE); + $this->assertResourceErrorResponse(422, 'A Password cannot be specified. It will be generated on login.', $response); + + // Allow visitors to register with email verification. + $config->set('register', USER_REGISTER_VISITORS); + $config->set('verify_mail', 1); + $config->save(); + $name = 'Jason.Taverner'; + $email = $name . self::USER_EMAIL_DOMAIN; + $user = $this->registerUser($name, FALSE); + $this->assertTrue(empty($user->getPassword())); + $this->assertTrue($user->isBlocked()); + + // TODO: The following fails in assert mail trait so F IT, we'll do it live #GROSS + // $captured_emails = $this->container->get('state')->get('system.test_mail_collector', []); + // $this->assertMailString('body', 'You may now log in by clicking this link', 1); + $assertion = "You may now log in by clicking this link"; + $mail_body = $this->getMailBody($assertion, $email); + $this->assertContains($assertion, $mail_body, "Message Found"); + + // Allow visitors to register with Admin approval and no email verification. + $config->set('register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL); + $config->set('verify_mail', 0); + $config->save(); + $name = 'Argaven'; + $email = $name . self::USER_EMAIL_DOMAIN; + $user = $this->registerUser($name); + $this->assertFalse(empty($user->getPassword())); + $this->assertTrue($user->isBlocked()); + // TODO: The following fails for the same reason as above. + // $this->assertMailString('body', 'Your application for an account is', 2); + // $this->assertMailString('body', 'Argaven has applied for an account', 2); + $assertion = "Your application for an account is"; + $mail_body = $this->getMailBody($assertion, $email); + $this->assertContains($assertion, $mail_body, "Message Found"); + $assertion = "Argaven has applied for an account"; + $mail_body = $this->getMailBody($assertion, self::TEST_EMAIL_DOMAIN); + $this->assertContains($assertion, $mail_body, "Message Found"); + + // Allow visitors to register with Admin approval and e-mail verification. + $config->set('register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL); + $config->set('verify_mail', 1); + $config->save(); + $name = 'Bob.Arctor'; + $email = $name . self::USER_EMAIL_DOMAIN; + $user = $this->registerUser($name, FALSE); + $this->assertTrue(empty($user->getPassword())); + $this->assertTrue($user->isBlocked()); + + // TODO: The following fails for the same reason as above. + // $this->assertMailString('body', 'Your application for an account is', 2); + // $this->assertMailString('body','Bob.Arctor has applied for an account', 2); + $assertion = "Your application for an account is"; + $mail_body = $this->getMailBody($assertion, $email); + $this->assertContains($assertion, $mail_body, "Message Found"); + $assertion = "Bob.Arctor has applied for an account"; + $mail_body = $this->getMailBody($assertion, self::TEST_EMAIL_DOMAIN); + $this->assertContains($assertion, $mail_body, "Message Found"); + + // Verify that an authenticated user cannot register a new user, despite + // being granted permission to do so because only anonymous users can + // register themselves, authenticated users with the necessary permissions + // can POST a new user to the "user" REST resource. + $this->initAuthentication(); + $response = $this->registerRequest($this->account->getAccountName()); + $this->assertResourceErrorResponse(403, "Only anonymous users can register a user.", $response); + } + + /** + * Create the request body. + * + * @param string $name + * Name. + * @param bool $include_password + * Include Password. + * @param bool $include_email + * Include Email. + * + * @return array + * Return the request body. + */ + protected function createRequestBody($name, $include_password = TRUE, $include_email = TRUE) { + global $base_url; + $request_body = [ + '_links' => ['type' => ["href" => $base_url . "/rest/type/user/user"]], + 'langcode' => [['value' => 'en']], + 'name' => [['value' => $name]], + ]; + + if ($include_email) { + $request_body['mail'] = [['value' => $name . self::USER_EMAIL_DOMAIN]]; + } + + if ($include_password) { + $request_body['pass']['value'] = 'SuperSecretPassword'; + } + + return $request_body; + } + + /** + * Helper function to generate the request body. + * + * @param array $request_body + * The request body array. + * + * @return array + * Return the request options. + */ + protected function createRequestOptions(array $request_body) { + $request_options = $this->getAuthenticationRequestOptions('POST'); + $request_options[RequestOptions::BODY] = $this->serializer->encode($request_body, static::$format); + $request_options[RequestOptions::HEADERS]['Content-Type'] = static::$mimeType; + + return $request_options; + } + + /** + * Registers a user via REST resource. + * + * @param string $name + * User name. + * @param bool $include_password + * Include the password. + * @param bool $include_email + * Include the email? + * + * @return bool|\Drupal\user\Entity\User + * Return bool or the user. + */ + protected function registerUser($name, $include_password = TRUE, $include_email = TRUE) { + // Verify that an anonymous user can register. + $response = $this->registerRequest($name, $include_password, $include_email); + $this->assertResourceResponse(200, FALSE, $response); + $user = user_load_by_name($name); + $this->assertFalse(empty($user), 'User was create as expected'); + return $user; + } + + /** + * Make a REST user registration request. + * + * @param string $name + * The name. + * @param bool $include_password + * Include the password? + * @param bool $include_email + * Include the email? + * + * @return \Psr\Http\Message\ResponseInterface + * Return the Response. + */ + protected function registerRequest($name, $include_password = TRUE, $include_email = TRUE) { + + $user_register_url = Url::fromRoute('user.register') + ->setRouteParameter('_format', static::$format); + $request_body = $this->createRequestBody($name, $include_password, $include_email); + $request_options = $this->createRequestOptions($request_body); + $response = $this->request('POST', $user_register_url, $request_options); + + return $response; + } + + /** + * This is a hack to get to the key_value system.test_mail_collector directly. + * + * @param string $search + * The string to search for. + * @param string $email + * The email to field we're looking for. + * + * @return string + * Return the body string. + */ + protected function getMailBody($search, $email) { + $prefix = $GLOBALS['databases']['default']['default']['prefix']; + $table = $prefix . 'key_value'; + $db = \Drupal::database(); + $query = "SELECT value FROM $table WHERE name='system.test_mail_collector'"; + $result = $db->query($query); + $captured_emails = unserialize($result->fetch()->value); + + $found = NULL; + foreach ($captured_emails as $mail) { + if ($email == $mail['to']) { + if (strpos($mail['body'], $search) !== FALSE) { + $found = $mail['body']; + } + } + } + + return $found == NULL ? FALSE : $found; + } + + /** + * {@inheritdoc} + */ + protected function setUpAuthorization($method) { + switch ($method) { + case 'POST': + $this->grantPermissionsToAuthenticatedRole(['restful post user_registration']); + $this->grantPermissionsToAnonymousRole(['restful post user_registration']); + break; + + default: + throw new \UnexpectedValueException(); + } + } + + /** + * {@inheritdoc} + */ + protected function assertNormalizationEdgeCases($method, Url $url, array $request_options) {} + + /** + * {@inheritdoc} + */ + protected function getExpectedUnauthorizedAccessMessage($method) {} + + /** + * {@inheritdoc} + */ + protected function getExpectedBcUnauthorizedAccessMessage($method) {} + + /** + * {@inheritdoc} + */ + protected function getExpectedUnauthorizedAccessCacheability() {} + +} -- 2.14.3 (Apple Git-98)