aneurinandClaude Sonnet 5
7da881bb78
APP_ALLOW_REGISTRATION (default true) gates the only "sign up" this app has -- the account-creation side effect of POST /api/auth/magic-link. When false, an unknown address is silently ignored (find-only, no findOrCreateByEmail) while an existing address still gets its sign-in link as normal; the response is identical either way (202, same message), so there's still no enumeration signal. - Config::allowRegistration, read from APP_ALLOW_REGISTRATION. - AuthController::requestLoginLink takes the flag; only looks up (doesn't create) when it's off. - docker-compose.yml / .env.example / README document the new var. - ApiTestCase::reconfigure() rebuilds the app against changed env (same database) for tests that need a non-default Config; two new AuthTest cases cover both halves (blocks a new address, doesn't block an existing one). 59 tests pass. Verified against the rebuilt container: with the flag on (default), a new address gets a link and an account; switched off via the same env var, a brand-new address gets the same 202 but no email and no user row, while an address that already had an account still receives its link. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
111 lines
4.5 KiB
PHP
111 lines
4.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests;
|
|
|
|
/**
|
|
* There is no register/login pair -- POST /api/auth/magic-link is the only way
|
|
* in, for both a brand-new address and a returning one.
|
|
*/
|
|
final class AuthTest extends ApiTestCase
|
|
{
|
|
public function test_a_magic_link_request_always_responds_202(): void
|
|
{
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
self::assertSame(202, $response->getStatusCode());
|
|
}
|
|
|
|
public function test_a_magic_link_request_validates_the_address(): void
|
|
{
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'not-an-email']);
|
|
|
|
self::assertSame(422, $response->getStatusCode());
|
|
self::assertArrayHasKey('email', $this->decode($response)['error']['details']);
|
|
}
|
|
|
|
public function test_opening_the_link_creates_the_account_and_signs_in(): void
|
|
{
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'Ada@example.com']);
|
|
|
|
$response = $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
$body = $this->decode($response);
|
|
self::assertSame('ada@example.com', $body['user']['email']);
|
|
self::assertTrue($body['user']['email_verified']);
|
|
self::assertNotNull($body['user']['email_verified_at']);
|
|
self::assertNull($body['user']['pending_email']);
|
|
self::assertArrayNotHasKey('password', $body['user']);
|
|
self::assertArrayNotHasKey('password_hash', $body['user']);
|
|
self::assertNotEmpty($body['token']);
|
|
}
|
|
|
|
public function test_a_second_request_signs_in_the_same_account(): void
|
|
{
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
$firstId = $this->decode(
|
|
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
|
|
)['user']['id'];
|
|
|
|
$this->db()->prepare('UPDATE users SET verification_email_sent_at = NULL WHERE email = :e')
|
|
->execute(['e' => 'ada@example.com']);
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ADA@EXAMPLE.COM']);
|
|
$secondId = $this->decode(
|
|
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]),
|
|
)['user']['id'];
|
|
|
|
self::assertSame($firstId, $secondId);
|
|
}
|
|
|
|
public function test_the_link_is_not_sent_again_within_the_resend_interval(): void
|
|
{
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
self::assertSame(202, $response->getStatusCode());
|
|
self::assertCount(1, $this->sentEmails());
|
|
}
|
|
|
|
public function test_me_requires_a_valid_token(): void
|
|
{
|
|
$unauthorised = $this->request('GET', '/api/me');
|
|
self::assertSame(401, $unauthorised->getStatusCode());
|
|
|
|
$response = $this->request('GET', '/api/me', null, $this->authHeader('linus@example.com'));
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
|
|
}
|
|
|
|
public function test_registration_can_be_turned_off_for_a_new_address(): void
|
|
{
|
|
$this->reconfigure(['APP_ALLOW_REGISTRATION' => 'false']);
|
|
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'nobody@example.com']);
|
|
|
|
// Same response either way -- no enumeration signal.
|
|
self::assertSame(202, $response->getStatusCode());
|
|
self::assertSame([], $this->sentEmails());
|
|
self::assertSame(0, (int) $this->db()->query('SELECT COUNT(*) FROM users')->fetchColumn());
|
|
}
|
|
|
|
public function test_turning_off_registration_does_not_block_an_existing_user(): void
|
|
{
|
|
// Sign up while registration is still open.
|
|
$this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
$this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
|
|
$this->db()->prepare('UPDATE users SET verification_email_sent_at = NULL WHERE email = :e')
|
|
->execute(['e' => 'ada@example.com']);
|
|
|
|
$this->reconfigure(['APP_ALLOW_REGISTRATION' => 'false']);
|
|
|
|
$response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
|
|
|
|
self::assertSame(202, $response->getStatusCode());
|
|
self::assertSame('ada@example.com', $this->lastEmail()['to']);
|
|
}
|
|
}
|