ElyBy-Mirror/accounts
1
0
Fork 0
mirror of https://github.com/elyby/accounts.git synced 2025-05-31 14:11:46 +05:30
Code Issues Packages Projects Releases Wiki Activity

Implemented account deletion. Not all cases covered with tests [skip ci]

Browse Source
This commit is contained in:
ErickSkrauch
2020-06-12 00:27:02 +03:00
parent c86817a93d
commit 0183e54442
56 changed files with 1041 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/tests/_pages/AuthenticationRoute.php
View File

@@ -24,10 +24,6 @@ class AuthenticationRoute extends BasePage {
$this->getActor()->sendPOST('/api/authentication/login', $params);
}
public function logout() {
$this->getActor()->sendPOST('/api/authentication/logout');
}
public function forgotPassword($login = null, $token = null) {
$this->getActor()->sendPOST('/api/authentication/forgot-password', [
'login' => $login,

26
api/tests/functional/LoginCest.php
View File

@@ -1,10 +1,13 @@
<?php
declare(strict_types=1);
namespace api\tests\functional;
use api\tests\_pages\AuthenticationRoute;
use api\tests\FunctionalTester;
use OTPHP\TOTP;
// TODO: very outdated tests. Need to rewrite
class LoginCest {
public function testLoginEmailOrUsername(FunctionalTester $I) {
@@ -215,4 +218,27 @@ class LoginCest {
$I->canSeeAuthCredentials(false);
}
public function testLoginIntoDeletedAccount(FunctionalTester $I) {
$route = new AuthenticationRoute($I);
$I->wantTo('login into account that marked for deleting');
$route->login('DeletedAccount', 'password_0');
$I->canSeeResponseContainsJson([
'success' => true,
]);
}
public function testLoginIntoBannedAccount(FunctionalTester $I) {
$route = new AuthenticationRoute($I);
$I->wantTo('login into banned account');
$route->login('Banned', 'password_0');
$I->canSeeResponseContainsJson([
'success' => false,
'errors' => [
'login' => 'error.account_banned',
],
]);
}
}

21
api/tests/functional/LogoutCest.php
View File

@@ -1,19 +1,28 @@
<?php
declare(strict_types=1);
namespace api\tests\functional;
use api\tests\_pages\AuthenticationRoute;
use api\tests\FunctionalTester;
use Codeception\Example;
class LogoutCest {
public function testLoginEmailOrUsername(FunctionalTester $I) {
$route = new AuthenticationRoute($I);
$I->amAuthenticated();
$route->logout();
/**
* @dataProvider getLogoutCases
*/
public function logout(FunctionalTester $I, Example $example) {
$I->amAuthenticated($example[0]);
$I->sendPOST('/api/authentication/logout');
$I->canSeeResponseContainsJson([
'success' => true,
]);
}
protected function getLogoutCases() {
yield 'active account' => ['admin'];
yield 'account that not accepted the rules' => ['Veleyaba'];
yield 'account marked for deleting' => ['DeletedAccount'];
}
}

89
api/tests/functional/accounts/DeleteCest.php Normal file
View File

@@ -0,0 +1,89 @@
<?php
declare(strict_types=1);
namespace api\tests\functional\accounts;
use api\tests\_pages\AccountsRoute;
use api\tests\FunctionalTester;
class DeleteCest {
public function deleteMyAccountWithValidPassword(FunctionalTester $I) {
$id = $I->amAuthenticated();
$I->sendDELETE("/api/v1/accounts/{$id}", [
'password' => 'password_0',
]);
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'success' => true,
]);
$I->sendGET("/api/v1/accounts/{$id}");
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'isDeleted' => true,
]);
}
public function deleteMyAccountWithNotAcceptedRules(FunctionalTester $I) {
$id = $I->amAuthenticated('Veleyaba');
$I->sendDELETE("/api/v1/accounts/{$id}", [
'password' => 'password_0',
]);
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'success' => true,
]);
$I->sendGET("/api/v1/accounts/{$id}");
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'isDeleted' => true,
'shouldAcceptRules' => true,
]);
}
public function deleteMyAccountWithInvalidPassword(FunctionalTester $I) {
$id = $I->amAuthenticated();
$I->sendDELETE("/api/v1/accounts/{$id}", [
'password' => 'invalid_password',
]);
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'success' => false,
'errors' => [
'password' => 'error.password_incorrect',
],
]);
}
public function deleteAlreadyDeletedAccount(FunctionalTester $I) {
$id = $I->amAuthenticated('DeletedAccount');
$I->sendDELETE("/api/v1/accounts/{$id}", [
'password' => 'password_0',
]);
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'success' => false,
'errors' => [
'account' => 'error.account_already_deleted',
],
]);
}
public function deleteNotMyAccount(FunctionalTester $I) {
$I->amAuthenticated();
$I->sendDELETE('/api/v1/accounts/2', [
'password' => 'password_0',
]);
$I->canSeeResponseCodeIs(403);
$I->canSeeResponseContainsJson([
'name' => 'Forbidden',
'message' => 'You are not allowed to perform this action.',
'code' => 0,
'status' => 403,
]);
}
}

23
api/tests/functional/accounts/GetCest.php
View File

@@ -1,4 +1,6 @@
<?php
declare(strict_types=1);
namespace api\tests\functional\accounts;
use api\tests\_pages\AccountsRoute;
@@ -6,10 +8,7 @@ use api\tests\FunctionalTester;
class GetCest {
/**
* @var AccountsRoute
*/
private $route;
private AccountsRoute $route;
public function _before(FunctionalTester $I) {
$this->route = new AccountsRoute($I);
@@ -29,6 +28,7 @@ class GetCest {
'email' => 'admin@ely.by',
'lang' => 'en',
'isActive' => true,
'isDeleted' => false,
'hasMojangUsernameCollision' => false,
'shouldAcceptRules' => false,
'elyProfileLink' => 'http://ely.by/u1',
@@ -51,6 +51,7 @@ class GetCest {
'email' => 'admin@ely.by',
'lang' => 'en',
'isActive' => true,
'isDeleted' => false,
'hasMojangUsernameCollision' => false,
'shouldAcceptRules' => false,
'elyProfileLink' => 'http://ely.by/u1',
@@ -72,6 +73,7 @@ class GetCest {
'isOtpEnabled' => false,
'lang' => 'en',
'isActive' => true,
'isDeleted' => false,
'hasMojangUsernameCollision' => false,
'shouldAcceptRules' => true,
'elyProfileLink' => 'http://ely.by/u9',
@@ -79,6 +81,19 @@ class GetCest {
$I->canSeeResponseJsonMatchesJsonPath('$.passwordChangedAt');
}
public function testGetInfoFromAccountMarkedForDeleting(FunctionalTester $I) {
// We're setting up a known expired token
$id = $I->amAuthenticated('DeletedAccount');
$I->sendGET("/api/v1/accounts/{$id}");
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'id' => $id,
'isActive' => true,
'isDeleted' => true,
]);
}
public function testGetInfoWithExpiredToken(FunctionalTester $I) {
// We're setting up a known expired token
$I->amBearerAuthenticated(

51
api/tests/functional/accounts/RestoreCest.php Normal file
View File

@@ -0,0 +1,51 @@
<?php
declare(strict_types=1);
namespace api\tests\functional\accounts;
use api\tests\_pages\AccountsRoute;
use api\tests\FunctionalTester;
class RestoreCest {
public function restoreMyDeletedAccount(FunctionalTester $I) {
$id = $I->amAuthenticated('DeletedAccount');
$I->sendPOST("/api/v1/accounts/{$id}/restore");
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'success' => true,
]);
$I->sendGET("/api/v1/accounts/{$id}");
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'isDeleted' => false,
]);
}
public function restoreNotDeletedAccount(FunctionalTester $I) {
$id = $I->amAuthenticated();
$I->sendPOST("/api/v1/accounts/{$id}/restore");
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseContainsJson([
'success' => false,
'errors' => [
'account' => 'error.account_not_deleted',
],
]);
}
public function restoreNotMyAccount(FunctionalTester $I) {
$I->amAuthenticated('DeletedAccount');
$I->sendPOST('/api/v1/accounts/1/restore');
$I->canSeeResponseCodeIs(403);
$I->canSeeResponseContainsJson([
'name' => 'Forbidden',
'message' => 'You are not allowed to perform this action.',
'code' => 0,
'status' => 403,
]);
}
}

14
api/tests/functional/authserver/AuthorizationCest.php
View File

@@ -97,6 +97,20 @@ class AuthorizationCest {
]);
}
public function deletedAccount(FunctionalTester $I) {
$I->wantTo('authenticate in account marked for deletion');
$I->sendPOST('/api/authserver/authentication/authenticate', [
'username' => 'DeletedAccount',
'password' => 'password_0',
'clientToken' => Uuid::uuid4()->toString(),
]);
$I->canSeeResponseCodeIs(401);
$I->canSeeResponseContainsJson([
'error' => 'ForbiddenOperationException',
'errorMessage' => 'Invalid credentials. Invalid nickname or password.',
]);
}
public function bannedAccount(FunctionalTester $I) {
$I->wantTo('authenticate in suspended account');
$I->sendPOST('/api/authserver/authentication/authenticate', [

13
api/tests/functional/authserver/RefreshCest.php
View File

@@ -93,6 +93,19 @@ class RefreshCest {
]);
}
public function refreshTokenFromDeletedUser(AuthserverSteps $I) {
$I->wantTo('refresh token from account marked for deletion');
$I->sendPOST('/api/authserver/authentication/refresh', [
'accessToken' => '239ba889-7020-4383-8d99-cd8c8aab4a2f',
'clientToken' => '47443658-4ff8-45e7-b33e-dc8915ab6421',
]);
$I->canSeeResponseCodeIs(401);
$I->canSeeResponseContainsJson([
'error' => 'ForbiddenOperationException',
'errorMessage' => 'Invalid token.',
]);
}
public function refreshTokenFromBannedUser(AuthserverSteps $I) {
$I->wantTo('refresh token from suspended account');
$I->sendPOST('/api/authserver/authentication/refresh', [

12
api/tests/functional/authserver/ValidateCest.php
View File

@@ -79,4 +79,16 @@ class ValidateCest {
]);
}
public function credentialsFromBannedAccount(AuthserverSteps $I) {
$I->wantTo('get error on expired legacy accessToken');
$I->sendPOST('/api/authserver/authentication/validate', [
'accessToken' => '239ba889-7020-4383-8d99-cd8c8aab4a2f',
]);
$I->canSeeResponseCodeIs(401);
$I->canSeeResponseContainsJson([
'error' => 'ForbiddenOperationException',
'errorMessage' => 'Invalid token.',
]);
}
}

7
api/tests/functional/mojang/UsernameToUuidCest.php
View File

@@ -58,6 +58,13 @@ class UsernameToUuidCest {
$I->canSeeResponseEquals('');
}
public function getUuidForDeletedAccount(FunctionalTester $I) {
$I->wantTo('get uuid for account that marked for deleting');
$this->route->usernameToUuid('DeletedAccount');
$I->canSeeResponseCodeIs(204);
$I->canSeeResponseEquals('');
}
public function nonPassedUsername(FunctionalTester $I) {
$I->wantTo('get 404 on not passed username');
$this->route->usernameToUuid('');

4
api/tests/functional/mojang/UsernamesToUuidsCest.php
View File

@@ -42,7 +42,7 @@ class UsernamesToUuidsCest {
public function getUuidsByPartialNonexistentUsernames(FunctionalTester $I) {
$I->wantTo('get uuids by few usernames and some nonexistent');
$this->route->uuidsByUsernames(['Admin', 'not-exists-user']);
$this->route->uuidsByUsernames(['Admin', 'DeletedAccount', 'not-exists-user']);
$I->canSeeResponseCodeIs(200);
$I->canSeeResponseIsJson();
$I->canSeeResponseContainsJson([
@@ -51,6 +51,8 @@ class UsernamesToUuidsCest {
'name' => 'Admin',
],
]);
$I->cantSeeResponseJsonMatchesJsonPath('$.[?(@.name="DeletedAccount")]');
$I->cantSeeResponseJsonMatchesJsonPath('$.[?(@.name="not-exists-user")]');
}
public function passAllNonexistentUsernames(FunctionalTester $I) {

7
api/tests/functional/mojang/UuidToUsernamesHistoryCest.php
View File

@@ -55,6 +55,13 @@ class UuidToUsernamesHistoryCest {
$I->canSeeResponseEquals('');
}
public function passUuidOfDeletedAccount(FunctionalTester $I) {
$I->wantTo('get username by passing uuid of the account marked for deleting');
$this->route->usernamesByUuid('6383de63-8f85-4ed5-92b7-5401a1fa68cd');
$I->canSeeResponseCodeIs(204);
$I->canSeeResponseEquals('');
}
public function passWrongUuidFormat(FunctionalTester $I) {
$I->wantTo('call profile route with invalid uuid string');
$this->route->usernamesByUuid('bla-bla-bla');

11
api/tests/functional/oauth/AuthCodeCest.php
View File

@@ -195,4 +195,15 @@ class AuthCodeCest {
$I->canSeeResponseJsonMatchesJsonPath('$.redirectUri');
}
public function finalizeByAccountMarkedForDeletion(FunctionalTester $I) {
$I->amAuthenticated('DeletedAccount');
$I->sendPOST('/api/oauth2/v1/complete?' . http_build_query([
'client_id' => 'ely',
'redirect_uri' => 'http://ely.by',
'response_type' => 'code',
'scope' => 'minecraft_server_session',
]), ['accept' => true]);
$I->canSeeResponseCodeIs(403);
}
}

13
api/tests/functional/sessionserver/JoinCest.php
View File

@@ -137,6 +137,19 @@ class JoinCest {
]);
}
public function joinByAccountMarkedForDeletion(FunctionalTester $I) {
$this->route->join([
'accessToken' => '239ba889-7020-4383-8d99-cd8c8aab4a2f',
'selectedProfile' => '6383de63-8f85-4ed5-92b7-5401a1fa68cd',
'serverId' => uuid(),
]);
$I->canSeeResponseCodeIs(401);
$I->canSeeResponseContainsJson([
'error' => 'ForbiddenOperationException',
'errorMessage' => 'Invalid credentials',
]);
}
private function expectSuccessResponse(FunctionalTester $I) {
$I->seeResponseCodeIs(200);
$I->seeResponseIsJson();

11
api/tests/functional/sessionserver/JoinLegacyCest.php
View File

@@ -106,6 +106,17 @@ class JoinLegacyCest {
$I->canSeeResponseContains('credentials can not be null.');
}
public function joinByAccountMarkedForDeletion(FunctionalTester $I) {
$I->wantTo('join to some server by legacy protocol with nil accessToken and selectedProfile');
$this->route->joinLegacy([
'sessionId' => 'token:239ba889-7020-4383-8d99-cd8c8aab4a2f:6383de63-8f85-4ed5-92b7-5401a1fa68cd',
'user' => 'DeletedAccount',
'serverId' => uuid(),
]);
$I->canSeeResponseCodeIs(401);
$I->canSeeResponseContains('Ely.by authorization required');
}
private function expectSuccessResponse(FunctionalTester $I) {
$I->seeResponseCodeIs(200);
$I->canSeeResponseEquals('OK');

11
api/tests/functional/sessionserver/ProfileCest.php
View File

@@ -58,4 +58,15 @@ class ProfileCest {
]);
}
public function getProfileOfAccountMarkedForDeletion(FunctionalTester $I) {
$this->route->profile('6383de63-8f85-4ed5-92b7-5401a1fa68cd');
$I->canSeeResponseCodeIs(401);
$I->canSeeResponseIsJson();
$I->seeResponseIsJson();
$I->canSeeResponseContainsJson([
'error' => 'ForbiddenOperationException',
'errorMessage' => 'Invalid uuid.',
]);
}
}

90
api/tests/unit/modules/accounts/models/DeleteAccountFormTest.php Normal file
View File

@@ -0,0 +1,90 @@
<?php
declare(strict_types=1);
namespace api\tests\unit\modules\accounts\models;
use api\modules\accounts\models\DeleteAccountForm;
use api\tests\unit\TestCase;
use common\models\Account;
use common\tasks\CreateWebHooksDeliveries;
use common\tasks\DeleteAccount;
use common\tests\fixtures\AccountFixture;
use ReflectionObject;
use Yii;
use yii\queue\Queue;
class DeleteAccountFormTest extends TestCase {
/**
* @var Queue|\PHPUnit\Framework\MockObject\MockObject
*/
private Queue $queue;
public function _fixtures(): array {
return [
'accounts' => AccountFixture::class,
];
}
public function _before(): void {
parent::_before();
$this->queue = $this->createMock(Queue::class);
Yii::$app->set('queue', $this->queue);
}
public function testPerformAction() {
/** @var Account $account */
$account = $this->tester->grabFixture('accounts', 'admin');
$this->queue
->expects($this->once())
->method('delay')
->with($this->equalToWithDelta(60 * 60 * 24 * 7, 5))
->willReturnSelf();
$this->queue
->expects($this->exactly(2))
->method('push')
->withConsecutive(
[$this->callback(function(CreateWebHooksDeliveries $task) use ($account): bool {
$this->assertSame($account->id, $task->payloads['id']);
return true;
})],
[$this->callback(function(DeleteAccount $task) use ($account): bool {
$obj = new ReflectionObject($task);
$property = $obj->getProperty('accountId');
$property->setAccessible(true);
$this->assertSame($account->id, $property->getValue($task));
return true;
})],
);
$model = new DeleteAccountForm($account, [
'password' => 'password_0',
]);
$this->assertTrue($model->performAction());
$this->assertSame(Account::STATUS_DELETED, $account->status);
$this->assertEqualsWithDelta(time(), $account->deleted_at, 5);
}
public function testPerformActionWithInvalidPassword() {
/** @var Account $account */
$account = $this->tester->grabFixture('accounts', 'admin');
$model = new DeleteAccountForm($account, [
'password' => 'invalid password',
]);
$this->assertFalse($model->performAction());
$this->assertSame(['password' => ['error.password_incorrect']], $model->getErrors());
}
public function testPerformActionForAlreadyDeletedAccount() {
/** @var Account $account */
$account = $this->tester->grabFixture('accounts', 'deleted-account');
$model = new DeleteAccountForm($account, [
'password' => 'password_0',
]);
$this->assertFalse($model->performAction());
$this->assertSame(['account' => ['error.account_already_deleted']], $model->getErrors());
}
}

61
api/tests/unit/modules/accounts/models/RestoreAccountFormTest.php Normal file
View File

@@ -0,0 +1,61 @@
<?php
declare(strict_types=1);
namespace api\tests\unit\modules\accounts\models;
use api\modules\accounts\models\RestoreAccountForm;
use api\tests\unit\TestCase;
use common\models\Account;
use common\tasks\CreateWebHooksDeliveries;
use common\tests\fixtures\AccountFixture;
use Yii;
use yii\queue\Queue;
class RestoreAccountFormTest extends TestCase {
/**
* @var Queue|\PHPUnit\Framework\MockObject\MockObject
*/
private Queue $queue;
public function _fixtures(): array {
return [
'accounts' => AccountFixture::class,
];
}
public function _before(): void {
parent::_before();
$this->queue = $this->createMock(Queue::class);
Yii::$app->set('queue', $this->queue);
}
public function testPerformAction() {
/** @var Account $account */
$account = $this->tester->grabFixture('accounts', 'deleted-account');
$this->queue
->expects($this->once())
->method('push')
->withConsecutive(
[$this->callback(function(CreateWebHooksDeliveries $task) use ($account): bool {
$this->assertSame($account->id, $task->payloads['id']);
return true;
})],
);
$model = new RestoreAccountForm($account);
$this->assertTrue($model->performAction());
$this->assertSame(Account::STATUS_ACTIVE, $account->status);
$this->assertNull($account->deleted_at);
}
public function testPerformActionForNotDeletedAccount() {
/** @var Account $account */
$account = $this->tester->grabFixture('accounts', 'admin');
$model = new RestoreAccountForm($account);
$this->assertFalse($model->performAction());
$this->assertSame(['account' => ['error.account_not_deleted']], $model->getErrors());
}
}

20
api/tests/unit/modules/internal/models/BanFormTest.php → api/tests/unit/modules/internal/models/BanAccountFormTest.php
View File

@@ -1,4 +1,6 @@
<?php
declare(strict_types=1);
namespace api\tests\unit\modules\internal\models;
use api\modules\accounts\models\BanAccountForm;
@@ -6,8 +8,9 @@ use api\modules\internal\helpers\Error as E;
use api\tests\unit\TestCase;
use common\models\Account;
use common\tasks\ClearAccountSessions;
use ReflectionObject;
class BanFormTest extends TestCase {
class BanAccountFormTest extends TestCase {
public function testValidateAccountActivity() {
$account = new Account();
@@ -25,13 +28,9 @@ class BanFormTest extends TestCase {
public function testBan() {
/** @var Account|\PHPUnit\Framework\MockObject\MockObject $account */
$account = $this->getMockBuilder(Account::class)
->setMethods(['save'])
->getMock();
$account->expects($this->once())
->method('save')
->willReturn(true);
$account = $this->createPartialMock(Account::class, ['save']);
$account->expects($this->once())->method('save')->willReturn(true);
$account->id = 123;
$model = new BanAccountForm($account);
$this->assertTrue($model->performAction());
@@ -39,7 +38,10 @@ class BanFormTest extends TestCase {
/** @var ClearAccountSessions $job */
$job = $this->tester->grabLastQueuedJob();
$this->assertInstanceOf(ClearAccountSessions::class, $job);
$this->assertSame($job->accountId, $account->id);
$obj = new ReflectionObject($job);
$property = $obj->getProperty('accountId');
$property->setAccessible(true);
$this->assertSame(123, $property->getValue($job));
}
}

11
api/tests/unit/rbac/rules/AccountOwnerTest.php
View File

@@ -39,14 +39,25 @@ class AccountOwnerTest extends TestCase {
Yii::$app->user->setIdentity($identity);
// Assert that account id matches
$this->assertFalse($rule->execute('token', $item, ['accountId' => 2]));
$this->assertFalse($rule->execute('token', $item, ['accountId' => '2']));
$this->assertTrue($rule->execute('token', $item, ['accountId' => 1]));
$this->assertTrue($rule->execute('token', $item, ['accountId' => '1']));
// Check accepted latest rules
$account->rules_agreement_version = null;
$this->assertFalse($rule->execute('token', $item, ['accountId' => 1]));
$this->assertTrue($rule->execute('token', $item, ['accountId' => 1, 'optionalRules' => true]));
$account->rules_agreement_version = LATEST_RULES_VERSION;
$this->assertTrue($rule->execute('token', $item, ['accountId' => 1]));
// Check deleted account behavior
$account->status = Account::STATUS_DELETED;
$this->assertFalse($rule->execute('token', $item, ['accountId' => 1]));
$this->assertTrue($rule->execute('token', $item, ['accountId' => 1, 'allowDeleted' => true]));
// Banned account should always be not allowed
$account->status = Account::STATUS_BANNED;
$this->assertFalse($rule->execute('token', $item, ['accountId' => 1]));
$this->assertFalse($rule->execute('token', $item, ['accountId' => 1, 'optionalRules' => true]));