Initial commit
This commit is contained in:
Ronald Huynen
@@ -0,0 +1,522 @@
|
||||
<?php
|
||||
|
||||
namespace Tests\Feature\Security\Authentication;
|
||||
|
||||
use App\Models\Admin;
|
||||
use App\Models\Bank;
|
||||
use App\Models\Organization;
|
||||
use App\Models\User;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Illuminate\Support\Facades\Auth;
|
||||
use Illuminate\Support\Facades\Hash;
|
||||
use Tests\TestCase;
|
||||
|
||||
/**
|
||||
* Direct Login Routes Security Tests
|
||||
*
|
||||
* Tests the security of direct login routes used in emails and external links:
|
||||
* - /user/{userId}/login
|
||||
* - /organization/{organizationId}/login
|
||||
* - /bank/{bankId}/login
|
||||
* - /admin/{adminId}/login
|
||||
*
|
||||
* Tests layered authentication, ownership verification, and intended URL handling.
|
||||
*
|
||||
* @group security
|
||||
* @group critical
|
||||
* @group authentication
|
||||
* @group direct-login
|
||||
*/
|
||||
class DirectLoginRoutesSecurityTest extends TestCase
|
||||
{
|
||||
use RefreshDatabase;
|
||||
|
||||
// ==========================================
|
||||
// USER DIRECT LOGIN TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test user direct login requires authentication
|
||||
*/
|
||||
public function test_user_direct_login_requires_authentication()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
|
||||
$response = $this->get(route('user.direct-login', ['userId' => $user->id]));
|
||||
|
||||
// Should redirect to login with intended URL (may be localized like /en/login)
|
||||
$response->assertRedirect();
|
||||
$redirectLocation = $response->headers->get('Location');
|
||||
$this->assertTrue(
|
||||
str_contains($redirectLocation, 'login') || str_contains($redirectLocation, '/en') || str_contains($redirectLocation, '/nl'),
|
||||
"Expected redirect to login page, got: {$redirectLocation}"
|
||||
);
|
||||
// Session url.intended may be set by controller
|
||||
}
|
||||
|
||||
/**
|
||||
* Test user direct login validates ownership
|
||||
*/
|
||||
public function test_user_direct_login_validates_ownership()
|
||||
{
|
||||
$user1 = User::factory()->create();
|
||||
$user2 = User::factory()->create();
|
||||
|
||||
$this->actingAs($user1, 'web');
|
||||
|
||||
// Try to access user2's profile
|
||||
$response = $this->get(route('user.direct-login', ['userId' => $user2->id]));
|
||||
|
||||
$response->assertStatus(403);
|
||||
$response->assertSee('You do not have access to this profile');
|
||||
}
|
||||
|
||||
/**
|
||||
* Test user direct login redirects to intended URL
|
||||
*/
|
||||
public function test_user_direct_login_redirects_to_intended_url()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$intendedUrl = route('main');
|
||||
$response = $this->get(route('user.direct-login', [
|
||||
'userId' => $user->id,
|
||||
'intended' => $intendedUrl,
|
||||
]));
|
||||
|
||||
$response->assertRedirect($intendedUrl);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test user direct login returns 404 for nonexistent user
|
||||
*/
|
||||
public function test_user_direct_login_returns_404_for_nonexistent_user()
|
||||
{
|
||||
$this->actingAs(User::factory()->create(), 'web');
|
||||
|
||||
$response = $this->get(route('user.direct-login', ['userId' => 99999]));
|
||||
|
||||
$response->assertStatus(404);
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// ORGANIZATION DIRECT LOGIN TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test organization direct login requires user authentication first
|
||||
*/
|
||||
public function test_organization_direct_login_requires_user_authentication()
|
||||
{
|
||||
$organization = Organization::factory()->create();
|
||||
|
||||
$response = $this->get(route('organization.direct-login', ['organizationId' => $organization->id]));
|
||||
|
||||
// Should redirect to user login
|
||||
$response->assertRedirect();
|
||||
$this->assertStringContainsString('login', $response->headers->get('Location'));
|
||||
|
||||
// Should store intended URL in session
|
||||
$this->assertNotNull(session('url.intended'));
|
||||
$this->assertStringContainsString("/organization/{$organization->id}/login", session('url.intended'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test organization direct login validates ownership
|
||||
*/
|
||||
public function test_organization_direct_login_validates_ownership()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$ownedOrg = Organization::factory()->create();
|
||||
$unownedOrg = Organization::factory()->create();
|
||||
|
||||
$user->organizations()->attach($ownedOrg->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
// Try to access unowned organization
|
||||
$response = $this->get(route('organization.direct-login', ['organizationId' => $unownedOrg->id]));
|
||||
|
||||
$response->assertStatus(403);
|
||||
$response->assertSee('You do not have access to this organization');
|
||||
}
|
||||
|
||||
/**
|
||||
* Test organization direct login switches guard directly (passwordless)
|
||||
*/
|
||||
public function test_organization_direct_login_switches_guard_passwordless()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$organization = Organization::factory()->create(['password' => Hash::make('password')]);
|
||||
$user->organizations()->attach($organization->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$response = $this->get(route('organization.direct-login', ['organizationId' => $organization->id]));
|
||||
|
||||
// Should switch to organization guard immediately without password
|
||||
$this->assertTrue(Auth::guard('organization')->check());
|
||||
$this->assertEquals($organization->id, Auth::guard('organization')->id());
|
||||
|
||||
$response->assertRedirect(route('main'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test organization direct login redirects to intended URL
|
||||
*/
|
||||
public function test_organization_direct_login_redirects_to_intended_url()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$organization = Organization::factory()->create();
|
||||
$user->organizations()->attach($organization->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$intendedUrl = '/some/deep/link';
|
||||
|
||||
$response = $this->get(route('organization.direct-login', [
|
||||
'organizationId' => $organization->id,
|
||||
'intended' => $intendedUrl,
|
||||
]));
|
||||
|
||||
$response->assertRedirect($intendedUrl);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test organization direct login returns 404 for nonexistent organization
|
||||
*/
|
||||
public function test_organization_direct_login_returns_404_for_nonexistent_profile()
|
||||
{
|
||||
$this->actingAs(User::factory()->create(), 'web');
|
||||
|
||||
$response = $this->get(route('organization.direct-login', ['organizationId' => 99999]));
|
||||
|
||||
$response->assertStatus(404);
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// BANK DIRECT LOGIN TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test bank direct login requires user authentication first
|
||||
*/
|
||||
public function test_bank_direct_login_requires_user_authentication()
|
||||
{
|
||||
$bank = Bank::factory()->create();
|
||||
|
||||
$response = $this->get(route('bank.direct-login', ['bankId' => $bank->id]));
|
||||
|
||||
// Should redirect to user login
|
||||
$response->assertRedirect();
|
||||
$this->assertStringContainsString('login', $response->headers->get('Location'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test bank direct login validates bank manager relationship
|
||||
*/
|
||||
public function test_bank_direct_login_validates_bank_manager_relationship()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$managedBank = Bank::factory()->create();
|
||||
$unmanagedBank = Bank::factory()->create();
|
||||
|
||||
$user->banksManaged()->attach($managedBank->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
// Try to access unmanaged bank
|
||||
$response = $this->get(route('bank.direct-login', ['bankId' => $unmanagedBank->id]));
|
||||
|
||||
$response->assertStatus(403);
|
||||
$response->assertSee('You do not have access to this bank');
|
||||
}
|
||||
|
||||
/**
|
||||
* Test bank direct login requires password
|
||||
*/
|
||||
public function test_bank_direct_login_requires_password()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$bank = Bank::factory()->create(['password' => Hash::make('bank-password')]);
|
||||
$user->banksManaged()->attach($bank->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$response = $this->get(route('bank.direct-login', ['bankId' => $bank->id]));
|
||||
|
||||
// Should redirect to bank login form (not switch immediately)
|
||||
$response->assertRedirect(route('bank.login'));
|
||||
|
||||
// Should NOT be authenticated on bank guard yet
|
||||
$this->assertFalse(Auth::guard('bank')->check());
|
||||
|
||||
// Should set session intent
|
||||
$this->assertEquals('Bank', session('intended_profile_switch_type'));
|
||||
$this->assertEquals($bank->id, session('intended_profile_switch_id'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test bank direct login with intended URL stores it in session
|
||||
*/
|
||||
public function test_bank_direct_login_stores_intended_url_in_session()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$bank = Bank::factory()->create();
|
||||
$user->banksManaged()->attach($bank->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$intendedUrl = '/deep/link/to/transaction';
|
||||
|
||||
$this->get(route('bank.direct-login', [
|
||||
'bankId' => $bank->id,
|
||||
'intended' => $intendedUrl,
|
||||
]));
|
||||
|
||||
$this->assertEquals($intendedUrl, session('bank_login_intended_url'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test bank login fails with wrong password
|
||||
*/
|
||||
public function test_bank_direct_login_fails_with_wrong_password()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$bank = Bank::factory()->create(['password' => Hash::make('correct-password')]);
|
||||
$user->banksManaged()->attach($bank->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
$this->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class);
|
||||
|
||||
session([
|
||||
'intended_profile_switch_type' => 'Bank',
|
||||
'intended_profile_switch_id' => $bank->id,
|
||||
]);
|
||||
|
||||
$response = $this->post(route('bank.login.post'), [
|
||||
'password' => 'wrong-password',
|
||||
]);
|
||||
|
||||
$response->assertSessionHasErrors(['password']);
|
||||
$this->assertFalse(Auth::guard('bank')->check());
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// ADMIN DIRECT LOGIN TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test admin direct login requires user authentication first
|
||||
*/
|
||||
public function test_admin_direct_login_requires_user_authentication()
|
||||
{
|
||||
$admin = Admin::factory()->create();
|
||||
|
||||
$response = $this->get(route('admin.direct-login', ['adminId' => $admin->id]));
|
||||
|
||||
// Should redirect to user login
|
||||
$response->assertRedirect();
|
||||
$this->assertStringContainsString('login', $response->headers->get('Location'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test admin direct login validates admin user relationship
|
||||
*/
|
||||
public function test_admin_direct_login_validates_admin_user_relationship()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$ownedAdmin = Admin::factory()->create();
|
||||
$unownedAdmin = Admin::factory()->create();
|
||||
|
||||
$user->admins()->attach($ownedAdmin->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
// Try to access unowned admin
|
||||
$response = $this->get(route('admin.direct-login', ['adminId' => $unownedAdmin->id]));
|
||||
|
||||
$response->assertStatus(403);
|
||||
$response->assertSee('You do not have access to this admin profile');
|
||||
}
|
||||
|
||||
/**
|
||||
* Test admin direct login requires password
|
||||
*/
|
||||
public function test_admin_direct_login_requires_password()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$admin = Admin::factory()->create(['password' => Hash::make('admin-password')]);
|
||||
$user->admins()->attach($admin->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$response = $this->get(route('admin.direct-login', ['adminId' => $admin->id]));
|
||||
|
||||
// Should redirect to admin login form
|
||||
$response->assertRedirect(route('admin.login'));
|
||||
|
||||
// Should NOT be authenticated on admin guard yet
|
||||
$this->assertFalse(Auth::guard('admin')->check());
|
||||
|
||||
// Should set session intent
|
||||
$this->assertEquals('Admin', session('intended_profile_switch_type'));
|
||||
$this->assertEquals($admin->id, session('intended_profile_switch_id'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test admin direct login fails for non-admin users
|
||||
*/
|
||||
public function test_admin_direct_login_fails_for_non_admin_users()
|
||||
{
|
||||
$regularUser = User::factory()->create();
|
||||
$admin = Admin::factory()->create();
|
||||
|
||||
// Regular user not linked to admin
|
||||
$this->actingAs($regularUser, 'web');
|
||||
|
||||
$response = $this->get(route('admin.direct-login', ['adminId' => $admin->id]));
|
||||
|
||||
$response->assertStatus(403);
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// SESSION VARIABLE CLEANUP TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test that session variables are cleared after successful authentication
|
||||
*/
|
||||
public function test_direct_login_session_variables_cleared_after_completion()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$bank = Bank::factory()->create(['password' => Hash::make('password')]);
|
||||
$user->banksManaged()->attach($bank->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
$this->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class);
|
||||
|
||||
// Set up direct login
|
||||
$this->get(route('bank.direct-login', [
|
||||
'bankId' => $bank->id,
|
||||
'intended' => '/target/url',
|
||||
]));
|
||||
|
||||
$this->assertNotNull(session('intended_profile_switch_type'));
|
||||
$this->assertNotNull(session('intended_profile_switch_id'));
|
||||
$this->assertNotNull(session('bank_login_intended_url'));
|
||||
|
||||
// Complete authentication
|
||||
$this->post(route('bank.login.post'), [
|
||||
'password' => 'password',
|
||||
]);
|
||||
|
||||
// Session variables should be cleared
|
||||
$this->assertNull(session('intended_profile_switch_type'));
|
||||
$this->assertNull(session('intended_profile_switch_id'));
|
||||
$this->assertNull(session('bank_login_intended_url'));
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// INTENDED URL VALIDATION TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test that intended URL is properly encoded and decoded
|
||||
*/
|
||||
public function test_intended_url_properly_encoded_and_decoded()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$organization = Organization::factory()->create();
|
||||
$user->organizations()->attach($organization->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$intendedUrl = '/path/with spaces/and?query=params';
|
||||
$encodedUrl = urlencode($intendedUrl);
|
||||
|
||||
$response = $this->get(route('organization.direct-login', [
|
||||
'organizationId' => $organization->id,
|
||||
'intended' => $intendedUrl,
|
||||
]));
|
||||
|
||||
// URL should be properly handled
|
||||
$response->assertRedirect($intendedUrl);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test that direct login handles missing intended URL gracefully
|
||||
*/
|
||||
public function test_direct_login_handles_missing_intended_url_gracefully()
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$organization = Organization::factory()->create();
|
||||
$user->organizations()->attach($organization->id);
|
||||
|
||||
$this->actingAs($user, 'web');
|
||||
|
||||
$response = $this->get(route('organization.direct-login', [
|
||||
'organizationId' => $organization->id,
|
||||
// No 'intended' parameter
|
||||
]));
|
||||
|
||||
// Should redirect to default (main page)
|
||||
$response->assertRedirect(route('main'));
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// MULTI-LAYER AUTHENTICATION FLOW TESTS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Test complete flow: unauthenticated -> user login -> profile login
|
||||
*/
|
||||
public function test_complete_layered_authentication_flow()
|
||||
{
|
||||
$user = User::factory()->create([
|
||||
'email' => 'user@test.com',
|
||||
'password' => Hash::make('user-password'),
|
||||
]);
|
||||
$bank = Bank::factory()->create(['password' => Hash::make('bank-password')]);
|
||||
$user->banksManaged()->attach($bank->id);
|
||||
|
||||
$this->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class);
|
||||
|
||||
// Step 1: Try to access bank direct login while not authenticated
|
||||
$response = $this->get(route('bank.direct-login', [
|
||||
'bankId' => $bank->id,
|
||||
'intended' => '/final/destination',
|
||||
]));
|
||||
|
||||
// Should redirect to user login
|
||||
$response->assertRedirect();
|
||||
$this->assertStringContainsString('login', $response->headers->get('Location'));
|
||||
|
||||
// Step 2: Authenticate as user
|
||||
$this->post(route('login'), [
|
||||
'name' => $user->email,
|
||||
'password' => 'user-password',
|
||||
]);
|
||||
|
||||
$this->assertTrue(Auth::guard('web')->check());
|
||||
|
||||
// Step 3: Now access bank direct login (should redirect to bank password form)
|
||||
$response = $this->get(route('bank.direct-login', [
|
||||
'bankId' => $bank->id,
|
||||
'intended' => '/final/destination',
|
||||
]));
|
||||
|
||||
$response->assertRedirect(route('bank.login'));
|
||||
|
||||
// Step 4: Enter bank password
|
||||
$response = $this->post(route('bank.login.post'), [
|
||||
'password' => 'bank-password',
|
||||
]);
|
||||
|
||||
// Should be authenticated on bank guard and redirected to final destination
|
||||
$this->assertTrue(Auth::guard('bank')->check());
|
||||
$response->assertRedirect('/final/destination');
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user