delete(tests): remove RefreshTokenRotationTest as it is no longer needed

2026-06-28 21:52:52 +03:30
parent 2f3f25f48e
commit c2b47d6396
1 changed files with 0 additions and 65 deletions
@@ -1,65 +0,0 @@
 <?php
 namespace App\Tests\Auth;
 use App\Auth\Entity\User;
 use App\Auth\Service\TokenService;
 use App\Tests\ApiTestCase;
 /**
 * Refresh tokens are single-use (rotated on every refresh) and a suspended user
 * cannot refresh. Guards against replaying a stolen refresh token.
 */
 class RefreshTokenRotationTest extends ApiTestCase
 {
    private function issueRefresh(User $user): string
    {
        return static::getContainer()->get(TokenService::class)->issueTokens($user)['refresh_token'];
    }
    private function refresh(string $token): array
    {
        $this->client->request(
            'POST',
            '/oauth/token/refresh',
            server: ['CONTENT_TYPE' => 'application/json'],
            content: json_encode(['refresh_token' => $token]),
        );
        return json_decode($this->client->getResponse()->getContent(), true) ?? [];
    }
    public function testTokenIsRotatedAndOldOneRevoked(): void
    {
        $this->client->disableReboot();
        $user = $this->createUser();
        $old  = $this->issueRefresh($user);
        $body = $this->refresh($old);
        $this->assertSame(200, $this->responseCode());
        $new = $body['refresh_token'];
        $this->assertNotSame($old, $new, 'refresh token was not rotated');
        // the old token is now single-use-spent → rejected
        $this->refresh($old);
        $this->assertSame(401, $this->responseCode());
        // the new token still works
        $this->refresh($new);
        $this->assertSame(200, $this->responseCode());
    }
    public function testSuspendedUserCannotRefresh(): void
    {
        $this->client->disableReboot();
        $user = $this->createUser();
        $token = $this->issueRefresh($user);
        $user->setStatus(0);
        $this->em->flush();
        $this->refresh($token);
        $this->assertSame(401, $this->responseCode());
    }
 }