hamedandClaude Opus 4.8
670cef24f4
M6: send-code rate-limited only per IP, so a victim's number could be SMS-flooded from rotating IPs. Add a per-mobile bucket (same 5/hour policy) keyed by the validated mobile. M7: /oauth/token/refresh reused the presented refresh token verbatim (no rotation) and never re-checked the user. The rotation infra already existed (issueTokens mints a fresh refresh token) — the controller just discarded it. Now revoke the presented token (single-use), issue a fresh pair, and reject a suspended user (status != 1). Regressions: tests/Auth/SendCodeMobileRateLimitTest, tests/Auth/RefreshTokenRotationTest (both fail without the fix). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
1.8 KiB
PHP
66 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Auth;
|
|
|
|
use App\Auth\Entity\User;
|
|
use App\Auth\Service\TokenService;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Refresh tokens are single-use (rotated on every refresh) and a suspended user
|
|
* cannot refresh. Guards against replaying a stolen refresh token.
|
|
*/
|
|
class RefreshTokenRotationTest extends ApiTestCase
|
|
{
|
|
private function issueRefresh(User $user): string
|
|
{
|
|
return static::getContainer()->get(TokenService::class)->issueTokens($user)['refresh_token'];
|
|
}
|
|
|
|
private function refresh(string $token): array
|
|
{
|
|
$this->client->request(
|
|
'POST',
|
|
'/oauth/token/refresh',
|
|
server: ['CONTENT_TYPE' => 'application/json'],
|
|
content: json_encode(['refresh_token' => $token]),
|
|
);
|
|
|
|
return json_decode($this->client->getResponse()->getContent(), true) ?? [];
|
|
}
|
|
|
|
public function testTokenIsRotatedAndOldOneRevoked(): void
|
|
{
|
|
$this->client->disableReboot();
|
|
$user = $this->createUser();
|
|
|
|
$old = $this->issueRefresh($user);
|
|
$body = $this->refresh($old);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
$new = $body['refresh_token'];
|
|
$this->assertNotSame($old, $new, 'refresh token was not rotated');
|
|
|
|
// the old token is now single-use-spent → rejected
|
|
$this->refresh($old);
|
|
$this->assertSame(401, $this->responseCode());
|
|
|
|
// the new token still works
|
|
$this->refresh($new);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testSuspendedUserCannotRefresh(): void
|
|
{
|
|
$this->client->disableReboot();
|
|
$user = $this->createUser();
|
|
$token = $this->issueRefresh($user);
|
|
|
|
$user->setStatus(0);
|
|
$this->em->flush();
|
|
|
|
$this->refresh($token);
|
|
$this->assertSame(401, $this->responseCode());
|
|
}
|
|
}
|