hamedandClaude Opus 4.8
670cef24f4
M6: send-code rate-limited only per IP, so a victim's number could be SMS-flooded from rotating IPs. Add a per-mobile bucket (same 5/hour policy) keyed by the validated mobile. M7: /oauth/token/refresh reused the presented refresh token verbatim (no rotation) and never re-checked the user. The rotation infra already existed (issueTokens mints a fresh refresh token) — the controller just discarded it. Now revoke the presented token (single-use), issue a fresh pair, and reject a suspended user (status != 1). Regressions: tests/Auth/SendCodeMobileRateLimitTest, tests/Auth/RefreshTokenRotationTest (both fail without the fix). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.2 KiB
PHP
35 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Auth;
|
|
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* send-code must cap requests per mobile number, not only per IP — otherwise a
|
|
* victim's number can be SMS-flooded from rotating IPs.
|
|
*/
|
|
class SendCodeMobileRateLimitTest extends ApiTestCase
|
|
{
|
|
public function testPerMobileCapHoldsAcrossDifferentIps(): void
|
|
{
|
|
$this->client->disableReboot();
|
|
$mobile = '0912' . str_pad((string) random_int(0, 9_999_999), 7, '0', STR_PAD_LEFT);
|
|
|
|
$statuses = [];
|
|
for ($i = 0; $i < 6; $i++) {
|
|
// each request from a different IP → the per-IP limiter never fires
|
|
$this->client->request(
|
|
'POST',
|
|
'/api/v1/user/send-code',
|
|
server: ['REMOTE_ADDR' => "10.20.30.$i", 'CONTENT_TYPE' => 'application/json'],
|
|
content: json_encode(['mobile' => $mobile]),
|
|
);
|
|
$statuses[] = $this->client->getResponse()->getStatusCode();
|
|
}
|
|
|
|
// send_code limit is 5/hour → the 6th for the same mobile is rejected
|
|
$this->assertSame(429, $statuses[5], 'per-mobile cap not enforced: ' . implode(',', $statuses));
|
|
$this->assertNotContains(429, array_slice($statuses, 0, 5));
|
|
}
|
|
}
|