63 lines
1.9 KiB
PHP
63 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Auth;
|
|
|
|
use App\Auth\Entity\User;
|
|
use App\Auth\Service\TokenService;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Refresh tokens are reusable within their TTL (not single-use rotated — the
|
|
* public site refreshes per server-render and can't persist a rotated token), but
|
|
* a suspended user (status != 1) cannot refresh.
|
|
*/
|
|
class RefreshTokenTest extends ApiTestCase
|
|
{
|
|
private function issueRefresh(User $user): string
|
|
{
|
|
return static::getContainer()->get(TokenService::class)->issueTokens($user)['refresh_token'];
|
|
}
|
|
|
|
private function refresh(string $token): array
|
|
{
|
|
$this->client->request(
|
|
'POST',
|
|
'/oauth/token/refresh',
|
|
server: ['CONTENT_TYPE' => 'application/json'],
|
|
content: json_encode(['refresh_token' => $token]),
|
|
);
|
|
|
|
return json_decode($this->client->getResponse()->getContent(), true) ?? [];
|
|
}
|
|
|
|
public function testTokenIsReusableAndReturnedUnchanged(): void
|
|
{
|
|
$this->client->disableReboot();
|
|
$user = $this->createUser();
|
|
$token = $this->issueRefresh($user);
|
|
|
|
$body = $this->refresh($token);
|
|
$this->assertSame(200, $this->responseCode());
|
|
$this->assertNotEmpty($body['access_token']);
|
|
// not rotated → the same refresh token comes back and stays valid
|
|
$this->assertSame($token, $body['refresh_token']);
|
|
|
|
// reusable: the same token works again (no single-use revocation)
|
|
$this->refresh($token);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testSuspendedUserCannotRefresh(): void
|
|
{
|
|
$this->client->disableReboot();
|
|
$user = $this->createUser();
|
|
$token = $this->issueRefresh($user);
|
|
|
|
$user->setStatus(0);
|
|
$this->em->flush();
|
|
|
|
$this->refresh($token);
|
|
$this->assertSame(401, $this->responseCode());
|
|
}
|
|
}
|