123 lines
4.4 KiB
PHP
123 lines
4.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Integration;
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
use Throwable;
|
|
use App\Auth\PasswordHasher;
|
|
use App\Auth\PinThrottle;
|
|
use App\Core\Config;
|
|
use App\Core\Database;
|
|
|
|
/**
|
|
* Throttle du PIN (RG-T22) contre une vraie MariaDB. Prouve, sur le schema reel :
|
|
* - l'upsert atomique + backoff sur pin_throttle (cle = utilisateur agissant) ;
|
|
* - l'ISOLATION dure vis-a-vis du login : les echecs de PIN ne touchent NI
|
|
* user.failed_login_attempts / user.lockout_until, NI login_throttle.
|
|
*
|
|
* Auto-skip si WAKDO_DB_TESTS != 1 ou base injoignable. Cree un user jetable
|
|
* (email .invalid), supprime en tearDown (la FK ON DELETE CASCADE purge la ligne
|
|
* pin_throttle associee).
|
|
*/
|
|
final class PinThrottleDbTest extends TestCase
|
|
{
|
|
private Database $db;
|
|
private Config $config;
|
|
private int $userId = 0;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
if (getenv('WAKDO_DB_TESTS') !== '1') {
|
|
self::markTestSkipped('Tests DB desactives (definir WAKDO_DB_TESTS=1 + DB_*).');
|
|
}
|
|
|
|
putenv('PIN_THROTTLE_THRESHOLD=5');
|
|
putenv('PIN_THROTTLE_BASE_SECONDS=30');
|
|
putenv('PIN_THROTTLE_MAX_SECONDS=300');
|
|
putenv('PIN_THROTTLE_WINDOW_SECONDS=900');
|
|
|
|
$this->config = new Config();
|
|
$this->db = new Database($this->config);
|
|
|
|
try {
|
|
$this->db->fetch('SELECT 1');
|
|
} catch (Throwable $exception) {
|
|
self::markTestSkipped('Base injoignable: ' . $exception->getMessage());
|
|
}
|
|
|
|
$roleRow = $this->db->fetch('SELECT id FROM role ORDER BY id LIMIT 1');
|
|
$roleId = (int) ($roleRow['id'] ?? 0);
|
|
self::assertGreaterThan(0, $roleId, 'role seede attendu');
|
|
|
|
$hasher = new PasswordHasher($this->config);
|
|
$this->db->execute(
|
|
'INSERT INTO user (email, password_hash, first_name, last_name, role_id, is_active) '
|
|
. 'VALUES (:email, :pwd, :fn, :ln, :role, 1)',
|
|
[
|
|
'email' => 'it-pinthr-' . bin2hex(random_bytes(6)) . '@wakdo.invalid',
|
|
'pwd' => $hasher->hash('IntegrationPass1'),
|
|
'fn' => 'Integration',
|
|
'ln' => 'PinThrottle',
|
|
'role' => $roleId,
|
|
],
|
|
);
|
|
$this->userId = (int) ($this->db->fetch('SELECT LAST_INSERT_ID() AS id')['id'] ?? 0);
|
|
}
|
|
|
|
protected function tearDown(): void
|
|
{
|
|
if ($this->userId === 0) {
|
|
return;
|
|
}
|
|
|
|
// FK ON DELETE CASCADE : la ligne pin_throttle de cet acteur part avec lui.
|
|
$this->db->execute('DELETE FROM user WHERE id = :id', ['id' => $this->userId]);
|
|
$this->userId = 0;
|
|
}
|
|
|
|
private function throttle(): PinThrottle
|
|
{
|
|
return new PinThrottle($this->db, $this->config);
|
|
}
|
|
|
|
public function testRecordFailureIncrementsAndLocksWithoutTouchingLoginCounters(): void
|
|
{
|
|
$now = time();
|
|
$throttle = $this->throttle();
|
|
|
|
for ($i = 0; $i < 5; $i++) {
|
|
$throttle->recordFailure($this->userId, $now);
|
|
}
|
|
|
|
$row = $this->db->fetch('SELECT failed_attempts, lockout_until FROM pin_throttle WHERE actor_user_id = :id', ['id' => $this->userId]);
|
|
self::assertNotNull($row);
|
|
self::assertSame(5, (int) ($row['failed_attempts'] ?? 0));
|
|
self::assertNotNull($row['lockout_until'] ?? null, 'verrou pose au seuil');
|
|
self::assertTrue(strtotime((string) $row['lockout_until']) > $now, 'verrou dans le futur');
|
|
|
|
self::assertTrue($throttle->isLocked($this->userId, $now));
|
|
|
|
// ISOLATION : aucun compteur de connexion touche par les echecs de PIN.
|
|
$userRow = $this->db->fetch('SELECT failed_login_attempts, lockout_until FROM user WHERE id = :id', ['id' => $this->userId]);
|
|
self::assertSame(0, (int) ($userRow['failed_login_attempts'] ?? -1));
|
|
self::assertNull($userRow['lockout_until'] ?? null);
|
|
}
|
|
|
|
public function testResetClearsTheActorRow(): void
|
|
{
|
|
$now = time();
|
|
$throttle = $this->throttle();
|
|
|
|
for ($i = 0; $i < 5; $i++) {
|
|
$throttle->recordFailure($this->userId, $now);
|
|
}
|
|
$throttle->reset($this->userId, $now);
|
|
|
|
$row = $this->db->fetch('SELECT failed_attempts, lockout_until FROM pin_throttle WHERE actor_user_id = :id', ['id' => $this->userId]);
|
|
self::assertSame(0, (int) ($row['failed_attempts'] ?? -1));
|
|
self::assertNull($row['lockout_until'] ?? null);
|
|
self::assertFalse($throttle->isLocked($this->userId, $now));
|
|
}
|
|
}
|