More integration tests

2026-05-26 13:51:13 +00:00 · 2026-04-21 15:13:27 +02:00
parent 99d230c70d
commit eba145ee2d
6 changed files with 449 additions and 3 deletions
@@ -49,7 +49,7 @@ class Update extends Action
                    )
                ],
            ))
-            ->param('duration', null, new Range(60, 31536000), 'Maximum session length in seconds. Minium allowed value is 60 seconds, and maximum is 1 year, which is 31536000 seconds.')
+            ->param('duration', null, new Range(5, 31536000), 'Maximum session length in seconds. Minium allowed value is 5 second, and maximum is 1 year, which is 31536000 seconds.')
            ->inject('response')
            ->inject('dbForPlatform')
            ->inject('project')
@@ -306,7 +306,7 @@ trait PoliciesBase

    public function testUpdateSessionDurationPolicyMin(): void
    {
-        $response = $this->updateSessionDurationPolicy(60);
+        $response = $this->updateSessionDurationPolicy(1);

        $this->assertSame(200, $response['headers']['status-code']);
        $this->assertSame(60, $response['body']['authDuration']);
@@ -325,7 +325,7 @@ trait PoliciesBase

    public function testUpdateSessionDurationPolicyBelowMin(): void
    {
-        $response = $this->updateSessionDurationPolicy(59);
+        $response = $this->updateSessionDurationPolicy(0);

        $this->assertSame(400, $response['headers']['status-code']);
    }
@@ -0,0 +1,104 @@
+<?php
+
+namespace Tests\E2E\Services\Project;
+
+use Tests\E2E\Client;
+use Tests\E2E\Scopes\ProjectCustom;
+use Tests\E2E\Scopes\Scope;
+use Tests\E2E\Scopes\SideServer;
+
+class PoliciesPasswordPersonalDataIntegrationTest extends Scope
+{
+    use ProjectCustom;
+    use SideServer;
+
+    public function testPasswordPersonalDataIntegration(): void
+    {
+        $projectId = $this->getProject()['$id'];
+        $apiKey = $this->getProject()['apiKey'];
+
+        $serverHeaders = [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'x-appwrite-key' => $apiKey,
+        ];
+
+        $setPersonalData = function (bool $enabled) use ($serverHeaders): void {
+            $response = $this->client->call(Client::METHOD_PATCH, '/project/policies/password-personal-data', $serverHeaders, [
+                'enabled' => $enabled,
+            ]);
+            $this->assertSame(200, $response['headers']['status-code']);
+            $this->assertSame($enabled, $response['body']['authPersonalDataCheck']);
+        };
+
+        $buildCases = function (): array {
+            $suffix = \uniqid();
+            $userId = 'personaluser' . $suffix;
+            $emailLocal = 'personalmail' . $suffix;
+            $email = $emailLocal . '@localhost.test';
+            $name = 'Personalname' . $suffix;
+            $phone = '+12025550' . \str_pad((string) \rand(100, 999), 3, '0', STR_PAD_LEFT);
+
+            return [
+                'userId' => [
+                    'userId' => $userId,
+                    'email' => 'safe_' . $suffix . '@localhost.test',
+                    'phone' => '+12025559' . \str_pad((string) \rand(100, 999), 3, '0', STR_PAD_LEFT),
+                    'name' => 'Safe Name',
+                    'password' => $userId . 'extra',
+                ],
+                'email' => [
+                    'userId' => 'safeid' . $suffix,
+                    'email' => $email,
+                    'phone' => '+12025558' . \str_pad((string) \rand(100, 999), 3, '0', STR_PAD_LEFT),
+                    'name' => 'Safe Name',
+                    'password' => 'prefix_' . $emailLocal . '_suffix',
+                ],
+                'name' => [
+                    'userId' => 'safeid2' . $suffix,
+                    'email' => 'safename_' . $suffix . '@localhost.test',
+                    'phone' => '+12025557' . \str_pad((string) \rand(100, 999), 3, '0', STR_PAD_LEFT),
+                    'name' => $name,
+                    'password' => 'prefix' . $name . 'xyz',
+                ],
+                'phone' => [
+                    'userId' => 'safeid3' . $suffix,
+                    'email' => 'safephone_' . $suffix . '@localhost.test',
+                    'phone' => $phone,
+                    'name' => 'Safe Name',
+                    'password' => 'prefix' . \str_replace('+', '', $phone) . 'xyz',
+                ],
+            ];
+        };
+
+        $createUser = function (array $params) use ($serverHeaders): array {
+            return $this->client->call(Client::METHOD_POST, '/users', $serverHeaders, [
+                'userId' => $params['userId'],
+                'email' => $params['email'],
+                'phone' => $params['phone'],
+                'password' => $params['password'],
+                'name' => $params['name'],
+            ]);
+        };
+
+        // Step 1: Enable password personal data policy
+        $setPersonalData(true);
+
+        // Step 2: Each of the four personal-data fields in the password must block user creation
+        foreach ($buildCases() as $field => $params) {
+            $response = $createUser($params);
+            $this->assertSame(400, $response['headers']['status-code'], 'Password containing ' . $field . ' should be rejected');
+            $this->assertSame('password_personal_data', $response['body']['type']);
+        }
+
+        // Step 3: Disable password personal data policy
+        $setPersonalData(false);
+
+        // Step 4: The same categories of passwords should now be accepted (fresh data to avoid uniqueness conflicts)
+        foreach ($buildCases() as $field => $params) {
+            $response = $createUser($params);
+            $this->assertSame(201, $response['headers']['status-code'], 'Password containing ' . $field . ' should be accepted with policy disabled');
+            $this->assertSame($params['userId'], $response['body']['$id']);
+        }
+    }
+}
@@ -0,0 +1,121 @@
+<?php
+
+namespace Tests\E2E\Services\Project;
+
+use Tests\E2E\Client;
+use Tests\E2E\Scopes\ProjectCustom;
+use Tests\E2E\Scopes\Scope;
+use Tests\E2E\Scopes\SideServer;
+use Utopia\Database\Helpers\ID;
+
+class PoliciesSessionAlertIntegrationTest extends Scope
+{
+    use ProjectCustom;
+    use SideServer;
+
+    public function testSessionAlertIntegration(): void
+    {
+        $projectId = $this->getProject()['$id'];
+        $apiKey = $this->getProject()['apiKey'];
+        $password = 'password1234';
+
+        $serverHeaders = [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'x-appwrite-key' => $apiKey,
+        ];
+
+        $publicHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+        ];
+
+        $setSessionAlert = function (bool $enabled) use ($serverHeaders): void {
+            $response = $this->client->call(Client::METHOD_PATCH, '/project/policies/session-alert', $serverHeaders, [
+                'enabled' => $enabled,
+            ]);
+            $this->assertSame(200, $response['headers']['status-code']);
+            $this->assertSame($enabled, $response['body']['authSessionAlerts']);
+        };
+
+        $createUser = function (string $email) use ($serverHeaders, $password): void {
+            $response = $this->client->call(Client::METHOD_POST, '/users', $serverHeaders, [
+                'userId' => ID::unique(),
+                'email' => $email,
+                'password' => $password,
+                'name' => 'Alert User',
+            ]);
+            $this->assertSame(201, $response['headers']['status-code']);
+        };
+
+        $createSession = function (string $email) use ($publicHeaders, $password): void {
+            $response = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $publicHeaders, [
+                'email' => $email,
+                'password' => $password,
+            ]);
+            $this->assertSame(201, $response['headers']['status-code']);
+        };
+
+        $countEmailsTo = function (string $address): int {
+            $emails = \json_decode(\file_get_contents('http://maildev:1080/email'), true) ?? [];
+            $count = 0;
+            foreach ($emails as $email) {
+                foreach ($email['to'] ?? [] as $recipient) {
+                    if (($recipient['address'] ?? '') === $address) {
+                        $count++;
+                    }
+                }
+            }
+            return $count;
+        };
+
+        $assertEmailCountStays = function (string $address, int $expected, int $seconds) use ($countEmailsTo): void {
+            $deadline = \microtime(true) + $seconds;
+            while (\microtime(true) < $deadline) {
+                $this->assertSame($expected, $countEmailsTo($address), 'Unexpected email count for ' . $address);
+                \usleep(500_000);
+            }
+        };
+
+        // Step 1: Disable session alerts
+        $setSessionAlert(false);
+
+        // Step 2: Create user1 and two sessions
+        $user1Email = 'alert1_' . uniqid() . '@localhost.test';
+        $createUser($user1Email);
+        $createSession($user1Email);
+        $createSession($user1Email);
+
+        // Step 3: No alert should arrive in the next 10 seconds
+        $assertEmailCountStays($user1Email, 0, 10);
+
+        // Step 4: Enable session alerts
+        $setSessionAlert(true);
+
+        // Step 5: Create user2 and one session
+        $user2Email = 'alert2_' . uniqid() . '@localhost.test';
+        $createUser($user2Email);
+        $createSession($user2Email);
+
+        // Step 6: First session never alerts, so nothing arrives in 10 seconds
+        $assertEmailCountStays($user2Email, 0, 10);
+
+        // Step 7: Create the second session for user2
+        $createSession($user2Email);
+
+        // Step 8: Session alert email should eventually arrive
+        $this->assertEventually(function () use ($countEmailsTo, $user2Email) {
+            $this->assertSame(1, $countEmailsTo($user2Email));
+        }, 15_000, 500);
+
+        // Step 9: Disable session alerts
+        $setSessionAlert(false);
+
+        // Step 10: Create the third session for user2
+        $createSession($user2Email);
+
+        // Step 11: No additional alert email should arrive in 10 seconds
+        $assertEmailCountStays($user2Email, 1, 10);
+    }
+}
@@ -0,0 +1,102 @@
+<?php
+
+namespace Tests\E2E\Services\Project;
+
+use Tests\E2E\Client;
+use Tests\E2E\Scopes\ProjectCustom;
+use Tests\E2E\Scopes\Scope;
+use Tests\E2E\Scopes\SideServer;
+use Utopia\Database\Helpers\ID;
+
+class PoliciesSessionDurationIntegrationTest extends Scope
+{
+    use ProjectCustom;
+    use SideServer;
+
+    public function testSessionDurationIntegration(): void
+    {
+        $projectId = $this->getProject()['$id'];
+        $apiKey = $this->getProject()['apiKey'];
+
+        $serverHeaders = [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'x-appwrite-key' => $apiKey,
+        ];
+
+        $publicHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+        ];
+
+        $setDuration = function (int $seconds) use ($serverHeaders): void {
+            $response = $this->client->call(Client::METHOD_PATCH, '/project/policies/session-duration', $serverHeaders, [
+                'duration' => $seconds,
+            ]);
+            $this->assertSame(200, $response['headers']['status-code']);
+            $this->assertSame($seconds, $response['body']['authDuration']);
+        };
+
+        // Step 1: Set session duration to 5 seconds
+        $setDuration(5);
+
+        // Step 2: Create user and a session
+        $email = 'duration_' . uniqid() . '@localhost.test';
+        $password = 'password1234';
+
+        $user = $this->client->call(Client::METHOD_POST, '/users', $serverHeaders, [
+            'userId' => ID::unique(),
+            'email' => $email,
+            'password' => $password,
+            'name' => 'Duration User',
+        ]);
+        $this->assertSame(201, $user['headers']['status-code']);
+
+        $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $publicHeaders, [
+            'email' => $email,
+            'password' => $password,
+        ]);
+        $this->assertSame(201, $session['headers']['status-code']);
+        $sessionCookie = $session['cookies']['a_session_' . $projectId];
+
+        $accountHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'cookie' => 'a_session_' . $projectId . '=' . $sessionCookie,
+        ];
+
+        $response = $this->client->call(Client::METHOD_GET, '/account', $accountHeaders);
+        $this->assertSame(200, $response['headers']['status-code']);
+
+        // Step 3: Poll until the 5s TTL elapses - session should expire
+        $this->assertEventually(function () use ($accountHeaders) {
+            $response = $this->client->call(Client::METHOD_GET, '/account', $accountHeaders);
+            $this->assertSame(401, $response['headers']['status-code']);
+        }, 15_000, 500);
+
+        // Step 4: Raise duration to 10s - same session should be usable again
+        $setDuration(10);
+
+        $this->assertEventually(function () use ($accountHeaders) {
+            $response = $this->client->call(Client::METHOD_GET, '/account', $accountHeaders);
+            $this->assertSame(200, $response['headers']['status-code']);
+        }, 15_000, 500);
+
+        // Step 5: Poll until the 10s TTL elapses - session should expire again
+        $this->assertEventually(function () use ($accountHeaders) {
+            $response = $this->client->call(Client::METHOD_GET, '/account', $accountHeaders);
+            $this->assertSame(401, $response['headers']['status-code']);
+        }, 20_000, 500);
+
+        // Step 6: Set duration to 1 year
+        $setDuration(31536000);
+
+        // Step 7: Same session should be usable again
+        $this->assertEventually(function () use ($accountHeaders) {
+            $response = $this->client->call(Client::METHOD_GET, '/account', $accountHeaders);
+            $this->assertSame(200, $response['headers']['status-code']);
+        }, 15_000, 500);
+    }
+}
@@ -0,0 +1,119 @@
+<?php
+
+namespace Tests\E2E\Services\Project;
+
+use Tests\E2E\Client;
+use Tests\E2E\Scopes\ProjectCustom;
+use Tests\E2E\Scopes\Scope;
+use Tests\E2E\Scopes\SideServer;
+use Utopia\Database\Helpers\ID;
+
+class PoliciesSessionInvalidationIntegrationTest extends Scope
+{
+    use ProjectCustom;
+    use SideServer;
+
+    public function testSessionInvalidationIntegration(): void
+    {
+        $projectId = $this->getProject()['$id'];
+        $apiKey = $this->getProject()['apiKey'];
+
+        $serverHeaders = [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'x-appwrite-key' => $apiKey,
+        ];
+
+        $publicHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+        ];
+
+        $setInvalidation = function (bool $enabled) use ($serverHeaders): void {
+            $response = $this->client->call(Client::METHOD_PATCH, '/project/policies/session-invalidation', $serverHeaders, [
+                'enabled' => $enabled,
+            ]);
+            $this->assertSame(200, $response['headers']['status-code']);
+            $this->assertSame($enabled, $response['body']['authInvalidateSessions']);
+        };
+
+        $accountHeaders = function (string $sessionCookie) use ($projectId): array {
+            return [
+                'origin' => 'http://localhost',
+                'content-type' => 'application/json',
+                'x-appwrite-project' => $projectId,
+                'cookie' => 'a_session_' . $projectId . '=' . $sessionCookie,
+            ];
+        };
+
+        $getAccount = function (string $sessionCookie) use ($accountHeaders): array {
+            return $this->client->call(Client::METHOD_GET, '/account', $accountHeaders($sessionCookie));
+        };
+
+        // Step 1: Disable session invalidation
+        $setInvalidation(false);
+
+        // Step 2: Create user and two sessions
+        $email = 'invalidation_' . uniqid() . '@localhost.test';
+        $firstPassword = 'firstpassword';
+
+        $user = $this->client->call(Client::METHOD_POST, '/users', $serverHeaders, [
+            'userId' => ID::unique(),
+            'email' => $email,
+            'password' => $firstPassword,
+            'name' => 'Invalidation User',
+        ]);
+        $this->assertSame(201, $user['headers']['status-code']);
+        $userId = $user['body']['$id'];
+
+        $login = function (string $password) use ($publicHeaders, $email, $projectId): string {
+            $response = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $publicHeaders, [
+                'email' => $email,
+                'password' => $password,
+            ]);
+            $this->assertSame(201, $response['headers']['status-code']);
+            return $response['cookies']['a_session_' . $projectId];
+        };
+
+        $session1 = $login($firstPassword);
+        $session2 = $login($firstPassword);
+
+        $this->assertSame(200, $getAccount($session1)['headers']['status-code']);
+        $this->assertSame(200, $getAccount($session2)['headers']['status-code']);
+
+        // Step 3: Change password while invalidation is disabled - both sessions survive
+        $secondPassword = 'secondpassword';
+        $response = $this->client->call(Client::METHOD_PATCH, '/users/' . $userId . '/password', $serverHeaders, [
+            'password' => $secondPassword,
+        ]);
+        $this->assertSame(200, $response['headers']['status-code']);
+
+        $this->assertEventually(function () use ($getAccount, $session1, $session2) {
+            $this->assertSame(200, $getAccount($session1)['headers']['status-code']);
+            $this->assertSame(200, $getAccount($session2)['headers']['status-code']);
+        }, 15_000, 500);
+
+        // Step 4: Enable session invalidation
+        $setInvalidation(true);
+
+        // Step 5: Change password - both sessions should be invalidated
+        $thirdPassword = 'thirdpassword';
+        $response = $this->client->call(Client::METHOD_PATCH, '/users/' . $userId . '/password', $serverHeaders, [
+            'password' => $thirdPassword,
+        ]);
+        $this->assertSame(200, $response['headers']['status-code']);
+
+        $this->assertEventually(function () use ($getAccount, $session1, $session2) {
+            $this->assertSame(401, $getAccount($session1)['headers']['status-code']);
+            $this->assertSame(401, $getAccount($session2)['headers']['status-code']);
+        }, 15_000, 500);
+
+        // Step 6: Disable session invalidation again
+        $setInvalidation(false);
+
+        // Step 7: Previously-invalidated sessions stay dead
+        $this->assertSame(401, $getAccount($session1)['headers']['status-code']);
+        $this->assertSame(401, $getAccount($session2)['headers']['status-code']);
+    }
+}