BookStack Code Mirror - bookstack/blob - tests/Auth/ResetPasswordTest.php

   1 <?php
   2
   3 namespace Tests\Auth;
   4
   5 use BookStack\Notifications\ResetPassword;
   6 use BookStack\Users\Models\User;
   7 use Illuminate\Support\Facades\Notification;
   8 use Tests\TestCase;
   9
  10 class ResetPasswordTest extends TestCase
  11 {
  12     public function test_reset_flow()
  13     {
  14         Notification::fake();
  15
  16         $resp = $this->get('/login');
  17         $this->withHtml($resp)->assertElementContains('a[href="' . url('/password/email') . '"]', 'Forgot Password?');
  18
  19         $resp = $this->get('/password/email');
  20         $this->withHtml($resp)->assertElementContains('form[action="' . url('/password/email') . '"]', 'Send Reset Link');
  21
  22         $resp = $this->post('/password/email', [
  23             'email' => '[email protected]',
  24         ]);
  25         $resp->assertRedirect('/password/email');
  26
  27         $resp = $this->get('/password/email');
  28         $resp->assertSee('A password reset link will be sent to [email protected] if that email address is found in the system.');
  29
  30         $this->assertDatabaseHas('password_resets', [
  31             'email' => '[email protected]',
  32         ]);
  33
  34         /** @var User $user */
  35         $user = User::query()->where('email', '=', '[email protected]')->first();
  36
  37         Notification::assertSentTo($user, ResetPassword::class);
  38         $n = Notification::sent($user, ResetPassword::class);
  39
  40         $this->get('/password/reset/' . $n->first()->token)
  41             ->assertOk()
  42             ->assertSee('Reset Password');
  43
  44         $resp = $this->post('/password/reset', [
  45             'email'                 => '[email protected]',
  46             'password'              => 'randompass',
  47             'password_confirmation' => 'randompass',
  48             'token'                 => $n->first()->token,
  49         ]);
  50         $resp->assertRedirect('/');
  51
  52         $this->get('/')->assertSee('Your password has been successfully reset');
  53     }
  54
  55     public function test_reset_flow_shows_success_message_even_if_wrong_password_to_prevent_user_discovery()
  56     {
  57         $this->get('/password/email');
  58         $resp = $this->followingRedirects()->post('/password/email', [
  59             'email' => '[email protected]',
  60         ]);
  61         $resp->assertSee('A password reset link will be sent to [email protected] if that email address is found in the system.');
  62         $resp->assertDontSee('We can\'t find a user');
  63
  64         $this->get('/password/reset/arandometokenvalue')->assertSee('Reset Password');
  65         $resp = $this->post('/password/reset', [
  66             'email'                 => '[email protected]',
  67             'password'              => 'randompass',
  68             'password_confirmation' => 'randompass',
  69             'token'                 => 'arandometokenvalue',
  70         ]);
  71         $resp->assertRedirect('/password/reset/arandometokenvalue');
  72
  73         $this->get('/password/reset/arandometokenvalue')
  74             ->assertDontSee('We can\'t find a user')
  75             ->assertSee('The password reset token is invalid for this email address.');
  76     }
  77
  78     public function test_reset_page_shows_sign_links()
  79     {
  80         $this->setSettings(['registration-enabled' => 'true']);
  81         $resp = $this->get('/password/email');
  82         $this->withHtml($resp)->assertElementContains('a', 'Log in')
  83             ->assertElementContains('a', 'Sign up');
  84     }
  85
  86     public function test_reset_request_is_throttled()
  87     {
  88         $editor = $this->users->editor();
  89         Notification::fake();
  90         $this->get('/password/email');
  91         $this->followingRedirects()->post('/password/email', [
  92             'email' => $editor->email,
  93         ]);
  94
  95         $resp = $this->followingRedirects()->post('/password/email', [
  96             'email' => $editor->email,
  97         ]);
  98         Notification::assertTimesSent(1, ResetPassword::class);
  99         $resp->assertSee('A password reset link will be sent to ' . $editor->email . ' if that email address is found in the system.');
 100     }
 101 }