BookStack Code Mirror - bookstack/blob - tests/Auth/AuthTest.php

   1 <?php
   2
   3 use BookStack\Notifications\ConfirmEmail;
   4 use Illuminate\Support\Facades\Notification;
   5
   6 class AuthTest extends TestCase
   7 {
   8
   9     public function test_auth_working()
  10     {
  11         $this->visit('/')
  12             ->seePageIs('/login');
  13     }
  14
  15     public function test_login()
  16     {
  17         $this->login('[email protected]', 'password')
  18             ->seePageIs('/');
  19     }
  20
  21     public function test_public_viewing()
  22     {
  23         $settings = app('BookStack\Services\SettingService');
  24         $settings->put('app-public', 'true');
  25         $this->visit('/')
  26             ->seePageIs('/')
  27             ->see('Log In');
  28     }
  29
  30     public function test_registration_showing()
  31     {
  32         // Ensure registration form is showing
  33         $this->setSettings(['registration-enabled' => 'true']);
  34         $this->visit('/login')
  35             ->see('Sign up')
  36             ->click('Sign up')
  37             ->seePageIs('/register');
  38     }
  39
  40     public function test_normal_registration()
  41     {
  42         // Set settings and get user instance
  43         $this->setSettings(['registration-enabled' => 'true']);
  44         $user = factory(\BookStack\User::class)->make();
  45
  46         // Test form and ensure user is created
  47         $this->visit('/register')
  48             ->see('Sign Up')
  49             ->type($user->name, '#name')
  50             ->type($user->email, '#email')
  51             ->type($user->password, '#password')
  52             ->press('Create Account')
  53             ->seePageIs('/')
  54             ->see($user->name)
  55             ->seeInDatabase('users', ['name' => $user->name, 'email' => $user->email]);
  56     }
  57
  58
  59     public function test_confirmed_registration()
  60     {
  61         // Fake notifications
  62         Notification::fake();
  63
  64         // Set settings and get user instance
  65         $this->setSettings(['registration-enabled' => 'true', 'registration-confirmation' => 'true']);
  66         $user = factory(\BookStack\User::class)->make();
  67
  68         // Go through registration process
  69         $this->visit('/register')
  70             ->see('Sign Up')
  71             ->type($user->name, '#name')
  72             ->type($user->email, '#email')
  73             ->type($user->password, '#password')
  74             ->press('Create Account')
  75             ->seePageIs('/register/confirm')
  76             ->seeInDatabase('users', ['name' => $user->name, 'email' => $user->email, 'email_confirmed' => false]);
  77
  78         // Ensure notification sent
  79         $dbUser = \BookStack\User::where('email', '=', $user->email)->first();
  80         Notification::assertSentTo($dbUser, ConfirmEmail::class);
  81
  82         // Test access and resend confirmation email
  83         $this->login($user->email, $user->password)
  84             ->seePageIs('/register/confirm/awaiting')
  85             ->see('Resend')
  86             ->visit('/books')
  87             ->seePageIs('/register/confirm/awaiting')
  88             ->press('Resend Confirmation Email');
  89
  90         // Get confirmation and confirm notification matches
  91         $emailConfirmation = DB::table('email_confirmations')->where('user_id', '=', $dbUser->id)->first();
  92         Notification::assertSentTo($dbUser, ConfirmEmail::class, function($notification, $channels) use ($emailConfirmation) {
  93             return $notification->token === $emailConfirmation->token;
  94         });
  95
  96         // Check confirmation email confirmation activation.
  97         $this->visit('/register/confirm/' . $emailConfirmation->token)
  98             ->seePageIs('/')
  99             ->see($user->name)
 100             ->notSeeInDatabase('email_confirmations', ['token' => $emailConfirmation->token])
 101             ->seeInDatabase('users', ['name' => $dbUser->name, 'email' => $dbUser->email, 'email_confirmed' => true]);
 102     }
 103
 104     public function test_restricted_registration()
 105     {
 106         $this->setSettings(['registration-enabled' => 'true', 'registration-confirmation' => 'true', 'registration-restrict' => 'example.com']);
 107         $user = factory(\BookStack\User::class)->make();
 108         // Go through registration process
 109         $this->visit('/register')
 110             ->type($user->name, '#name')
 111             ->type($user->email, '#email')
 112             ->type($user->password, '#password')
 113             ->press('Create Account')
 114             ->seePageIs('/register')
 115             ->dontSeeInDatabase('users', ['email' => $user->email])
 116             ->see('That email domain does not have access to this application');
 117
 118         $user->email = '[email protected]';
 119
 120         $this->visit('/register')
 121             ->type($user->name, '#name')
 122             ->type($user->email, '#email')
 123             ->type($user->password, '#password')
 124             ->press('Create Account')
 125             ->seePageIs('/register/confirm')
 126             ->seeInDatabase('users', ['name' => $user->name, 'email' => $user->email, 'email_confirmed' => false]);
 127     }
 128
 129     public function test_user_creation()
 130     {
 131         $user = factory(\BookStack\User::class)->make();
 132
 133         $this->asAdmin()
 134             ->visit('/settings/users')
 135             ->click('Add New User')
 136             ->type($user->name, '#name')
 137             ->type($user->email, '#email')
 138             ->check('roles[admin]')
 139             ->type($user->password, '#password')
 140             ->type($user->password, '#password-confirm')
 141             ->press('Save')
 142             ->seePageIs('/settings/users')
 143             ->seeInDatabase('users', $user->toArray())
 144             ->see($user->name);
 145     }
 146
 147     public function test_user_updating()
 148     {
 149         $user = $this->getNormalUser();
 150         $password = $user->password;
 151         $this->asAdmin()
 152             ->visit('/settings/users')
 153             ->click($user->name)
 154             ->seePageIs('/settings/users/' . $user->id)
 155             ->see($user->email)
 156             ->type('Barry Scott', '#name')
 157             ->press('Save')
 158             ->seePageIs('/settings/users')
 159             ->seeInDatabase('users', ['id' => $user->id, 'name' => 'Barry Scott', 'password' => $password])
 160             ->notSeeInDatabase('users', ['name' => $user->name]);
 161     }
 162
 163     public function test_user_password_update()
 164     {
 165         $user = $this->getNormalUser();
 166         $userProfilePage = '/settings/users/' . $user->id;
 167         $this->asAdmin()
 168             ->visit($userProfilePage)
 169             ->type('newpassword', '#password')
 170             ->press('Save')
 171             ->seePageIs($userProfilePage)
 172             ->see('Password confirmation required')
 173
 174             ->type('newpassword', '#password')
 175             ->type('newpassword', '#password-confirm')
 176             ->press('Save')
 177             ->seePageIs('/settings/users');
 178
 179             $userPassword = \BookStack\User::find($user->id)->password;
 180             $this->assertTrue(Hash::check('newpassword', $userPassword));
 181     }
 182
 183     public function test_user_deletion()
 184     {
 185         $userDetails = factory(\BookStack\User::class)->make();
 186         $user = $this->getEditor($userDetails->toArray());
 187
 188         $this->asAdmin()
 189             ->visit('/settings/users/' . $user->id)
 190             ->click('Delete User')
 191             ->see($user->name)
 192             ->press('Confirm')
 193             ->seePageIs('/settings/users')
 194             ->notSeeInDatabase('users', ['name' => $user->name]);
 195     }
 196
 197     public function test_user_cannot_be_deleted_if_last_admin()
 198     {
 199         $adminRole = \BookStack\Role::getRole('admin');
 200         // Ensure we currently only have 1 admin user
 201         $this->assertEquals(1, $adminRole->users()->count());
 202         $user = $adminRole->users->first();
 203
 204         $this->asAdmin()->visit('/settings/users/' . $user->id)
 205             ->click('Delete User')
 206             ->press('Confirm')
 207             ->seePageIs('/settings/users/' . $user->id)
 208             ->see('You cannot delete the only admin');
 209     }
 210
 211     public function test_logout()
 212     {
 213         $this->asAdmin()
 214             ->visit('/')
 215             ->seePageIs('/')
 216             ->visit('/logout')
 217             ->visit('/')
 218             ->seePageIs('/login');
 219     }
 220
 221     public function test_reset_password_flow()
 222     {
 223         $this->visit('/login')->click('Forgot Password?')
 224             ->seePageIs('/password/email')
 225             ->type('[email protected]', 'email')
 226             ->press('Send Reset Link')
 227             ->see('A password reset link has been sent to [email protected]');
 228
 229         $this->seeInDatabase('password_resets', [
 230             'email' => '[email protected]'
 231         ]);
 232
 233         $reset = DB::table('password_resets')->where('email', '=', '[email protected]')->first();
 234         $this->visit('/password/reset/' . $reset->token)
 235             ->see('Reset Password')
 236             ->submitForm('Reset Password', [
 237                 'email' => '[email protected]',
 238                 'password' => 'randompass',
 239                 'password_confirmation' => 'randompass'
 240             ])->seePageIs('/')
 241             ->see('Your password has been successfully reset');
 242     }
 243
 244     public function test_reset_password_page_shows_sign_links()
 245     {
 246         $this->setSettings(['registration-enabled' => 'true']);
 247         $this->visit('/password/email')
 248             ->seeLink('Log in')
 249             ->seeLink('Sign up');
 250     }
 251
 252     /**
 253      * Perform a login
 254      * @param string $email
 255      * @param string $password
 256      * @return $this
 257      */
 258     protected function login($email, $password)
 259     {
 260         return $this->visit('/login')
 261             ->type($email, '#email')
 262             ->type($password, '#password')
 263             ->press('Log In');
 264     }
 265 }