3 # tests for Koha::Token
5 # Copyright 2016 Rijksmuseum
7 # This file is part of Koha.
9 # Koha is free software; you can redistribute it and/or modify it
10 # under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # Koha is distributed in the hope that it will be useful, but
15 # WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with Koha; if not, see <http://www.gnu.org/licenses>.
23 use Test::More tests => 13;
25 use Time::HiRes qw|usleep|;
30 C4::Context->_new_userenv('DUMMY SESSION');
31 C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, '');
33 my $tokenizer = Koha::Token->new;
34 is( length( $tokenizer->generate ), 1, "Generate without parameters" );
35 my $token = $tokenizer->generate({ length => 20 });
36 is( length($token), 20, "Token $token has 20 chars" );
38 my $id = $tokenizer->generate({ length => 8 });
39 my $csrftoken = $tokenizer->generate_csrf({ session_id => $id });
40 isnt( length($csrftoken), 0, "Token $csrftoken should not be empty" );
42 is( $tokenizer->check, undef, "Check without any parameters" );
43 my $result = $tokenizer->check_csrf({
44 session_id => $id, token => $csrftoken,
46 is( $result, 1, "CSRF token verified" );
48 $result = $tokenizer->check({
49 type => 'CSRF', id => $id, token => $token,
51 isnt( $result, 1, "This token is no CSRF token" );
53 # Test MaxAge parameter
54 my $age = 1; # 1 second
55 $result = $tokenizer->check_csrf({
56 session_id => $id, token => $csrftoken, MaxAge => $age,
58 is( $result, 1, "CSRF token still valid within one second" );
59 usleep $age * 1000000 * 2; # micro (millionth) seconds + 100%
60 $result = $tokenizer->check_csrf({
61 session_id => $id, token => $csrftoken, MaxAge => $age,
63 isnt( $result, 1, "CSRF token expired after one second" );
65 subtest 'Same id (cookie CGISESSID) with an other logged in user' => sub {
67 $csrftoken = $tokenizer->generate_csrf({ session_id => $id });
68 $result = $tokenizer->check_csrf({
69 session_id => $id, token => $csrftoken,
71 is( $result, 1, "CSRF token verified" );
72 C4::Context->set_userenv(0,43,0,'firstname','surname', 'CPL', 'Library 1', 0, '');
73 $result = $tokenizer->check_csrf({
74 session_id => $id, token => $csrftoken,
76 is( $result, '', "CSRF token is not verified if another logged in user is using the same id" );
79 subtest 'Same logged in user with another session (cookie CGISESSID)' => sub {
81 C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, '');
82 $csrftoken = $tokenizer->generate_csrf({ session_id => $id });
83 $result = $tokenizer->check_csrf({
84 session_id => $id, token => $csrftoken,
86 is( $result, 1, "CSRF token verified" );
87 # Get another session id
88 $id = $tokenizer->generate({ length => 8 });
89 $result = $tokenizer->check_csrf({
90 session_id => $id, token => $csrftoken,
92 is( $result, '', "CSRF token is not verified if another session is used" );
95 subtest 'Pattern parameter' => sub {
97 my $id = $tokenizer->generate({ pattern => '\d\d', length => 8 });
98 is( length($id), 2, 'Pattern overrides length' );
99 ok( $id =~ /\d{2}/, 'Two digits found' );
100 $id = $tokenizer->generate({ pattern => '[A-Z]{10}' });
101 is( length($id), 10, 'Check length again' );
102 ok( $id !~ /[^A-Z]/, 'Only uppercase letters' );
103 throws_ok( sub { $tokenizer->generate({ pattern => 'abc{d,e}', }) }, 'Koha::Exceptions::Token::BadPattern', 'Exception should be thrown when wrong pattern is used');
106 subtest 'JWT' => sub {
110 my $jwt = $tokenizer->generate_jwt({ id => $id });
112 my $is_valid = $tokenizer->check_jwt({ id => $id, token => $jwt });
113 is( $is_valid, 1, 'valid token should return 1' );
115 $is_valid = $tokenizer->check_jwt({ id => 24, token => $jwt });
116 isnt( $is_valid, 1, 'invalid token should not return 1' );
118 my $retrieved_id = $tokenizer->decode_jwt({ token => $jwt });
119 is( $retrieved_id, $id, 'id stored in jwt should be correct' );
122 subtest 'testing _add_default_csrf_params with/without userenv (bug 27849)' => sub {
125 # Current userenv: userid == 42
126 my $result = Koha::Token::_add_default_csrf_params({ session_id => '567' });
127 is( $result->{session_id}, 567, 'Check session id' );
128 is( $result->{id}, '42_567', 'Check userid' );
131 C4::Context::_unset_userenv('DUMMY SESSION');
132 is( C4::Context::userenv, undef, 'No userenv anymore' );
133 $result = Koha::Token::_add_default_csrf_params({}); # pass no session_id
134 is( $result->{session_id}, Koha::Token::DEFA_SESSION_ID, 'Check session id' );
135 is( $result->{id}, Koha::Token::DEFA_SESSION_USERID. '_'. $result->{session_id}, 'Check userid' );