File size: 7,418 Bytes
bf8c0ce | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 | <?php
/**
* Matomo - free/libre analytics platform
*
* @link https://matomo.org
* @license https://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
*/
namespace Piwik\Tests\System;
use Piwik\API\Request;
use Piwik\Date;
use Piwik\Plugins\UsersManager\Model;
use Piwik\Tests\Framework\Fixture;
use Piwik\Tests\Framework\TestCase\SystemTestCase;
/**
* @group Core
*/
class ResponseCodeTest extends SystemTestCase
{
public static function setUpBeforeClass(): void
{
parent::setUpBeforeClass();
$model = new Model();
$model->addUser(
Fixture::VIEW_USER_LOGIN,
Fixture::VIEW_USER_PASSWORD,
'hello2@example.org',
Date::now()->getDatetime()
);
$model->addUserAccess(Fixture::VIEW_USER_LOGIN, 'view', [1]);
$model->addTokenAuth(
Fixture::VIEW_USER_LOGIN,
Fixture::VIEW_USER_TOKEN,
'View user token',
Date::now()->getDatetime()
);
}
public function testApiCallWithoutPermissionShouldHaveCorrectHttpStatus()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl() . 'tests/PHPUnit/proxy/index.php?module=API&method=API.getPhpVersion',
['token_auth' => Fixture::VIEW_USER_TOKEN]
);
// The user doesn't have superuser access, so status code should be 401
$this->assertEquals(401, $info['http_code']);
}
public function testApiShouldHaveCorrectHttpStatus()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl() . 'tests/PHPUnit/proxy/index.php?module=API&method=API.getPhpVersion',
['token_auth' => Fixture::ADMIN_USER_TOKEN]
);
// User has access so status code should be 200
$this->assertEquals(200, $info['http_code']);
}
public function testProcessedApiCallWithExceptionShouldHaveCorrectHttpStatus()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl(
) . 'tests/PHPUnit/proxy/index.php?module=API&method=SitesManager.getSiteUrlsFromId&idSite=1&reThrow=1',
['token_auth' => Fixture::VIEW_USER_TOKEN]
);
// The message and status code from a nested API call should be used if they are not catched.
$this->assertEquals("<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<result>\n <error message=\"You can't access this resource as it requires a 'superuser' access.\" />\n</result>", $response);
$this->assertEquals(401, $info['http_code']);
}
public function testProcessedApiCallWithCaughtExceptionShouldHaveCorrectHttpStatus()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl(
) . 'tests/PHPUnit/proxy/index.php?module=API&method=SitesManager.getSiteUrlsFromId&idSite=1',
['token_auth' => Fixture::VIEW_USER_TOKEN]
);
// Even though the user doesn't have superuser access, the response code should be 200 as the exception in the nested API call is caught
$this->assertEquals("<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<result>error caught</result>", $response);
$this->assertEquals(200, $info['http_code']);
}
public function testProcessedApiShouldHaveCorrectHttpStatus()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl(
) . 'tests/PHPUnit/proxy/index.php?module=API&method=SitesManager.getSiteUrlsFromId&idSite=1',
['token_auth' => Fixture::ADMIN_USER_TOKEN]
);
// The user has access to nested API method, so it's response should be returned
$this->assertEquals("<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<result>no error</result>", $response);
$this->assertEquals(200, $info['http_code']);
}
public function testApiMissingRequiredParameterShouldReturn400()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl() . 'tests/PHPUnit/proxy/index.php?module=API&method=SitesManager.getSiteFromId',
['token_auth' => Fixture::ADMIN_USER_TOKEN]
);
$this->assertEquals(400, $info['http_code']);
$this->assertStringContainsString('Please specify a value for \'idSite\'', $response);
}
public function testValidModuleInvalidActionShouldReturn404()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl() . 'tests/PHPUnit/proxy/index.php?module=CoreHome&action=doesNotExist'
);
$this->assertEquals(404, $info['http_code']);
$this->assertStringContainsString("Action 'doesNotExist' not found in the module 'CoreHome'", $response);
}
public function testMissingAssetChunkShouldReturn404()
{
[, $info] = $this->curl(
Fixture::getRootUrl() . 'tests/PHPUnit/proxy/index.php?module=Proxy&action=getPluginUmdJs&plugin=NotAPlugin'
);
$this->assertEquals(404, $info['http_code']);
}
public function testMissingPluginShouldReturn404HttpStatus()
{
[$response, $info] = $this->curl(
Fixture::getRootUrl() . 'tests/PHPUnit/proxy/index.php?module=NotAPlugin&action=index'
);
$this->assertEquals(404, $info['http_code']);
$this->assertStringContainsString('The plugin NotAPlugin was not found.', $response);
}
private function curl($url, $postParams = [])
{
if (!function_exists('curl_init')) {
$this->markTestSkipped('Curl is not installed');
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postParams);
$response = curl_exec($ch);
$headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$response = substr($response, $headerSize);
$responseInfo = curl_getinfo($ch);
curl_close($ch);
return [$response, $responseInfo];
}
public function provideContainerConfig()
{
return [
'observers.global' => \DI\add(
[
[
'API.Request.intercept',
\DI\value(
function (&$returnedValue, $finalParameters, $pluginName, $methodName, $parametersRequest) {
if ($pluginName !== 'SitesManager' || $methodName !== 'getSiteUrlsFromId') {
return;
}
try {
// This call requires SuperUser access
Request::processRequest('API.getPhpVersion', [], $parametersRequest);
$returnedValue = 'no error';
} catch (\Exception $e) {
$returnedValue = 'error caught';
if (!empty($parametersRequest['reThrow'])) {
throw $e;
}
}
}
),
],
]
),
];
}
}
ResponseCodeTest::$fixture = new Fixture();
|