bao/portal-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update rm deadcode

Browse Source
This commit is contained in:
baodev0
2026-09-27 11:42:40 +07:00
parent 82a71244ca
commit 3af59bd9c5
129 changed files with 5194 additions and 2698 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/Api/Client/ClientAuthSecurityTest.php
+71
View File
@@ -7,6 +7,7 @@ namespace Tests\Feature\Api\Client;
use App\Mail\Customer\PasswordResetLink;
use App\Models\Customer;
use App\Models\RefreshToken;
use App\Services\Api\Client\ClientAuthService;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Mail;
@@ -138,6 +139,76 @@ class ClientAuthSecurityTest extends TestCase
->getJson('/v1/banks')->assertStatus(429);
}
public function test_logout_revokes_refresh_token_so_it_cannot_be_used_again(): void
{
$customer = Customer::factory()->create(['status' => 1]);
$jwt = \Tymon\JWTAuth\Facades\JWTAuth::fromUser($customer);
$rawRefreshToken = 'raw-refresh-token';
RefreshToken::create([
'customer_id' => $customer->id,
'token' => hash('sha256', $rawRefreshToken),
'expires_at' => now()->addDays(30),
]);
$this->api()->withHeader('Authorization', "Bearer {$jwt}")
->postJson('/v1/client/logout', ['refresh_token' => $rawRefreshToken])
->assertOk();
$this->assertSame(0, RefreshToken::where('customer_id', $customer->id)->count());
$this->api()->postJson('/v1/client/refresh', ['refresh_token' => $rawRefreshToken])
->assertStatus(401);
}
public function test_reused_rotated_refresh_token_revokes_all_tokens_of_customer(): void
{
$customer = Customer::factory()->create(['status' => 1]);
$rawRefreshToken = 'raw-refresh-token';
RefreshToken::create([
'customer_id' => $customer->id,
'token' => hash('sha256', $rawRefreshToken),
'expires_at' => now()->addDays(30),
]);
// Rotation hợp lệ lần đầu: đánh dấu token cũ đã dùng, cấp token mới.
$first = $this->api()->postJson('/v1/client/refresh', ['refresh_token' => $rawRefreshToken])->assertOk();
$newRawRefreshToken = $first->json('data.refresh_token');
$this->assertNotSame($rawRefreshToken, $newRawRefreshToken);
// Token cũ vẫn còn nhưng đã đánh dấu revoked_at, cộng token mới vừa cấp.
$this->assertSame(2, RefreshToken::where('customer_id', $customer->id)->count());
$this->travel(ClientAuthService::REFRESH_TOKEN_REUSE_GRACE_SECONDS + 1)->seconds();
// Dùng lại token cũ (đã rotate): coi như bị lộ, thu hồi toàn bộ token của khách.
$this->api()->postJson('/v1/client/refresh', ['refresh_token' => $rawRefreshToken])
->assertStatus(401);
$this->assertSame(0, RefreshToken::where('customer_id', $customer->id)->count());
// Token mới (hợp lệ, chưa dùng) cũng đã bị thu hồi theo.
$this->api()->postJson('/v1/client/refresh', ['refresh_token' => $newRawRefreshToken])
->assertStatus(401);
}
public function test_concurrent_refresh_within_grace_window_does_not_revoke_sessions(): void
{
$customer = Customer::factory()->create(['status' => 1]);
$rawRefreshToken = 'raw-refresh-token';
RefreshToken::create([
'customer_id' => $customer->id,
'token' => hash('sha256', $rawRefreshToken),
'expires_at' => now()->addDays(30),
]);
$first = $this->api()->postJson('/v1/client/refresh', ['refresh_token' => $rawRefreshToken])->assertOk();
$second = $this->api()->postJson('/v1/client/refresh', ['refresh_token' => $rawRefreshToken])->assertOk();
foreach ([$first, $second] as $response) {
$this->api()->postJson('/v1/client/refresh', ['refresh_token' => $response->json('data.refresh_token')])
->assertOk();
}
}
public function test_legacy_cccd_path_is_not_exposed(): void
{
$customer = Customer::factory()->create(['status' => 1, 'front_identity_number' => '/uploads/2023/11/06/abc.jpg']);