framework/tests/integration/extenders/CsrfTest.php

71 lines
1.7 KiB
PHP
Raw Normal View History

2020-04-04 03:32:18 +08:00
<?php
/*
* This file is part of Flarum.
*
* For detailed copyright and license information, please view the
* LICENSE file that was distributed with this source code.
*/
namespace Flarum\Tests\integration\extenders;
use Flarum\Extend;
use Flarum\Testing\integration\TestCase;
2020-04-04 03:32:18 +08:00
use Flarum\User\User;
class CsrfTest extends TestCase
{
protected $testUser = [
'username' => 'test',
'password' => 'too-obscure',
'email' => 'test@machine.local',
];
/**
* @test
*/
public function create_user_post_needs_csrf_token_by_default()
{
$response = $this->send(
$this->request('POST', '/api/users', [
'json' => [
'data' => [
'attributes' => $this->testUser
]
],
])
);
$this->assertEquals(400, $response->getStatusCode());
}
/**
* @test
*/
public function create_user_post_doesnt_need_csrf_token_if_whitelisted()
{
$this->extend(
(new Extend\Csrf)
->exemptRoute('users.create')
);
2020-04-04 03:32:18 +08:00
$response = $this->send(
$this->request('POST', '/api/users', [
'json' => [
'data' => [
'attributes' => $this->testUser
]
],
])
2020-04-04 03:32:18 +08:00
);
$this->assertEquals(201, $response->getStatusCode());
$user = User::where('username', $this->testUser['username'])->firstOrFail();
$this->assertEquals(0, $user->is_email_confirmed);
$this->assertEquals($this->testUser['username'], $user->username);
$this->assertEquals($this->testUser['email'], $user->email);
2020-04-04 03:32:18 +08:00
}
}