Add PHP unit tests and page tests.

Run "composer install", then "composer test".
2026-09-26 03:48:09 +02:00
parent 848c447c5b
commit ed959888b4
42 changed files with 5522 additions and 0 deletions
@@ -0,0 +1,70 @@
+<?php
+namespace Xxx\Tests\Unit;
+
+use Xxx\Tests\Support\SiteData;
+use Xxx\Tests\Support\TestCase;
+
+// Password hashing and upgrades in session.lib.php
+class PasswordTest extends TestCase {
+  protected function setUp(): void {
+    parent::setUp();
+    open_db('open');
+  }
+
+  private function addEditor(string $hash): void {
+    SiteData::$tables['editors'][] = array('username' => 'ed', 'password' => $hash, 'email' => 'ed@example.org');
+  }
+
+  private function storedHash(): string {
+    return SiteData::$tables['editors'][0]['password'];
+  }
+
+  public function testAlgorithmIsArgon2idWhenAvailable(): void {
+    $this->assertSame(defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : PASSWORD_BCRYPT, password_algorithm());
+  }
+
+  public function testHashIsStoredAndChecked(): void {
+    $this->addEditor('old');
+    $hash = password_hash('secret', password_algorithm());
+    $this->assertTrue(store_password_hash('ed', $hash));
+    $this->assertSame($hash, $this->storedHash());
+    $this->assertTrue(password_hash_is_stored('ed', $hash));
+    $this->assertFalse(password_hash_is_stored('ed', 'other'));
+    $this->assertFalse(password_hash_is_stored('nobody', $hash));
+  }
+
+  public function testCutHashIsNotStored(): void {
+    $this->addEditor('old');
+    SiteData::$passwordLength = 60;
+    $hash = str_repeat('h', 97);
+    $this->assertFalse(store_password_hash('ed', $hash));
+  }
+
+  public function testOldMd5CryptHashIsUpgraded(): void {
+    $old = crypt('secret', '$1$abcdefgh$');
+    $this->assertTrue(password_verify('secret', $old), 'password_verify() still accepts the old hashes');
+    $this->addEditor($old);
+    rehash_password('ed', 'secret', $old);
+    $new = $this->storedHash();
+    $this->assertNotSame($old, $new);
+    $this->assertTrue(password_verify('secret', $new));
+    $this->assertFalse(password_needs_rehash($new, password_algorithm()));
+  }
+
+  public function testCurrentHashIsLeftAlone(): void {
+    $hash = password_hash('secret', password_algorithm());
+    $this->addEditor($hash);
+    rehash_password('ed', 'secret', $hash);
+    $this->assertSame($hash, $this->storedHash());
+    $this->assertSame('', $this->loggedErrors());
+  }
+
+  public function testShortColumnKeepsTheOldHash(): void {
+    $old = crypt('secret', '$1$abcdefgh$');
+    $this->addEditor($old);
+    SiteData::$passwordLength = 50;
+    rehash_password('ed', 'secret', $old);
+    $this->assertSame($old, $this->storedHash());
+    $this->assertStringContainsString('could not store a new password hash for ed; widen editors.password', $this->loggedErrors());
+  }
+}