call('get', route('api.ping'), [ 'timestamp' => \gmdate('Y-m-d H:i:s') ]); $response->assertStatus(400); } /** * Test timestamp middleware works as expected. * * @return void */ public function testTimestampMiddleware() { $response = $this->json('get', route('api.ping'), [ 'timestamp' => \gmdate('Y-m-d H:i:s') ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::OK()); } /** * Timestamp middleware should fail if timestamp parameter is missing. * * @return void */ public function testTimestampMiddlewareCheckFailMissing() { $response = $this->json('get', route('api.ping'), []); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $json->assertFragment(['data' => [ 'code' => ApiError::wrongTimeStamp()->value, 'message' => ApiError::wrongTimeStamp()->label ]]); } /** * Timestamp middleware should fail if timestamp parameter has wrong format. * * @return void */ public function testTimestampMiddlewareCheckFailWrongFormat() { $response = $this->json('get', route('api.ping'), ['timestamp' => \gmdate('Y/m/d')]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $json->assertFragment(['data' => [ 'code' => ApiError::wrongTimeStamp()->value, 'message' => ApiError::wrongTimeStamp()->label ]]); } /** * Timestamp middleware should fail if timestamp is older than "config('api.timestampTimeout', 10)". * * @return void */ public function testTimestampMiddlewareCheckFailIfTooOld() { $response = $this->json('get', route('api.ping'), [ 'timestamp' => \gmdate('Y-m-d H:i:s', \time() - config('api.timestampTimeout', 10)) ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $json->assertFragment(['data' => [ 'code' => ApiError::wrongTimeStamp()->value, 'message' => ApiError::wrongTimeStamp()->label ]]); } /** * Test api route throttle. * * ! This has to be the last test of this class. * * @return void */ public function testApiThrottle() { for ($i = config('api.apiRequestRatePerMinute', 100); $i >= 0; $i--) { $this->json('get', route('api.ping'), [ 'timestamp' => \gmdate('Y-m-d H:i:s') ]); } $response = $this->json('get', route('api.ping'), [ 'timestamp' => \gmdate('Y-m-d H:i:s') ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $response->assertStatus(429); } /** * Test wrong http method call * * @return void */ public function testWrongMethodCall() { $response = $this->json('post', route('api.ping'), [ 'timestamp' => \gmdate('Y-m-d H:i:s', \time()) ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $this->assertEquals(ApiError::methodNotAllowed()->value, $json->json('data.code')); } /** * Test Auth fail when no token * * @return void */ public function testAuthFailNoToken() { $response = $this->json('get', route('api.media.show', [ 'apiMedia' => Str::uuid() ]), [ 'timestamp' => \gmdate('Y-m-d H:i:s', \time()) ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $this->assertEquals(ApiError::apiAuthFailed()->value, $json->json('data.code')); } /** * Test Auth fail when unknown token * * @return void */ public function testAuthFailUnknownToken() { $response = $this->json('get', route('api.media.show', [ 'apiMedia' => Str::uuid() ]), [ 'bearer_token' => 'qsdqsdqsd', 'timestamp' => \gmdate('Y-m-d H:i:s', \time()) ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $this->assertEquals(ApiError::apiAuthFailed()->value, $json->json('data.code')); } /** * Test Auth fail when wrong signature * * @return void */ public function testAuthFailWrongSignature() { $apiToken = ApiToken::query()->firstOrFail(); $response = $this->json('get', route('api.media.show', [ 'apiMedia' => Str::uuid() ]), [ 'bearer_token' => $apiToken->public_token, 'timestamp' => \gmdate('Y-m-d H:i:s', \time()), 'signature' => 'sdqdqsdqd' ]); $json = $response->decodeResponseJson(); $this->assertApiResponseStatusIs($json, ApiStatus::KO()); $this->assertEquals(ApiError::apiAuthFailed()->value, $json->json('data.code')); } }