ldc-dam/tests/Api/ApiBaseTest.php

<?php

namespace Tests\Api;

use App\Enums\Legacy\ApiError;
use App\Enums\Legacy\ApiStatus;
use App\Models\Api\ApiToken;
use Illuminate\Foundation\Testing\DatabaseTransactions;
use Illuminate\Support\Str;
use Tests\CreatesApplication;

class ApiBaseTest extends ApiBase
{
    use CreatesApplication;
    use DatabaseTransactions;

    /**
     * Test Api only handle json calls
     *
     * @return void
     */
    public function testOnlyJsonCallsAreHandled()
    {
        $response = $this->call('get', route('api.ping'), [
            'timestamp' => \gmdate('Y-m-d H:i:s')
        ]);
        $response->assertStatus(400);
    }

    /**
     * Test timestamp middleware works as expected.
     *
     * @return void
     */
    public function testTimestampMiddleware()
    {
        $response = $this->json('get', route('api.ping'), [
            'timestamp' => \gmdate('Y-m-d H:i:s')
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::OK());
    }

    /**
     * Timestamp middleware should fail if timestamp parameter is missing.
     *
     * @return void
     */
    public function testTimestampMiddlewareCheckFailMissing()
    {
        $response = $this->json('get', route('api.ping'), []);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $json->assertFragment(['data' => [
            'code' => ApiError::wrongTimeStamp()->value,
            'message' => ApiError::wrongTimeStamp()->label
        ]]);
    }

    /**
     * Timestamp middleware should fail if timestamp parameter has wrong format.
     *
     * @return void
     */
    public function testTimestampMiddlewareCheckFailWrongFormat()
    {
        $response = $this->json('get', route('api.ping'), ['timestamp' => \gmdate('Y/m/d')]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $json->assertFragment(['data' => [
            'code' => ApiError::wrongTimeStamp()->value,
            'message' => ApiError::wrongTimeStamp()->label
        ]]);
    }

    /**
     * Timestamp middleware should fail if timestamp is older than "config('api.timestampTimeout', 10)".
     *
     * @return void
     */
    public function testTimestampMiddlewareCheckFailIfTooOld()
    {
        $response = $this->json('get', route('api.ping'), [
            'timestamp' => \gmdate('Y-m-d H:i:s', \time() - config('api.timestampTimeout', 10))
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $json->assertFragment(['data' => [
            'code' => ApiError::wrongTimeStamp()->value,
            'message' => ApiError::wrongTimeStamp()->label
        ]]);
    }

    /**
     * Test api route throttle.
     *
     * ! This has to be the last test of this class.
     *
     * @return void
     */
    public function testApiThrottle()
    {
        for ($i = config('api.apiRequestRatePerMinute', 100); $i >= 0; $i--) {
            $this->json('get', route('api.ping'), [
                'timestamp' => \gmdate('Y-m-d H:i:s')
            ]);
        }

        $response = $this->json('get', route('api.ping'), [
            'timestamp' => \gmdate('Y-m-d H:i:s')
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $response->assertStatus(429);
    }

    /**
     * Test wrong http method call
     *
     * @return void
     */
    public function testWrongMethodCall()
    {
        $response = $this->json('post', route('api.ping'), [
            'timestamp' => \gmdate('Y-m-d H:i:s', \time())
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $this->assertEquals(ApiError::methodNotAllowed()->value, $json->json('data.code'));
    }

    /**
     * Test Auth fail when no token
     *
     * @return void
     */
    public function testAuthFailNoToken()
    {
        $response = $this->json('get', route('api.media.show', [
            'apiMedia' => Str::uuid()
        ]), [
            'timestamp' => \gmdate('Y-m-d H:i:s', \time())
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $this->assertEquals(ApiError::apiAuthFailed()->value, $json->json('data.code'));
    }

    /**
     * Test Auth fail when unknown token
     *
     * @return void
     */
    public function testAuthFailUnknownToken()
    {
        $response = $this->json('get', route('api.media.show', [
            'apiMedia' => Str::uuid()
        ]), [
            'bearer_token' => 'qsdqsdqsd',
            'timestamp' => \gmdate('Y-m-d H:i:s', \time())
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $this->assertEquals(ApiError::apiAuthFailed()->value, $json->json('data.code'));
    }

    /**
     * Test Auth fail when wrong signature
     *
     * @return void
     */
    public function testAuthFailWrongSignature()
    {
        $apiToken = ApiToken::query()->firstOrFail();
        $response = $this->json('get', route('api.media.show', [
            'apiMedia' => Str::uuid()
        ]), [
            'bearer_token' => $apiToken->public_token,
            'timestamp' => \gmdate('Y-m-d H:i:s', \time()),
            'signature' => 'sdqdqsdqd'
        ]);
        $json     = $response->decodeResponseJson();
        $this->assertApiResponseStatusIs($json, ApiStatus::KO());
        $this->assertEquals(ApiError::apiAuthFailed()->value, $json->json('data.code'));
    }
}