put('alice', 'password-alice', 'user'); $users->put('bob', 'password-bob', 'user'); $users->put('root', 'password-root', 'admin'); $users->put('carol', 'password-carol', 'user'); $probe = stream_socket_server('tcp://127.0.0.1:0'); $port = (int) substr((string) stream_socket_get_name($probe, false), strrpos((string) stream_socket_get_name($probe, false), ':') + 1); fclose($probe); $server = proc_open( [PHP_BINARY, '-S', "127.0.0.1:{$port}", '-t', "{$base}/www"], [0 => ['file', '/dev/null', 'r'], 1 => ['file', '/dev/null', 'w'], 2 => ['file', "{$base}/server.log", 'w']], $pipes, null, ['FEUERWERK_DATA' => $data, 'FEUERWERK_QUOTA_BYTES' => (string) QUOTA] + getenv(), ); register_shutdown_function(static function () use ($server, $base): void { proc_terminate($server); exec('rm -rf ' . escapeshellarg($base)); }); /** * One request against the API. * * @param array $headers * @return array{status:int,body:mixed,headers:list} */ function call(string $method, string $route, ?string $cookie = null, mixed $body = null, array $headers = []): array { global $port; $lines = []; if ($cookie !== null) { $lines[] = "Cookie: feuerwerk_session={$cookie}"; } foreach ($headers as $name => $value) { $lines[] = "{$name}: {$value}"; } $content = ''; if (is_string($body)) { $content = $body; $lines[] = 'Content-Type: application/octet-stream'; } elseif ($body !== null) { $content = (string) json_encode($body); $lines[] = 'Content-Type: application/json'; } $context = stream_context_create(['http' => [ 'method' => $method, 'header' => implode("\r\n", $lines), 'content' => $content, 'ignore_errors' => true, 'timeout' => 20, ]]); [$path, $query] = array_pad(explode('&', $route, 2), 2, null); $url = "http://127.0.0.1:{$port}/feuerwerk/api/index.php?r=" . $path . ($query === null ? '' : "&{$query}"); $text = @file_get_contents($url, false, $context); $received = $http_response_header ?? []; preg_match('#^HTTP/\S+ (\d{3})#', $received[0] ?? '', $status); return [ 'status' => (int) ($status[1] ?? 0), 'body' => $text === false || $text === '' ? null : json_decode($text, true), 'headers' => $received, ]; } function signIn(string $name, string $password): string { $answer = call('POST', 'auth/login', null, ['username' => $name, 'password' => $password]); foreach ($answer['headers'] as $line) { if (preg_match('/^Set-Cookie: feuerwerk_session=([^;]+)/i', $line, $match)) { return $match[1]; } } throw new RuntimeException("{$name} could not sign in: " . json_encode($answer)); } $up = false; for ($i = 0; $i < 50 && !$up; $i++) { usleep(100_000); $up = call('GET', 'auth/session')['status'] === 200; } check('the API comes up on its scratch directory', $up, @file_get_contents("{$base}/server.log")); if (!$up) { exit(1); } /** A PNG of one pixel: the smallest image the texture store takes. */ $png = base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=='); $wav = static fn(int $bytes, string $tag): string => 'RIFF' . pack('V', 36) . 'WAVE' . str_repeat("\0", $bytes) . $tag; $alice = signIn('alice', 'password-alice'); $bob = signIn('bob', 'password-bob'); $admin = signIn('root', 'password-root'); // What the matrix asks about: a project of alice's that uses an image of hers, with a snapshot and a // release, and a sound of hers that nothing uses. $project = call('POST', 'projects', $alice, ['name' => 'Alice'])['body']; $texture = call('POST', 'textures&name=a.png', $alice, $png)['body']['file'] ?? ''; $sound = call('POST', 'sounds&name=a.wav', $alice, $wav(32, 'alice'))['body']['file'] ?? ''; $saved = call('PUT', "projects/{$project['id']}", $alice, [ 'revision' => 1, 'project' => ['id' => $project['id'], 'name' => 'Alice', 'assets' => [['id' => 't', 'file' => $texture]]], ]); $snapshot = call('POST', "projects/{$project['id']}/snapshots", $alice, ['name' => 'One'])['body']; $release = call('POST', "projects/{$project['id']}/release", $alice)['body']; check( 'alice has her project, image, sound, snapshot and release', $saved['status'] === 200 && $texture !== '' && $sound !== '' && isset($snapshot['id'], $release['token']), [$saved['status'], $texture, $sound, $snapshot, $release], ); $folder = explode('/', $texture)[0]; $p = $project['id']; $s = $snapshot['id']; $missing = $folder . '/' . str_repeat('0', 64); /** * Method, route, body, the route as the header comment of api/index.php names it, and the status * expected from [signed out, alice who owns it, bob who does not, an administrator]; null where * asking would destroy what the next rows need. * * @var list */ $matrix = [ ['GET', 'auth/session', null, 'GET auth/session', [200, 200, 200, 200]], ['POST', 'auth/login', ['username' => 'carol', 'password' => 'password-carol'], 'POST auth/login', [200, 200, 200, 200]], ['POST', 'auth/logout', null, 'POST auth/logout', [204, null, null, null]], ['POST', 'auth/password', ['currentPassword' => 'x', 'newPassword' => ''], 'POST auth/password', [401, 422, 422, 422]], ['GET', 'users', null, 'GET users', [401, 403, 403, 200]], ['POST', 'users', ['username' => '', 'password' => '', 'role' => 'user'], 'POST users', [401, 403, 403, 422]], ['PATCH', 'users/alice', [], 'PATCH users/{}', [401, 403, 403, 200]], ['DELETE', 'users/nobody', null, 'DELETE users/{}', [401, 403, 403, 404]], ['GET', 'projects', null, 'GET projects', [401, 200, 200, 200]], ['POST', 'projects', ['name' => ''], 'POST projects', [401, 422, 422, 422]], ['GET', "projects/{$p}", null, 'GET projects/{}', [401, 200, 404, 200]], ['PUT', "projects/{$p}", ['revision' => 999, 'project' => []], 'PUT projects/{}', [401, 409, 404, 409]], ['DELETE', "projects/{$p}", null, 'DELETE projects/{}', [401, null, 404, 403]], ['GET', "projects/{$p}/snapshots", null, 'GET projects/{}/snapshots', [401, 200, 404, 200]], ['POST', "projects/{$p}/snapshots", [], 'POST projects/{}/snapshots', [401, 201, 404, 201]], ['DELETE', "projects/{$p}/snapshots/{$s}", null, 'DELETE projects/{}/snapshots/{}', [401, null, 404, null]], ['POST', "projects/{$p}/snapshots/{$s}/restore", ['revision' => -1], 'POST projects/{}/snapshots/{}/restore', [401, 409, 404, 409]], ['GET', "projects/{$p}/release", null, 'GET projects/{}/release', [401, 200, 404, 200]], ['POST', "projects/{$p}/release", null, 'POST projects/{}/release', [401, 200, 404, 200]], ['DELETE', "projects/{$p}/release", null, 'DELETE projects/{}/release', [401, null, 404, null]], ['GET', "releases/{$release['token']}", null, 'GET releases/{}', [200, 200, 200, 200]], ['GET', 'textures', null, 'GET textures', [401, 200, 200, 200]], ['POST', 'textures&name=b.png', $png, 'POST textures', [401, 201, 201, 201]], ['DELETE', "textures/{$texture}", null, 'DELETE textures/{}', [401, 409, 403, 409]], ['GET', 'fonts', null, 'GET fonts', [401, 200, 200, 200]], ['POST', 'fonts&name=x.ttf', 'not a font at all', 'POST fonts', [401, 422, 422, 422]], ['DELETE', "fonts/{$missing}.ttf", null, 'DELETE fonts/{}', [401, 404, 403, 404]], ['GET', 'sounds', null, 'GET sounds', [401, 200, 200, 200]], ['POST', 'sounds&name=b.wav', $wav(32, 'b'), 'POST sounds', [401, 201, 201, 201]], ['DELETE', "sounds/{$sound}", null, 'DELETE sounds/{}', [401, null, 403, null]], ['GET', 'videos', null, 'GET videos', [401, 200, 200, 200]], ['POST', 'videos&name=x.mov&convert=0', 'not a video at all', 'POST videos', [401, 422, 422, 422]], ['POST', "videos/{$missing}.mp4/convert", null, 'POST videos/{}/convert', [401, 404, 403, 404]], ['DELETE', "videos/{$missing}.mp4", null, 'DELETE videos/{}', [401, 404, 403, 404]], ['POST', 'pixels', 'not a cel', 'POST pixels', [401, 422, 422, 422]], ['GET', 'plugins', null, 'GET plugins', [401, 200, 200, 200]], ['GET', 'plugins/nothing.js', null, 'GET plugins/{}', [401, 404, 404, 404]], ]; $actors = ['signed out' => null, 'alice' => $alice, 'bob' => $bob, 'an administrator' => $admin]; foreach ($matrix as [$method, $route, $body, $documented, $expected]) { $got = []; $want = []; foreach (array_values($actors) as $i => $cookie) { if ($expected[$i] === null) { continue; } $got[] = call($method, $route, $cookie, $body)['status']; $want[] = $expected[$i]; } check("{$documented}: " . implode(' / ', array_map( static fn(string $who, ?int $status): string => "{$who} " . ($status ?? '-'), array_keys($actors), $expected, )), $got === $want, $got); } // Every route the API documents is asked about above. preg_match_all('/^\s*\*\s+(GET|POST|PUT|PATCH|DELETE)\s+\?r=([^\s&\[]+)/m', (string) file_get_contents("{$root}/api/index.php"), $found, PREG_SET_ORDER); $documentedRoutes = array_values(array_unique(array_map( static fn(array $m): string => $m[1] . ' ' . preg_replace('/\{[^}]*\}/', '{}', $m[2]), $found, ))); $asked = array_unique(array_column($matrix, 3)); $unasked = array_values(array_diff($documentedRoutes, $asked)); check('every route of the API is in the matrix', count($documentedRoutes) > 30 && $unasked === [], $unasked ?: count($documentedRoutes)); check('and the matrix asks about no route the API does not name', array_values(array_diff($asked, $documentedRoutes)) === [], array_values(array_diff($asked, $documentedRoutes))); // --- Paths, depth and unknown routes -------------------------------------------------------------- check('an unknown route is 401 signed out', call('GET', 'nothing')['status'] === 401); check('and 404 signed in', call('GET', 'nothing', $alice)['status'] === 404); check('a path that climbs out of a store is refused for a user', call('DELETE', 'textures/../users.json', $bob)['status'] === 403); check('and not found for an administrator', call('DELETE', 'textures/../users.json', $admin)['status'] === 404); check('a project id that climbs out is no project id', call('GET', 'projects/..%2Fusers', $alice)['status'] === 400); check('a route deeper than its kind allows is not there', call('GET', "projects/{$p}/snapshots/{$s}/restore/more", $alice)['status'] === 404); check('the accounts file is still there', is_file("{$data}/users.json")); // --- Requests from other sites -------------------------------------------------------------------- check( 'a write from another site is refused before anything else', call('POST', 'projects', $alice, ['name' => 'x'], ['Sec-Fetch-Site' => 'cross-site'])['status'] === 403, ); check( 'so is one from a sibling subdomain', call('POST', 'auth/login', null, ['username' => 'alice', 'password' => 'password-alice'], ['Sec-Fetch-Site' => 'same-site'])['status'] === 403, ); check( 'the editor’s own page passes', call('POST', 'projects', $alice, ['name' => ''], ['Sec-Fetch-Site' => 'same-origin'])['status'] === 422, ); check('reading from another site is no write', call('GET', 'projects', $alice, null, ['Sec-Fetch-Site' => 'cross-site'])['status'] === 200); // --- Quota ---------------------------------------------------------------------------------------- $large = $wav(QUOTA, 'large'); $refused = call('POST', 'sounds&name=large.wav', $alice, $large); check( 'an upload past the quota is refused with 413, saying how full the account is', $refused['status'] === 413 && str_contains((string) ($refused['body']['error'] ?? ''), 'Not enough space'), $refused, ); check('an administrator has no quota', call('POST', 'sounds&name=large.wav', $admin, $large)['status'] === 201); $big = ['id' => $p, 'name' => 'Alice', 'assets' => [], 'pad' => str_repeat('x', QUOTA)]; check('so is a save that would grow a project past it', call('PUT', "projects/{$p}", $alice, ['revision' => 2, 'project' => $big])['status'] === 413); check('a save that keeps it small goes through', call('PUT', "projects/{$p}", $alice, ['revision' => 2, 'project' => ['name' => 'Alice']])['status'] === 200); // --- Sign-ins: the brake ------------------------------------------------------------------------- $gone = signIn('carol', 'password-carol'); check('signing out ends that session', call('POST', 'auth/logout', $gone)['status'] === 204 && call('GET', 'projects', $gone)['status'] === 401); $wrong = []; for ($i = 0; $i < 5; $i++) { $wrong[] = call('POST', 'auth/login', null, ['username' => 'bob', 'password' => 'guess'])['status']; } check('five wrong passwords are five 401', $wrong === [401, 401, 401, 401, 401], $wrong); $locked = call('POST', 'auth/login', null, ['username' => 'bob', 'password' => 'password-bob']); $retry = preg_grep('/^Retry-After: \d+$/i', $locked['headers']); check('then even the right one waits, with 429 and Retry-After', $locked['status'] === 429 && $retry !== [], $locked); check('the session of somebody already signed in goes on', call('GET', 'projects', $alice)['status'] === 200); echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n"; exit($failed === 0 ? 0 : 1);