fix(testing): use cookie for testing authentication (#3924)

framework/core/tests/integration/admin/IndexTest.php

@@ -0,0 +1,52 @@
+<?php
+
+/*
+ * This file is part of Flarum.
+ *
+ * For detailed copyright and license information, please view the
+ * LICENSE file that was distributed with this source code.
+ */
+
+namespace Flarum\Tests\integration\admin;
+
+use Flarum\Testing\integration\RetrievesAuthorizedUsers;
+use Flarum\Testing\integration\TestCase;
+
+class IndexTest extends TestCase
+{
+    use RetrievesAuthorizedUsers;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp(): void
+    {
+        $this->prepareDatabase([
+            'users' => [
+                $this->normalUser()
+            ]
+        ]);
+    }
+
+    public function admin_can_access_admin_route(): void
+    {
+        $response = $this->send(
+            $this->request('GET', '/admin', [
+                'authenticatedAs' => 1,
+            ])
+        );
+
+        $this->assertEquals(200, $response->getStatusCode());
+    }
+
+    public function user_cannot_access_admin_route(): void
+    {
+        $response = $this->send(
+            $this->request('GET', '/admin', [
+                'authenticatedAs' => 2,
+            ])
+        );
+
+        $this->assertEquals(403, $response->getStatusCode());
+    }
+}

framework/core/tests/integration/forum/GlobalLogoutTest.php

@@ -59,19 +59,12 @@ class GlobalLogoutTest extends TestCase
      * @dataProvider canGloballyLogoutDataProvider
      * @test
      */
-    public function can_globally_log_out(int $authenticatedAs, string $identification, string $password)
+    public function can_globally_log_out(int $authenticatedAs)
     {
-        $loginResponse = $this->send(
-            $this->request('POST', '/login', [
-                'json' => compact('identification', 'password')
-            ])
-        );
-
         $response = $this->send(
-            $this->requestWithCookiesFrom(
+            $this->request('POST', '/global-logout', [
-                $this->request('POST', '/global-logout'),
+                'authenticatedAs' => $authenticatedAs,
-                $loginResponse,
+            ]),
-            )
         );
 
         $this->assertEquals(204, $response->getStatusCode());
@@ -85,10 +78,10 @@ class GlobalLogoutTest extends TestCase
     {
         return [
             // Admin
-            [1, 'admin', 'password'],
+            [1],
 
             // Normal user
-            [2, 'normal', 'too-obscure'],
+            [2],
         ];
     }
 }

framework/core/tests/integration/forum/IndexTest.php

@@ -9,7 +9,6 @@
 
 namespace Flarum\Tests\integration\forum;
 
-use Flarum\Extend;
 use Flarum\Testing\integration\RetrievesAuthorizedUsers;
 use Flarum\Testing\integration\TestCase;
 
@@ -22,10 +21,6 @@ class IndexTest extends TestCase
      */
     protected function setUp(): void
     {
-        $this->extend(
-            (new Extend\Csrf)->exemptRoute('login')
-        );
-
         $this->prepareDatabase([
             'users' => [
                 $this->normalUser()
@@ -51,18 +46,9 @@ class IndexTest extends TestCase
      */
     public function user_serialized_by_current_user_serializer()
     {
-        $login = $this->send(
-            $this->request('POST', '/login', [
-                'json' => [
-                    'identification' => 'normal',
-                    'password' => 'too-obscure'
-                ]
-            ])
-        );
-
         $response = $this->send(
             $this->request('GET', '/', [
-                'cookiesFrom' => $login
+                'authenticatedAs' => 2,
             ])
         );
 

php-packages/testing/src/integration/BuildsHttpRequests.php

@@ -11,6 +11,7 @@ namespace Flarum\Testing\integration;
 
 use Carbon\Carbon;
 use Dflydev\FigCookies\SetCookie;
+use Flarum\Http\CookieFactory;
 use Illuminate\Support\Str;
 use Laminas\Diactoros\CallbackStream;
 use Psr\Http\Message\ResponseInterface as Response;
@@ -46,11 +47,14 @@ trait BuildsHttpRequests
             'user_id' => $userId,
             'created_at' => Carbon::now()->toDateTimeString(),
             'last_activity_at' => Carbon::now()->toDateTimeString(),
-            'type' => 'session'
+            'type' => 'session_remember'
         ]);
 
+        $cookies = $this->app()->getContainer()->make(CookieFactory::class);
+
         return $req
-            ->withAddedHeader('Authorization', "Token {$token}")
+            ->withAttribute('bypassCsrfToken', true)
+            ->withCookieParams([$cookies->getName('remember') => $token])
             // We save the token as an attribute so that we can retrieve it for test purposes.
             ->withAttribute('tests_token', $token);
     }