|
|
|
@@ -0,0 +1,113 @@
|
|
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
declare(strict_types=1);
|
|
|
|
|
|
|
|
|
|
namespace Mailcow\Tests\Auth;
|
|
|
|
|
|
|
|
|
|
use PDO;
|
|
|
|
|
use PHPUnit\Framework\Attributes\DataProvider;
|
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
|
|
|
|
|
|
require_once __DIR__ . '/../Support/legacy_auth_functions.php';
|
|
|
|
|
require_once __DIR__ . '/../../../data/web/inc/functions.auth.inc.php';
|
|
|
|
|
|
|
|
|
|
// Legacy apppass_login() with its own query, on an in-memory SQLite database
|
|
|
|
|
class AppPasswordLoginTest extends TestCase
|
|
|
|
|
{
|
|
|
|
|
private const PROTOCOLS = ['imap_access', 'smtp_access', 'pop3_access', 'sieve_access', 'eas_access', 'dav_access'];
|
|
|
|
|
|
|
|
|
|
private PDO $pdo;
|
|
|
|
|
|
|
|
|
|
protected function setUp(): void
|
|
|
|
|
{
|
|
|
|
|
$this->pdo = new PDO('sqlite::memory:');
|
|
|
|
|
$this->pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
|
|
|
|
|
$this->pdo->sqliteCreateFunction('regexp', fn ($pattern, $value) => preg_match('/' . $pattern . '/', (string)$value) === 1, 2);
|
|
|
|
|
$this->pdo->exec("CREATE TABLE `domain` (`domain` TEXT PRIMARY KEY, `active` INTEGER NOT NULL DEFAULT 1)");
|
|
|
|
|
$this->pdo->exec("CREATE TABLE `mailbox` (`username` TEXT PRIMARY KEY, `domain` TEXT, `kind` TEXT NOT NULL DEFAULT '',
|
|
|
|
|
`active` INTEGER NOT NULL DEFAULT 1, `attributes` TEXT)");
|
|
|
|
|
$this->pdo->exec("CREATE TABLE `app_passwd` (`id` INTEGER PRIMARY KEY, `name` TEXT, `mailbox` TEXT, `password` TEXT,
|
|
|
|
|
`active` INTEGER NOT NULL DEFAULT 1, " . implode(', ', array_map(fn ($p) => "`$p` INTEGER NOT NULL DEFAULT 0", self::PROTOCOLS)) . ")");
|
|
|
|
|
$GLOBALS['pdo'] = $this->pdo;
|
|
|
|
|
$_SESSION = [];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected function tearDown(): void
|
|
|
|
|
{
|
|
|
|
|
unset($GLOBALS['pdo']);
|
|
|
|
|
$_SESSION = [];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public static function logins(): array
|
|
|
|
|
{
|
|
|
|
|
$off = array_fill_keys(self::PROTOCOLS, '0');
|
|
|
|
|
return [
|
|
|
|
|
// [mailbox, domain active, app password, service, password, result, denied]
|
|
|
|
|
'imap' => [[], 1, ['imap_access' => 1], 'imap', 'app-secret', 'user', false],
|
|
|
|
|
'imap, mailbox imap off' => [['attributes' => $off], 1, ['imap_access' => 1, 'smtp_access' => 1], 'imap', 'app-secret', 'user', false],
|
|
|
|
|
'smtp, mailbox smtp off' => [['attributes' => $off], 1, ['imap_access' => 1, 'smtp_access' => 1], 'smtp', 'app-secret', 'user', false],
|
|
|
|
|
'eas, mailbox eas off' => [['attributes' => $off], 1, ['eas_access' => 1], 'EAS', 'app-secret', 'user', false],
|
|
|
|
|
'dav, mailbox dav off' => [['attributes' => $off], 1, ['dav_access' => 1], 'DAV', 'app-secret', 'user', false],
|
|
|
|
|
// denied: right password, login not allowed
|
|
|
|
|
'protocol not in app password' => [[], 1, ['imap_access' => 1, 'smtp_access' => 1], 'pop3', 'app-secret', false, true],
|
|
|
|
|
'app password inactive' => [[], 1, ['imap_access' => 1, 'active' => 0], 'imap', 'app-secret', false, true],
|
|
|
|
|
'mailbox inactive' => [['active' => 0], 1, ['imap_access' => 1], 'imap', 'app-secret', false, true],
|
|
|
|
|
'mailbox login disabled' => [['active' => 2], 1, ['imap_access' => 1], 'imap', 'app-secret', false, true],
|
|
|
|
|
'domain inactive' => [[], 0, ['imap_access' => 1], 'imap', 'app-secret', false, true],
|
|
|
|
|
'shared mailbox' => [['attributes' => ['shared' => '1']], 1, ['imap_access' => 1], 'imap', 'app-secret', false, true],
|
|
|
|
|
// failed: counted by netfilter
|
|
|
|
|
'wrong password' => [[], 1, ['imap_access' => 1], 'imap', 'wrong', false, false],
|
|
|
|
|
'resource mailbox' => [['kind' => 'location'], 1, ['imap_access' => 1], 'imap', 'app-secret', false, false],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[DataProvider('logins')]
|
|
|
|
|
public function testLogin(array $mailbox, int $domainActive, array $appPasswd, string $service, string $password, string|false $result, bool $denied): void
|
|
|
|
|
{
|
|
|
|
|
$this->addMailbox($mailbox, $domainActive);
|
|
|
|
|
$id = $this->addAppPasswd($appPasswd);
|
|
|
|
|
|
|
|
|
|
$isDenied = false;
|
|
|
|
|
$this->assertSame($result, apppass_login('user@example.org', $password, ['service' => $service, 'is_internal' => true], $isDenied));
|
|
|
|
|
$this->assertSame($denied, $isDenied);
|
|
|
|
|
if ($result !== false) {
|
|
|
|
|
$this->assertEquals($id, $_SESSION['app_passwd_id']);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function testUiLoginWithoutServiceIsRefused(): void
|
|
|
|
|
{
|
|
|
|
|
$this->addMailbox([], 1);
|
|
|
|
|
$this->addAppPasswd(array_fill_keys(self::PROTOCOLS, 1));
|
|
|
|
|
|
|
|
|
|
$this->assertFalse(apppass_login('user@example.org', 'app-secret', ['is_internal' => false]));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function testOtherAppPasswordOfTheMailboxIsTried(): void
|
|
|
|
|
{
|
|
|
|
|
$this->addMailbox(['attributes' => array_fill_keys(self::PROTOCOLS, '0')], 1);
|
|
|
|
|
$this->addAppPasswd(['eas_access' => 1], 'other-secret');
|
|
|
|
|
$id = $this->addAppPasswd(['imap_access' => 1]);
|
|
|
|
|
|
|
|
|
|
$this->assertSame('user', apppass_login('user@example.org', 'app-secret', ['service' => 'imap', 'is_internal' => true]));
|
|
|
|
|
$this->assertEquals($id, $_SESSION['app_passwd_id']);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private function addMailbox(array $mailbox, int $domainActive): void
|
|
|
|
|
{
|
|
|
|
|
$attributes = array_merge(array_fill_keys(self::PROTOCOLS, '1'), ['shared' => '0'], $mailbox['attributes'] ?? []);
|
|
|
|
|
$this->pdo->prepare("INSERT INTO `domain` (`domain`, `active`) VALUES ('example.org', ?)")->execute([$domainActive]);
|
|
|
|
|
$this->pdo->prepare("INSERT INTO `mailbox` (`username`, `domain`, `kind`, `active`, `attributes`) VALUES ('user@example.org', 'example.org', ?, ?, ?)")
|
|
|
|
|
->execute([$mailbox['kind'] ?? '', $mailbox['active'] ?? 1, json_encode($attributes)]);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private function addAppPasswd(array $appPasswd, string $password = 'app-secret'): int
|
|
|
|
|
{
|
|
|
|
|
$row = array_merge(array_fill_keys(self::PROTOCOLS, 0), ['active' => 1], $appPasswd);
|
|
|
|
|
$hash = '{BLF-CRYPT}' . password_hash($password, PASSWORD_BCRYPT, ['cost' => 4]);
|
|
|
|
|
$this->pdo->prepare("INSERT INTO `app_passwd` (`name`, `mailbox`, `password`, " . implode(', ', array_map(fn ($c) => "`$c`", array_keys($row))) . ")
|
|
|
|
|
VALUES ('test', 'user@example.org', ?, " . implode(', ', array_fill(0, count($row), '?')) . ")")
|
|
|
|
|
->execute(array_merge([$hash], array_values($row)));
|
|
|
|
|
return (int)$this->pdo->lastInsertId();
|
|
|
|
|
}
|
|
|
|
|
}
|
FreddleSpl0it