PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

migrate file-access tokens onto shared OneTimeToken model (hash-at-rest)

Browse Source
This commit is contained in:
Pontoporeia
2026-08-24 11:36:02 +02:00
parent 3f1dcf5d43
commit d7184e4447
6 changed files with 122 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/FileAccessTokenTest.php
+11 -5
View File
@@ -55,12 +55,16 @@ class FileAccessTokenTest extends TestCase
$token = $this->db->generateAccessToken($requestId, 24);
$stmt = $this->pdo->prepare('SELECT * FROM file_access_tokens WHERE request_id = ?');
$stmt->execute([$requestId]);
$stmt = $this->pdo->prepare(
"SELECT * FROM one_time_tokens WHERE purpose = 'file_access' ORDER BY id DESC LIMIT 1"
);
$stmt->execute();
$row = $stmt->fetch();
$this->assertNotFalse($row);
$this->assertSame($token, $row['token'], 'Current impl stores the plaintext token');
$this->assertSame(hash('sha256', $token), $row['token_hash'], 'Only the hash is stored, never the plaintext');
$this->assertNotSame($token, $row['token_hash']);
$this->assertSame(['request_id' => $requestId], json_decode($row['context'], true));
$this->assertSame(1, (int) $row['is_valid']);
$this->assertNull($row['used_at']);
$this->assertNotNull($row['expires_at']);
@@ -87,8 +91,10 @@ class FileAccessTokenTest extends TestCase
$this->db->redeemAccessToken($token, '1.2.3.4', 'ua');
$stmt = $this->pdo->prepare('SELECT used_at, is_valid FROM file_access_tokens WHERE request_id = ?');
$stmt->execute([$requestId]);
$stmt = $this->pdo->prepare(
"SELECT used_at, is_valid FROM one_time_tokens WHERE purpose = 'file_access'"
);
$stmt->execute();
$row = $stmt->fetch();
$this->assertNotNull($row['used_at']);