add password-reset flow: request endpoint + reset page + login link (shared OneTimeToken)

2026-09-25 01:53:03 +02:00 · 2026-08-24 11:36:02 +02:00
parent d7184e4447
commit ddae5d8fef
7 changed files with 269 additions and 10 deletions
@@ -0,0 +1,65 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * OneTimeTokenTest — unit tests for the shared single-use token model.
+ */
+class OneTimeTokenTest extends TestCase
+{
+    private OneTimeToken $ot;
+    private PDO $pdo;
+
+    protected function setUp(): void
+    {
+        TestDatabase::resetData();
+        $this->pdo = TestDatabase::getPDO();
+        $this->ot  = new OneTimeToken($this->pdo);
+    }
+
+    public function testIssueReturns256BitHex(): void
+    {
+        $token = $this->ot->issue('test', 3600);
+        $this->assertMatchesRegularExpression('/^[0-9a-f]{64}$/', $token);
+    }
+
+    public function testIssueStoresOnlyHashAndContext(): void
+    {
+        $token = $this->ot->issue('test', 3600, ['a' => 1]);
+        $row = $this->pdo->query("SELECT * FROM one_time_tokens WHERE purpose = 'test'")->fetch();
+
+        $this->assertNotFalse($row);
+        $this->assertSame(hash('sha256', $token), $row['token_hash']);
+        $this->assertNotSame($token, $row['token_hash']);
+        $this->assertSame(['a' => 1], json_decode($row['context'], true));
+    }
+
+    public function testPurposeIsolation(): void
+    {
+        $token = $this->ot->issue('alpha', 3600);
+        $this->assertFalse($this->ot->isValid('beta', $token));
+    }
+
+    public function testRedeemReturnsContextAndConsumesToken(): void
+    {
+        $token = $this->ot->issue('test', 3600, ['k' => 'v']);
+        $this->assertSame(['k' => 'v'], $this->ot->redeem('test', $token));
+        $this->assertNull($this->ot->redeem('test', $token));
+    }
+
+    public function testExpiredTokenIsInvalidAndLookupStillFindsIt(): void
+    {
+        $token = $this->ot->issue('test', -10, ['k' => 'v']);
+        $this->assertFalse($this->ot->isValid('test', $token));
+        $this->assertNull($this->ot->redeem('test', $token));
+
+        $row = $this->ot->lookup('test', $token);
+        $this->assertNotNull($row);
+        $this->assertSame(['k' => 'v'], $row['context']);
+    }
+
+    public function testLookupUnknownTokenReturnsNull(): void
+    {
+        $this->assertNull($this->ot->lookup('test', str_repeat('ab', 32)));
+    }
+}