public function onAuthorization(\ZF\MvcAuth\MvcAuthEvent $e)
{
// For testing purpose we must reset the autorization to not authorized,
// otherwise it would entirely skip the authaurisation step. But there should
// be no side-effect for production
$e->setIsAuthorized(false);
}
public function testBailsEarlyIfMvcAuthEventIsAuthorizedAlready()
{
$listener = $this->listener;
// Setting identity to ensure we don't get a false positive
$this->mvcAuthEvent->setIdentity(new GuestIdentity());
$this->mvcAuthEvent->setIsAuthorized(true);
$this->assertNull($listener($this->mvcAuthEvent));
}
/**
* @covers ZF\Apigility\MvcAuth\UnauthorizedListener::__invoke
*/
public function testInvokePropagates403ResponseWhenAuthorizationHasFailed()
{
$unauthorizedListener = new UnauthorizedListener();
$mvcEvent = new MvcEvent();
$mvcEvent->setResponse(new Response());
$mvcAuthEvent = new MvcAuthEvent($mvcEvent, null, null);
$mvcAuthEvent->setIsAuthorized(false);
$invokeResponse = $unauthorizedListener->__invoke($mvcAuthEvent);
$this->assertInstanceOf('ZF\\ApiProblem\\ApiProblemResponse', $invokeResponse);
$this->assertEquals(403, $invokeResponse->getStatusCode());
$this->assertEquals('Forbidden', $invokeResponse->getReasonPhrase());
}
/**
* Attempt to authorize the discovered identity based on the ACLs present
*
* @param MvcAuthEvent $mvcAuthEvent
* @void
*/
public function __invoke(MvcAuthEvent $mvcAuthEvent)
{
try {
$requestedImage = $this->getServiceLocator()->get('image.requested.image');
} catch (ServiceNotCreatedException $e) {
// service not created caused by service return null (image not found in database)
return $mvcAuthEvent->getMvcEvent()->getResponse()->setStatusCode(404)->send();
}
$authenticatedUser = $this->getServiceLocator()->get('image.authenticated.user');
// check if requested image owned by authenticated user
if ($requestedImage->getId() !== null && $requestedImage->getUser()->getId() != $authenticatedUser->getId()) {
$mvcAuthEvent->setIsAuthorized(false);
}
}
/**
* Trigger the authorization event
*
* @param MvcEvent $mvcEvent
* @return null|Response
*/
public function authorization(MvcEvent $mvcEvent)
{
if (!$mvcEvent->getRequest() instanceof HttpRequest || $mvcEvent->getRequest()->isOptions()) {
return;
}
$responses = $this->events->trigger(MvcAuthEvent::EVENT_AUTHORIZATION, $this->mvcAuthEvent, function ($r) {
return is_bool($r) || $r instanceof Response;
});
$result = $responses->last();
if (is_bool($result)) {
$this->mvcAuthEvent->setIsAuthorized($result);
return;
}
if ($result instanceof Response) {
return $result;
}
}
/**
* @depends testAuthorizedFlagIsFalseByDefault
*/
public function testAuthorizedFlagIsMutable()
{
$this->mvcAuthEvent->setIsAuthorized(true);
$this->assertTrue($this->mvcAuthEvent->isAuthorized());
}