public function CasSubscriberTest::testGatewayPaths in CAS 8

Test that the gateway auth works as expected.

File

tests/src/Functional/CasSubscriberTest.php, line 100

Class

CasSubscriberTest

Tests the CAS forced login controller.

Namespace

Drupal\Tests\cas\Functional

Code

public function testGatewayPaths() {
  global $base_path;
  $admin = $this
    ->drupalCreateUser([
    'administer account settings',
  ]);
  $this
    ->drupalLogin($admin);

  // Create some dummy nodes so we have some content paths to work with
  // when triggering forced auth paths.
  $this
    ->drupalCreateContentType([
    'type' => 'page',
    'name' => 'Basic page',
  ]);
  $this
    ->drupalCreateNode();

  // Configure CAS with gateway auth enabled for our node.
  $edit = [
    'server[hostname]' => 'fakecasserver.localhost',
    'server[path]' => '/auth',
    'gateway[check_frequency]' => CasHelper::CHECK_ONCE,
    'gateway[paths][pages]' => "/node/1",
  ];
  $this
    ->drupalPostForm('/admin/config/people/cas', $edit, 'Save configuration');
  $config = $this
    ->config('cas.settings');
  $this
    ->assertEquals(CasHelper::CHECK_ONCE, $config
    ->get('gateway.check_frequency'));
  $this
    ->assertEquals("/node/1", $config
    ->get('gateway.paths')['pages']);
  $this
    ->drupalLogout();
  $this
    ->disableRedirects();
  $this
    ->prepareRequest();

  // Ensure that visiting the page triggers the redirect and the returnto
  // parameter is set bring users back to the page they were on.
  $session = $this
    ->getSession();
  $session
    ->visit($this
    ->buildUrl('node/1', [
    'absolute' => TRUE,
  ]));
  $this
    ->assertEquals(302, $session
    ->getStatusCode());
  $expected_redirect_url = 'https://fakecasserver.localhost/auth/login?' . UrlHelper::buildQuery([
    'gateway' => 'true',
    'service' => $this
      ->buildServiceUrlWithParams([
      'destination' => $base_path . 'node/1',
    ]),
  ]);
  $this
    ->assertEquals($expected_redirect_url, $session
    ->getResponseHeader('Location'));

  // @TODO Test that visting page as a bot does NOT trigger a redirect.
  // We cannot do this at the moment because we can't spoof a user agent!
  // See https://www.drupal.org/node/2820515.
}