Kevin Adametz
67f6906b87
Mit BASIC_AUTH_ENABLED=true (Staging) bekam Stripe für jeden Webhook-Call ein 401 — Zahlungen wurden nie erfüllt. Der Endpoint ist durch die Signaturprüfung (STRIPE_WEBHOOK_SECRET) geschützt. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.3 KiB
PHP
65 lines
2.3 KiB
PHP
<?php
|
|
|
|
use App\Http\Middleware\BasicAuthMiddleware;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
beforeEach(function () {
|
|
config()->set('auth.basic.enabled', true);
|
|
config()->set('auth.basic.user', 'staging');
|
|
config()->set('auth.basic.password', 'secret');
|
|
});
|
|
|
|
function handleBasicAuth(Request $request): Response
|
|
{
|
|
return (new BasicAuthMiddleware)->handle($request, fn () => response('ok'));
|
|
}
|
|
|
|
test('rejects request without credentials', function () {
|
|
$response = handleBasicAuth(Request::create('/dashboard', 'GET'));
|
|
|
|
expect($response->getStatusCode())->toBe(401)
|
|
->and($response->headers->get('WWW-Authenticate'))->toBe('Basic');
|
|
});
|
|
|
|
test('rejects request with wrong password', function () {
|
|
$request = Request::create('/dashboard', 'GET', server: [
|
|
'PHP_AUTH_USER' => 'staging',
|
|
'PHP_AUTH_PW' => 'wrong',
|
|
]);
|
|
|
|
expect(handleBasicAuth($request)->getStatusCode())->toBe(401);
|
|
});
|
|
|
|
test('passes request with correct credentials', function () {
|
|
$request = Request::create('/dashboard', 'GET', server: [
|
|
'PHP_AUTH_USER' => 'staging',
|
|
'PHP_AUTH_PW' => 'secret',
|
|
]);
|
|
|
|
expect(handleBasicAuth($request)->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips gate entirely when disabled', function () {
|
|
config()->set('auth.basic.enabled', false);
|
|
|
|
expect(handleBasicAuth(Request::create('/dashboard', 'GET'))->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips gate when credentials are not configured', function () {
|
|
config()->set('auth.basic.user', null);
|
|
config()->set('auth.basic.password', null);
|
|
|
|
expect(handleBasicAuth(Request::create('/dashboard', 'GET'))->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips basic auth for api and livewire routes', function () {
|
|
expect(handleBasicAuth(Request::create('/api/v1/press-releases', 'GET'))->getStatusCode())->toBe(200)
|
|
->and(handleBasicAuth(Request::create('/livewire/update', 'POST'))->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips basic auth for the stripe webhook', function () {
|
|
// Stripe kann keine Basic-Auth-Zugangsdaten mitsenden — der Endpoint
|
|
// ist stattdessen durch die Webhook-Signaturprüfung geschützt.
|
|
expect(handleBasicAuth(Request::create('/stripe/webhook', 'POST'))->getStatusCode())->toBe(200);
|
|
});
|