class TokenBrowserAccessTestCase

class TokenBrowserAccessTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * Tests that the token tree is only accessible with a valid security token.
   */
  public function testTokenTreeAccess() {
    $admin_user = $this->backdropCreateUser(array('administer site configuration'));
    $this->backdropLogin($admin_user);

    // Following the link provided within a form includes a valid token.
    $this->backdropGet('admin/config/development/maintenance');
    $settings = $this->backdropGetSettings();
    $this->clickLink(t('Browse available tokens.'));
    $this->assertResponse(200, 'Token tree is accessible with a valid security token.');
    $this->assertRaw('data-type="site"', 'Token types are listed in the token tree.');
    $query = backdrop_parse_url($this->getUrl());
    $query = $query['query'];
    $this->assertTrue(!empty($query['token']), 'Token tree link contains a security token.');

    // Requests without a token are denied.
    $this->backdropGet('token/tree');
    $this->assertResponse(403, 'Token tree is not accessible without a security token.');
    $this->backdropGet('token/tree', array('query' => array('token_types' => '"all"')));
    $this->assertResponse(403, 'All token types are not accessible without a security token.');
    $this->assertNoRaw('data-type="site"', 'Token types are not listed without a security token.');

    // Requests with an invalid token are denied.
    $invalid_query = array('token' => $this->randomName(43)) + $query;
    $this->backdropGet('token/tree', array('query' => $invalid_query));
    $this->assertResponse(403, 'Token tree is not accessible with an invalid security token.');

    // A token meant for the individual token endpoint is not accepted.
    $invalid_query = array('token' => $settings['tokenBrowser']['token']) + $query;
    $this->backdropGet('token/tree', array('query' => $invalid_query));
    $this->assertResponse(403, 'Token tree is not accessible with a security token for a different purpose.');

    // A token is only valid for the session for which it was generated.
    $this->backdropLogout();
    $this->backdropGet('token/tree', array('query' => $query));
    $this->assertResponse(403, 'Token tree is not accessible with a security token from another session.');
    $this->backdropGet('token/tree', array('query' => array('token_types' => '"all"')));
    $this->assertResponse(403, 'Token tree is not accessible to anonymous users without a security token.');
  }

  /**
   * Tests that individual tokens are only accessible with a security token.
   */
  public function testTokenEndpointAccess() {
    $admin_user = $this->backdropCreateUser(array('administer site configuration'));
    $this->backdropLogin($admin_user);

    // The page containing the token browser link provides the security token.
    $this->backdropGet('admin/config/development/maintenance');
    $settings = $this->backdropGetSettings();
    $tree_link = $this->xpath('//a[contains(@class, :class)]', array(':class' => 'token-browser-link'));
    $tree_query = backdrop_parse_url((string) $tree_link[0]['href']);
    $query = array(
      'ancestors' => backdrop_json_encode(array('site')),
      'token' => $settings['tokenBrowser']['token'],
      'show_restricted' => 'false',
    );
    $tokens = backdrop_json_decode($this->backdropGet('token-browser/token/site', array('query' => $query)));
    $this->assertResponse(200, 'Tokens are accessible with a valid security token.');
    $this->assertEqual($tokens['name']['raw'], '[site:name]', 'Tokens are listed with a valid security token.');

    // Requests without a token are denied.
    $this->backdropGet('token-browser/token/site', array('query' => array('token' => NULL) + $query));
    $this->assertResponse(403, 'Tokens are not accessible without a security token.');
    $this->assertNoRaw('[site:name]', 'Tokens are not listed without a security token.');

    // Requests with an invalid token are denied.
    $invalid_query = array('token' => $this->randomName(43)) + $query;
    $this->backdropGet('token-browser/token/site', array('query' => $invalid_query));
    $this->assertResponse(403, 'Tokens are not accessible with an invalid security token.');

    // A token meant for the token tree is not accepted.
    $invalid_query = array('token' => $tree_query['query']['token']) + $query;
    $this->backdropGet('token-browser/token/site', array('query' => $invalid_query));
    $this->assertResponse(403, 'Tokens are not accessible with a security token for a different purpose.');

    // A token is only valid for the session for which it was generated.
    $this->backdropLogout();
    $this->backdropGet('token-browser/token/site', array('query' => $query));
    $this->assertResponse(403, 'Tokens are not accessible with a security token from another session.');
    $this->assertNoRaw('[site:name]', 'Tokens are not listed with a security token from another session.');
  }
}