PhpPasswordTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\Core\Password;

use Drupal\Core\Password\PhpPassword;
use Drupal\Core\Password\PasswordInterface;
use Drupal\Tests\UnitTestCase;

/**
 * Unit tests for password hashing API.
 *
 * @coversDefaultClass \Drupal\Core\Password\PhpPassword
 * @group System
 */
class PhpPasswordTest extends UnitTestCase {
    
    /**
     * The raw password.
     */
    protected string $password;
    
    /**
     * The hashed password.
     */
    protected string $passwordHash;
    
    /**
     * The password hasher under test.
     */
    protected PasswordInterface $passwordHasher;
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() : void {
        parent::setUp();
        $this->password = $this->randomMachineName();
        $this->passwordHasher = new PhpPassword(PASSWORD_BCRYPT, [
            'cost' => 5,
        ]);
        $this->passwordHash = $this->passwordHasher
            ->hash($this->password);
    }
    
    /**
     * Tests a password needs update.
     *
     * @covers ::hash
     * @covers ::needsRehash
     */
    public function testPasswordNeedsUpdate() : void {
        $weakHash = (new PhpPassword(PASSWORD_BCRYPT, [
            'cost' => 4,
        ]))->hash($this->password);
        $this->assertTrue($this->passwordHasher
            ->needsRehash($weakHash), 'Password hash with weak cost settings needs a new hash.');
    }
    
    /**
     * Tests password hashing.
     *
     * @covers ::check
     * @covers ::needsRehash
     */
    public function testPasswordChecking() : void {
        $this->assertTrue($this->passwordHasher
            ->check($this->password, $this->passwordHash), 'Password check succeeds.');
        $this->assertFalse($this->passwordHasher
            ->needsRehash($this->passwordHash), 'Does not need a new hash.');
    }
    
    /**
     * Tests password rehashing.
     *
     * @covers ::hash
     * @covers ::check
     * @covers ::needsRehash
     */
    public function testPasswordRehashing() : void {
        // Increment the cost by one.
        $strongHasher = new PhpPassword(PASSWORD_BCRYPT, [
            'cost' => 6,
        ]);
        $this->assertTrue($strongHasher->needsRehash($this->passwordHash), 'Needs a new hash after incrementing the cost option.');
        // Re-hash the password.
        $rehashedPassword = $strongHasher->hash($this->password);
        $this->assertNotEquals($rehashedPassword, $this->passwordHash, 'Password hash changed again.');
        // Now the hash should be OK.
        $this->assertFalse($strongHasher->needsRehash($rehashedPassword), 'Re-hashed password does not need a new hash.');
        $this->assertTrue($strongHasher->check($this->password, $rehashedPassword), 'Password check succeeds with re-hashed password.');
        $this->assertTrue($this->passwordHasher
            ->check($this->password, $rehashedPassword), 'Password check succeeds with re-hashed password with original hasher.');
    }
    
    /**
     * Verifies that passwords longer than 512 bytes are not hashed.
     *
     * @covers ::hash
     *
     * @dataProvider providerLongPasswords
     */
    public function testLongPassword($password, $allowed) : void {
        $passwordHash = $this->passwordHasher
            ->hash($password);
        if ($allowed) {
            $this->assertNotFalse($passwordHash);
        }
        else {
            $this->assertFalse($passwordHash);
        }
    }
    
    /**
     * Provides the test matrix for testLongPassword().
     */
    public static function providerLongPasswords() {
        // '512 byte long password is allowed.'
        $passwords['allowed'] = [
            str_repeat('x', PasswordInterface::PASSWORD_MAX_LENGTH),
            TRUE,
        ];
        // 513 byte long password is not allowed.
        $passwords['too_long'] = [
            str_repeat('x', PasswordInterface::PASSWORD_MAX_LENGTH + 1),
            FALSE,
        ];
        // Check a string of 3-byte UTF-8 characters, 510 byte long password is
        // allowed.
        $len = (int) floor(PasswordInterface::PASSWORD_MAX_LENGTH / 3);
        $diff = PasswordInterface::PASSWORD_MAX_LENGTH % 3;
        $passwords['utf8'] = [
            str_repeat('€', $len),
            TRUE,
        ];
        // 512 byte long password is allowed.
        $passwords['ut8_extended'] = [
            $passwords['utf8'][0] . str_repeat('x', $diff),
            TRUE,
        ];
        // Check a string of 3-byte UTF-8 characters, 513 byte long password is
        // allowed.
        $passwords['utf8_too_long'] = [
            str_repeat('€', $len + 1),
            FALSE,
        ];
        return $passwords;
    }
    
    /**
     * Tests password check in case provided hash is NULL.
     *
     * @covers ::check
     */
    public function testEmptyHash() : void {
        $this->assertFalse($this->passwordHasher
            ->check($this->password, NULL));
        $this->assertFalse($this->passwordHasher
            ->check($this->password, ''));
    }

}