<?php
/**
* SeekQuarry/Yioop --
* Open Source Pure PHP Search Engine, Crawler, and Indexer
*
* Copyright (C) 2009 - 2026 Chris Pollett chris@pollett.org
*
* LICENSE:
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* END LICENSE
*
* @author Chris Pollett chris@pollett.org
* @license https://www.gnu.org/licenses/ GPL3
* @link https://www.seekquarry.com/
* @copyright 2009 - 2026
* @filesource
*/
namespace seekquarry\yioop\tests;
use seekquarry\yioop\configs as C;
use seekquarry\yioop\library as L;
use seekquarry\yioop\library\UnitTest;
use seekquarry\yioop\models\SigninModel;
use seekquarry\yioop\models\ProfileModel;
use seekquarry\yioop\models\datasources\Sqlite3Manager;
/**
* Tests the one-time sign-in code storage on SigninModel: storing a code,
* reading it back, replacing it when a new one is requested, counting
* wrong guesses, and deleting it so it can only ever be used once. It also
* tests the LDAP account lookups: turning the email a directory returns
* into the Yioop account that owns it, finding emails shared by more than
* one account, and reporting whether an email is already taken by another
* account. Each test runs against a fresh throwaway sqlite file so the
* behavior is exercised in isolation.
*
* @author Chris Pollett
*/
class SigninModelTest extends UnitTest
{
/**
* Filesystem path for the throwaway test DB
* @var string
*/
public $db_path;
/**
* Model under test
* @var SigninModel
*/
public $model;
/**
* Sets up an empty DB holding the SIGNIN_CODE table for the one-time
* code tests and a small USERS table for the LDAP email-to-account
* lookup tests, then hands it to a fresh model instance.
*/
public function setUp()
{
$tag = getmypid() . "_" . random_int(1000, 9999);
$this->db_path = C\WORK_DIRECTORY . "/temp/" .
"signin_code_test_$tag.db";
$db = new Sqlite3Manager();
$db->connect("", "", "", $this->db_path);
/* Build the tables from ProfileModel's definitions, the same ones the
live database uses, so this test tracks any schema change rather
than hand-copied CREATE TABLEs that could drift. */
$dbinfo = ["DBMS" => "Sqlite3", "DB_HOST" => ""];
$profile = new ProfileModel(C\DB_NAME, false);
$profile->initializeSql($db, $dbinfo);
foreach (['SIGNIN_CODE', 'USERS'] as $table) {
$db->execute($profile->create_statements[$table]);
}
$this->model = new SigninModel(C\DB_NAME, false);
$this->model->db = $db;
}
/**
* Disconnects and removes the throwaway DB.
*/
public function tearDown()
{
if ($this->model && $this->model->db) {
$this->model->db->disconnect();
unset(Sqlite3Manager::$active_connections[
$this->model->db->connect_string]);
}
if ($this->db_path && file_exists($this->db_path)) {
unlink($this->db_path);
}
}
/**
* Counting must work out each witness's value from the random one the
* ballot drew when it started, so the ballot has to give that value
* back by witness position. A position the ballot does not have gives
* nothing rather than a wrong value.
*/
public function witnessSeedKeptTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_seed_" . getmypid() .
".txt";
$first = random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES);
$second = random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES);
file_put_contents($path, "-----SEEDS-----\n" .
base64_encode($first) . "\n" . base64_encode($second) .
"\n-----KEY-----\nsomething\n");
$this->assertEqual($first, $model->witnessSeedKept($path, 0),
"the first witness's value comes back");
$this->assertEqual($second, $model->witnessSeedKept($path, 1),
"the second witness's value comes back");
$this->assertTrue(!$model->witnessSeedKept($path, 7),
"a witness the ballot does not have gives nothing");
$this->assertTrue(!$model->witnessSeedKept($path, false),
"a name that is not a witness gives nothing");
unlink($path);
}
/**
* A witness who gave their password by mail is not present when the
* ballot is counted, so the value their password makes may be handed
* in already worked out. Doing that must build the same keys as
* having the password itself.
*/
public function keysFromWorkedOutValuesTestCase()
{
$model = $this->model;
$witnesses = ["alice", "bob"];
$passwords = ["one", "two"];
$seeds = [random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES)];
list(, $with_password) = $model->createWitnessKeyPair($witnesses,
$passwords, $seeds);
$hashes = [];
foreach ($witnesses as $at => $witness) {
$hashes[$at] = hash('sha256', $seeds[$at] . $witness .
$passwords[$at], true);
}
list(, $with_values) = $model->createWitnessKeyPair($witnesses,
[], $seeds, $hashes);
$this->assertEqual($with_password, $with_values,
"worked-out values build the same public key as passwords");
}
/**
* The check that says whether anything read a round's key file is
* only as good as the file system under it, so the site has to be
* able to say whether a read moves an access time there and warn
* where it does not. The answer must be one of three known ones, and
* it must not leave its probe file behind.
*/
public function keyFileWatchfulnessTestCase()
{
$model = $this->model;
$before = count(glob(C\TEMP_DIR . "/*.txt"));
$said = $model->keyFileWatchfulness();
$this->assertTrue(in_array($said,
["watched", "unwatched", "unknown"]),
"the answer is one the caller knows how to read");
$this->assertEqual($before, count(glob(C\TEMP_DIR . "/*.txt")),
"asking leaves no file behind");
$this->assertEqual($said, $model->keyFileWatchfulness(),
"asking twice gives the same answer");
}
/**
* Once every witness has contributed, the ballot's keys are made from
* the parts they left, and the round is then put beyond reach. A
* round whose key file has been read gives nothing back, since the
* parts could have been taken and the ballot has to be begun again.
*/
public function finishWitnessRoundTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_finish_" . getmypid() .
".txt";
$page_hash = "finish" . getmypid();
$witnesses = ["alice", "bob"];
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$public = $model->openWitnessRound($path, $page_hash);
$model->keepWitnessShare($path, "alice", $public,
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
hash('sha256', "alice-part", true));
$this->assertTrue(!$model->finishWitnessRound($path, $page_hash,
$witnesses), "a round short of a witness is not finished");
$model->keepWitnessShare($path, "bob", $public,
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
hash('sha256', "bob-part", true));
$made = $model->finishWitnessRound($path, $page_hash, $witnesses);
$this->assertTrue($made !== false,
"a round every witness has answered is finished");
$this->assertEqual(3, count($made[0]),
"one value for each witness and one for the seed");
$this->assertEqual(SODIUM_CRYPTO_BOX_PUBLICKEYBYTES,
strlen($made[1]), "a public key comes back");
$model->closeWitnessRound($path, $page_hash);
$this->assertTrue(!file_exists($path),
"closing the round takes its file away");
}
/**
* A round whose key file has been read must not be finished, because
* the parts waiting in it could have been opened by somebody else.
*/
public function finishRefusesAReadRoundTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_read_" . getmypid() .
".txt";
$page_hash = "read" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$public = $model->openWitnessRound($path, $page_hash);
$model->keepWitnessShare($path, "alice", $public,
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
hash('sha256', "alice-part", true));
$key_file = $model->witnessRoundKeyFile($page_hash);
touch($key_file, filemtime($key_file), time() + 60);
clearstatcache(true, $key_file);
$this->assertTrue(!$model->finishWitnessRound($path, $page_hash,
["alice"]), "a round whose key was read is refused");
$model->closeWitnessRound($path, $page_hash);
$this->assertTrue(!file_exists($path),
"closing the round takes its file away");
}
/**
* A witness acting by mail is not at the form when the others are, so
* their part waits in the ballot's secrets file. It must wait sealed
* to the round's public key, whose secret half sits in a file of its
* own, so what waits in the secrets file is of no use to a reader of
* that file alone.
*/
public function witnessRoundSealsPartsTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_round_" . getmypid() .
".txt";
$page_hash = "hash" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$public = $model->openWitnessRound($path, $page_hash);
$model->keepWitnessShare($path, "alice", $public, "rand-a",
"hash-a");
$model->keepWitnessShare($path, "bob", $public, "rand-b",
"hash-b");
$said = file_get_contents($path);
$this->assertTrue(strpos($said, "hash-a") === false,
"no part is in the file as itself");
$this->assertTrue(strpos($said, "-----SEEDS-----") !== false,
"what the file already held is still there");
$opened = $model->openWitnessShares($path, $page_hash);
$this->assertEqual(2, count($opened), "both parts open");
$this->assertEqual("hash-a", $opened["alice"]["hash"],
"the first witness's value comes back");
$this->assertEqual("rand-b", $opened["bob"]["random"],
"the second witness's random value comes back");
$model->closeWitnessRound($path, $page_hash);
$this->assertTrue(!file_exists($path),
"closing the round takes its file away");
$this->assertTrue(!file_exists(
$model->witnessRoundKeyFile($page_hash)),
"closing the round deletes the key file");
}
/**
* A file written once has the same access time as change time, and
* several file systems move an access time on a read only when it
* already lags the change time. A round's key file must therefore be
* left with its access time behind, or a reader would never show.
*/
public function keyFileIsLeftAbleToReportAReadTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_lag_" . getmypid() .
".txt";
$page_hash = "lag" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$model->openWitnessRound($path, $page_hash);
$key_file = $model->witnessRoundKeyFile($page_hash);
clearstatcache(true, $key_file);
$this->assertTrue(fileatime($key_file) < filemtime($key_file),
"the key file's access time lags its change time");
$model->closeWitnessRound($path, $page_hash);
}
/**
* Either time moving means somebody has been at the key: a read moves
* the access time, a write moves the change time. A file system that
* will not report a read still reports a change, so both are watched.
*/
public function roundNoticesAChangeAsWellAsAReadTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_change_" . getmypid() .
".txt";
$page_hash = "change" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$model->openWitnessRound($path, $page_hash);
$key_file = $model->witnessRoundKeyFile($page_hash);
$this->assertTrue($model->witnessRoundIsIntact($path, $page_hash),
"a round nothing has read or changed is still good");
clearstatcache(true, $key_file);
touch($key_file, filemtime($key_file) + 60, fileatime($key_file));
clearstatcache(true, $key_file);
$this->assertTrue(!$model->witnessRoundIsIntact($path,
$page_hash), "a key file that was written to is not intact");
$model->closeWitnessRound($path, $page_hash);
}
/**
* A round whose key file has been read by somebody is one where the
* parts could have been opened, so it must be refused rather than
* finished. The check is the key file's access time against the one
* written down when the round opened.
*/
public function witnessRoundNoticesAReaderTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_touch_" . getmypid() .
".txt";
$page_hash = "touch" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$model->openWitnessRound($path, $page_hash);
$this->assertTrue($model->witnessRoundIsIntact($path, $page_hash),
"a round nothing has read or changed is still good");
$key_file = $model->witnessRoundKeyFile($page_hash);
touch($key_file, filemtime($key_file), time() + 60);
clearstatcache(true, $key_file);
$this->assertTrue(!$model->witnessRoundIsIntact($path,
$page_hash), "a round whose key file was read is not");
$model->closeWitnessRound($path, $page_hash);
$this->assertTrue(!$model->witnessRoundIsIntact($path,
$page_hash), "a round with no key file at all is not");
}
/**
* Sending a fresh set of invitations must end the set before it, so a
* witness holding an older mail finds its link no longer opens the
* ballot. The nonce every invitation carries is what does that: asking
* again without sending gives the same one, and sending gives a new
* one that the older links no longer match.
*/
public function ballotInviteNonceTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_nonce_" . getmypid() .
".txt";
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$first = $model->ballotInviteNonce($path);
$this->assertTrue($first !== "", "a ballot is given a nonce");
$this->assertEqual($first, $model->ballotInviteNonce($path),
"asking again without sending gives the same one");
$later = time() + 3600;
$token = $model->ballotInviteToken(7, "b1", "alice", "start",
$later, $first);
$second = $model->ballotInviteNonce($path, true);
$this->assertTrue($first !== $second,
"sending a fresh set gives a different nonce");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b1",
"alice", "start", $later, $second),
"a link from the older set no longer opens the ballot");
$this->assertTrue(strpos(file_get_contents($path),
"-----SEEDS-----") !== false,
"what the file already held is still there");
unlink($path);
}
/**
* An invitation to take part in a ballot is good only for the witness,
* ballot and stage it was made for, and only until it expires. A
* witness follows the link in their own time, so a token that has
* grown old, or been altered to name somebody else, must be refused.
*/
public function ballotInviteTestCase()
{
$model = $this->model;
$later = time() + 3600;
$token = $model->ballotInviteToken(7, "b1", "alice", "start",
$later, "nonce-one");
$this->assertTrue($model->ballotInviteIsGood($token, 7, "b1",
"alice", "start", $later, "nonce-one"),
"the invitation as it was sent is good");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b1",
"bob", "start", $later, "nonce-one"),
"naming another witness is refused");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b1",
"alice", "count", $later, "nonce-one"),
"naming another stage is refused");
$this->assertTrue(!$model->ballotInviteIsGood($token, 8, "b1",
"alice", "start", $later, "nonce-one"),
"naming another page is refused");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b2",
"alice", "start", $later, "nonce-one"),
"naming another ballot is refused");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b1",
"alice", "start", $later, "nonce-two"),
"another nonce is refused");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b1",
"alice", "start", $later + 60, "nonce-one"),
"moving the expiry later is refused");
$this->assertTrue(!$model->ballotInviteIsGood($token, 7, "b1",
"alice", "start", $later, "nonce-one", $later + 1),
"an invitation past its expiry is refused");
}
/**
* A witness who has taken their part is refused the link that brought
* them, so following it a second time cannot replace what they gave.
* The refusal names having already acted rather than a bad link, since
* the link itself is still the one this site sent.
*/
public function witnessLinkIsRefusedOnceTakenTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_twice_" . getmypid() .
".txt";
$page_hash = "twice" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$public = $model->openWitnessRound($path, $page_hash);
$nonce = $model->ballotInviteNonce($path);
$later = time() + 3600;
$token = $model->ballotInviteToken(7, "b1", "alice", "start",
$later, $nonce);
$this->assertEqual("", $model->witnessLinkRefusal($path, $token,
7, "b1", "alice", "start", $later),
"a link nobody has followed may be followed");
$model->keepWitnessShare($path, "alice", $public,
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
hash('sha256', "alice-part", true));
$this->assertEqual($model::LINK_TAKEN,
$model->witnessLinkRefusal($path, $token, 7, "b1", "alice",
"start", $later),
"the same link followed again says the part is already taken");
$other = $model->ballotInviteToken(7, "b1", "bob", "start",
$later, $nonce);
$this->assertEqual("", $model->witnessLinkRefusal($path, $other,
7, "b1", "bob", "start", $later),
"a witness who has not acted is still let in");
$model->closeWitnessRound($path, $page_hash);
}
/**
* A ballot made from parts the witnesses left sealed can be counted
* with the passwords those parts were made from. The ballot's key
* has to be built from the value each password made; built from
* anything else, every count of it came back saying the key did not
* match and the votes could not be opened.
*/
public function ballotMadeFromSealedPartsCanBeCountedTestCase()
{
$model = $this->model;
$stem = C\WORK_DIRECTORY . "/temp/ballot_trip_" . getmypid();
$round_filepath = $stem . "_round.txt";
$secrets_filepath = $stem . "_secrets.txt";
$csv_filepath = $stem . "_votes.csv";
$form_hash = "trip" . getmypid();
$witnesses = ["bob", "root"];
$passwords = ["bob-word", "root-word"];
file_put_contents($round_filepath, "");
$public = $model->openWitnessRound($round_filepath, $form_hash);
foreach ($witnesses as $at => $witness) {
$drawn = random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES);
$model->keepWitnessShare($round_filepath, $witness, $public,
$drawn, hash('sha256', $drawn . $witness .
$passwords[$at], true));
}
$made = $model->finishWitnessRound($round_filepath, $form_hash,
$witnesses);
$this->assertTrue($made !== false,
"a round both witnesses have taken part in can be finished");
$model->createBallotFile($secrets_filepath, $form_hash,
$witnesses, [], $made[0], $made[4]);
$model->closeWitnessRound($round_filepath, $form_hash);
$this->assertEqual("SUCCESS",
$model->countBallotFile($secrets_filepath, $csv_filepath,
$form_hash, $witnesses, $passwords),
"and it counts with the passwords its parts were made from");
$this->assertEqual($model::KEY_MISMATCH,
$model->countBallotFile($secrets_filepath, $csv_filepath,
$form_hash, $witnesses, ["bob-word", "another-word"]),
"while a different password still cannot open it");
foreach ([$round_filepath, $secrets_filepath, $csv_filepath] as
$leftover) {
if (file_exists($leftover)) {
unlink($leftover);
}
}
}
/**
* A witness written to moments ago is not written to again. The
* button that invites them is pressed once; a request that reaches
* the site twice would send a second invitation whose fresh nonce
* ends the first, leaving the witness holding a link the site no
* longer knows.
*/
public function witnessWrittenToJustNowIsLeftAloneTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_invited_" . getmypid() .
".txt";
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$this->assertTrue(!$model->witnessInvitedJustNow($path, "alice",
60), "a witness nobody has written to may be written to");
$model->noteWitnessInvited($path, "alice", time());
$this->assertTrue($model->witnessInvitedJustNow($path, "alice",
60), "one written to a moment ago is left alone");
$this->assertTrue(!$model->witnessInvitedJustNow($path, "bob",
60), "and the others are unaffected");
$model->noteWitnessInvited($path, "alice", time() - 120);
$this->assertTrue(!$model->witnessInvitedJustNow($path, "alice",
60), "once the wait has passed they may be written to again");
$this->assertEqual(["alice"],
array_keys($model->witnessInvitesNoted($path)),
"what was written down is read back");
if (file_exists($path)) {
unlink($path);
}
}
/**
* A link is refused once it has expired and once a fresher set of
* invitations has replaced the set it belongs to. A witness may sit on
* their mail for days, and a ballot may be started over in the
* meantime, so both have to turn the older link away.
*/
public function witnessLinkIsRefusedWhenStaleTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_stale_" . getmypid() .
".txt";
$page_hash = "stale" . getmypid();
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$model->openWitnessRound($path, $page_hash);
$nonce = $model->ballotInviteNonce($path);
$gone = time() - 60;
$expired = $model->ballotInviteToken(7, "b1", "alice", "start",
$gone, $nonce);
$this->assertEqual($model::LINK_EXPIRED,
$model->witnessLinkRefusal($path, $expired, 7, "b1", "alice",
"start", $gone),
"a link past its expiry says it has run out");
$later = time() + 3600;
$token = $model->ballotInviteToken(7, "b1", "alice", "start",
$later, $nonce);
$model->ballotInviteNonce($path, true);
$this->assertEqual($model::LINK_BAD,
$model->witnessLinkRefusal($path, $token, 7, "b1", "alice",
"start", $later),
"a link from the set before the newest is refused");
$model->closeWitnessRound($path, $page_hash);
}
/**
* A ballot waits on every witness, so one who never answers leaves it
* unmade. What the witnesses who did answer gave has to keep waiting
* sealed for as long as that takes, and has to be gone once the round
* is given up on.
*/
public function roundWaitsSealedForAWitnessWhoNeverAnswersTestCase()
{
$model = $this->model;
$path = C\WORK_DIRECTORY . "/temp/ballot_waits_" . getmypid() .
".txt";
$page_hash = "waits" . getmypid();
$witnesses = ["alice", "bob"];
file_put_contents($path, "-----SEEDS-----\nc2VlZA==\n");
$public = $model->openWitnessRound($path, $page_hash);
$model->keepWitnessShare($path, "alice", $public,
random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES),
hash('sha256', "alice-part", true));
$this->assertTrue(!$model->finishWitnessRound($path, $page_hash,
$witnesses), "a ballot is not made while a witness is out");
$said = file_get_contents($path);
$this->assertTrue(strpos($said,
hash('sha256', "alice-part", true)) === false,
"what the witness who answered gave is not there to read");
$this->assertTrue(
file_exists($model->witnessRoundKeyFile($page_hash)),
"the round waits on rather than being given up");
$this->assertEqual(1, count($model->witnessSharesKept($path)),
"one part waits and the other has not arrived");
$model->closeWitnessRound($path, $page_hash);
$this->assertTrue(!file_exists($path) &&
!file_exists($model->witnessRoundKeyFile($page_hash)),
"giving up on the round takes both its files away");
}
/**
* Counting rebuilds the ballot's key from what every witness gives the
* second time, so a witness who gives a different password than they
* gave at the start rebuilds a different key. That is refused rather
* than counted, whether the password is typed at the form or its
* worked-out value arrives from a witness who answered by mail.
*/
public function countRefusesWhenAPasswordDiffersTestCase()
{
$model = $this->model;
$stem = C\WORK_DIRECTORY . "/temp/ballot_count_" . getmypid();
$path = $stem . ".txt";
$csv_path = $stem . ".csv";
$form_hash = "count" . getmypid();
$witnesses = ["alice", "bob"];
$passwords = ["alice-word", "bob-word"];
$model->createBallotFile($path, $form_hash, $witnesses, $passwords);
$this->assertEqual("KEY_MISMATCH",
$model->countBallotFile($path, $csv_path, $form_hash,
$witnesses, ["alice-word", "another-word"]),
"a password that differs from the first one is refused");
$seeds = [$model->witnessSeedKept($path, 0),
$model->witnessSeedKept($path, 1)];
$wrong = [1 => hash('sha256', $seeds[1] . "bob" . "another-word",
true)];
$this->assertEqual("KEY_MISMATCH",
$model->countBallotFile($path, $csv_path, $form_hash,
$witnesses, ["alice-word", ""], $wrong),
"a value worked out from the wrong password is refused too");
$right = [1 => hash('sha256', $seeds[1] . "bob" . "bob-word",
true)];
$this->assertEqual("SUCCESS",
$model->countBallotFile($path, $csv_path, $form_hash,
$witnesses, ["alice-word", ""], $right),
"a value worked out from the right password counts it");
$this->assertEqual("SUCCESS",
$model->countBallotFile($path, $csv_path, $form_hash,
$witnesses, $passwords),
"the passwords the ballot began with count it");
foreach ([$path, $csv_path] as $leftover) {
if (file_exists($leftover)) {
unlink($leftover);
}
}
}
/**
* Two invitations to the same witness for the same ballot differ,
* since each carries its own nonce, so one cannot stand for another.
*/
public function ballotInvitesDifferTestCase()
{
$model = $this->model;
$later = time() + 3600;
$first = $model->ballotInviteToken(7, "b1", "alice", "start",
$later, "nonce-one");
$second = $model->ballotInviteToken(7, "b1", "alice", "start",
$later, "nonce-two");
$this->assertTrue($first !== $second,
"two invitations are not the same token");
}
/**
* A stored code can be read back, starting with zero wrong guesses
* and the expiry time it was given.
*/
public function storeAndReadTestCase()
{
$expires = time() + C\SIGNIN_CODE_TIMEOUT;
$this->model->setSigninCode(7, L\crawlCrypt("ABCD2345"), $expires);
$record = $this->model->getSigninCode(7);
$this->assertTrue(!empty($record),
"getSigninCode returns the stored row");
$this->assertEqual(0, intval($record['TRIES']),
"a fresh code starts with zero wrong guesses");
$this->assertEqual($expires, intval($record['EXPIRES']),
"the expiry time is persisted");
}
/**
* The right code matches the stored hash and a wrong one does not,
* which is exactly the check the sign-in flow performs.
*/
public function verifyMatchTestCase()
{
$code = "PQRS7890";
$this->model->setSigninCode(7, L\crawlCrypt($code),
time() + C\SIGNIN_CODE_TIMEOUT);
$record = $this->model->getSigninCode(7);
$this->assertTrue(hash_equals($record['CODE_HASH'],
L\crawlCrypt($code, $record['CODE_HASH'])),
"the right code matches the stored hash");
$this->assertFalse(hash_equals($record['CODE_HASH'],
L\crawlCrypt("WRONG234", $record['CODE_HASH'])),
"a wrong code does not match");
}
/**
* Requesting a new code replaces any earlier one, so only the most
* recent code works and its wrong-guess count starts over.
*/
public function replaceTestCase()
{
$this->model->setSigninCode(7, L\crawlCrypt("FIRST234"),
time() + C\SIGNIN_CODE_TIMEOUT);
$this->model->incrementSigninCodeTries(7);
$this->model->setSigninCode(7, L\crawlCrypt("SECOND34"),
time() + C\SIGNIN_CODE_TIMEOUT);
$record = $this->model->getSigninCode(7);
$this->assertTrue(hash_equals($record['CODE_HASH'],
L\crawlCrypt("SECOND34", $record['CODE_HASH'])),
"only the newest code is stored");
$this->assertEqual(0, intval($record['TRIES']),
"the replacement resets the wrong-guess count");
}
/**
* Each wrong guess is counted so the flow can retire a code once it
* reaches the allowed ceiling.
*/
public function incrementTriesTestCase()
{
$this->model->setSigninCode(7, L\crawlCrypt("CODE2345"),
time() + C\SIGNIN_CODE_TIMEOUT);
$this->model->incrementSigninCodeTries(7);
$this->model->incrementSigninCodeTries(7);
$record = $this->model->getSigninCode(7);
$this->assertEqual(2, intval($record['TRIES']),
"each wrong guess bumps the count by one");
}
/**
* A used code is deleted so the same code can never sign anyone in a
* second time.
*/
public function singleUseDeleteTestCase()
{
$this->model->setSigninCode(7, L\crawlCrypt("ONESHOT2"),
time() + C\SIGNIN_CODE_TIMEOUT);
$this->model->deleteSigninCode(7);
$record = $this->model->getSigninCode(7);
$this->assertTrue(empty($record),
"a deleted code is gone");
}
/**
* A user with no pending code simply has nothing to read.
*/
public function unknownUserTestCase()
{
$record = $this->model->getSigninCode(999);
$this->assertTrue(empty($record),
"there is no row for a user without a code");
}
/**
* Adds one account row to the throwaway USERS table for the LDAP
* lookup tests below.
*
* @param int $user_id the account's numeric id
* @param string $user_name the account's username
* @param string $email the account's email
*/
public function insertUser($user_id, $user_name, $email)
{
$this->model->db->execute("INSERT INTO USERS " .
"(USER_ID, USER_NAME, EMAIL) VALUES (?, ?, ?)",
[$user_id, $user_name, $email]);
}
/**
* The email a directory returns maps to the one account that owns it,
* case-insensitively; an unknown email, an empty email, and an email
* shared by two accounts all map to false so a sign-in is never
* granted to a guessed or ambiguous account.
*/
public function localUserForLdapEmailTestCase()
{
$this->insertUser(1, "jane", "jane@example.com");
$this->assertEqual("jane",
$this->model->localUserForLdapEmail("jane@example.com"),
"an email maps to the account that owns it");
$this->assertEqual("jane",
$this->model->localUserForLdapEmail("JANE@EXAMPLE.COM"),
"the email match ignores letter case");
$this->assertFalse(
$this->model->localUserForLdapEmail("nobody@example.com"),
"an unknown email maps to no account");
$this->assertFalse($this->model->localUserForLdapEmail(""),
"an empty email maps to no account");
$this->insertUser(2, "jane2", "jane@example.com");
$this->assertFalse(
$this->model->localUserForLdapEmail("jane@example.com"),
"an email two accounts share is refused as ambiguous");
}
/**
* The conflict scan lists only emails more than one account holds,
* with the usernames that share each, and skips accounts that have no
* email at all.
*/
public function emailConflictsTestCase()
{
$this->insertUser(1, "jane", "jane@example.com");
$this->insertUser(2, "bob", "bob@example.com");
$this->insertUser(3, "noemail", "");
$this->assertEqual([], $this->model->emailConflicts(),
"no conflict while every email is unique");
$this->insertUser(4, "jane2", "JANE@example.com");
$this->insertUser(5, "noemail2", "");
$conflicts = $this->model->emailConflicts();
$this->assertEqual(1, count($conflicts),
"exactly one email is shared");
$shared = array_values($conflicts)[0];
sort($shared);
$this->assertEqual(["jane", "jane2"], $shared,
"both usernames that share the email are listed");
}
/**
* The quick conflict check is false while every email is unique and
* true once two accounts share one.
*/
public function hasEmailConflictTestCase()
{
$this->insertUser(1, "jane", "jane@example.com");
$this->insertUser(2, "bob", "bob@example.com");
$this->assertFalse($this->model->hasEmailConflict(),
"no conflict while every email is unique");
$this->insertUser(3, "jane2", "jane@example.com");
$this->assertTrue($this->model->hasEmailConflict(),
"a shared email is a conflict");
}
/**
* The readiness check lists every missing setting plus a root account
* with no email when LDAP is otherwise blank, and returns an empty
* list once the three settings are present, the root account has an
* email, and no two accounts share one. A shared email shows up as its
* own problem.
*/
public function ldapConfigProblemsTestCase()
{
$this->assertEqual(
["no_servers", "no_suffix", "no_base_dn", "root_no_email"],
$this->model->ldapConfigProblems("", "", ""),
"blank LDAP with no root email lists every problem");
$this->insertUser(C\ROOT_ID, "root", "root@example.com");
$this->assertEqual([],
$this->model->ldapConfigProblems("ldap.example.com",
"@example.com", "dc=example,dc=com"),
"filled settings with a root email and no clashes are ready");
$this->insertUser(2, "jane", "jane@example.com");
$this->insertUser(3, "jane2", "jane@example.com");
$this->assertEqual(["email_conflicts"],
$this->model->ldapConfigProblems("ldap.example.com",
"@example.com", "dc=example,dc=com"),
"a shared email is the only remaining problem");
}
/**
* Checks that the live root directory check refuses to even try a bind
* when something it needs is missing: a blank root username, a blank
* password, or no directory server to reach. Each returns the
* bind_failed token without contacting a directory, which keeps the site
* on locally stored passwords. The successful bind and email match cannot
* be exercised here because they need a real directory to answer.
*/
public function ldapRootValidationProblemRejectsEmptyTestCase()
{
$this->assertEqual("bind_failed",
$this->model->ldapRootValidationProblem("ldap.example.com",
"@example.com", "dc=example,dc=com", "", "secret"),
"a blank root username cannot validate");
$this->assertEqual("bind_failed",
$this->model->ldapRootValidationProblem("ldap.example.com",
"@example.com", "dc=example,dc=com", "root", ""),
"a blank root password cannot validate");
$this->assertEqual("bind_failed",
$this->model->ldapRootValidationProblem("",
"@example.com", "dc=example,dc=com", "root", "secret"),
"no directory server to reach cannot validate");
}
}
(c) 2026 Seekquarry - Open Source Search Engine Software