Symfony PHPUnit 測試不驗證用戶

Question

我有一個 Symfony 4.4 項目。 登錄、身份驗證和授權在 Web 上運行良好。

為了在單元測試中模擬身份驗證，我使用了Symfony 的示例。

......但這不起作用。 用戶未在單元測試中進行身份驗證。 我收到一條未經授權並帶有錯誤消息“訪問此資源需要完全身份驗證”。

我的測試：

namespace App\Tests\Controller;

use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
use Symfony\Component\BrowserKit\Cookie;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Guard\Token\PostAuthenticationGuardToken;
use App\Entity\User;
use Doctrine\ORM\EntityManagerInterface;

class DefaultControllerTest extends WebTestCase
{
    private $client = null;

    public function setUp()
    {
        $this->client = static::createClient();
    }

    public function testJsonUserEndpoint()
    {
        $this->logIn();
        $crawler = $this->client->request('GET', '/json/user');

        $this->assertNotContains('invalid_credentials', $this->client->getResponse()->getContent());
    }

    private function logIn()
    {
        $user = self::$container->get(EntityManagerInterface::class)->getRepository(User::class)->findOneByMail('test106@test.com');

        $session = $this->client->getContainer()->get('session');

        $firewallName = 'main';
        $firewallContext = 'main';

        $token = new PostAuthenticationGuardToken($user, $firewallName, ['ROLE_USER']);
        $session->set('_security_'.$firewallContext, serialize($token));
        $session->save();

        $cookie = new Cookie($session->getName(), $session->getId());
        $this->client->getCookieJar()->set($cookie);
    }
}

我的防火牆：

        main:
            anonymous:
                secret: '%env(APP_SECRET)%'
            remember_me:
                always_remember_me: true
                secret: '%env(APP_SECRET)%'
            provider: session_user_provider
            guard:
                authenticators:
                    - App\Security\Authenticator\LoginAuthenticator
                    - App\Security\Authenticator\MobileBridgeAuthenticator
                    - App\Security\Authenticator\BearerTokenAuthenticator
                    - App\Security\Authenticator\HashAuthenticator
                    - App\Security\Authenticator\ClientAuthenticator
                entry_point: App\Security\Authenticator\LoginAuthenticator

            logout:
                path: execute_logout
                target: render_login

單元測試失敗：

1) App\Tests\Controller\DefaultControllerTest::testJsonUserEndpoint
Failed asserting that '{"status":"invalid_credentials","errors":["Invalid Credentials"],"debug":"Full authentication is required to access this resource.","error":"Unauthorized"}' does not contain "invalid_credentials".

如何在不使用登錄表單的情況下對我的單元測試中的用戶進行身份驗證？

Answer 1

問題是我沒有將角色與用戶一起存儲在數據庫中——它們被添加到我的身份驗證器中——並且將角色傳遞給PostAuthenticationGuardToken是不夠的。 我還必須將它們添加到令牌中的用戶：

$user->setRoles(['ROLE_USER']);
$token = new PostAuthenticationGuardToken($session_user, $firewallName, ['ROLE_USER']);

實際上，只要它是一個數組，令牌的角色就無關緊要：

$user->setRoles(['ROLE_USER']);
$token = new PostAuthenticationGuardToken($session_user, $firewallName, []);