upgrade

vendor/symfony/security/Http/Tests/RememberMe/AbstractRememberMeServicesTest.php

@@ -0,0 +1,313 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\Tests\RememberMe;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\RememberMe\AbstractRememberMeServices;
+
+class AbstractRememberMeServicesTest extends TestCase
+{
+    public function testGetRememberMeParameter()
+    {
+        $service = $this->getService(null, array('remember_me_parameter' => 'foo'));
+
+        $this->assertEquals('foo', $service->getRememberMeParameter());
+    }
+
+    public function testGetSecret()
+    {
+        $service = $this->getService();
+        $this->assertEquals('foosecret', $service->getSecret());
+    }
+
+    public function testAutoLoginReturnsNullWhenNoCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+
+        $this->assertNull($service->autoLogin(new Request()));
+    }
+
+    /**
+     * @expectedException \RuntimeException
+     */
+    public function testAutoLoginThrowsExceptionWhenImplementationDoesNotReturnUserInterface()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+        $request->cookies->set('foo', 'foo');
+
+        $service
+            ->expects($this->once())
+            ->method('processAutoLoginCookie')
+            ->will($this->returnValue(null))
+        ;
+
+        $service->autoLogin($request);
+    }
+
+    public function testAutoLogin()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+        $request->cookies->set('foo', 'foo');
+
+        $user = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $user
+            ->expects($this->once())
+            ->method('getRoles')
+            ->will($this->returnValue(array()))
+        ;
+
+        $service
+            ->expects($this->once())
+            ->method('processAutoLoginCookie')
+            ->will($this->returnValue($user))
+        ;
+
+        $returnedToken = $service->autoLogin($request);
+
+        $this->assertSame($user, $returnedToken->getUser());
+        $this->assertSame('foosecret', $returnedToken->getSecret());
+        $this->assertSame('fookey', $returnedToken->getProviderKey());
+    }
+
+    /**
+     * @dataProvider provideOptionsForLogout
+     */
+    public function testLogout(array $options)
+    {
+        $service = $this->getService(null, $options);
+        $request = new Request();
+        $response = new Response();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $service->logout($request, $response, $token);
+        $cookie = $request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME);
+        $this->assertInstanceOf('Symfony\Component\HttpFoundation\Cookie', $cookie);
+        $this->assertTrue($cookie->isCleared());
+        $this->assertSame($options['name'], $cookie->getName());
+        $this->assertSame($options['path'], $cookie->getPath());
+        $this->assertSame($options['domain'], $cookie->getDomain());
+        $this->assertSame($options['secure'], $cookie->isSecure());
+        $this->assertSame($options['httponly'], $cookie->isHttpOnly());
+    }
+
+    public function provideOptionsForLogout()
+    {
+        return array(
+            array(array('name' => 'foo', 'path' => '/', 'domain' => null, 'secure' => false, 'httponly' => true)),
+            array(array('name' => 'foo', 'path' => '/bar', 'domain' => 'baz.com', 'secure' => true, 'httponly' => false)),
+        );
+    }
+
+    public function testLoginFail()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+
+        $service->loginFail($request);
+
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testLoginSuccessIsNotProcessedWhenTokenDoesNotContainUserInterfaceImplementation()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'always_remember_me' => true, 'path' => null, 'domain' => null));
+        $request = new Request();
+        $response = new Response();
+        $account = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->once())
+            ->method('getUser')
+            ->will($this->returnValue('foo'))
+        ;
+
+        $service
+            ->expects($this->never())
+            ->method('onLoginSuccess')
+        ;
+
+        $this->assertFalse($request->request->has('foo'));
+
+        $service->loginSuccess($request, $response, $token);
+    }
+
+    public function testLoginSuccessIsNotProcessedWhenRememberMeIsNotRequested()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'always_remember_me' => false, 'remember_me_parameter' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+        $response = new Response();
+        $account = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->once())
+            ->method('getUser')
+            ->will($this->returnValue($account))
+        ;
+
+        $service
+            ->expects($this->never())
+            ->method('onLoginSuccess')
+            ->will($this->returnValue(null))
+        ;
+
+        $this->assertFalse($request->request->has('foo'));
+
+        $service->loginSuccess($request, $response, $token);
+    }
+
+    public function testLoginSuccessWhenRememberMeAlwaysIsTrue()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'always_remember_me' => true, 'path' => null, 'domain' => null));
+        $request = new Request();
+        $response = new Response();
+        $account = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->once())
+            ->method('getUser')
+            ->will($this->returnValue($account))
+        ;
+
+        $service
+            ->expects($this->once())
+            ->method('onLoginSuccess')
+            ->will($this->returnValue(null))
+        ;
+
+        $service->loginSuccess($request, $response, $token);
+    }
+
+    /**
+     * @dataProvider getPositiveRememberMeParameterValues
+     */
+    public function testLoginSuccessWhenRememberMeParameterWithPathIsPositive($value)
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'always_remember_me' => false, 'remember_me_parameter' => 'foo[bar]', 'path' => null, 'domain' => null));
+
+        $request = new Request();
+        $request->request->set('foo', array('bar' => $value));
+        $response = new Response();
+        $account = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->once())
+            ->method('getUser')
+            ->will($this->returnValue($account))
+        ;
+
+        $service
+            ->expects($this->once())
+            ->method('onLoginSuccess')
+            ->will($this->returnValue(true))
+        ;
+
+        $service->loginSuccess($request, $response, $token);
+    }
+
+    /**
+     * @dataProvider getPositiveRememberMeParameterValues
+     */
+    public function testLoginSuccessWhenRememberMeParameterIsPositive($value)
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'always_remember_me' => false, 'remember_me_parameter' => 'foo', 'path' => null, 'domain' => null));
+
+        $request = new Request();
+        $request->request->set('foo', $value);
+        $response = new Response();
+        $account = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->once())
+            ->method('getUser')
+            ->will($this->returnValue($account))
+        ;
+
+        $service
+            ->expects($this->once())
+            ->method('onLoginSuccess')
+            ->will($this->returnValue(true))
+        ;
+
+        $service->loginSuccess($request, $response, $token);
+    }
+
+    public function getPositiveRememberMeParameterValues()
+    {
+        return array(
+            array('true'),
+            array('1'),
+            array('on'),
+            array('yes'),
+            array(true),
+        );
+    }
+
+    public function testEncodeCookieAndDecodeCookieAreInvertible()
+    {
+        $cookieParts = array('aa', 'bb', 'cc');
+        $service = $this->getService();
+
+        $encoded = $this->callProtected($service, 'encodeCookie', array($cookieParts));
+        $this->assertInternalType('string', $encoded);
+
+        $decoded = $this->callProtected($service, 'decodeCookie', array($encoded));
+        $this->assertSame($cookieParts, $decoded);
+    }
+
+    /**
+     * @expectedException \InvalidArgumentException
+     * @expectedExceptionMessage cookie delimiter
+     */
+    public function testThereShouldBeNoCookieDelimiterInCookieParts()
+    {
+        $cookieParts = array('aa', 'b'.AbstractRememberMeServices::COOKIE_DELIMITER.'b', 'cc');
+        $service = $this->getService();
+
+        $this->callProtected($service, 'encodeCookie', array($cookieParts));
+    }
+
+    protected function getService($userProvider = null, $options = array(), $logger = null)
+    {
+        if (null === $userProvider) {
+            $userProvider = $this->getProvider();
+        }
+
+        return $this->getMockForAbstractClass('Symfony\Component\Security\Http\RememberMe\AbstractRememberMeServices', array(
+            array($userProvider), 'foosecret', 'fookey', $options, $logger,
+        ));
+    }
+
+    protected function getProvider()
+    {
+        $provider = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserProviderInterface')->getMock();
+        $provider
+            ->expects($this->any())
+            ->method('supportsClass')
+            ->will($this->returnValue(true))
+        ;
+
+        return $provider;
+    }
+
+    private function callProtected($object, $method, array $args)
+    {
+        $reflection = new \ReflectionClass(get_class($object));
+        $reflectionMethod = $reflection->getMethod($method);
+        $reflectionMethod->setAccessible(true);
+
+        return $reflectionMethod->invokeArgs($object, $args);
+    }
+}

vendor/symfony/security/Http/Tests/RememberMe/PersistentTokenBasedRememberMeServicesTest.php

@@ -0,0 +1,339 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\Tests\RememberMe;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
+use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\Security\Core\Authentication\RememberMe\PersistentToken;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\Security\Http\RememberMe\PersistentTokenBasedRememberMeServices;
+use Symfony\Component\Security\Core\Exception\TokenNotFoundException;
+use Symfony\Component\Security\Core\Exception\CookieTheftException;
+
+class PersistentTokenBasedRememberMeServicesTest extends TestCase
+{
+    public static function setUpBeforeClass()
+    {
+        try {
+            random_bytes(1);
+        } catch (\Exception $e) {
+            self::markTestSkipped($e->getMessage());
+        }
+    }
+
+    public function testAutoLoginReturnsNullWhenNoCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo'));
+
+        $this->assertNull($service->autoLogin(new Request()));
+    }
+
+    public function testAutoLoginThrowsExceptionOnInvalidCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => false, 'remember_me_parameter' => 'foo'));
+        $request = new Request();
+        $request->request->set('foo', 'true');
+        $request->cookies->set('foo', 'foo');
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testAutoLoginThrowsExceptionOnNonExistentToken()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => false, 'remember_me_parameter' => 'foo'));
+        $request = new Request();
+        $request->request->set('foo', 'true');
+        $request->cookies->set('foo', $this->encodeCookie(array(
+            $series = 'fooseries',
+            $tokenValue = 'foovalue',
+        )));
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->once())
+            ->method('loadTokenBySeries')
+            ->will($this->throwException(new TokenNotFoundException('Token not found.')))
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testAutoLoginReturnsNullOnNonExistentUser()
+    {
+        $userProvider = $this->getProvider();
+        $service = $this->getService($userProvider, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => true, 'lifetime' => 3600, 'secure' => false, 'httponly' => false));
+        $request = new Request();
+        $request->cookies->set('foo', $this->encodeCookie(array('fooseries', 'foovalue')));
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->once())
+            ->method('loadTokenBySeries')
+            ->will($this->returnValue(new PersistentToken('fooclass', 'fooname', 'fooseries', 'foovalue', new \DateTime())))
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $userProvider
+            ->expects($this->once())
+            ->method('loadUserByUsername')
+            ->will($this->throwException(new UsernameNotFoundException('user not found')))
+        ;
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->has(RememberMeServicesInterface::COOKIE_ATTR_NAME));
+    }
+
+    public function testAutoLoginThrowsExceptionOnStolenCookieAndRemovesItFromThePersistentBackend()
+    {
+        $userProvider = $this->getProvider();
+        $service = $this->getService($userProvider, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => true));
+        $request = new Request();
+        $request->cookies->set('foo', $this->encodeCookie(array('fooseries', 'foovalue')));
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $service->setTokenProvider($tokenProvider);
+
+        $tokenProvider
+            ->expects($this->once())
+            ->method('loadTokenBySeries')
+            ->will($this->returnValue(new PersistentToken('fooclass', 'foouser', 'fooseries', 'anotherFooValue', new \DateTime())))
+        ;
+
+        $tokenProvider
+            ->expects($this->once())
+            ->method('deleteTokenBySeries')
+            ->with($this->equalTo('fooseries'))
+            ->will($this->returnValue(null))
+        ;
+
+        try {
+            $service->autoLogin($request);
+            $this->fail('Expected CookieTheftException was not thrown.');
+        } catch (CookieTheftException $e) {
+        }
+
+        $this->assertTrue($request->attributes->has(RememberMeServicesInterface::COOKIE_ATTR_NAME));
+    }
+
+    public function testAutoLoginDoesNotAcceptAnExpiredCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => true, 'lifetime' => 3600));
+        $request = new Request();
+        $request->cookies->set('foo', $this->encodeCookie(array('fooseries', 'foovalue')));
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->once())
+            ->method('loadTokenBySeries')
+            ->with($this->equalTo('fooseries'))
+            ->will($this->returnValue(new PersistentToken('fooclass', 'username', 'fooseries', 'foovalue', new \DateTime('yesterday'))))
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->has(RememberMeServicesInterface::COOKIE_ATTR_NAME));
+    }
+
+    public function testAutoLogin()
+    {
+        $user = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $user
+            ->expects($this->once())
+            ->method('getRoles')
+            ->will($this->returnValue(array('ROLE_FOO')))
+        ;
+
+        $userProvider = $this->getProvider();
+        $userProvider
+            ->expects($this->once())
+            ->method('loadUserByUsername')
+            ->with($this->equalTo('foouser'))
+            ->will($this->returnValue($user))
+        ;
+
+        $service = $this->getService($userProvider, array('name' => 'foo', 'path' => null, 'domain' => null, 'secure' => false, 'httponly' => false, 'always_remember_me' => true, 'lifetime' => 3600));
+        $request = new Request();
+        $request->cookies->set('foo', $this->encodeCookie(array('fooseries', 'foovalue')));
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->once())
+            ->method('loadTokenBySeries')
+            ->with($this->equalTo('fooseries'))
+            ->will($this->returnValue(new PersistentToken('fooclass', 'foouser', 'fooseries', 'foovalue', new \DateTime())))
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $returnedToken = $service->autoLogin($request);
+
+        $this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\RememberMeToken', $returnedToken);
+        $this->assertSame($user, $returnedToken->getUser());
+        $this->assertEquals('foosecret', $returnedToken->getSecret());
+        $this->assertTrue($request->attributes->has(RememberMeServicesInterface::COOKIE_ATTR_NAME));
+    }
+
+    public function testLogout()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => '/foo', 'domain' => 'foodomain.foo', 'secure' => true, 'httponly' => false));
+        $request = new Request();
+        $request->cookies->set('foo', $this->encodeCookie(array('fooseries', 'foovalue')));
+        $response = new Response();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->once())
+            ->method('deleteTokenBySeries')
+            ->with($this->equalTo('fooseries'))
+            ->will($this->returnValue(null))
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $service->logout($request, $response, $token);
+
+        $cookie = $request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME);
+        $this->assertTrue($cookie->isCleared());
+        $this->assertEquals('/foo', $cookie->getPath());
+        $this->assertEquals('foodomain.foo', $cookie->getDomain());
+        $this->assertTrue($cookie->isSecure());
+        $this->assertFalse($cookie->isHttpOnly());
+    }
+
+    public function testLogoutSimplyIgnoresNonSetRequestCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+        $response = new Response();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->never())
+            ->method('deleteTokenBySeries')
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $service->logout($request, $response, $token);
+
+        $cookie = $request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME);
+        $this->assertTrue($cookie->isCleared());
+        $this->assertEquals('/', $cookie->getPath());
+        $this->assertNull($cookie->getDomain());
+    }
+
+    public function testLogoutSimplyIgnoresInvalidCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+        $request->cookies->set('foo', 'somefoovalue');
+        $response = new Response();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->never())
+            ->method('deleteTokenBySeries')
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $service->logout($request, $response, $token);
+
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testLoginFail()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null));
+        $request = new Request();
+
+        $this->assertFalse($request->attributes->has(RememberMeServicesInterface::COOKIE_ATTR_NAME));
+        $service->loginFail($request);
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testLoginSuccessSetsCookieWhenLoggedInWithNonRememberMeTokenInterfaceImplementation()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true));
+        $request = new Request();
+        $response = new Response();
+
+        $account = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $account
+            ->expects($this->once())
+            ->method('getUsername')
+            ->will($this->returnValue('foo'))
+        ;
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->any())
+            ->method('getUser')
+            ->will($this->returnValue($account))
+        ;
+
+        $tokenProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\RememberMe\TokenProviderInterface')->getMock();
+        $tokenProvider
+            ->expects($this->once())
+            ->method('createNewToken')
+        ;
+        $service->setTokenProvider($tokenProvider);
+
+        $cookies = $response->headers->getCookies();
+        $this->assertCount(0, $cookies);
+
+        $service->loginSuccess($request, $response, $token);
+
+        $cookies = $response->headers->getCookies(ResponseHeaderBag::COOKIES_ARRAY);
+        $cookie = $cookies['myfoodomain.foo']['/foo/path']['foo'];
+        $this->assertFalse($cookie->isCleared());
+        $this->assertTrue($cookie->isSecure());
+        $this->assertTrue($cookie->isHttpOnly());
+        $this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
+        $this->assertEquals('myfoodomain.foo', $cookie->getDomain());
+        $this->assertEquals('/foo/path', $cookie->getPath());
+    }
+
+    protected function encodeCookie(array $parts)
+    {
+        $service = $this->getService();
+        $r = new \ReflectionMethod($service, 'encodeCookie');
+        $r->setAccessible(true);
+
+        return $r->invoke($service, $parts);
+    }
+
+    protected function getService($userProvider = null, $options = array(), $logger = null)
+    {
+        if (null === $userProvider) {
+            $userProvider = $this->getProvider();
+        }
+
+        return new PersistentTokenBasedRememberMeServices(array($userProvider), 'foosecret', 'fookey', $options, $logger);
+    }
+
+    protected function getProvider()
+    {
+        $provider = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserProviderInterface')->getMock();
+        $provider
+            ->expects($this->any())
+            ->method('supportsClass')
+            ->will($this->returnValue(true))
+        ;
+
+        return $provider;
+    }
+}

vendor/symfony/security/Http/Tests/RememberMe/ResponseListenerTest.php

@@ -0,0 +1,104 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\Tests\RememberMe;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\Security\Http\RememberMe\ResponseListener;
+use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Cookie;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+class ResponseListenerTest extends TestCase
+{
+    public function testRememberMeCookieIsSentWithResponse()
+    {
+        $cookie = new Cookie('rememberme');
+
+        $request = $this->getRequest(array(
+            RememberMeServicesInterface::COOKIE_ATTR_NAME => $cookie,
+        ));
+
+        $response = $this->getResponse();
+        $response->headers->expects($this->once())->method('setCookie')->with($cookie);
+
+        $listener = new ResponseListener();
+        $listener->onKernelResponse($this->getEvent($request, $response));
+    }
+
+    public function testRememberMeCookieIsNotSendWithResponseForSubRequests()
+    {
+        $cookie = new Cookie('rememberme');
+
+        $request = $this->getRequest(array(
+            RememberMeServicesInterface::COOKIE_ATTR_NAME => $cookie,
+        ));
+
+        $response = $this->getResponse();
+        $response->headers->expects($this->never())->method('setCookie');
+
+        $listener = new ResponseListener();
+        $listener->onKernelResponse($this->getEvent($request, $response, HttpKernelInterface::SUB_REQUEST));
+    }
+
+    public function testRememberMeCookieIsNotSendWithResponse()
+    {
+        $request = $this->getRequest();
+
+        $response = $this->getResponse();
+        $response->headers->expects($this->never())->method('setCookie');
+
+        $listener = new ResponseListener();
+        $listener->onKernelResponse($this->getEvent($request, $response));
+    }
+
+    public function testItSubscribesToTheOnKernelResponseEvent()
+    {
+        $listener = new ResponseListener();
+
+        $this->assertSame(array(KernelEvents::RESPONSE => 'onKernelResponse'), ResponseListener::getSubscribedEvents());
+    }
+
+    private function getRequest(array $attributes = array())
+    {
+        $request = new Request();
+
+        foreach ($attributes as $name => $value) {
+            $request->attributes->set($name, $value);
+        }
+
+        return $request;
+    }
+
+    private function getResponse()
+    {
+        $response = new Response();
+        $response->headers = $this->getMockBuilder('Symfony\Component\HttpFoundation\ResponseHeaderBag')->getMock();
+
+        return $response;
+    }
+
+    private function getEvent($request, $response, $type = HttpKernelInterface::MASTER_REQUEST)
+    {
+        $event = $this->getMockBuilder('Symfony\Component\HttpKernel\Event\FilterResponseEvent')
+            ->disableOriginalConstructor()
+            ->getMock();
+
+        $event->expects($this->any())->method('getRequest')->will($this->returnValue($request));
+        $event->expects($this->any())->method('isMasterRequest')->will($this->returnValue($type === HttpKernelInterface::MASTER_REQUEST));
+        $event->expects($this->any())->method('getResponse')->will($this->returnValue($response));
+
+        return $event;
+    }
+}

vendor/symfony/security/Http/Tests/RememberMe/TokenBasedRememberMeServicesTest.php

@@ -0,0 +1,285 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\Tests\RememberMe;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
+use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\Security\Http\RememberMe\TokenBasedRememberMeServices;
+
+class TokenBasedRememberMeServicesTest extends TestCase
+{
+    public function testAutoLoginReturnsNullWhenNoCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo'));
+
+        $this->assertNull($service->autoLogin(new Request()));
+    }
+
+    public function testAutoLoginThrowsExceptionOnInvalidCookie()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => false, 'remember_me_parameter' => 'foo'));
+        $request = new Request();
+        $request->request->set('foo', 'true');
+        $request->cookies->set('foo', 'foo');
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testAutoLoginThrowsExceptionOnNonExistentUser()
+    {
+        $userProvider = $this->getProvider();
+        $service = $this->getService($userProvider, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => true, 'lifetime' => 3600));
+        $request = new Request();
+        $request->cookies->set('foo', $this->getCookie('fooclass', 'foouser', time() + 3600, 'foopass'));
+
+        $userProvider
+            ->expects($this->once())
+            ->method('loadUserByUsername')
+            ->will($this->throwException(new UsernameNotFoundException('user not found')))
+        ;
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testAutoLoginDoesNotAcceptCookieWithInvalidHash()
+    {
+        $userProvider = $this->getProvider();
+        $service = $this->getService($userProvider, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => true, 'lifetime' => 3600));
+        $request = new Request();
+        $request->cookies->set('foo', base64_encode('class:'.base64_encode('foouser').':123456789:fooHash'));
+
+        $user = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $user
+            ->expects($this->once())
+            ->method('getPassword')
+            ->will($this->returnValue('foopass'))
+        ;
+
+        $userProvider
+            ->expects($this->once())
+            ->method('loadUserByUsername')
+            ->with($this->equalTo('foouser'))
+            ->will($this->returnValue($user))
+        ;
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    public function testAutoLoginDoesNotAcceptAnExpiredCookie()
+    {
+        $userProvider = $this->getProvider();
+        $service = $this->getService($userProvider, array('name' => 'foo', 'path' => null, 'domain' => null, 'always_remember_me' => true, 'lifetime' => 3600));
+        $request = new Request();
+        $request->cookies->set('foo', $this->getCookie('fooclass', 'foouser', time() - 1, 'foopass'));
+
+        $user = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $user
+            ->expects($this->once())
+            ->method('getPassword')
+            ->will($this->returnValue('foopass'))
+        ;
+
+        $userProvider
+            ->expects($this->once())
+            ->method('loadUserByUsername')
+            ->with($this->equalTo('foouser'))
+            ->will($this->returnValue($user))
+        ;
+
+        $this->assertNull($service->autoLogin($request));
+        $this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
+    }
+
+    /**
+     * @dataProvider provideUsernamesForAutoLogin
+     *
+     * @param string $username
+     */
+    public function testAutoLogin($username)
+    {
+        $user = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $user
+            ->expects($this->once())
+            ->method('getRoles')
+            ->will($this->returnValue(array('ROLE_FOO')))
+        ;
+        $user
+            ->expects($this->once())
+            ->method('getPassword')
+            ->will($this->returnValue('foopass'))
+        ;
+
+        $userProvider = $this->getProvider();
+        $userProvider
+            ->expects($this->once())
+            ->method('loadUserByUsername')
+            ->with($this->equalTo($username))
+            ->will($this->returnValue($user))
+        ;
+
+        $service = $this->getService($userProvider, array('name' => 'foo', 'always_remember_me' => true, 'lifetime' => 3600));
+        $request = new Request();
+        $request->cookies->set('foo', $this->getCookie('fooclass', $username, time() + 3600, 'foopass'));
+
+        $returnedToken = $service->autoLogin($request);
+
+        $this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\RememberMeToken', $returnedToken);
+        $this->assertSame($user, $returnedToken->getUser());
+        $this->assertEquals('foosecret', $returnedToken->getSecret());
+    }
+
+    public function provideUsernamesForAutoLogin()
+    {
+        return array(
+            array('foouser', 'Simple username'),
+            array('foo'.TokenBasedRememberMeServices::COOKIE_DELIMITER.'user', 'Username might contain the delimiter'),
+        );
+    }
+
+    public function testLogout()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => null, 'domain' => null, 'secure' => true, 'httponly' => false));
+        $request = new Request();
+        $response = new Response();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+
+        $service->logout($request, $response, $token);
+
+        $cookie = $request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME);
+        $this->assertTrue($cookie->isCleared());
+        $this->assertEquals('/', $cookie->getPath());
+        $this->assertNull($cookie->getDomain());
+        $this->assertTrue($cookie->isSecure());
+        $this->assertFalse($cookie->isHttpOnly());
+    }
+
+    public function testLoginFail()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'path' => '/foo', 'domain' => 'foodomain.foo'));
+        $request = new Request();
+
+        $service->loginFail($request);
+
+        $cookie = $request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME);
+        $this->assertTrue($cookie->isCleared());
+        $this->assertEquals('/foo', $cookie->getPath());
+        $this->assertEquals('foodomain.foo', $cookie->getDomain());
+    }
+
+    public function testLoginSuccessIgnoresTokensWhichDoNotContainAnUserInterfaceImplementation()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'always_remember_me' => true, 'path' => null, 'domain' => null));
+        $request = new Request();
+        $response = new Response();
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token
+            ->expects($this->once())
+            ->method('getUser')
+            ->will($this->returnValue('foo'))
+        ;
+
+        $cookies = $response->headers->getCookies();
+        $this->assertCount(0, $cookies);
+
+        $service->loginSuccess($request, $response, $token);
+
+        $cookies = $response->headers->getCookies();
+        $this->assertCount(0, $cookies);
+    }
+
+    public function testLoginSuccess()
+    {
+        $service = $this->getService(null, array('name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true));
+        $request = new Request();
+        $response = new Response();
+
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $user = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserInterface')->getMock();
+        $user
+            ->expects($this->once())
+            ->method('getPassword')
+            ->will($this->returnValue('foopass'))
+        ;
+        $user
+            ->expects($this->once())
+            ->method('getUsername')
+            ->will($this->returnValue('foouser'))
+        ;
+        $token
+            ->expects($this->atLeastOnce())
+            ->method('getUser')
+            ->will($this->returnValue($user))
+        ;
+
+        $cookies = $response->headers->getCookies();
+        $this->assertCount(0, $cookies);
+
+        $service->loginSuccess($request, $response, $token);
+
+        $cookies = $response->headers->getCookies(ResponseHeaderBag::COOKIES_ARRAY);
+        $cookie = $cookies['myfoodomain.foo']['/foo/path']['foo'];
+        $this->assertFalse($cookie->isCleared());
+        $this->assertTrue($cookie->isSecure());
+        $this->assertTrue($cookie->isHttpOnly());
+        $this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
+        $this->assertEquals('myfoodomain.foo', $cookie->getDomain());
+        $this->assertEquals('/foo/path', $cookie->getPath());
+    }
+
+    protected function getCookie($class, $username, $expires, $password)
+    {
+        $service = $this->getService();
+        $r = new \ReflectionMethod($service, 'generateCookieValue');
+        $r->setAccessible(true);
+
+        return $r->invoke($service, $class, $username, $expires, $password);
+    }
+
+    protected function encodeCookie(array $parts)
+    {
+        $service = $this->getService();
+        $r = new \ReflectionMethod($service, 'encodeCookie');
+        $r->setAccessible(true);
+
+        return $r->invoke($service, $parts);
+    }
+
+    protected function getService($userProvider = null, $options = array(), $logger = null)
+    {
+        if (null === $userProvider) {
+            $userProvider = $this->getProvider();
+        }
+
+        $service = new TokenBasedRememberMeServices(array($userProvider), 'foosecret', 'fookey', $options, $logger);
+
+        return $service;
+    }
+
+    protected function getProvider()
+    {
+        $provider = $this->getMockBuilder('Symfony\Component\Security\Core\User\UserProviderInterface')->getMock();
+        $provider
+            ->expects($this->any())
+            ->method('supportsClass')
+            ->will($this->returnValue(true))
+        ;
+
+        return $provider;
+    }
+}