cw2007/move_detect
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test(cloud): cover unknown-username 401 parity + logout session clear

Browse source
This commit is contained in:
유창욱 2026-07-12 00:46:39 +09:00
parent 902bbe93c8
commit f7a0a3740e
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
cloud/tests/AuthControllerTest.php
View file

@ -50,4 +50,21 @@ final class AuthControllerTest extends TestCase
$this->assertSame(200, $res->status()); $this->assertSame(200, $res->status());
$this->assertSame(1, $sess->get('user_id')); $this->assertSame(1, $sess->get('user_id'));
} }
public function testUnknownUsernameReturns401GenericBody(): void {
$c = new AuthController($this->users(), new InMemoryAuditRepository());
$res = $c->login($this->req('nobody', 'whatever'), new ArraySessionStore(), now: 1000);
$this->assertSame(401, $res->status());
// identical generic body to the wrong-password case (no user-enumeration leak)
$wrong = $c->login($this->req('alice', 'nope'), new ArraySessionStore(), now: 1000);
$this->assertSame($wrong->body(), $res->body());
}
public function testLogoutClearsSession(): void {
$c = new AuthController($this->users(), new InMemoryAuditRepository());
$sess = new ArraySessionStore();
$c->login($this->req('alice', 'pw'), $sess, now: 1000);
$this->assertSame(1, $sess->get('user_id'));
$res = $c->logout($sess);
$this->assertSame(200, $res->status());
$this->assertNull($sess->get('user_id')); // session identity cleared
}
} }