root
38 lines
1.1 KiB
PHP
38 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace Tests\Unit;
|
|
|
|
use App\Services\ApplicationUrlService;
|
|
use App\Services\Auth\AuthSessionService;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class AuthSessionServiceTest extends TestCase
|
|
{
|
|
private AuthSessionService $svc;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
// ApplicationUrlService is final (cannot be mocked); these tests only exercise
|
|
// relative-path sanitization and never call docsHomeUrl().
|
|
$this->svc = new AuthSessionService(new ApplicationUrlService());
|
|
}
|
|
|
|
public function test_sanitize_redirect_relative(): void
|
|
{
|
|
$this->assertSame('/dashboard', $this->svc->sanitizeRedirectTarget('/dashboard'));
|
|
$this->assertSame('/dash?q=1', $this->svc->sanitizeRedirectTarget('/dash?q=1'));
|
|
}
|
|
|
|
public function test_sanitize_redirect_empty(): void
|
|
{
|
|
$this->assertNull($this->svc->sanitizeRedirectTarget(''));
|
|
$this->assertNull($this->svc->sanitizeRedirectTarget(' '));
|
|
}
|
|
|
|
public function test_sanitize_rejects_protocol_relative(): void
|
|
{
|
|
$this->assertNull($this->svc->sanitizeRedirectTarget('//evil.example/path'));
|
|
}
|
|
}
|