Merge pull request #70 from jrushlow/refactor/generator

fixed selector length

Author: jrushlow

src/Generator/ResetPasswordRandomGenerator.php

@@ -20,13 +20,15 @@ class ResetPasswordRandomGenerator
 {
     /**
      * Original credit to Laravel's Str::random() method.
+     *
+     * String length is 20 characters
      */
-    public function getRandomAlphaNumStr(int $length): string
+    public function getRandomAlphaNumStr(): string
     {
         $string = '';
 
-        while (($len = \strlen($string)) < $length) {
-            $size = $length - $len;
+        while (($len = \strlen($string)) < 20) {
+            $size = 20 - $len;
 
             $bytes = \random_bytes($size);
 

src/Generator/ResetPasswordTokenGenerator.php

@@ -20,8 +20,6 @@
  */
 class ResetPasswordTokenGenerator
 {
-    private const RANDOM_STR_LENGTH = 20;
-
     /**
      * @var string Unique, random, cryptographically secure string
      */
@@ -47,10 +45,10 @@ public function __construct(string $signingKey, ResetPasswordRandomGenerator $ge
     public function createToken(\DateTimeInterface $expiresAt, $userId, string $verifier = null): ResetPasswordTokenComponents
     {
         if (null === $verifier) {
-            $verifier = $this->randomGenerator->getRandomAlphaNumStr(self::RANDOM_STR_LENGTH);
+            $verifier = $this->randomGenerator->getRandomAlphaNumStr();
         }
 
-        $selector = $this->randomGenerator->getRandomAlphaNumStr(self::RANDOM_STR_LENGTH);
+        $selector = $this->randomGenerator->getRandomAlphaNumStr();
 
         $encodedData = \json_encode([$verifier, $userId, $expiresAt->getTimestamp()]);
 

src/Model/ResetPasswordRequestTrait.php

@@ -18,7 +18,7 @@
 trait ResetPasswordRequestTrait
 {
     /**
-     * @ORM\Column(type="string", length=100)
+     * @ORM\Column(type="string", length=20)
      */
     private $selector;
 

src/ResetPasswordHelper.php

@@ -108,6 +108,10 @@ public function validateTokenAndFetchUser(string $fullToken): object
     {
         $this->resetPasswordCleaner->handleGarbageCollection();
 
+        if (40 !== \strlen($fullToken)) {
+            throw new InvalidResetPasswordTokenException();
+        }
+
         $resetRequest = $this->findResetPasswordRequest($fullToken);
 
         if (null === $resetRequest) {

tests/UnitTests/Generator/ResetPasswordRandomGeneratorTest.php

@@ -18,20 +18,20 @@
  */
 class ResetPasswordRandomGeneratorTest extends TestCase
 {
-    public function testIsProvidedLength(): void
+    public function testLengthIs20(): void
     {
         $generator = new ResetPasswordRandomGenerator();
-        $result = $generator->getRandomAlphaNumStr(100);
+        $result = $generator->getRandomAlphaNumStr();
 
-        self::assertSame(100, \strlen($result));
+        self::assertSame(20, \strlen($result));
     }
 
     public function testIsRandom(): void
     {
         $generator = new ResetPasswordRandomGenerator();
 
-        $resultA = $generator->getRandomAlphaNumStr(20);
-        $resultB = $generator->getRandomAlphaNumStr(20);
+        $resultA = $generator->getRandomAlphaNumStr();
+        $resultB = $generator->getRandomAlphaNumStr();
 
         self::assertNotSame($resultA, $resultB);
     }

tests/UnitTests/Generator/ResetPasswordTokenGeneratorTest.php

@@ -43,7 +43,6 @@ public function testSelectorGeneratedByRandomGenerator(): void
         $this->mockRandomGenerator
             ->expects($this->exactly(2))
             ->method('getRandomAlphaNumStr')
-            ->with(20)
         ;
 
         $generator = $this->getTokenGenerator();

tests/UnitTests/Model/ResetPasswordRequestTraitTest.php

@@ -26,7 +26,7 @@ public function testIsCompatibleWithInterface(): void
 
     public function propertyDataProvider(): \Generator
     {
-        yield ['selector', '@ORM\Column(type="string", length=100)'];
+        yield ['selector', '@ORM\Column(type="string", length=20)'];
         yield ['hashedToken', '@ORM\Column(type="string", length=100)'];
         yield ['requestedAt', '@ORM\Column(type="datetime_immutable")'];
         yield ['expiresAt', '@ORM\Column(type="datetime_immutable")'];

tests/UnitTests/ResetPasswordHelperTest.php

@@ -22,7 +22,7 @@
 
 /**
  * @author  Jesse Rushlow <[email protected]>
- * @authot  Ryan Weaver   <[email protected]>
+ * @author  Ryan Weaver   <[email protected]>
  */
 class ResetPasswordHelperTest extends TestCase
 {
@@ -65,7 +65,7 @@ protected function setUp(): void
         $this->mockTokenGenerator = $this->createMock(ResetPasswordTokenGenerator::class);
         $this->mockCleaner = $this->createMock(ResetPasswordCleaner::class);
         $this->mockResetRequest = $this->createMock(ResetPasswordRequestInterface::class);
-        $this->randomToken = \bin2hex(\random_bytes(10));
+        $this->randomToken = \bin2hex(\random_bytes(20));
         $this->mockUser = new class() {};
     }
 
@@ -173,7 +173,7 @@ public function testRemoveResetRequestRetrievesTokenFromRepository(): void
         $this->mockRepo
             ->expects($this->once())
             ->method('findResetPasswordRequest')
-            ->with($this->randomToken)
+            ->with(\substr($this->randomToken, 0, 20))
             ->willReturn($this->mockResetRequest)
         ;
 
@@ -198,6 +198,14 @@ public function testRemoveResetRequestCallsRepositoryToRemoveResetRequestObject(
         $helper->removeResetRequest('1234');
     }
 
+    public function testExceptionThrownIfTokenLengthIsNotOfCorrectSize(): void
+    {
+        $this->expectException(InvalidResetPasswordTokenException::class);
+
+        $helper = $this->getPasswordResetHelper();
+        $helper->validateTokenAndFetchUser(\substr($this->randomToken, 0, 39));
+    }
+
     public function testExceptionIsThrownIfTokenNotFoundDuringValidation(): void
     {
         $this->mockRepo
@@ -209,7 +217,7 @@ public function testExceptionIsThrownIfTokenNotFoundDuringValidation(): void
         $this->expectException(InvalidResetPasswordTokenException::class);
 
         $helper = $this->getPasswordResetHelper();
-        $helper->validateTokenAndFetchUser('1234');
+        $helper->validateTokenAndFetchUser($this->randomToken);
     }
 
     public function testValidateTokenThrowsExceptionOnExpiredResetRequest(): void
@@ -223,7 +231,7 @@ public function testValidateTokenThrowsExceptionOnExpiredResetRequest(): void
         $this->mockRepo
             ->expects($this->once())
             ->method('findResetPasswordRequest')
-            ->with($this->randomToken)
+            ->with(\substr($this->randomToken, 0, 20))
             ->willReturn($this->mockResetRequest)
         ;
 
@@ -256,7 +264,7 @@ public function testValidateTokenFetchesUserIfTokenNotExpired(): void
         $this->mockRepo
             ->expects($this->once())
             ->method('findResetPasswordRequest')
-            ->with($this->randomToken)
+            ->with(\substr($this->randomToken, 0, 20))
             ->willReturn($this->mockResetRequest)
         ;