<?php
/**
 * SeekQuarry/Yioop --
 * Open Source Pure PHP Search Engine, Crawler, and Indexer
 *
 * Copyright (C) 2009 - 2026  Chris Pollett chris@pollett.org
 *
 * LICENSE:
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * END LICENSE
 *
 * @author Chris Pollett chris@pollett.org
 * @license https://www.gnu.org/licenses/ GPL3
 * @link https://www.seekquarry.com/
 * @copyright 2009 - 2026
 * @filesource
 */
namespace seekquarry\yioop\tests;

use seekquarry\yioop\configs as C;
use seekquarry\yioop\controllers\RegisterController;
use seekquarry\yioop\library\UnitTest;

/**
 * Checks the proof-of-work captcha that now guards account creation and
 * recovery. The image captcha has been retired, so every sign-up and
 * recovery form relies on the browser solving a small hash puzzle; this
 * test pins down that the server accepts a correct solution and rejects
 * a wrong one.
 *
 * @author Chris Pollett
 */
class RegisterControllerTest extends UnitTest
{
    /**
     * The controller whose proof-of-work check is under test.
     * @var RegisterController
     */
    public $controller;
    /**
     * Builds a controller for each test case without running its
     * constructor, since the proof-of-work check only reads the session
     * and request and needs none of the controller's normal set-up.
     */
    public function setUp()
    {
        $reflection = new \ReflectionClass(RegisterController::class);
        $this->controller = $reflection->newInstanceWithoutConstructor();
        /* The cases about a suppressed address need the controller to
           hold stand-ins for the two models they reach through. */
        $reflection = new \ReflectionClass(RegisterController::class);
        $this->controller = $reflection->newInstanceWithoutConstructor();
                $this->controller->model_instances = [
            "user" => new class {
                /**
                 * Stand-in: no username is ever already in use.
                 *
                 * @param string $user the username to look up
                 * @return bool false, meaning the name is free
                 */
                public function getUserId($user)
                {
                    return false;
                }
            },
            "mailSuppression" => new class {
                /**
                 * Stand-in suppression check: one address is suppressed.
                 *
                 * @param string $email address to check
                 * @return bool true when the address is the burned one
                 */
                public function isSuppressed($email)
                {
                    return strtolower(trim((string) $email)) ===
                        "burned@example.com";
                }
            },
        ];
        $_SESSION = [];
        $_REQUEST = [];
    }
    /**
     * Nothing to take down between test cases.
     */
    public function tearDown()
    {
    }
    /**
     * Sets up a proof-of-work challenge in the session at difficulty two
     * (the answer's hash must start with two zeros) and returns the text
     * prefix the browser hashes its guesses against.
     *
     * @return string the "random:request_time:" prefix a guess is added to
     */
    private function startChallenge()
    {
        $_SESSION = [];
        $_SESSION["random_string"] = "test_random_string";
        $_SESSION["request_time"] = time();
        $_SESSION["level"] = 2;
        return $_SESSION["random_string"] . ':' .
            $_SESSION["request_time"] . ':';
    }
    /**
     * A guess whose hash meets the difficulty is accepted as a human.
     */
    public function acceptsValidProofOfWorkTestCase()
    {
        $prefix = $this->startChallenge();
        $nonce = 0;
        while (substr(sha1($prefix . $nonce), 0, 2) !== "00") {
            $nonce++;
        }
        $_REQUEST['nonce_for_string'] = (string)$nonce;
        $this->assertTrue($this->controller->validateHashCode(),
            "a guess meeting the difficulty passes the proof-of-work");
    }
    /**
     * A guess whose hash misses the difficulty is rejected.
     */
    public function rejectsBadProofOfWorkTestCase()
    {
        $prefix = $this->startChallenge();
        $bad = 0;
        while (substr(sha1($prefix . $bad), 0, 2) === "00") {
            $bad++;
        }
        $_REQUEST['nonce_for_string'] = (string)$bad;
        $this->assertFalse($this->controller->validateHashCode(),
            "a guess missing the difficulty fails the proof-of-work");
    }
    /**
     * The shared proof-of-work check passes a hash with enough zeroes and
     * fails one without, given the same inputs directly.
     */
    public function meetsProofOfWorkChecksLeadingZeroesTestCase()
    {
        $random_string = "abc";
        $request_time = "123";
        $good = 0;
        while (substr(sha1($random_string . ':' . $request_time . ':' .
            $good), 0, 2) !== "00") {
            $good++;
        }
        $this->assertTrue($this->controller->meetsProofOfWork($random_string,
            $request_time, (string)$good, 2),
            "a nonce producing two leading zeroes passes");
        $bad = 0;
        while (substr(sha1($random_string . ':' . $request_time . ':' .
            $bad), 0, 2) === "00") {
            $bad++;
        }
        $this->assertFalse($this->controller->meetsProofOfWork($random_string,
            $request_time, (string)$bad, 2),
            "a nonce missing two leading zeroes fails");
    }
    /**
     * Runs the registration data check for one email address and returns
     * the resulting data array.
     *
     * @param string $email address to register with
     * @return array the data the check fills in, including SUCCESS
     */
    public function checkEmail($email)
    {
        $_REQUEST = ["a" => "processAccountData", "user" => "newperson",
            "email" => $email, "password" => "Abcdef1!",
            "repassword" => "Abcdef1!", "first" => "New", "last" => "Person"];
        $data = ["check_user" => true, "check_fields" =>
            ["user", "email", "password", "repassword", "first", "last"]];
        $this->controller->dataIntegrityCheck($data);
        return $data;
    }
    /**
     * A suppressed address is refused and no account is allowed.
     */
    public function suppressedEmailRefusedTestCase()
    {
        $data = $this->checkEmail("burned@example.com");
        $this->assertFalse($data['SUCCESS'],
            "registration with a suppressed address fails");
        $this->assertTrue(strpos($data['SCRIPT'], "doMessage") !== false,
            "the user is shown a message explaining the refusal");
    }
    /**
     * An ordinary address passes the check.
     */
    public function ordinaryEmailAllowedTestCase()
    {
        $data = $this->checkEmail("fresh@example.com");
        $this->assertTrue($data['SUCCESS'],
            "registration with an ordinary address passes the check");
    }
    /**
     * The reserved name "bot" (the unsubscribe mailbox) cannot be taken
     * by a new account.
     */
    public function reservedBotNameRefusedTestCase()
    {
        $_REQUEST = ["a" => "createAccount", "user" => "bot",
            "email" => "fresh@example.com", "password" => "Abcdef1!",
            "repassword" => "Abcdef1!", "first" => "New",
            "last" => "Person"];
        $data = ["check_user" => true, "check_fields" =>
            ["user", "email", "password", "repassword", "first", "last"]];
        $this->controller->dataIntegrityCheck($data);
        $this->assertFalse($data['SUCCESS'],
            "the reserved name bot cannot be registered");
    }
    /**
     * codeAndResendSurviveRecoveryOffTestCase checks that a site with
     * account recovery turned off still offers the emailed sign in
     * code and the resending of an activation mail. Neither recovers
     * an account: one signs in a user who has one, the other sends
     * again the mail that makes a new account usable. A reader on such
     * a site who follows either link and lands on the account form
     * sees this case fail.
     */
    public function codeAndResendSurviveRecoveryOffTestCase()
    {
        $offered = $this->controller->activities;
        $this->assertTrue(in_array("signinCode", $offered),
            "the emailed sign in code is offered");
        $this->assertTrue(in_array("resendRegistration", $offered),
            "resending an activation mail is offered");
    }
}
