make classes final

src/Generator/ResetPasswordRandomGenerator.php

@@ -14,10 +14,8 @@
  * @author Ryan Weaver   <[email protected]>
  *
  * @internal
- *
- * @final
  */
-class ResetPasswordRandomGenerator
+final class ResetPasswordRandomGenerator
 {
     /**
      * Original credit to Laravel's Str::random() method.

src/Generator/ResetPasswordTokenGenerator.php

@@ -11,16 +11,15 @@
 
 use SymfonyCasts\Bundle\ResetPassword\Exception\ResetPasswordRuntimeException;
 use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordTokenComponents;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordTokenComponentsInterface;
 
 /**
  * @author Jesse Rushlow <[email protected]>
  * @author Ryan Weaver   <[email protected]>
  *
  * @internal
- *
- * @final
  */
-class ResetPasswordTokenGenerator
+final class ResetPasswordTokenGenerator implements ResetPasswordTokenGeneratorInterface
 {
     /**
      * @param string $signingKey Unique, random, cryptographically secure string
@@ -40,7 +39,7 @@ public function __construct(
      *
      * @throws ResetPasswordRuntimeException
      */
-    public function createToken(\DateTimeInterface $expiresAt, int|string $userId, ?string $verifier = null): ResetPasswordTokenComponents
+    public function createToken(\DateTimeInterface $expiresAt, int|string $userId, ?string $verifier = null): ResetPasswordTokenComponentsInterface
     {
         if (null === $verifier) {
             $verifier = $this->generator->getRandomAlphaNumStr();

src/Generator/ResetPasswordTokenGeneratorInterface.php

@@ -0,0 +1,20 @@
+<?php
+
+/*
+ * This file is part of the SymfonyCasts ResetPasswordBundle package.
+ * Copyright (c) SymfonyCasts <https://symfonycasts.com/>
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace SymfonyCasts\Bundle\ResetPassword\Generator;
+
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordTokenComponentsInterface;
+
+/**
+ * @author Jesse Rushlow <[email protected]>
+ */
+interface ResetPasswordTokenGeneratorInterface
+{
+    public function createToken(\DateTimeInterface $expiresAt, int|string $userId, ?string $verifier = null): ResetPasswordTokenComponentsInterface;
+}

src/Model/ResetPasswordTokenComponents.php

@@ -14,10 +14,8 @@
  * @author Ryan Weaver   <[email protected]>
  *
  * @internal
- *
- * @final
  */
-class ResetPasswordTokenComponents
+final class ResetPasswordTokenComponents implements ResetPasswordTokenComponentsInterface
 {
     public function __construct(
         #[\SensitiveParameter]

src/Model/ResetPasswordTokenComponentsInterface.php

@@ -0,0 +1,31 @@
+<?php
+
+/*
+ * This file is part of the SymfonyCasts ResetPasswordBundle package.
+ * Copyright (c) SymfonyCasts <https://symfonycasts.com/>
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace SymfonyCasts\Bundle\ResetPassword\Model;
+
+/**
+ * @author Jesse Rushlow <[email protected]>
+ */
+interface ResetPasswordTokenComponentsInterface
+{
+    /**
+     * @return string Non-hashed random string used to fetch request objects from persistence
+     */
+    public function getSelector(): string;
+
+    /**
+     * @return string The hashed non-public token used to validate reset password requests
+     */
+    public function getHashedToken(): string;
+
+    /**
+     * The public token consists of a concatenated random non-hashed selector string and random non-hashed verifier string.
+     */
+    public function getPublicToken(): string;
+}

src/ResetPasswordHelper.php

@@ -12,11 +12,11 @@
 use SymfonyCasts\Bundle\ResetPassword\Exception\ExpiredResetPasswordTokenException;
 use SymfonyCasts\Bundle\ResetPassword\Exception\InvalidResetPasswordTokenException;
 use SymfonyCasts\Bundle\ResetPassword\Exception\TooManyPasswordRequestsException;
-use SymfonyCasts\Bundle\ResetPassword\Generator\ResetPasswordTokenGenerator;
+use SymfonyCasts\Bundle\ResetPassword\Generator\ResetPasswordTokenGeneratorInterface;
 use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestInterface;
 use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordToken;
 use SymfonyCasts\Bundle\ResetPassword\Persistence\ResetPasswordRequestRepositoryInterface;
-use SymfonyCasts\Bundle\ResetPassword\Util\ResetPasswordCleaner;
+use SymfonyCasts\Bundle\ResetPassword\Util\ResetPasswordCleanerInterface;
 
 /**
  * @author Jesse Rushlow <[email protected]>
@@ -34,8 +34,8 @@ final class ResetPasswordHelper implements ResetPasswordHelperInterface
      * @param int $requestThrottleTime  Another password reset cannot be made faster than this throttle time in seconds
      */
     public function __construct(
-        private ResetPasswordTokenGenerator $generator,
-        private ResetPasswordCleaner $cleaner,
+        private ResetPasswordTokenGeneratorInterface $generator,
+        private ResetPasswordCleanerInterface $cleaner,
         private ResetPasswordRequestRepositoryInterface $repository,
         private int $resetRequestLifetime,
         private int $requestThrottleTime,

src/Util/ResetPasswordCleaner.php

@@ -19,7 +19,7 @@
  *
  * @final
  */
-class ResetPasswordCleaner
+class ResetPasswordCleaner implements ResetPasswordCleanerInterface
 {
     /**
      * @param bool $enabled Enable/disable garbage collection

src/Util/ResetPasswordCleanerInterface.php

@@ -0,0 +1,18 @@
+<?php
+
+/*
+ * This file is part of the SymfonyCasts ResetPasswordBundle package.
+ * Copyright (c) SymfonyCasts <https://symfonycasts.com/>
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace SymfonyCasts\Bundle\ResetPassword\Util;
+
+/**
+ * @author Jesse Rushlow <[email protected]>
+ */
+interface ResetPasswordCleanerInterface
+{
+    public function handleGarbageCollection(bool $force = false): int;
+}

tests/Unit/Generator/ResetPasswordTokenGeneratorTest.php

@@ -20,93 +20,71 @@
  */
 class ResetPasswordTokenGeneratorTest extends TestCase
 {
-    /**
-     * @var MockObject|ResetPasswordRandomGenerator
-     */
-    private $mockRandomGenerator;
-
-    /**
-     * @var MockObject|\DateTimeImmutable
-     */
-    private $mockExpiresAt;
+    private MockObject&\DateTimeImmutable $mockExpiresAt;
+    private ResetPasswordTokenGenerator $tokenGenerator;
 
     protected function setUp(): void
     {
-        $this->mockRandomGenerator = $this->createMock(ResetPasswordRandomGenerator::class);
         $this->mockExpiresAt = $this->createMock(\DateTimeImmutable::class);
+        $this->tokenGenerator = new ResetPasswordTokenGenerator('secret-key', new ResetPasswordRandomGenerator());
     }
 
-    public function testSelectorGeneratedByRandomGenerator(): void
+    public function testCreateTokenReturnsValidHashedTokenComponents(): void
     {
-        $this->mockRandomGenerator
-            ->expects($this->exactly(2))
-            ->method('getRandomAlphaNumStr')
-        ;
+        $result = $this->tokenGenerator->createToken($this->mockExpiresAt, 'userId');
 
-        $generator = $this->getTokenGenerator();
-        $generator->createToken($this->mockExpiresAt, 'userId');
-    }
+        // The public token = "selector token" + "verifier token"
+        self::assertSame(20, \strlen($result->getSelector()));
+        self::assertSame(40, \strlen($result->getPublicToken()));
 
-    public function testHashedTokenIsCreatedWithExpectedParams(): void
-    {
-        $this->mockRandomGenerator
-            ->expects($this->exactly(2))
-            ->method('getRandomAlphaNumStr')
-            ->willReturnOnConsecutiveCalls('verifier', 'selector')
-        ;
-
-        $this->mockExpiresAt
-            ->expects($this->once())
-            ->method('getTimestamp')
-            ->willReturn(2020)
-        ;
-
-        $expected = hash_hmac(
-            'sha256',
-            json_encode(['verifier', 'user1234', 2020]),
-            'key',
-            true
-        );
-
-        $generator = $this->getTokenGenerator();
-        $result = $generator->createToken($this->mockExpiresAt, 'user1234');
-
-        self::assertSame(base64_encode($expected), $result->getHashedToken());
+        $verifier = substr($result->getPublicToken(), 20, 20);
+
+        $expectedHash = base64_encode(hash_hmac(
+            algo: 'sha256',
+            data: json_encode([$verifier, 'userId', $this->mockExpiresAt->getTimestamp()]),
+            key: 'secret-key',
+            binary: true
+        ));
+
+        self::assertSame($expectedHash, $result->getHashedToken());
     }
 
-    public function testHashedTokenIsCreatedUsingOptionVerifierParam(): void
+    public function testCreateTokenUsesProvidedVerifierToken(): void
     {
-        $date = 2020;
-        $userId = 'user1234';
-        $knownVerifier = 'verified';
-
-        $this->mockRandomGenerator
-            ->expects($this->once())
-            ->method('getRandomAlphaNumStr')
-            ->willReturnOnConsecutiveCalls('un-used-verifier', 'selector')
-        ;
-
-        $this->mockExpiresAt
-            ->expects($this->once())
-            ->method('getTimestamp')
-            ->willReturn($date)
-        ;
-
-        $knownToken = hash_hmac(
-            'sha256',
-            json_encode([$knownVerifier, $userId, $date]),
-            'key',
-            true
-        );
-
-        $generator = $this->getTokenGenerator();
-        $result = $generator->createToken($this->mockExpiresAt, $userId, $knownVerifier);
-
-        self::assertSame(base64_encode($knownToken), $result->getHashedToken());
+        $result = $this->tokenGenerator->createToken($this->mockExpiresAt, 'userId', '1234');
+
+        $expectedHash = base64_encode(hash_hmac(
+            algo: 'sha256',
+            data: json_encode(['1234', 'userId', $this->mockExpiresAt->getTimestamp()]),
+            key: 'secret-key',
+            binary: true
+        ));
+
+        self::assertSame($expectedHash, $result->getHashedToken());
     }
 
-    private function getTokenGenerator(): ResetPasswordTokenGenerator
+    public function testCreateTokenUsesProvidedParams(): void
     {
-        return new ResetPasswordTokenGenerator('key', $this->mockRandomGenerator);
+        $result = $this->tokenGenerator->createToken($this->mockExpiresAt, 'userId', '1234');
+
+        $expectedHash = base64_encode(hash_hmac(
+            algo: 'sha256',
+            data: json_encode(['1234', 'userId', '0123456789']),
+            key: 'secret-key',
+            binary: true
+        ));
+
+        // We used a "fake" timestamp in our expectedHash
+        self::assertNotSame($expectedHash, $result->getHashedToken());
+
+        $expectedHash = base64_encode(hash_hmac(
+            algo: 'sha256',
+            data: json_encode(['1234', 'bad-user-id', $this->mockExpiresAt->getTimestamp()]),
+            key: 'secret-key',
+            binary: true
+        ));
+
+        // We used a "fake" user id in our expectedHash
+        self::assertNotSame($expectedHash, $result->getHashedToken());
     }
 }