-
Tagesansicht
-
Alle Mahlzeiten nach Wochentag
+
Tagesansicht
+
Alle Mahlzeiten nach Wochentag
{% if total == 0 %}
-
Noch keine Mahlzeiten angelegt.
+
Noch keine Mahlzeiten angelegt.
{% else %}
{% for tag, mahlzeiten in tage %}
-
{{ tag }}
+
{{ tag }}
{% for m in mahlzeiten %}
{{ include('mahlzeiten/_mahlzeit.html.twig', { m: m }) }}
diff --git a/tests/Functional/UI/Essen/PwaSmokeTest.php b/tests/Functional/UI/Essen/PwaSmokeTest.php
new file mode 100644
index 0000000..d5d0d06
--- /dev/null
+++ b/tests/Functional/UI/Essen/PwaSmokeTest.php
@@ -0,0 +1,75 @@
+followRedirects(false);
+ $em = self::getContainer()->get('doctrine')->getManager();
+ $schemaTool = new SchemaTool($em);
+ $schemaTool->dropSchema($em->getMetadataFactory()->getAllMetadata());
+ $schemaTool->createSchema($em->getMetadataFactory()->getAllMetadata());
+ $session = self::getContainer()->get('session.factory')->createSession();
+ $session->start();
+ foreach (['auth_sub' => 'test-sub', 'auth_name' => 'Jens', 'auth_email' => 'jens@ljh31.de'] as $k => $v) {
+ $session->set($k, $v);
+ }
+ $session->save();
+ $client->getCookieJar()->set(new Cookie($session->getName(), $session->getId()));
+
+ return $client;
+ }
+
+ public function testIndexHasPwaAndMobileMarkers(): void
+ {
+ $client = self::authedClient();
+ $client->request('GET', '/mahlzeiten');
+
+ self::assertResponseIsSuccessful();
+ $html = (string) $client->getResponse()->getContent();
+ self::assertStringContainsString('manifest.webmanifest', $html);
+ self::assertStringContainsString('class="fab"', $html);
+ self::assertStringContainsString("register('/sw.js')", $html);
+ self::assertStringContainsString('href="/mahlzeiten/tage"', $html);
+ }
+
+ public function testTageHighlightsHeutigerTag(): void
+ {
+ $client = self::authedClient();
+ $client->request('POST', '/mahlzeiten', [
+ 'name' => 'Heutiges Gericht',
+ 'notiz' => '',
+ 'wochentage' => [self::heuteWert()],
+ ]);
+ $client->request('GET', '/mahlzeiten/tage');
+
+ self::assertResponseIsSuccessful();
+ $h2 = $client->getCrawler()->filterXPath('//h2[@data-heute="1"]');
+ self::assertCount(1, $h2, 'Genau ein trägt das data-heute-Attribut.');
+ self::assertSame(self::heuteName(), trim($h2->text()));
+ }
+
+ private static function heuteName(): string
+ {
+ $iso = (int) (new \DateTimeImmutable('now', new \DateTimeZone('Europe/Berlin')))->format('N');
+
+ return ['Mo', 'Di', 'Mi', 'Do', 'Fr', 'Sa', 'So'][$iso - 1];
+ }
+
+ private static function heuteWert(): string
+ {
+ $iso = (int) (new \DateTimeImmutable('now', new \DateTimeZone('Europe/Berlin')))->format('N');
+
+ return ['mo', 'di', 'mi', 'do', 'fr', 'sa', 'so'][$iso - 1];
+ }
+}
diff --git a/tests/Unit/UI/Http/Auth/OidcClientTest.php b/tests/Unit/UI/Http/Auth/OidcClientTest.php
new file mode 100644
index 0000000..e8f75aa
--- /dev/null
+++ b/tests/Unit/UI/Http/Auth/OidcClientTest.php
@@ -0,0 +1,174 @@
+key = openssl_pkey_new([
+ 'private_key_bits' => 2048,
+ 'private_key_type' => OPENSSL_KEYTYPE_RSA,
+ ]);
+ if ($this->key === false) {
+ self::fail('konnte RSA-Schlüssel generieren.');
+ }
+ $details = openssl_pkey_get_details($this->key);
+ $n = $details['n'] ?? $details['rsa']['n'];
+ $e = $details['e'] ?? $details['rsa']['e'];
+ $this->jwk = [
+ 'n' => self::b64url($n),
+ 'e' => self::b64url($e),
+ ];
+ }
+
+ public function testVerifyIdTokenAkzeptiertGueltigSigniertesToken(): void
+ {
+ $jwt = $this->signJwt(['sub' => 'jens@ljh31.de', 'email' => 'jens@ljh31.de']);
+
+ $claims = $this->oidcClient()->verifyIdToken($jwt);
+
+ self::assertSame('jens@ljh31.de', $claims['sub']);
+ self::assertSame('jens@ljh31.de', $claims['email']);
+ self::assertSame(self::ISSUER, $claims['iss']);
+ }
+
+ public function testVerifyIdTokenAkzeptiertAudienceAlsArray(): void
+ {
+ $jwt = $this->signJwt(['sub' => 'x'], ['aud' => ['essen', 'anderer-client']]);
+
+ $claims = $this->oidcClient()->verifyIdToken($jwt);
+
+ self::assertSame('x', $claims['sub']);
+ }
+
+ public function testVerifyIdTokenVerwirftManipuliertesPayload(): void
+ {
+ $jwt = $this->signJwt(['sub' => 'jens@ljh31.de']);
+ $tampered = $this->tamper($jwt, 'jens@ljh31.de', 'admin@ljh31.de');
+
+ $this->expectException(\RuntimeException::class);
+ $this->oidcClient()->verifyIdToken($tampered);
+ }
+
+ public function testVerifyIdTokenVerwirftFalscheIssuer(): void
+ {
+ $jwt = $this->signJwt(['sub' => 'x'], ['iss' => 'https://anderer.issuer/realms/family']);
+
+ $this->expectException(\RuntimeException::class);
+ $this->oidcClient()->verifyIdToken($jwt);
+ }
+
+ public function testVerifyIdTokenVerwirftFalscheAudience(): void
+ {
+ $jwt = $this->signJwt(['sub' => 'x'], ['aud' => 'falscher-client']);
+
+ $this->expectException(\RuntimeException::class);
+ $this->oidcClient()->verifyIdToken($jwt);
+ }
+
+ public function testVerifyIdTokenVerwirftAbgelaufenesToken(): void
+ {
+ $jwt = $this->signJwt(['sub' => 'x'], ['exp' => time() - 3600]);
+
+ $this->expectException(\RuntimeException::class);
+ $this->oidcClient()->verifyIdToken($jwt);
+ }
+
+ public function testVerifyIdTokenWähltRichtigenKeyBeiMehrfachJwks(): void
+ {
+ // Zusätzliches RSA-OAEP-Enc-Key (wie in der echten Keycloak-Realm):
+ // muss ignoriert werden, obwohl es denselben Modulus teilt.
+ $jwt = $this->signJwt(['sub' => 'x']);
+
+ $claims = $this->oidcClient(extraKey: [
+ 'kty' => 'RSA',
+ 'alg' => 'RSA-OAEP',
+ 'use' => 'enc',
+ 'kid' => 'test-kid-enc',
+ 'n' => $this->jwk['n'],
+ 'e' => $this->jwk['e'],
+ ])->verifyIdToken($jwt);
+
+ self::assertSame('x', $claims['sub']);
+ }
+
+ private function signJwt(array $claims, array $overrides = []): string
+ {
+ $header = ['alg' => 'RS256', 'typ' => 'JWT', 'kid' => self::KID];
+ $payload = array_merge([
+ 'iss' => self::ISSUER,
+ 'aud' => self::CLIENT_ID,
+ 'exp' => time() + 300,
+ 'iat' => time(),
+ ], $overrides, $claims);
+
+ $h64 = self::b64url((string) json_encode($header));
+ $p64 = self::b64url((string) json_encode($payload));
+ if (openssl_sign("$h64.$p64", $sig, $this->key, OPENSSL_ALGO_SHA256) !== true) {
+ self::fail('konnte Test-JWT signieren.');
+ }
+
+ return "$h64.$p64." . self::b64url($sig);
+ }
+
+ private function tamper(string $jwt, string $from, string $to): string
+ {
+ $parts = explode('.', $jwt);
+ $payload = json_decode((string) base64_decode(strtr($parts[1], '-_', '+/')), true);
+ $payload['sub'] = $to;
+ $parts[1] = self::b64url((string) json_encode($payload));
+ return implode('.', $parts);
+ }
+
+ private function oidcClient(?array $extraKey = null): OidcClient
+ {
+ $keys = [[
+ 'kty' => 'RSA',
+ 'alg' => 'RS256',
+ 'use' => 'sig',
+ 'kid' => self::KID,
+ 'n' => $this->jwk['n'],
+ 'e' => $this->jwk['e'],
+ ]];
+ if ($extraKey !== null) {
+ array_unshift($keys, $extraKey);
+ }
+
+ $httpClient = new MockHttpClient(new MockResponse((string) json_encode(['keys' => $keys])));
+
+ return new OidcClient(
+ httpClient: $httpClient,
+ issuer: self::ISSUER,
+ clientId: self::CLIENT_ID,
+ clientSecret: null,
+ redirectUri: 'https://app.test/auth/callback',
+ );
+ }
+
+ private static function b64url(string $binary): string
+ {
+ return rtrim(strtr(base64_encode($binary), '+/', '-_'), '=');
+ }
+}