注销/撤销令牌的Laravel Passport单元测试

Question

我正在使用Laravel Passport，并且在控制器中具有注销功能。见下文：

public function logout(Request $request){
    auth()->user()->token()->revoke();
    $response = ['message' => 'You have been successfully logged out!'];
    return response($response, 200);
}

我现在试图为此编写一个单元测试，但是即使在注销和令牌被撤销后，用户仍然保持登录状态。我发现此方法照明\Auth\ResestGuard::注销不存在Laravel Passport，但即使此解决方案也不适用于我。我猜这可能是因为我正在使用Laravel 8。我的单元测试是这样的：

public function testLogout()
{
    //Random email and password
    $email = $this->faker->email;
    $password = $this->faker->password(8);

    //Create a user
    $this->createUser($this->faker->name, $email, $password);

    //Data for the post request
    $data = [
        'email' => $email,
        'password' => $password
    ];

    //Try login
    $response = $this->json('POST','api/login', $data);
    //Assert it was successful
    $response->assertStatus(200);

    //Assert we received a token
    $this->assertArrayHasKey('token', $response->json());

    //Get the token
    $token = $response->json()['token'];

    //Setup authenticated header
    $header = [
        'Authorization' => 'Bearer '.$token
    ];
    //try to access authenticated route
    $response = $this->json('get', 'api/ads', [], $header);
    //Assert it was successful
    $response->assertStatus(200);

    $this->resetAuth();
    //Logout the user
    $response = $this->post('api/logout', [], $header);
    //Assert it was successful
    $response->assertStatus(200);

    //try to access authenticated route
    $response = $this->json('get', 'api/ads', [], $header);
    //Assert it returns unathorized error
    $response->assertStatus(401);


    //Delete the user
    User::where('email', $email)->delete();

}

结果如下：

预期状态代码401，但收到200。断言401与200相同失败。

Answer 1

您的注销方法看起来很奇怪。我会这么做

use Illuminate\Support\Facades\Auth;

// ... other controller methods

public function logout(Request $request)
{
  Auth::logout();
  $request->session()->invalidate();
  $request->session()->regenerateToken();

  // ...do a redirect or other stuff
}

注销。这将正确注销用户。这也是Laravel文件中提出的方法。

要从Laravel Passport注销，您可以运行

if (Auth::check()) {
  Auth::user()->token()->revoke();
}

撤消当前使用的令牌。这肯定会让用户从其请求注销的当前设备注销。

确保在路由/网络中。php您的注销路径位于组（['middleware'=

Answer 2

你在一次测试中做得太多了。但除此之外，我无法在代码中发现任何问题。但这对我起了作用：

class LogoutController extends Controller
{
    public function __construct()
    {
        $this->middleware('auth:api');
    }

    public function logout()
    {
        Auth::user()->token()->revoke();
        $tokenId = Auth::user()->token()->id;

        $refreshTokenRepository = app('Laravel\Passport\RefreshTokenRepository');
        $refreshTokenRepository->revokeRefreshTokensByAccessTokenId($tokenId);

        return response(null, Response::HTTP_NO_CONTENT);
    }
}

测试可以简单地执行以下操作：

public function testAnAuthenticatedUserCanLogout()
{
    $user = User::factory()->create();

    Passport::actingAs($user);

    $this->postJson('/api/logout')
        ->assertNoContent();
}