bring back remember-me

* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

4 files changed, 201 insertions, 136 deletions

diff --git a/tests/lib/Authentication/Token/DefaultTokenMapperTest.php b/tests/lib/Authentication/Token/DefaultTokenMapperTest.php
index d71d9468477..418a4d14f62 100644
--- a/tests/lib/Authentication/Token/DefaultTokenMapperTest.php
+++ b/tests/lib/Authentication/Token/DefaultTokenMapperTest.php
@@ -130,6 +130,7 @@ class DefaultTokenMapperTest extends TestCase {
 		$token->setName('Firefox on Android');
 		$token->setToken('1504445f1524fc801035448a95681a9378ba2e83930c814546c56e5d6ebde221198792fd900c88ed5ead0555780dad1ebce3370d7e154941cd5de87eb419899b');
 		$token->setType(IToken::TEMPORARY_TOKEN);
+		$token->setRemember(IToken::DO_NOT_REMEMBER);
 		$token->setLastActivity($this->time - 60 * 60 * 24 * 3);
 		$token->setLastCheck($this->time - 10);
 
diff --git a/tests/lib/Authentication/Token/DefaultTokenProviderTest.php b/tests/lib/Authentication/Token/DefaultTokenProviderTest.php
index 7f90cf051f4..cd6bf7bad57 100644
--- a/tests/lib/Authentication/Token/DefaultTokenProviderTest.php
+++ b/tests/lib/Authentication/Token/DefaultTokenProviderTest.php
@@ -25,7 +25,6 @@ namespace Test\Authentication\Token;
 use OC\Authentication\Token\DefaultToken;
 use OC\Authentication\Token\DefaultTokenProvider;
 use OC\Authentication\Token\IToken;
-use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\IConfig;
 use OCP\ILogger;
@@ -81,6 +80,7 @@ class DefaultTokenProviderTest extends TestCase {
 		$toInsert->setName($name);
 		$toInsert->setToken(hash('sha512', $token . '1f4h9s'));
 		$toInsert->setType($type);
+		$toInsert->setRemember(IToken::DO_NOT_REMEMBER);
 		$toInsert->setLastActivity($this->time);
 
 		$this->config->expects($this->any())
@@ -95,7 +95,7 @@ class DefaultTokenProviderTest extends TestCase {
 			->method('insert')
 			->with($this->equalTo($toInsert));
 
-		$actual = $this->tokenProvider->generateToken($token, $uid, $user, $password, $name, $type);
+		$actual = $this->tokenProvider->generateToken($token, $uid, $user, $password, $name, $type, IToken::DO_NOT_REMEMBER);
 
 		$this->assertEquals($toInsert, $actual);
 	}
@@ -245,13 +245,19 @@ class DefaultTokenProviderTest extends TestCase {
 
 	public function testInvalidateOldTokens() {
 		$defaultSessionLifetime = 60 * 60 * 24;
-		$this->config->expects($this->once())
+		$defaultRememberMeLifetime = 60 * 60 * 24 * 15;
+		$this->config->expects($this->exactly(2))
 			->method('getSystemValue')
-			->with('session_lifetime', $defaultSessionLifetime)
-			->will($this->returnValue(150));
-		$this->mapper->expects($this->once())
+			->will($this->returnValueMap([
+				['session_lifetime', $defaultSessionLifetime, 150],
+				['remember_login_cookie_lifetime', $defaultRememberMeLifetime, 300],
+			]));
+		$this->mapper->expects($this->at(0))
 			->method('invalidateOld')
 			->with($this->time - 150);
+		$this->mapper->expects($this->at(1))
+			->method('invalidateOld')
+			->with($this->time - 300);
 
 		$this->tokenProvider->invalidateOldTokens();
 	}
diff --git a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
index 72b70d817d2..52f3ca28500 100644
--- a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
+++ b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
@@ -233,8 +233,15 @@ class ManagerTest extends TestCase {
 			->with($this->user, $challenge)
 			->will($this->returnValue(true));
 		$this->session->expects($this->once())
+			->method('get')
+			->with('two_factor_remember_login')
+			->will($this->returnValue(false));
+		$this->session->expects($this->at(1))
 			->method('remove')
 			->with('two_factor_auth_uid');
+		$this->session->expects($this->at(2))
+			->method('remove')
+			->with('two_factor_remember_login');
 
 		$this->assertTrue($this->manager->verifyChallenge('email', $this->user, $challenge));
 	}
@@ -304,11 +311,29 @@ class ManagerTest extends TestCase {
 			->method('getUID')
 			->will($this->returnValue('ferdinand'));
 
-		$this->session->expects($this->once())
+		$this->session->expects($this->at(0))
+			->method('set')
+			->with('two_factor_auth_uid', 'ferdinand');
+		$this->session->expects($this->at(1))
+			->method('set')
+			->with('two_factor_remember_login', true);
+
+		$this->manager->prepareTwoFactorLogin($this->user, true);
+	}
+
+	public function testPrepareTwoFactorLoginDontRemember() {
+		$this->user->expects($this->once())
+			->method('getUID')
+			->will($this->returnValue('ferdinand'));
+
+		$this->session->expects($this->at(0))
 			->method('set')
 			->with('two_factor_auth_uid', 'ferdinand');
+		$this->session->expects($this->at(1))
+			->method('set')
+			->with('two_factor_remember_login', false);
 
-		$this->manager->prepareTwoFactorLogin($this->user);
+		$this->manager->prepareTwoFactorLogin($this->user, false);
 	}
 
 }
diff --git a/tests/lib/User/SessionTest.php b/tests/lib/User/SessionTest.php
index 268d8e10e5a..c324870a60a 100644
--- a/tests/lib/User/SessionTest.php
+++ b/tests/lib/User/SessionTest.php
@@ -52,6 +52,8 @@ class SessionTest extends \Test\TestCase {
 		$this->tokenProvider = $this->createMock(IProvider::class);
 		$this->config = $this->createMock(IConfig::class);
 		$this->throttler = $this->createMock(Throttler::class);
+
+		\OC_User::setIncognitoMode(false);
 	}
 
 	public function testGetUser() {
@@ -100,7 +102,7 @@ class SessionTest extends \Test\TestCase {
 			->method('updateTokenActivity')
 			->with($token);
 
-		$manager->expects($this->any())
+		$manager->expects($this->once())
 			->method('get')
 			->with($expectedUser->getUID())
 			->will($this->returnValue($expectedUser));
@@ -181,16 +183,9 @@ class SessionTest extends \Test\TestCase {
 			}, 'foo'));
 
 		$managerMethods = get_class_methods(Manager::class);
-		//keep following methods intact in order to ensure hooks are
-		//working
-		$doNotMock = array('__construct', 'emit', 'listen');
-		foreach ($doNotMock as $methodName) {
-			$i = array_search($methodName, $managerMethods, true);
-			if ($i !== false) {
-				unset($managerMethods[$i]);
-			}
-		}
-		$manager = $this->getMockBuilder(Manager::class)
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
 			->setMethods($managerMethods)
 			->setConstructorArgs([$this->config])
 			->getMock();
@@ -238,17 +233,10 @@ class SessionTest extends \Test\TestCase {
 			->with('bar')
 			->will($this->throwException(new \OC\Authentication\Exceptions\InvalidTokenException()));
 
-		$managerMethods = get_class_methods('\OC\User\Manager');
-		//keep following methods intact in order to ensure hooks are
-		//working
-		$doNotMock = array('__construct', 'emit', 'listen');
-		foreach ($doNotMock as $methodName) {
-			$i = array_search($methodName, $managerMethods, true);
-			if ($i !== false) {
-				unset($managerMethods[$i]);
-			}
-		}
-		$manager = $this->getMockBuilder(Manager::class)
+		$managerMethods = get_class_methods(\OC\User\Manager::class);
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
 			->setMethods($managerMethods)
 			->setConstructorArgs([$this->config])
 			->getMock();
@@ -273,17 +261,10 @@ class SessionTest extends \Test\TestCase {
 
 	public function testLoginInvalidPassword() {
 		$session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
-		$managerMethods = get_class_methods('\OC\User\Manager');
-		//keep following methods intact in order to ensure hooks are
-		//working
-		$doNotMock = array('__construct', 'emit', 'listen');
-		foreach ($doNotMock as $methodName) {
-			$i = array_search($methodName, $managerMethods, true);
-			if ($i !== false) {
-				unset($managerMethods[$i]);
-			}
-		}
-		$manager = $this->getMockBuilder(Manager::class)
+		$managerMethods = get_class_methods(\OC\User\Manager::class);
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
 			->setMethods($managerMethods)
 			->setConstructorArgs([$this->config])
 			->getMock();
@@ -513,156 +494,208 @@ class SessionTest extends \Test\TestCase {
 
 	public function testRememberLoginValidToken() {
 		$session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
-		$session->expects($this->exactly(1))
-			->method('set')
-			->with($this->callback(function ($key) {
-				switch ($key) {
-					case 'user_id':
-						return true;
-					default:
-						return false;
-				}
-			}, 'foo'));
-		$session->expects($this->once())
-			->method('regenerateId');
+		$managerMethods = get_class_methods(\OC\User\Manager::class);
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
+		$userSession = $this->getMockBuilder(Session::class)
+			//override, otherwise tests will fail because of setcookie()
+			->setMethods(['setMagicInCookie'])
+			->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config])
+			->getMock();
 
-		$managerMethods = get_class_methods(Manager::class);
-		//keep following methods intact in order to ensure hooks are
-		//working
-		$doNotMock = array('__construct', 'emit', 'listen');
-		foreach ($doNotMock as $methodName) {
-			$i = array_search($methodName, $managerMethods, true);
-			if ($i !== false) {
-				unset($managerMethods[$i]);
-			}
-		}
-		$manager = $this->getMockBuilder(Manager::class)
+		$user = $this->createMock(IUser::class);
+		$token = 'goodToken';
+		$oldSessionId = 'sess321';
+		$sessionId = 'sess123';
 			->setMethods($managerMethods)
 			->setConstructorArgs([$this->config])
 			->getMock();
 
-		$backend = $this->createMock(\Test\Util\User\Dummy::class);
+		$session->expects($this->once())
+			->method('regenerateId');
+		$manager->expects($this->once())
+			->method('get')
+			->with('foo')
+			->will($this->returnValue($user));
+		$this->config->expects($this->once())
+			->method('getUserKeys')
+			->with('foo', 'login_token')
+			->will($this->returnValue([$token]));
+		$this->config->expects($this->once())
+			->method('deleteUserValue')
+			->with('foo', 'login_token', $token);
+		$this->config->expects($this->once())
+			->method('setUserValue'); // TODO: mock new random value
 
-		$user = $this->getMockBuilder(User::class)->setConstructorArgs(['foo', $backend])->getMock();
+		$session->expects($this->once())
+			->method('getId')
+			->will($this->returnValue($sessionId));
+		$this->tokenProvider->expects($this->once())
+			->method('renewSessionToken')
+			->with($oldSessionId, $sessionId)
+			->will($this->returnValue(true));
 
 		$user->expects($this->any())
 			->method('getUID')
 			->will($this->returnValue('foo'));
+		$userSession->expects($this->once())
+			->method('setMagicInCookie');
 		$user->expects($this->once())
 			->method('updateLastLoginTimestamp');
+		$session->expects($this->once())
+			->method('set')
+			->with('user_id', 'foo');
 
-		$manager->expects($this->once())
-			->method('get')
-			->with('foo')
-			->will($this->returnValue($user));
+		$granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
 
-		//prepare login token
-		$token = 'goodToken';
-		\OC::$server->getConfig()->setUserValue('foo', 'login_token', $token, time());
+		$this->assertTrue($granted);
+	}
 
+	public function testRememberLoginInvalidSessionToken() {
+		$session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
+		$managerMethods = get_class_methods(\OC\User\Manager::class);
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
 		$userSession = $this->getMockBuilder(Session::class)
 			//override, otherwise tests will fail because of setcookie()
 			->setMethods(['setMagicInCookie'])
-			//there  are passed as parameters to the constructor
 			->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config])
 			->getMock();
 
-		$granted = $userSession->loginWithCookie('foo', $token);
-
-		$this->assertSame($granted, true);
-	}
+		$user = $this->createMock(IUser::class);
+		$token = 'goodToken';
+		$oldSessionId = 'sess321';
+		$sessionId = 'sess123';
 
-	public function testRememberLoginInvalidToken() {
-		$session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
-		$session->expects($this->never())
-			->method('set');
 		$session->expects($this->once())
 			->method('regenerateId');
+		$manager->expects($this->once())
+			->method('get')
+			->with('foo')
+			->will($this->returnValue($user));
+		$this->config->expects($this->once())
+			->method('getUserKeys')
+			->with('foo', 'login_token')
+			->will($this->returnValue([$token]));
+		$this->config->expects($this->once())
+			->method('deleteUserValue')
+			->with('foo', 'login_token', $token);
+		$this->config->expects($this->once())
+			->method('setUserValue'); // TODO: mock new random value
 
-		$managerMethods = get_class_methods('\OC\User\Manager');
-		//keep following methods intact in order to ensure hooks are
-		//working
-		$doNotMock = array('__construct', 'emit', 'listen');
-		foreach ($doNotMock as $methodName) {
-			$i = array_search($methodName, $managerMethods, true);
-			if ($i !== false) {
-				unset($managerMethods[$i]);
-			}
-		}
-		$manager = $this->getMockBuilder(Manager::class)
+		$session->expects($this->once())
+			->method('getId')
+			->will($this->returnValue($sessionId));
+		$this->tokenProvider->expects($this->once())
+			->method('renewSessionToken')
+			->with($oldSessionId, $sessionId)
+			->will($this->throwException(new \OC\Authentication\Exceptions\InvalidTokenException()));
 			->setMethods($managerMethods)
 			->setConstructorArgs([$this->config])
 			->getMock();
 
-		$backend = $this->createMock(\Test\Util\User\Dummy::class);
-
-		$user = $this->getMockBuilder(User::class)->setConstructorArgs(['foo', $backend])->getMock();
-
-		$user->expects($this->any())
+		$user->expects($this->never())
 			->method('getUID')
 			->will($this->returnValue('foo'));
+		$userSession->expects($this->never())
+			->method('setMagicInCookie');
 		$user->expects($this->never())
 			->method('updateLastLoginTimestamp');
+		$session->expects($this->never())
+			->method('set')
+			->with('user_id', 'foo');
+
+		$granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
+
+		$this->assertFalse($granted);
+	}
+
+	public function testRememberLoginInvalidToken() {
+		$session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
+		$managerMethods = get_class_methods(\OC\User\Manager::class);
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
+		$userSession = $this->getMockBuilder(Session::class)
+			//override, otherwise tests will fail because of setcookie()
+			->setMethods(['setMagicInCookie'])
+			->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config])
+			->getMock();
+
+		$user = $this->createMock(IUser::class);
+		$token = 'goodToken';
+		$oldSessionId = 'sess321';
 
+		$session->expects($this->once())
+			->method('regenerateId');
 		$manager->expects($this->once())
 			->method('get')
 			->with('foo')
 			->will($this->returnValue($user));
+		$this->config->expects($this->once())
+			->method('getUserKeys')
+			->with('foo', 'login_token')
+			->will($this->returnValue(['anothertoken']));
+		$this->config->expects($this->never())
+			->method('deleteUserValue')
+			->with('foo', 'login_token', $token);
+
+		$this->tokenProvider->expects($this->never())
+			->method('renewSessionToken');
+		$userSession->expects($this->never())
+			->method('setMagicInCookie');
+		$user->expects($this->never())
+			->method('updateLastLoginTimestamp');
+		$session->expects($this->never())
+			->method('set')
+			->with('user_id', 'foo');
 
-		//prepare login token
-		$token = 'goodToken';
-		\OC::$server->getConfig()->setUserValue('foo', 'login_token', $token, time());
-
-		$userSession = new \OC\User\Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config);
-		$granted = $userSession->loginWithCookie('foo', 'badToken');
+		$granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
 
-		$this->assertSame($granted, false);
+		$this->assertFalse($granted);
 	}
 
 	public function testRememberLoginInvalidUser() {
 		$session = $this->getMockBuilder(Memory::class)->setConstructorArgs([''])->getMock();
-		$session->expects($this->never())
-			->method('set');
+		$managerMethods = get_class_methods(\OC\User\Manager::class);
+		//keep following methods intact in order to ensure hooks are working
+		$mockedManagerMethods = array_diff($managerMethods, ['__construct', 'emit', 'listen']);
+		$manager = $this->getMockBuilder(Manager::class)->setMethods($mockedManagerMethods)->getMock();
+		$userSession = $this->getMockBuilder(Session::class)
+			//override, otherwise tests will fail because of setcookie()
+			->setMethods(['setMagicInCookie'])
+			->setConstructorArgs([$manager, $session, $this->timeFactory, $this->tokenProvider, $this->config])
+			->getMock();
+		$token = 'goodToken';
+		$oldSessionId = 'sess321';
+
 		$session->expects($this->once())
 			->method('regenerateId');
-
-		$managerMethods = get_class_methods('\OC\User\Manager');
-		//keep following methods intact in order to ensure hooks are
-		//working
-		$doNotMock = array('__construct', 'emit', 'listen');
-		foreach ($doNotMock as $methodName) {
-			$i = array_search($methodName, $managerMethods, true);
-			if ($i !== false) {
-				unset($managerMethods[$i]);
-			}
-		}
-		$manager = $this->getMockBuilder(Manager::class)
 			->setMethods($managerMethods)
 			->setConstructorArgs([$this->config])
 			->getMock();
-
-		$backend = $this->createMock(\Test\Util\User\Dummy::class);
-
-		$user = $this->getMockBuilder(User::class)->setConstructorArgs(['foo', $backend])->getMock();
-
-		$user->expects($this->never())
-			->method('getUID');
-		$user->expects($this->never())
-			->method('updateLastLoginTimestamp');
-
 		$manager->expects($this->once())
 			->method('get')
 			->with('foo')
 			->will($this->returnValue(null));
+		$this->config->expects($this->never())
+			->method('getUserKeys')
+			->with('foo', 'login_token')
+			->will($this->returnValue(['anothertoken']));
+
+		$this->tokenProvider->expects($this->never())
+			->method('renewSessionToken');
+		$userSession->expects($this->never())
+			->method('setMagicInCookie');
+		$session->expects($this->never())
+			->method('set')
+			->with('user_id', 'foo');
 
-		//prepare login token
-		$token = 'goodToken';
-		\OC::$server->getConfig()->setUserValue('foo', 'login_token', $token, time());
-
-		$userSession = new \OC\User\Session($manager, $session, $this->timeFactory, $this->tokenProvider, $this->config);
-		$granted = $userSession->loginWithCookie('foo', $token);
+		$granted = $userSession->loginWithCookie('foo', $token, $oldSessionId);
 
-		$this->assertSame($granted, false);
+		$this->assertFalse($granted);
 	}
 
 	public function testActiveUserAfterSetSession() {