Publish is silent on failure unless ack requested. Fixes #86

voryx · Mar 3, 2015 · f380c80 · f380c80
1 parent 912671b
commit f380c80
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 3 deletions.
diff --git a/src/Thruway/Realm.php b/src/Thruway/Realm.php
@@ -146,6 +146,13 @@ private function processAuthenticated(Session $session, Message $msg)
             if (!$this->getAuthorizationManager()->isAuthorizedTo($session, $msg)) {
                 Logger::alert($this,
                     "Permission denied: " . $msg->getActionName() . " " . $msg->getUri() . " for " . $session->getAuthenticationDetails()->getAuthId());
+
+                // we are not to send messages in response to publish messages unless
+                // they set acknowledge = true
+                if ($msg instanceof PublishMessage) {
+                    if (!$msg->acknowledge()) return;
+                }
+
                 $session->sendMessage(ErrorMessage::createErrorMessageFromMessage($msg, "wamp.error.not_authorized"));
 
                 return;

diff --git a/tests/Unit/RealmTest.php b/tests/Unit/RealmTest.php
@@ -119,17 +119,18 @@ public function testUnauthorizedActions() {
         $realm->setAuthorizationManager($authorizationManager);
 
         $subscribeMsg = new \Thruway\Message\SubscribeMessage(\Thruway\Common\Utils::getUniqueId(), [], "some_topic");
-        $publishMsg = new \Thruway\Message\PublishMessage(\Thruway\Common\Utils::getUniqueId(), [], "some_topic");
+        $publishMsg = new \Thruway\Message\PublishMessage(\Thruway\Common\Utils::getUniqueId(), (object)["acknowledge"=>true], "some_topic");
         $registerMsg = new \Thruway\Message\RegisterMessage(\Thruway\Common\Utils::getUniqueId(), [], 'some_procedure');
         $callMsg = new \Thruway\Message\CallMessage(\Thruway\Common\Utils::getUniqueId(), [], "some_procedure");
 
-        $authorizationManager->expects($this->exactly(4))
+        $authorizationManager->expects($this->exactly(5))
             ->method("isAuthorizedTo")
             ->withConsecutive(
                 [$this->isInstanceOf('\Thruway\Session'), $this->isInstanceOf('\Thruway\Message\SubscribeMessage')],
                 [$this->isInstanceOf('\Thruway\Session'), $this->isInstanceOf('\Thruway\Message\PublishMessage')],
                 [$this->isInstanceOf('\Thruway\Session'), $this->isInstanceOf('\Thruway\Message\RegisterMessage')],
-                [$this->isInstanceOf('\Thruway\Session'), $this->isInstanceOf('\Thruway\Message\CallMessage')]
+                [$this->isInstanceOf('\Thruway\Session'), $this->isInstanceOf('\Thruway\Message\CallMessage')],
+                [$this->isInstanceOf('\Thruway\Session'), $this->isInstanceOf('\Thruway\Message\PublishMessage')]
             )
             ->willReturn(false);;
 
@@ -158,6 +159,10 @@ public function testUnauthorizedActions() {
         $realm->onMessage($session, $publishMsg);
         $realm->onMessage($session, $registerMsg);
         $realm->onMessage($session, $callMsg);
+
+        // make sure publish doesn't send error back when ack is false
+        $publishMsg2 = $publishMsg = new \Thruway\Message\PublishMessage(\Thruway\Common\Utils::getUniqueId(), [], "some_topic");;
+        $realm->onMessage($session, $publishMsg2);
     }
 
     public function testImmediateAbort() {