fix(manager): restore XHR CSRF responses and update tab restoration tests

Author: Seiger

core/src/Middleware/VerifyCsrfToken.php

@@ -154,11 +154,12 @@ protected function getActionId($request)
     }
 
     /**
-     * Builds the rejection response, matching the format the caller expects.
+     * Builds the rejection response. Legacy XHR callers require JSON even when
+     * their Accept header prefers HTML; ordinary page loads receive plain text.
      */
     protected function reject($request)
     {
-        if ($request->expectsJson()) {
+        if ($request->ajax() || $request->wantsJson()) {
             return Response::json(['error' => 'CSRF token mismatch', 'code' => 'csrf_token_mismatch'], 403);
         }
 

core/tests/Unit/Manager/FrameMainTargetHelperIncludeTest.php

@@ -1,13 +1,16 @@
 <?php
 
-test('manager frame loads main target link helper before modx js', function () {
+test('manager frame loads navigation and restoration helpers before versioned evo js', function () {
     $template = file_get_contents(dirname(__DIR__, 4) . '/manager/views/frame/1.blade.php');
 
     $treeHelper = 'media/script/tree-drop-guard-helper.js?v={{evo()->getVersionData(\'version\')}}';
     $mainTargetHelper = 'media/script/main-target-link-helper.js?v={{evo()->getVersionData(\'version\')}}';
-    $modxScript = '{{ManagerTheme::getThemeUrl()}}js/evo.js?v={{evo()->getVersionData(\'version\')}}';
+    $tabHelper = "@revision(MGR_DIR . '/media/script/manager-tab-state.js')";
+    $evoScript = "@revision(MGR_DIR . '/' . ManagerTheme::getThemeDir(false) . 'js/evo.js')";
 
     expect(str_contains($template, $treeHelper))->toBeTrue();
     expect(str_contains($template, $mainTargetHelper))->toBeTrue();
-    expect(strpos($template, $mainTargetHelper))->toBeLessThan(strpos($template, $modxScript));
+    expect($template)->toContain($tabHelper)->toContain($evoScript);
+    expect(strpos($template, $mainTargetHelper))->toBeLessThan(strpos($template, $tabHelper));
+    expect(strpos($template, $tabHelper))->toBeLessThan(strpos($template, $evoScript));
 });

core/tests/Unit/Manager/GlobalTabsCsrfTokenTest.php

@@ -1,21 +1,36 @@
 <?php
 
-test('manager global tabs refresh persisted csrf tokens before restoring urls', function () {
+test('manager global tabs delegate token-free storage and audited restoration to the shared helper', function () {
     $frame = file_get_contents(dirname(__DIR__, 4) . '/manager/views/frame/1.blade.php');
 
     expect($frame)
-        ->toContain('csrf_token: @js(csrf_token())');
+        ->toMatch('~<meta\s+name="csrf-token"\s+content="\{\{ csrf_token\(\) \}\}"\s*/?>~')
+        ->toContain("config('cms.manager_tab_restore.modules'")
+        ->toContain('tab_restore_user:');
 
     $script = file_get_contents(dirname(__DIR__, 4) . '/manager/media/style/default/js/evo.js');
 
     expect($script)
-        ->toContain("tabsCsrfPlaceholder: '__EVO_CSRF_TOKEN__'")
+        ->not->toContain('__EVO_CSRF_TOKEN__')
         ->toContain('tabUrlForStorage: function (url)')
         ->toContain('tabUrlForRestore: function (url)')
+        ->toContain('w.evoManagerTabState.storage(url, evo.tabsRestoreOptions())')
+        ->toContain('w.evoManagerTabState.restore(url, evo.tabsRestoreOptions())')
         ->toContain('url: evo.tabUrlForStorage(url)')
         ->toContain('active: evo.tabUrlForStorage(activeUrl)')
-        ->toContain('url: evo.tabUrlForRestore(tab.url)')
-        ->toContain('url: evo.tabUrlForRestore(data.active)')
-        ->toContain('evo.tabUrlForRestore(href)')
+        ->toContain('var tabUrl = evo.tabUrlForRestore(tab.url)')
+        ->toContain('var activeUrl = evo.tabUrlForRestore(data.active)')
+        ->toContain('startupUrl = evo.tabUrlForRestore(w.location.href)')
+        ->toContain('token: evo.tabsCsrfToken()')
+        ->toContain('modules: evo.config.tab_restore_modules')
+        ->toContain("'EVO_Tabs:' + encodeURIComponent(evo.EVO_MANAGER_URL) + ':' + evo.config.tab_restore_user")
         ->toContain("localStorage.setItem('page_url', evo.tabUrlForStorage(b))");
+
+    // Runtime URL validation and stale-token cases live in manager-tab-state.test.js.
+    $helper = file_get_contents(dirname(__DIR__, 4) . '/manager/media/script/manager-tab-state.js');
+    expect($helper)
+        ->toContain("target.searchParams.delete('_token')")
+        ->toContain("target.searchParams.set('_token', options.token)")
+        ->toContain('var target = read(url, options)')
+        ->toContain("if (!target || !options.token) return ''");
 });

core/tests/Unit/Security/ManagerCsrfMiddlewareTest.php

@@ -205,8 +205,11 @@ function csrfPassed(Request $request): bool
     expect(csrfPassed($request))->toBeTrue();
 });
 
-it('answers XHR callers with JSON and page requests with plain text', function () {
-    $xhr = csrfRequest('POST', ['a' => 109], ['HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest']);
+it('answers XHR callers with JSON and page requests with plain text', function (string $accept) {
+    $xhr = csrfRequest('POST', ['a' => 109], [
+        'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest',
+        'HTTP_ACCEPT' => $accept,
+    ]);
     $page = csrfRequest('GET', ['a' => 6, 'id' => 3]);
 
     $middleware = new VerifyCsrfToken();
@@ -216,6 +219,13 @@ function csrfPassed(Request $request): bool
         ->toMatchArray(['kind' => 'json', 'status' => 403])
         ->and($middleware->handle($page, $noop))
         ->toMatchArray(['kind' => 'text', 'status' => 403]);
+})->with(['text/html', '*/*', 'application/json']);
+
+it('answers non-XHR JSON clients with a JSON rejection', function () {
+    $request = csrfRequest('POST', ['a' => 109], ['HTTP_ACCEPT' => 'application/json']);
+
+    expect((new VerifyCsrfToken())->handle($request, fn () => 'next'))
+        ->toMatchArray(['kind' => 'json', 'status' => 403]);
 });
 
 it('lets HEAD and OPTIONS through for ordinary navigation', function (string $method) {