Does this module work with `codeception/module-rest`?

[earthiverse]

I'm getting 401 (Unauthorized) in the tests I use $I->amHttpAuthenticated('test', 'test'); with.
Routes that I don't check authorization seem to work.

When I run a test using Mezzio

FetchCest: Test fetch and retrieve svg
Signature: Codeception\Acceptance\FetchCest:testFetchAndRetrieveSvg
Test: tests/Codeception/Acceptance/FetchCest.php:testFetchAndRetrieveSvg
Scenario --
 I am http authenticated "test","test"
 I send post "/fetch",{"url":"https://upload.wikimedia.org/wikipedia/en/8/80/Wikipedia-logo-v2.svg","name":"Wikipedia Logo"}
  [Request] POST /fetch {"url":"https://upload.wikimedia.org/wikipedia/en/8/80/Wikipedia-logo-v2.svg","name":"Wikipedia Logo"}
  [Request Headers] []
  [Page] /fetch
  [Response] 401
  [Request Cookies] []
  [Response Headers] {"WWW-Authenticate":["Basic realm="media-store""]}
  [Response] 
 I see response is json 
 FAIL 

When I run it using PhpBrowser

FetchCest: Test fetch and retrieve svg
Signature: Codeception\Acceptance\FetchCest:testFetchAndRetrieveSvg
Test: tests/Codeception/Acceptance/FetchCest.php:testFetchAndRetrieveSvg
Scenario --
 I am http authenticated "test","test"
 I send post "/fetch",{"url":"https://upload.wikimedia.org/wikipedia/en/8/80/Wikipedia-logo-v2.svg","name":"Wikipedia Logo"}
  [Request] POST http://media-store.localhost/fetch {"url":"https://upload.wikimedia.org/wikipedia/en/8/80/Wikipedia-logo-v2.svg","name":"Wikipedia Logo"}
  [Request Headers] []
  [Page] http://media-store.localhost/fetch
  [Response] 200
  [Request Cookies] []
  [Response Headers] {"Server":["nginx/1.27.1"],"Date":["Wed, 09 Oct 2024 02:29:39 GMT"],"Content-Type":["application/json"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"X-Powered-By":["PHP/8.3.12"]}
  [Response] {"success":true,"url":"http://media-store.localhost/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo","meta":{"width":103,"height":94,"filesize":165428,"mimetype":"image/svg+xml"}}
 I see response is json 
 I see response contains json {"success":true,"meta":{"mimetype":"image/svg+xml"}}
 I see response code is 200
 I grab data from response by json path "url"
 I assert not null "/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo"
 I assert string contains string ignoring case "Wikipedia","/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo"
 I assert string contains string ignoring case "Logo","/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo"
 I am http authenticated "",""
 I send get "/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo"
  [Request] GET http://media-store.localhost/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo
  [Request Headers] []
  [Page] http://media-store.localhost/img/store/79/bd/bb953537891b27c9d26a0f1815584fbe5364/wikipedia-logo
  [Response] 200
  [Request Cookies] []
  [Response Headers] {"Server":["nginx/1.27.1"],"Date":["Wed, 09 Oct 2024 02:29:40 GMT"],"Content-Type":["image/svg+xml"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"X-Powered-By":["PHP/8.3.12"],"Last-Modified":["Tue, 08 Oct 2024 07:59:10 GMT"],"Cache-Control":["public, max-age=86400, no-transform"],"ETag":["0df5066882793e7b1893e3adc393abbc"]}
  [Response] <A very long XML string here>
 I see response code is 200
 PASSED 

Here's my Acceptance.suite.yml

actor: AcceptanceTester
suite_namespace: Codeception\Acceptance
modules:
  enabled:
    - \Codeception\Module\Asserts
    - \Codeception\Module\REST
  config:
    \Codeception\Module\REST:
      depends: \Codeception\Module\PhpBrowser
      url: http://media-store.localhost/
env:
  mezzio:
    modules:
      enabled:
        - \Codeception\Module\Mezzio
      config:
        \Codeception\Module\REST:
          depends: \Codeception\Module\Mezzio
          url: /
  docker:
    modules:
      config:
        \Codeception\Module\REST:
          url: http://localhost:8080/

And my test

public function testFetchAndRetrieveSvg(AcceptanceTester $I): void
{
    // Fetch the Wikipedia logo
    $I->amHttpAuthenticated('test', 'test');
    $I->sendPost('/fetch', [
        'url' => 'https://upload.wikimedia.org/wikipedia/en/8/80/Wikipedia-logo-v2.svg',
        'name' => 'Wikipedia Logo',
    ]);
    $I->seeResponseIsJson();
    $I->seeResponseContainsJson([
        'success' => true,
        'meta' => [
            'mimetype' => 'image/svg+xml',
        ],
    ]);
    $I->seeResponseCodeIs(StatusCodes::STATUS_OK);

    // Parse the URL that we retrieved in the response
    $path = parse_url($I->grabDataFromResponseByJsonPath('url')[0])['path'];
    $I->assertNotNull($path);
    $I->assertStringContainsStringIgnoringCase('Wikipedia', $path);
    $I->assertStringContainsStringIgnoringCase('Logo', $path);

    // Retrieve the stored image without authentication
    $I->amHttpAuthenticated('', '');
    $I->sendGet($path);
    $I->seeResponseCodeIs(StatusCodes::STATUS_OK);
}

[Naktibalda]

Yes, it does work with module-rest.

module-mezzio only sets PHP_AUTH_USER, PHP_AUTH_PW in ServerRequest object, $_SERVER is not updated.
They should be accessible using $request->getServerParams().

[earthiverse]

I'm using Mezzio's mezzio-authentication-basic package, which looks like it only parses the Header.

https://github.com/mezzio/mezzio-authentication-basic/blob/d4de17a175f4d71558a5dc1b33087938dba3f02b/src/BasicAccess.php#L57

If I add the header manually it works.

$I->haveHttpHeader('Authentication', 'Basic dGVzdDp0ZXN0');

[earthiverse]

I ended up making helper functions in my AcceptanceTester to work around this.

    public function amAuthenticated(string $username, string $password): void
    {
        if ($this->getScenario()->current('env') === 'mezzio') {
            $auth = base64_encode("$username:$password");
            $this->haveHttpHeader('Authorization', "Basic $auth");
        } else {
            $this->amHttpAuthenticated($username, $password);
        }
    }

    public function amUnauthenticated(): void
    {
        if ($this->getScenario()->current('env') === 'mezzio') {
            $this->unsetHttpHeader('Authorization');
        } else {
            $this->amHttpAuthenticated('', '');
        }
    }