Testing Laravel Password Reset - php

Question

I'm implementing the password reset functionality described in the Laravel docs at https://laravel.com/docs/8.x/passwords. My method for resetting passwords is as follows:
public function doPasswordReset(Request $request)
{
$request->validate([
'token' => 'required',
'email' => 'required|email',
'password' => 'required|min:8|confirmed',
]);
$status = Password::reset(
$request->only('email', 'password', 'password_confirmation', 'token'),
function ($user, $password) {
$user->forceFill([
'password' => Hash::make($password)
]);
//remember token not needed
//->setRememberToken(Str::random(60));
$user->save();
event(new PasswordReset($user));
}
);
return $status === Password::PASSWORD_RESET
? redirect()->route('login')->with('status', __($status))
: back()->withErrors(['email' => [__($status)]]);
}
My test for this method is:
/** #test */
public function the_user_can_update_their_password()
{
ParentUser::factory()->create([
'email' => 'user#domain.com',
'password' => Hash::make('oldpassword')
]);
$token = Password::createToken(ParentUser::first());
Password::shouldReceive('reset')
->once()
->withSomeofArgs([
'email' => 'user#domain.com',
'password' => 'newpassword',
'password_confirmation' => 'newpassword',
'token' => $token
])
->andReturn(Password::PASSWORD_RESET);
$response = $this->post(route('password.update'), [
'email' => 'user#domain.com',
'password' => 'newpassword',
'password_confirmation' => 'newpassword',
'token' => $token
]);
$response->assertRedirect(route('login'));
//failures from here
$this->assertEquals(Hash::make('newpassword'), Hash::make(ParentUser::first()->password));
$this->assertNotEquals(Hash::make('oldpassword'), Hash::make(ParentUser::first()->password));
Event::fake();
Event::assertDispatched(PasswordReset::class, ParentUser::first());
}
My issue is that the last three assertations fail. I realize that this is happening because my mock is not calling the closure to effect the password change and raise the event. So my question is whether it is possible to mock some arguments of a function call.
One solution I am thinking is to factor out the closure into its own method and test that separately. In the absence of anything else, I think this may be the only way.

Answer 1

Props to #tim-lewis and #apokryfos who both provided answers to help. The following is the amended test which now passes.
#apokryfos stated that mocking the call shouldn't happen as we need to actuallly effect the password change.
#tim-lewis in his answer showed that a hash needs to be checked with the Hash::check() method
/** #test */
public function the_user_can_update_their_password()
{
ParentUser::factory()->create([
'email' => 'user#domain.com',
'password' => Hash::make('oldpassword')
]);
$token = Password::createToken(ParentUser::first());
Event::fake();
$response = $this->post(route('password.update'), [
'email' => 'user#domain.com',
'password' => 'newpassword',
'password_confirmation' => 'newpassword',
'token' => $token
]);
dump(ParentUser::first()->password);
$response->assertRedirect(route('login'));
$this->assertTrue(Hash::check('newpassword', ParentUser::first()->password));
Event::assertDispatched(PasswordReset::class);
}

Answer 2

Hash::make() doesn't generate the same Hash for any given value. Take a look:
Hash::make('newpassword') == Hash::make('newpassword')
// false
Since this is false, I would expect assetEquals() to fail here, since they values do not equal each other. Instead, take a look at the Hash::check() method:
Hash::check('newpassword', Hash::make('newpassword'))
// true
You can use assertTrue() against it instead, something like:
$this->assertTrue(Hash::check('newpassword', ParentUser::first()->password));
$this->assertFalse(Hash::check('oldpassword', ParentUser::first()->password));
Sidenote, ->password should already be Hashed, so there's no need to wrap that in another Hash::make(), as you'd then have a "Hash-of-a-hash", which would fail the Hash::check().