From 4e6b586b77b4182764d04f6ed4b3713ff1fb4282 Mon Sep 17 00:00:00 2001
From: fs <fs@breadcrumb-solutions.de>
Date: Mon, 13 Apr 2026 19:28:07 +0200
Subject: [PATCH] =?UTF-8?q?refactor:=20enforce=20layer=20discipline=20?=
 =?UTF-8?q?=E2=80=94=20move=20repositories,=20fix=20constructor=20injectio?=
 =?UTF-8?q?n?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Move HelpdeskTenantSettingsRepository and HelpdeskTokenRepository from
  Service/ to Repository/ directory (GR-SEC-003: SQL only in repositories)
- Make AccessControl constructor require IntendedUrlService explicitly
  instead of falling back to `new IntendedUrlService()` (GR-TEST-002:
  no service instantiation outside factories)
- Update all imports and tests accordingly

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 lib/Http/AccessControl.php                           |  4 ++--
 .../Module/Helpdesk/HelpdeskContainerRegistrar.php   |  4 ++--
 .../HelpdeskTenantSettingsRepository.php             |  2 +-
 .../HelpdeskTokenRepository.php                      |  2 +-
 .../Helpdesk/Service/HelpdeskOAuthTokenService.php   |  2 ++
 .../Service/HelpdeskTenantSettingsGateway.php        |  1 +
 modules/helpdesk/pages/helpdesk/settings/index().php |  2 +-
 .../Service/HelpdeskOAuthTokenServiceTest.php        |  2 +-
 .../Helpdesk/Service/HelpdeskTokenRepositoryTest.php |  2 +-
 tests/Http/AccessControlTest.php                     | 12 +++++++++---
 10 files changed, 21 insertions(+), 12 deletions(-)
 rename modules/helpdesk/lib/Module/Helpdesk/{Service => Repository}/HelpdeskTenantSettingsRepository.php (98%)
 rename modules/helpdesk/lib/Module/Helpdesk/{Service => Repository}/HelpdeskTokenRepository.php (98%)

diff --git a/lib/Http/AccessControl.php b/lib/Http/AccessControl.php
index a73cd03..47b2a66 100644
--- a/lib/Http/AccessControl.php
+++ b/lib/Http/AccessControl.php
@@ -22,7 +22,7 @@ class AccessControl
     private array $configuredPublicPaths;
     private IntendedUrlService $intendedUrlService;
 
-    public function __construct(array $publicPaths = [], ?IntendedUrlService $intendedUrlService = null)
+    public function __construct(array $publicPaths, IntendedUrlService $intendedUrlService)
     {
         $normalizedPaths = [];
         foreach ($publicPaths as $path) {
@@ -34,7 +34,7 @@ class AccessControl
         }
 
         $this->configuredPublicPaths = array_values(array_unique($normalizedPaths));
-        $this->intendedUrlService = $intendedUrlService ?? new IntendedUrlService();
+        $this->intendedUrlService = $intendedUrlService;
     }
 
     /**
diff --git a/modules/helpdesk/lib/Module/Helpdesk/HelpdeskContainerRegistrar.php b/modules/helpdesk/lib/Module/Helpdesk/HelpdeskContainerRegistrar.php
index 3c11312..e74126b 100644
--- a/modules/helpdesk/lib/Module/Helpdesk/HelpdeskContainerRegistrar.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/HelpdeskContainerRegistrar.php
@@ -13,8 +13,8 @@ use MintyPHP\Module\Helpdesk\Service\EffectiveHelpdeskSettingsService;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskOAuthTokenService;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskSettingsGateway;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskTenantSettingsGateway;
-use MintyPHP\Module\Helpdesk\Service\HelpdeskTenantSettingsRepository;
-use MintyPHP\Module\Helpdesk\Service\HelpdeskTokenRepository;
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTenantSettingsRepository;
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTokenRepository;
 use MintyPHP\Module\Helpdesk\Service\SystemRecommendationEngine;
 use MintyPHP\Module\Helpdesk\Service\TicketCommunicationService;
 use MintyPHP\Service\Access\PermissionService;
diff --git a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsRepository.php b/modules/helpdesk/lib/Module/Helpdesk/Repository/HelpdeskTenantSettingsRepository.php
similarity index 98%
rename from modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsRepository.php
rename to modules/helpdesk/lib/Module/Helpdesk/Repository/HelpdeskTenantSettingsRepository.php
index f7047f9..d950f09 100644
--- a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsRepository.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/Repository/HelpdeskTenantSettingsRepository.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace MintyPHP\Module\Helpdesk\Service;
+namespace MintyPHP\Module\Helpdesk\Repository;
 
 use MintyPHP\DB;
 
diff --git a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTokenRepository.php b/modules/helpdesk/lib/Module/Helpdesk/Repository/HelpdeskTokenRepository.php
similarity index 98%
rename from modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTokenRepository.php
rename to modules/helpdesk/lib/Module/Helpdesk/Repository/HelpdeskTokenRepository.php
index 3f43f68..fce6461 100644
--- a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTokenRepository.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/Repository/HelpdeskTokenRepository.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace MintyPHP\Module\Helpdesk\Service;
+namespace MintyPHP\Module\Helpdesk\Repository;
 
 use MintyPHP\DB;
 use MintyPHP\Service\Settings\SettingsCryptoGatewayInterface;
diff --git a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskOAuthTokenService.php b/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskOAuthTokenService.php
index 419ac15..2929c9a 100644
--- a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskOAuthTokenService.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskOAuthTokenService.php
@@ -2,6 +2,8 @@
 
 namespace MintyPHP\Module\Helpdesk\Service;
 
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTokenRepository;
+
 /**
  * OAuth2 client_credentials token service for BC OData access.
  *
diff --git a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsGateway.php b/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsGateway.php
index 81898b7..0d157ad 100644
--- a/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsGateway.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/Service/HelpdeskTenantSettingsGateway.php
@@ -2,6 +2,7 @@
 
 namespace MintyPHP\Module\Helpdesk\Service;
 
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTenantSettingsRepository;
 use MintyPHP\Service\Settings\SettingsCryptoGatewayInterface;
 
 /**
diff --git a/modules/helpdesk/pages/helpdesk/settings/index().php b/modules/helpdesk/pages/helpdesk/settings/index().php
index 83a8aa0..815e810 100644
--- a/modules/helpdesk/pages/helpdesk/settings/index().php
+++ b/modules/helpdesk/pages/helpdesk/settings/index().php
@@ -5,7 +5,7 @@ use MintyPHP\Http\SessionStoreInterface;
 use MintyPHP\Module\Helpdesk\HelpdeskAuthorizationPolicy;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskSettingsGateway;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskTenantSettingsGateway;
-use MintyPHP\Module\Helpdesk\Service\HelpdeskTokenRepository;
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTokenRepository;
 use MintyPHP\Router;
 use MintyPHP\Session;
 use MintyPHP\Support\Flash;
diff --git a/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskOAuthTokenServiceTest.php b/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskOAuthTokenServiceTest.php
index 669e94b..1e51b94 100644
--- a/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskOAuthTokenServiceTest.php
+++ b/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskOAuthTokenServiceTest.php
@@ -5,7 +5,7 @@ namespace MintyPHP\Tests\Module\Helpdesk\Service;
 use MintyPHP\Module\Helpdesk\Service\EffectiveHelpdeskSettingsService;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskOAuthTokenService;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskSettingsGateway;
-use MintyPHP\Module\Helpdesk\Service\HelpdeskTokenRepository;
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTokenRepository;
 use PHPUnit\Framework\TestCase;
 
 class HelpdeskOAuthTokenServiceTest extends TestCase
diff --git a/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskTokenRepositoryTest.php b/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskTokenRepositoryTest.php
index d02d692..3b6acfd 100644
--- a/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskTokenRepositoryTest.php
+++ b/modules/helpdesk/tests/Module/Helpdesk/Service/HelpdeskTokenRepositoryTest.php
@@ -2,7 +2,7 @@
 
 namespace MintyPHP\Tests\Module\Helpdesk\Service;
 
-use MintyPHP\Module\Helpdesk\Service\HelpdeskTokenRepository;
+use MintyPHP\Module\Helpdesk\Repository\HelpdeskTokenRepository;
 use MintyPHP\Service\Settings\SettingsCryptoGatewayInterface;
 use PHPUnit\Framework\TestCase;
 
diff --git a/tests/Http/AccessControlTest.php b/tests/Http/AccessControlTest.php
index a3087bf..c81a1b5 100644
--- a/tests/Http/AccessControlTest.php
+++ b/tests/Http/AccessControlTest.php
@@ -3,13 +3,19 @@
 namespace MintyPHP\Tests\Http;
 
 use MintyPHP\Http\AccessControl;
+use MintyPHP\Http\IntendedUrlService;
 use PHPUnit\Framework\TestCase;
 
 class AccessControlTest extends TestCase
 {
+    private function createAccessControl(array $publicPaths = []): AccessControl
+    {
+        return new AccessControl($publicPaths, new IntendedUrlService());
+    }
+
     public function testConfiguredPublicPathIsAccessible(): void
     {
-        $accessControl = new AccessControl(['imprint', 'privacy']);
+        $accessControl = $this->createAccessControl(['imprint', 'privacy']);
 
         $this->assertTrue($accessControl->isPublicPath('imprint'));
         $this->assertTrue($accessControl->isPublicPath('/privacy'));
@@ -17,7 +23,7 @@ class AccessControlTest extends TestCase
 
     public function testPageSlugPathIsNotAutoPublic(): void
     {
-        $accessControl = new AccessControl(['imprint']);
+        $accessControl = $this->createAccessControl(['imprint']);
 
         $this->assertTrue($accessControl->isPublicPath('imprint'));
         $this->assertFalse($accessControl->isPublicPath('page/imprint'));
@@ -25,7 +31,7 @@ class AccessControlTest extends TestCase
 
     public function testAlwaysPublicPrefixesRemainAccessible(): void
     {
-        $accessControl = new AccessControl([]);
+        $accessControl = $this->createAccessControl([]);
 
         $this->assertTrue($accessControl->isPublicPath('api/v1/health'));
         $this->assertTrue($accessControl->isPublicPath('auth/microsoft/callback'));