chore: snapshot notifications hardening and css/docs alignment

2026-03-20 00:05:03 +01:00
parent fb6e30a062
commit 60c27e50cb
41 changed files with 1862 additions and 254 deletions
--- a/modules/notifications/tests/Module/Notifications/Listeners/UserActivatedNotificationListenerTest.php
+++ b/modules/notifications/tests/Module/Notifications/Listeners/UserActivatedNotificationListenerTest.php
@@ -0,0 +1,99 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Notifications\Listeners;
+
+use MintyPHP\Module\Notifications\Listeners\UserActivatedNotificationListener;
+use MintyPHP\Module\Notifications\Service\NotificationService;
+use MintyPHP\Repository\Tenant\UserTenantRepositoryInterface;
+use MintyPHP\Repository\User\UserReadRepositoryInterface;
+use MintyPHP\Service\Access\PermissionService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class UserActivatedNotificationListenerTest extends TestCase
+{
+    private NotificationService&MockObject $notificationService;
+    private UserReadRepositoryInterface&MockObject $userReadRepository;
+    private UserTenantRepositoryInterface&MockObject $userTenantRepository;
+    private UserActivatedNotificationListener $listener;
+
+    protected function setUp(): void
+    {
+        $this->notificationService = $this->createMock(NotificationService::class);
+        $this->userReadRepository = $this->createMock(UserReadRepositoryInterface::class);
+        $this->userTenantRepository = $this->createMock(UserTenantRepositoryInterface::class);
+        $this->listener = new UserActivatedNotificationListener(
+            $this->notificationService,
+            $this->userReadRepository,
+            $this->userTenantRepository
+        );
+    }
+
+    public function testHandleNotifiesTenantAdmins(): void
+    {
+        $this->userReadRepository->expects($this->once())->method('find')->with(10)->willReturn([
+            'id' => 10,
+            'uuid' => 'user-uuid',
+            'display_name' => 'Alice',
+        ]);
+        $this->userReadRepository->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->with([PermissionService::USERS_UPDATE])
+            ->willReturn([20, 30]);
+
+        $this->notificationService->expects($this->exactly(2))
+            ->method('createForTenantAdminUsers')
+            ->with(
+                $this->callback(static fn (int $tenantId): bool => in_array($tenantId, [1, 2], true)),
+                'user.activated',
+                $this->stringContains('Alice'),
+                null,
+                'admin/users/edit/user-uuid',
+                ['user_id' => 10, 'uuid' => 'user-uuid'],
+                5,
+                $this->isType('array')
+            );
+
+        $this->listener->handle('user.activated', [
+            'user_id' => 10,
+            'tenant_ids' => [1, 2],
+            'actor_user_id' => 5,
+        ]);
+    }
+
+    public function testHandleFallsBackToUserTenantAssignments(): void
+    {
+        $this->userReadRepository->expects($this->once())->method('find')->with(10)->willReturn([
+            'id' => 10,
+            'uuid' => 'user-uuid',
+            'display_name' => 'Alice',
+        ]);
+        $this->userTenantRepository->expects($this->once())->method('listTenantIdsByUserId')->with(10)->willReturn([7]);
+        $this->userReadRepository->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->willReturn([20]);
+
+        $this->notificationService->expects($this->once())
+            ->method('createForTenantAdminUsers')
+            ->with(
+                7,
+                'user.activated',
+                $this->anything(),
+                null,
+                'admin/users/edit/user-uuid',
+                $this->anything(),
+                null,
+                $this->anything()
+            );
+
+        $this->listener->handle('user.activated', ['user_id' => 10]);
+    }
+
+    public function testHandleSkipsInvalidPayload(): void
+    {
+        $this->userReadRepository->expects($this->never())->method('find');
+        $this->notificationService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.activated', ['user_id' => 0]);
+    }
+}
--- a/modules/notifications/tests/Module/Notifications/Listeners/UserAssignmentChangedNotificationListenerTest.php
+++ b/modules/notifications/tests/Module/Notifications/Listeners/UserAssignmentChangedNotificationListenerTest.php
@@ -0,0 +1,114 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Notifications\Listeners;
+
+use MintyPHP\Module\Notifications\Listeners\UserAssignmentChangedNotificationListener;
+use MintyPHP\Module\Notifications\Service\NotificationService;
+use MintyPHP\Repository\User\UserReadRepositoryInterface;
+use MintyPHP\Service\Access\PermissionService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class UserAssignmentChangedNotificationListenerTest extends TestCase
+{
+    private NotificationService&MockObject $notificationService;
+    private UserReadRepositoryInterface&MockObject $userReadRepository;
+    private UserAssignmentChangedNotificationListener $listener;
+
+    protected function setUp(): void
+    {
+        $this->notificationService = $this->createMock(NotificationService::class);
+        $this->userReadRepository = $this->createMock(UserReadRepositoryInterface::class);
+        $this->listener = new UserAssignmentChangedNotificationListener(
+            $this->notificationService,
+            $this->userReadRepository
+        );
+    }
+
+    public function testHandleNotifiesAffectedUserAndTenantAdmins(): void
+    {
+        $this->userReadRepository->expects($this->once())->method('find')->with(10)->willReturn([
+            'id' => 10,
+            'uuid' => 'user-uuid',
+            'display_name' => 'Alice',
+        ]);
+        $this->userReadRepository->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->with([PermissionService::USERS_UPDATE_ASSIGNMENTS])
+            ->willReturn([20, 30]);
+
+        $this->notificationService->expects($this->once())
+            ->method('createForUser')
+            ->with(
+                10,
+                null,
+                'user.assignment_changed',
+                $this->stringContains('Alice'),
+                $this->isType('string'),
+                'admin/users/edit/user-uuid',
+                $this->isType('array')
+            )
+            ->willReturn(99);
+
+        $this->notificationService->expects($this->once())
+            ->method('createForTenantAdminUsers')
+            ->with(
+                1,
+                'user.assignment_changed',
+                $this->stringContains('Alice'),
+                $this->isType('string'),
+                'admin/users/edit/user-uuid',
+                $this->isType('array'),
+                7,
+                $this->isType('array')
+            )
+            ->willReturn(1);
+
+        $this->listener->handle('user.assignment_changed', [
+            'user_id' => 10,
+            'tenant_ids' => [1],
+            'actor_user_id' => 7,
+            'changes' => ['roles' => ['before' => [1], 'after' => [2]]],
+        ]);
+    }
+
+    public function testHandleExcludesAffectedUserWhenActorEqualsTarget(): void
+    {
+        $this->userReadRepository->expects($this->once())->method('find')->with(10)->willReturn([
+            'id' => 10,
+            'uuid' => 'user-uuid',
+            'display_name' => 'Alice',
+        ]);
+        $this->userReadRepository->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->willReturn([20]);
+
+        $this->notificationService->expects($this->never())->method('createForUser');
+        $this->notificationService->expects($this->once())
+            ->method('createForTenantAdminUsers')
+            ->with(
+                1,
+                'user.assignment_changed',
+                $this->anything(),
+                $this->anything(),
+                'admin/users/edit/user-uuid',
+                $this->anything(),
+                10,
+                $this->anything()
+            );
+
+        $this->listener->handle('user.assignment_changed', [
+            'user_id' => 10,
+            'tenant_ids' => [1],
+            'actor_user_id' => 10,
+        ]);
+    }
+
+    public function testHandleSkipsInvalidPayload(): void
+    {
+        $this->notificationService->expects($this->never())->method('createForUser');
+        $this->notificationService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.assignment_changed', ['user_id' => 0]);
+    }
+}
--- a/modules/notifications/tests/Module/Notifications/Listeners/UserCreatedNotificationListenerTest.php
+++ b/modules/notifications/tests/Module/Notifications/Listeners/UserCreatedNotificationListenerTest.php
@@ -27,14 +27,14 @@ class UserCreatedNotificationListenerTest extends TestCase

    public function testHandleCreatesNotificationsForTenantAdminUsers(): void
    {
-        $this->userRepo->method('find')->with(10)->willReturn([
+        $this->userRepo->expects($this->any())->method('find')->with(10)->willReturn([
            'id' => 10,
            'display_name' => 'Alice Smith',
            'first_name' => 'Alice',
            'last_name' => 'Smith',
        ]);
-        $this->utRepo->method('listTenantIdsByUserId')->with(10)->willReturn([1, 2]);
-        $this->userRepo->method('listPrivilegedUserIdsByPermissionKeys')
+        $this->utRepo->expects($this->any())->method('listTenantIdsByUserId')->with(10)->willReturn([1, 2]);
+        $this->userRepo->expects($this->any())->method('listPrivilegedUserIdsByPermissionKeys')
            ->with([PermissionService::USERS_CREATE])
            ->willReturn([20, 30]);

@@ -60,12 +60,12 @@ class UserCreatedNotificationListenerTest extends TestCase

    public function testHandleExcludesActorFromRecipients(): void
    {
-        $this->userRepo->method('find')->with(10)->willReturn([
+        $this->userRepo->expects($this->any())->method('find')->with(10)->willReturn([
            'id' => 10,
            'display_name' => 'Bob',
        ]);
-        $this->utRepo->method('listTenantIdsByUserId')->with(10)->willReturn([1]);
-        $this->userRepo->method('listPrivilegedUserIdsByPermissionKeys')->willReturn([20]);
+        $this->utRepo->expects($this->any())->method('listTenantIdsByUserId')->with(10)->willReturn([1]);
+        $this->userRepo->expects($this->any())->method('listPrivilegedUserIdsByPermissionKeys')->willReturn([20]);

        $this->notifService->expects($this->once())
            ->method('createForTenantAdminUsers')
@@ -99,7 +99,7 @@ class UserCreatedNotificationListenerTest extends TestCase

    public function testHandleSkipsWhenUserNotFound(): void
    {
-        $this->userRepo->method('find')->with(99)->willReturn(null);
+        $this->userRepo->expects($this->any())->method('find')->with(99)->willReturn(null);
        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');

        $this->listener->handle('user.created', [
@@ -111,11 +111,11 @@ class UserCreatedNotificationListenerTest extends TestCase

    public function testHandleSkipsWhenNoTenants(): void
    {
-        $this->userRepo->method('find')->with(10)->willReturn([
+        $this->userRepo->expects($this->any())->method('find')->with(10)->willReturn([
            'id' => 10,
            'display_name' => 'Alice',
        ]);
-        $this->utRepo->method('listTenantIdsByUserId')->with(10)->willReturn([]);
+        $this->utRepo->expects($this->any())->method('listTenantIdsByUserId')->with(10)->willReturn([]);
        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');

        $this->listener->handle('user.created', [
@@ -127,12 +127,12 @@ class UserCreatedNotificationListenerTest extends TestCase

    public function testHandleSkipsWhenNoAdminUsers(): void
    {
-        $this->userRepo->method('find')->with(10)->willReturn([
+        $this->userRepo->expects($this->any())->method('find')->with(10)->willReturn([
            'id' => 10,
            'display_name' => 'Alice',
        ]);
-        $this->utRepo->method('listTenantIdsByUserId')->with(10)->willReturn([1]);
-        $this->userRepo->method('listPrivilegedUserIdsByPermissionKeys')->willReturn([]);
+        $this->utRepo->expects($this->any())->method('listTenantIdsByUserId')->with(10)->willReturn([1]);
+        $this->userRepo->expects($this->any())->method('listPrivilegedUserIdsByPermissionKeys')->willReturn([]);

        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');

--- a/modules/notifications/tests/Module/Notifications/Listeners/UserDeactivatedNotificationListenerTest.php
+++ b/modules/notifications/tests/Module/Notifications/Listeners/UserDeactivatedNotificationListenerTest.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Notifications\Listeners;
+
+use MintyPHP\Module\Notifications\Listeners\UserDeactivatedNotificationListener;
+use MintyPHP\Module\Notifications\Service\NotificationService;
+use MintyPHP\Repository\Tenant\UserTenantRepositoryInterface;
+use MintyPHP\Repository\User\UserReadRepositoryInterface;
+use MintyPHP\Service\Access\PermissionService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class UserDeactivatedNotificationListenerTest extends TestCase
+{
+    private NotificationService&MockObject $notificationService;
+    private UserReadRepositoryInterface&MockObject $userReadRepository;
+    private UserTenantRepositoryInterface&MockObject $userTenantRepository;
+    private UserDeactivatedNotificationListener $listener;
+
+    protected function setUp(): void
+    {
+        $this->notificationService = $this->createMock(NotificationService::class);
+        $this->userReadRepository = $this->createMock(UserReadRepositoryInterface::class);
+        $this->userTenantRepository = $this->createMock(UserTenantRepositoryInterface::class);
+        $this->listener = new UserDeactivatedNotificationListener(
+            $this->notificationService,
+            $this->userReadRepository,
+            $this->userTenantRepository
+        );
+    }
+
+    public function testHandleNotifiesTenantAdmins(): void
+    {
+        $this->userReadRepository->expects($this->once())->method('find')->with(10)->willReturn([
+            'id' => 10,
+            'uuid' => 'user-uuid',
+            'display_name' => 'Alice',
+        ]);
+        $this->userReadRepository->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->with([PermissionService::USERS_UPDATE])
+            ->willReturn([20, 30]);
+
+        $this->notificationService->expects($this->exactly(2))
+            ->method('createForTenantAdminUsers')
+            ->with(
+                $this->callback(static fn (int $tenantId): bool => in_array($tenantId, [1, 2], true)),
+                'user.deactivated',
+                $this->stringContains('Alice'),
+                null,
+                'admin/users/edit/user-uuid',
+                ['user_id' => 10, 'uuid' => 'user-uuid'],
+                5,
+                $this->isType('array')
+            );
+
+        $this->listener->handle('user.deactivated', [
+            'user_id' => 10,
+            'tenant_ids' => [1, 2],
+            'actor_user_id' => 5,
+        ]);
+    }
+
+    public function testHandleSkipsWhenNoTenantIsResolved(): void
+    {
+        $this->userReadRepository->expects($this->once())->method('find')->with(10)->willReturn([
+            'id' => 10,
+            'uuid' => 'user-uuid',
+            'display_name' => 'Alice',
+        ]);
+        $this->userTenantRepository->expects($this->once())->method('listTenantIdsByUserId')->with(10)->willReturn([]);
+        $this->notificationService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.deactivated', ['user_id' => 10]);
+    }
+}
--- a/modules/notifications/tests/Module/Notifications/Listeners/UserDeletedNotificationListenerTest.php
+++ b/modules/notifications/tests/Module/Notifications/Listeners/UserDeletedNotificationListenerTest.php
@@ -0,0 +1,142 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Notifications\Listeners;
+
+use MintyPHP\Module\Notifications\Listeners\UserDeletedNotificationListener;
+use MintyPHP\Module\Notifications\Service\NotificationService;
+use MintyPHP\Repository\User\UserReadRepositoryInterface;
+use MintyPHP\Service\Access\PermissionService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class UserDeletedNotificationListenerTest extends TestCase
+{
+    private NotificationService&MockObject $notifService;
+    private UserReadRepositoryInterface&MockObject $userRepo;
+    private UserDeletedNotificationListener $listener;
+
+    protected function setUp(): void
+    {
+        $this->notifService = $this->createMock(NotificationService::class);
+        $this->userRepo = $this->createMock(UserReadRepositoryInterface::class);
+        $this->listener = new UserDeletedNotificationListener($this->notifService, $this->userRepo);
+    }
+
+    public function testHandleCleansUpAndNotifiesAdmins(): void
+    {
+        $this->notifService->expects($this->once())
+            ->method('deleteAllForUser')
+            ->with(10);
+
+        $this->userRepo->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->with([PermissionService::USERS_DELETE])
+            ->willReturn([20, 30]);
+
+        $this->notifService->expects($this->exactly(2))
+            ->method('createForTenantAdminUsers')
+            ->willReturnCallback(function (int $tenantId, string $type, string $title, ?string $body, ?string $link, array $data, ?int $excludeUserId, array $adminSet): int {
+                $this->assertContains($tenantId, [1, 2]);
+                $this->assertSame('user.deleted', $type);
+                $this->assertStringContainsString('Alice', $title);
+                $this->assertNull($link);
+                $this->assertSame(5, $excludeUserId);
+                $this->assertArrayHasKey(20, $adminSet);
+                $this->assertArrayHasKey(30, $adminSet);
+                return 1;
+            });
+
+        $this->listener->handle('user.deleted', [
+            'user_id' => 10,
+            'display_name' => 'Alice',
+            'tenant_ids' => [1, 2],
+            'actor_user_id' => 5,
+        ]);
+    }
+
+    public function testHandleSkipsOnInvalidUserId(): void
+    {
+        $this->notifService->expects($this->never())->method('deleteAllForUser');
+        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.deleted', ['user_id' => 0]);
+        $this->listener->handle('user.deleted', []);
+    }
+
+    public function testHandleStillCleansUpWhenDisplayNameEmpty(): void
+    {
+        $this->notifService->expects($this->once())
+            ->method('deleteAllForUser')
+            ->with(10);
+
+        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.deleted', [
+            'user_id' => 10,
+            'display_name' => '',
+            'tenant_ids' => [1],
+        ]);
+    }
+
+    public function testHandleStillCleansUpWhenTenantIdsEmpty(): void
+    {
+        $this->notifService->expects($this->once())
+            ->method('deleteAllForUser')
+            ->with(10);
+
+        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.deleted', [
+            'user_id' => 10,
+            'display_name' => 'Alice',
+            'tenant_ids' => [],
+        ]);
+    }
+
+    public function testHandleExcludesActorFromRecipients(): void
+    {
+        $this->notifService->expects($this->once())->method('deleteAllForUser')->with(10);
+
+        $this->userRepo->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->willReturn([20]);
+
+        $this->notifService->expects($this->once())
+            ->method('createForTenantAdminUsers')
+            ->with(
+                1,
+                'user.deleted',
+                $this->anything(),
+                null,
+                null,
+                $this->anything(),
+                7, // actor excluded
+                $this->anything()
+            )
+            ->willReturn(1);
+
+        $this->listener->handle('user.deleted', [
+            'user_id' => 10,
+            'display_name' => 'Alice',
+            'tenant_ids' => [1],
+            'actor_user_id' => 7,
+        ]);
+    }
+
+    public function testHandleSkipsNotificationWhenNoAdminUsers(): void
+    {
+        $this->notifService->expects($this->once())->method('deleteAllForUser')->with(10);
+
+        $this->userRepo->expects($this->once())
+            ->method('listPrivilegedUserIdsByPermissionKeys')
+            ->willReturn([]);
+
+        $this->notifService->expects($this->never())->method('createForTenantAdminUsers');
+
+        $this->listener->handle('user.deleted', [
+            'user_id' => 10,
+            'display_name' => 'Alice',
+            'tenant_ids' => [1],
+        ]);
+    }
+}
--- a/modules/notifications/tests/Module/Notifications/NotificationsAuthorizationPolicyTest.php
+++ b/modules/notifications/tests/Module/Notifications/NotificationsAuthorizationPolicyTest.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Notifications;
+
+use MintyPHP\Module\Notifications\NotificationsAuthorizationPolicy;
+use MintyPHP\Service\Access\PermissionService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class NotificationsAuthorizationPolicyTest extends TestCase
+{
+    private PermissionService&MockObject $permissionService;
+    private NotificationsAuthorizationPolicy $policy;
+
+    protected function setUp(): void
+    {
+        $this->permissionService = $this->createMock(PermissionService::class);
+        $this->policy = new NotificationsAuthorizationPolicy($this->permissionService);
+    }
+
+    public function testSupportsNotificationsAbilityOnly(): void
+    {
+        self::assertTrue($this->policy->supports(NotificationsAuthorizationPolicy::ABILITY_VIEW));
+        self::assertFalse($this->policy->supports('users.view'));
+    }
+
+    public function testAuthorizeAllowsUserWithPermission(): void
+    {
+        $this->permissionService->expects($this->once())
+            ->method('userHas')
+            ->with(11, NotificationsAuthorizationPolicy::PERMISSION_KEY)
+            ->willReturn(true);
+
+        $decision = $this->policy->authorize(NotificationsAuthorizationPolicy::ABILITY_VIEW, [
+            'actor_user_id' => 11,
+        ]);
+
+        self::assertTrue($decision->isAllowed());
+    }
+
+    public function testAuthorizeDeniesWithoutPermission(): void
+    {
+        $this->permissionService->expects($this->once())
+            ->method('userHas')
+            ->with(11, NotificationsAuthorizationPolicy::PERMISSION_KEY)
+            ->willReturn(false);
+
+        $decision = $this->policy->authorize(NotificationsAuthorizationPolicy::ABILITY_VIEW, [
+            'actor_user_id' => 11,
+        ]);
+
+        self::assertFalse($decision->isAllowed());
+        self::assertSame(403, $decision->status());
+    }
+}
--- a/modules/notifications/tests/Module/Notifications/Service/NotificationServiceTest.php
+++ b/modules/notifications/tests/Module/Notifications/Service/NotificationServiceTest.php
@@ -4,18 +4,21 @@ namespace MintyPHP\Tests\Module\Notifications\Service;

 use MintyPHP\Module\Notifications\Repository\NotificationRepositoryInterface;
 use MintyPHP\Module\Notifications\Service\NotificationService;
+use MintyPHP\Repository\Tenant\UserTenantRepositoryInterface;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;

 class NotificationServiceTest extends TestCase
 {
    private NotificationRepositoryInterface&MockObject $notifRepo;
+    private UserTenantRepositoryInterface&MockObject $utRepo;
    private NotificationService $service;

    protected function setUp(): void
    {
        $this->notifRepo = $this->createMock(NotificationRepositoryInterface::class);
-        $this->service = new NotificationService($this->notifRepo);
+        $this->utRepo = $this->createMock(UserTenantRepositoryInterface::class);
+        $this->service = new NotificationService($this->notifRepo, $this->utRepo);
    }

    public function testCreateForUserInsertsNotification(): void
@@ -46,7 +49,7 @@ class NotificationServiceTest extends TestCase

    public function testUnreadCountReturnsCorrectCount(): void
    {
-        $this->notifRepo->method('countUnreadByUser')->with(3)->willReturn(7);
+        $this->notifRepo->expects($this->any())->method('countUnreadByUser')->with(3, null)->willReturn(7);

        $this->assertSame(7, $this->service->unreadCount(3));
    }
@@ -62,7 +65,7 @@ class NotificationServiceTest extends TestCase
    {
        $this->notifRepo->expects($this->once())
            ->method('markRead')
-            ->with(10, 3)
+            ->with(10, 3, null)
            ->willReturn(true);

        $this->assertTrue($this->service->markAsRead(3, 10));
@@ -80,7 +83,7 @@ class NotificationServiceTest extends TestCase
    {
        $this->notifRepo->expects($this->once())
            ->method('markAllReadByUser')
-            ->with(3)
+            ->with(3, null)
            ->willReturn(5);

        $this->assertSame(5, $this->service->markAllAsRead(3));
@@ -90,7 +93,7 @@ class NotificationServiceTest extends TestCase
    {
        $this->notifRepo->expects($this->once())
            ->method('delete')
-            ->with(10, 3)
+            ->with(10, 3, null)
            ->willReturn(true);

        $this->assertTrue($this->service->dismiss(3, 10));
@@ -122,8 +125,161 @@ class NotificationServiceTest extends TestCase
            ['id' => 1, 'title' => 'Test', 'is_read' => 0],
            ['id' => 2, 'title' => 'Test 2', 'is_read' => 1],
        ];
-        $this->notifRepo->method('listByUser')->with(3, 50, 0)->willReturn($expected);
+        $this->notifRepo->expects($this->any())->method('listByUser')->with(3, null, 50, 0)->willReturn($expected);

        $this->assertSame($expected, $this->service->listForUser(3));
    }
+
+    public function testListForUserPassesTenantScope(): void
+    {
+        $this->notifRepo->expects($this->once())
+            ->method('listByUser')
+            ->with(3, 9, 25, 0)
+            ->willReturn([]);
+
+        $this->assertSame([], $this->service->listForUser(3, 9, 25));
+    }
+
+    // --- createForTenantUsers ---
+
+    public function testCreateForTenantUsersCreatesForAllUsersExcludingActor(): void
+    {
+        $this->utRepo->expects($this->once())
+            ->method('listActiveUserIdsByTenantId')
+            ->with(1)
+            ->willReturn([10, 20, 30]);
+
+        $this->notifRepo->expects($this->exactly(2))
+            ->method('create')
+            ->willReturn(1);
+
+        $result = $this->service->createForTenantUsers(1, 'system', 'Hello', null, null, [], 20);
+
+        $this->assertSame(2, $result);
+    }
+
+    public function testCreateForTenantUsersSkipsSuppressedDuplicates(): void
+    {
+        $this->utRepo->expects($this->once())
+            ->method('listActiveUserIdsByTenantId')
+            ->with(1)
+            ->willReturn([10, 20, 30]);
+
+        $this->notifRepo->expects($this->exactly(3))
+            ->method('create')
+            ->willReturnOnConsecutiveCalls(11, false, 13);
+
+        $result = $this->service->createForTenantUsers(1, 'user.activated', 'Activated', null, null, ['user_id' => 99], null);
+
+        $this->assertSame(2, $result);
+    }
+
+    public function testCreateForTenantUsersCreatesForAllWhenNoExclude(): void
+    {
+        $this->utRepo->expects($this->once())
+            ->method('listActiveUserIdsByTenantId')
+            ->with(1)
+            ->willReturn([10, 20]);
+
+        $this->notifRepo->expects($this->exactly(2))
+            ->method('create')
+            ->willReturn(1);
+
+        $result = $this->service->createForTenantUsers(1, 'system', 'Hello', null, null, [], null);
+
+        $this->assertSame(2, $result);
+    }
+
+    public function testCreateForTenantUsersRejectsInvalidInputs(): void
+    {
+        $this->utRepo->expects($this->never())->method('listActiveUserIdsByTenantId');
+        $this->notifRepo->expects($this->never())->method('create');
+
+        $this->assertSame(0, $this->service->createForTenantUsers(0, 'system', 'Hello', null, null, [], null));
+        $this->assertSame(0, $this->service->createForTenantUsers(1, '', 'Hello', null, null, [], null));
+        $this->assertSame(0, $this->service->createForTenantUsers(1, 'system', '', null, null, [], null));
+    }
+
+    // --- createForTenantAdminUsers ---
+
+    public function testCreateForTenantAdminUsersFiltersToAllowedUsers(): void
+    {
+        $this->utRepo->expects($this->once())
+            ->method('listActiveUserIdsByTenantId')
+            ->with(1)
+            ->willReturn([10, 20, 30, 40]);
+
+        $this->notifRepo->expects($this->exactly(2))
+            ->method('create')
+            ->willReturn(1);
+
+        $allowedUserIds = array_flip([20, 30]);
+        $result = $this->service->createForTenantAdminUsers(1, 'system', 'Hello', null, null, [], null, $allowedUserIds);
+
+        $this->assertSame(2, $result);
+    }
+
+    public function testCreateForTenantAdminUsersExcludesActor(): void
+    {
+        $this->utRepo->expects($this->once())
+            ->method('listActiveUserIdsByTenantId')
+            ->with(1)
+            ->willReturn([10, 20, 30]);
+
+        $this->notifRepo->expects($this->once())
+            ->method('create')
+            ->willReturn(1);
+
+        $allowedUserIds = array_flip([20, 30]);
+        $result = $this->service->createForTenantAdminUsers(1, 'system', 'Hello', null, null, [], 20, $allowedUserIds);
+
+        $this->assertSame(1, $result);
+    }
+
+    public function testCreateForTenantAdminUsersRejectsEmptyAllowedUsers(): void
+    {
+        $this->utRepo->expects($this->never())->method('listActiveUserIdsByTenantId');
+        $this->notifRepo->expects($this->never())->method('create');
+
+        $this->assertSame(0, $this->service->createForTenantAdminUsers(1, 'system', 'Hello', null, null, [], null, []));
+    }
+
+    public function testCreateForTenantAdminUsersRejectsInvalidInputs(): void
+    {
+        $this->utRepo->expects($this->never())->method('listActiveUserIdsByTenantId');
+        $this->notifRepo->expects($this->never())->method('create');
+
+        $allowed = array_flip([10]);
+        $this->assertSame(0, $this->service->createForTenantAdminUsers(0, 'system', 'Hello', null, null, [], null, $allowed));
+        $this->assertSame(0, $this->service->createForTenantAdminUsers(1, '', 'Hello', null, null, [], null, $allowed));
+        $this->assertSame(0, $this->service->createForTenantAdminUsers(1, 'system', '', null, null, [], null, $allowed));
+    }
+
+    public function testCreateForUserAddsDedupeMetadataForCoreTypes(): void
+    {
+        $this->notifRepo->expects($this->once())
+            ->method('create')
+            ->with($this->callback(function (array $data): bool {
+                return $data['type'] === 'user.deleted'
+                    && !empty($data['dedupe_fingerprint'])
+                    && !empty($data['dedupe_bucket']);
+            }))
+            ->willReturn(55);
+
+        $result = $this->service->createForUser(5, 1, 'user.deleted', 'User deleted: Bob', null, null, ['user_id' => 33]);
+        $this->assertSame(55, $result);
+    }
+
+    public function testCreateForUserSkipsDedupeMetadataForNonCoreTypes(): void
+    {
+        $this->notifRepo->expects($this->once())
+            ->method('create')
+            ->with($this->callback(function (array $data): bool {
+                return !isset($data['dedupe_fingerprint']) || $data['dedupe_fingerprint'] === null;
+            }))
+            ->willReturn(56);
+
+        $result = $this->service->createForUser(5, 1, 'system', 'System', null, null, ['user_id' => 33]);
+        $this->assertSame(56, $result);
+    }
 }