fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(arch): enforce gateway compliance and remove service-wrapping gateways

Browse Source
This commit is contained in:
Felix Schneider
2026-03-13 11:31:33 +01:00
parent 082fa4c9a5
commit 892da0048d
96 changed files with 1117 additions and 1060 deletions
Download Patch File Download Diff File Expand all files Collapse all files

159
tests/Service/Access/UserAuthorizationPolicyTest.php
View File

@@ -2,10 +2,9 @@
namespace MintyPHP\Tests\Service\Access;
use MintyPHP\Service\Access\PermissionGateway;
use MintyPHP\Service\Access\PermissionService;
use MintyPHP\Service\Access\UserAuthorizationPolicy;
use MintyPHP\Service\Directory\DirectoryScopeGateway;
use MintyPHP\Service\Tenant\TenantScopeService;
use PHPUnit\Framework\TestCase;
class UserAuthorizationPolicyTest extends TestCase
@@ -14,14 +13,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminViewRequiresUsersViewPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->expects($this->once())
$permissionService = $this->createMock(PermissionService::class);
$permissionService->expects($this->once())
->method('userHas')
->with(13, PermissionService::USERS_VIEW)
->willReturn(false);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$scopeGateway = $this->createMock(TenantScopeService::class);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_VIEW, [
'actor_user_id' => 13,
]);
@@ -31,14 +30,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminCreateRequiresUsersCreatePermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->expects($this->once())
$permissionService = $this->createMock(PermissionService::class);
$permissionService->expects($this->once())
->method('userHas')
->with(13, PermissionService::USERS_CREATE)
->willReturn(false);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$scopeGateway = $this->createMock(TenantScopeService::class);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_CREATE, [
'actor_user_id' => 13,
]);
@@ -48,16 +47,16 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminActivateRequiresUsersUpdatePermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->expects($this->once())
$permissionService = $this->createMock(PermissionService::class);
$permissionService->expects($this->once())
->method('userHas')
->with(11, PermissionService::USERS_UPDATE)
->willReturn(false);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->never())->method('canAccess');
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_ACTIVATE, [
'actor_user_id' => 11,
'target_user_id' => 22,
@@ -68,17 +67,17 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminActivateReturnsPermissionDeniedWhenTenantScopeFails(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
11 => [PermissionService::USERS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 22, 11)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_ACTIVATE, [
'actor_user_id' => 11,
'target_user_id' => 22,
@@ -89,14 +88,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminDeactivateAllowsSelfWithoutScopeLookup(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->never())->method('canAccess');
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_DEACTIVATE, [
'actor_user_id' => 9,
'target_user_id' => 9,
@@ -107,14 +106,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminBulkDeleteRequiresUsersDeletePermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->expects($this->once())
$permissionService = $this->createMock(PermissionService::class);
$permissionService->expects($this->once())
->method('userHas')
->with(7, PermissionService::USERS_DELETE)
->willReturn(false);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$scopeGateway = $this->createMock(TenantScopeService::class);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_BULK, [
'actor_user_id' => 7,
@@ -126,17 +125,17 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminDeleteReturnsPermissionDeniedWhenTenantScopeFails(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
7 => [PermissionService::USERS_DELETE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 17, 7)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_DELETE, [
'actor_user_id' => 7,
'target_user_id' => 17,
@@ -147,16 +146,16 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminAccessPdfBulkRequiresPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->expects($this->once())
$permissionService = $this->createMock(PermissionService::class);
$permissionService->expects($this->once())
->method('userHas')
->with(21, PermissionService::USERS_ACCESS_PDF)
->willReturn(false);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->never())->method('canAccess');
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_ACCESS_PDF_BULK, [
'actor_user_id' => 21,
]);
@@ -166,17 +165,17 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminApiTokensManageRequiresScopeForOtherUsers(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
8 => [PermissionService::API_TOKENS_MANAGE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 18, 8)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_API_TOKENS_MANAGE, [
'actor_user_id' => 8,
'target_user_id' => 18,
@@ -187,14 +186,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAdminSendAccessAllowsSelfWithSelfUpdatePermission(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
30 => [PermissionService::USERS_SELF_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->never())->method('canAccess');
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_SEND_ACCESS, [
'actor_user_id' => 30,
'target_user_id' => 30,
@@ -205,18 +204,18 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditContextAllowsOwnAccountWithUsersSelfUpdate(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
30 => [PermissionService::USERS_SELF_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->never())->method('canAccess');
$scopeGateway->expects($this->once())
->method('getUserTenantIds')
->with(30)
->willReturn([2, 3]);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_EDIT_CONTEXT, [
'actor_user_id' => 30,
'target_user_id' => 30,
@@ -233,14 +232,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditContextReturnsPermissionDeniedWhenTargetIsOutOfScope(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$permissionService = $this->createMock(PermissionService::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 66, 33)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_EDIT_CONTEXT, [
'actor_user_id' => 33,
'target_user_id' => 66,
@@ -251,11 +250,11 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditContextHidesSecurityArtifactsWithoutAuditPermission(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 55, 9)
@@ -265,7 +264,7 @@ class UserAuthorizationPolicyTest extends TestCase
->with(9)
->willReturn([1]);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_EDIT_CONTEXT, [
'actor_user_id' => 9,
'target_user_id' => 55,
@@ -277,11 +276,11 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditContextShowsSecurityArtifactsWithAuditPermission(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_VIEW, PermissionService::USERS_VIEW_AUDIT],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 55, 9)
@@ -291,7 +290,7 @@ class UserAuthorizationPolicyTest extends TestCase
->with(9)
->willReturn([1]);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_EDIT_CONTEXT, [
'actor_user_id' => 9,
'target_user_id' => 55,
@@ -303,11 +302,11 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditSubmitRejectsUserWithoutEditCapability(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 55, 9)
@@ -317,7 +316,7 @@ class UserAuthorizationPolicyTest extends TestCase
->with(9)
->willReturn([1]);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_EDIT_SUBMIT, [
'actor_user_id' => 9,
'target_user_id' => 55,
@@ -328,14 +327,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAvatarUploadAllowsOwnAccountWithSelfUpdate(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
19 => [PermissionService::USERS_SELF_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->never())->method('canAccess');
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_AVATAR_UPLOAD, [
'actor_user_id' => 19,
'target_user_id' => 19,
@@ -346,14 +345,14 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAvatarDeleteReturnsPermissionDeniedOutOfScope(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$permissionService = $this->createMock(PermissionService::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 42, 7)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_AVATAR_DELETE, [
'actor_user_id' => 7,
'target_user_id' => 42,
@@ -364,17 +363,17 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAvatarViewAllowsInScopeAddressBookViewer(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
5 => [PermissionService::ADDRESS_BOOK_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 70, 5)
->willReturn(true);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_AVATAR_VIEW, [
'actor_user_id' => 5,
'target_user_id' => 70,
@@ -385,16 +384,16 @@ class UserAuthorizationPolicyTest extends TestCase
public function testAvatarViewRejectsInScopeUserWithoutAnyRelevantPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')->willReturn(false);
$permissionService = $this->createMock(PermissionService::class);
$permissionService->method('userHas')->willReturn(false);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 70, 5)
->willReturn(true);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_ADMIN_USERS_AVATAR_VIEW, [
'actor_user_id' => 5,
'target_user_id' => 70,
@@ -405,17 +404,17 @@ class UserAuthorizationPolicyTest extends TestCase
public function testApiShowReturnsNotFoundWhenTenantScopeFails(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
4 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 44, 4)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_API_USERS_SHOW_GET, [
'actor_user_id' => 4,
'target_user_id' => 44,
@@ -427,11 +426,11 @@ class UserAuthorizationPolicyTest extends TestCase
public function testApiShowReturnsNotFoundForScopedTokenCrossTenantResource(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
4 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 44, 4)
@@ -441,7 +440,7 @@ class UserAuthorizationPolicyTest extends TestCase
->with('users', 44, 2)
->willReturn(false);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_API_USERS_SHOW_GET, [
'actor_user_id' => 4,
'target_user_id' => 44,
@@ -453,12 +452,12 @@ class UserAuthorizationPolicyTest extends TestCase
public function testApiCreateForScopedTokenRejectsOutOfScopeTenantIds(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
5 => [PermissionService::USERS_CREATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$scopeGateway = $this->createMock(TenantScopeService::class);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_API_USERS_INDEX_POST, [
'actor_user_id' => 5,
@@ -471,12 +470,12 @@ class UserAuthorizationPolicyTest extends TestCase
public function testApiCreateForScopedTokenEnforcesScopedTenantInInput(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
5 => [PermissionService::USERS_CREATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$scopeGateway = $this->createMock(TenantScopeService::class);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_API_USERS_INDEX_POST, [
'actor_user_id' => 5,
@@ -491,11 +490,11 @@ class UserAuthorizationPolicyTest extends TestCase
public function testApiUpdateForScopedTokenRejectsOutOfScopePrimaryTenant(): void
{
$permissionGateway = $this->permissionGatewayAllowing([
$permissionService = $this->permissionGatewayAllowing([
6 => [PermissionService::USERS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway = $this->createMock(TenantScopeService::class);
$scopeGateway->expects($this->once())
->method('canAccess')
->with('users', 42, 6)
@@ -505,7 +504,7 @@ class UserAuthorizationPolicyTest extends TestCase
->with('users', 42, 2)
->willReturn(true);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
$policy = new UserAuthorizationPolicy($permissionService, $scopeGateway);
$decision = $policy->authorize(UserAuthorizationPolicy::ABILITY_API_USERS_SHOW_UPDATE, [
'actor_user_id' => 6,
'target_user_id' => 42,