fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

major update

Browse Source
This commit is contained in:
Felix Schneider
2026-03-04 15:56:58 +01:00
parent 16759a2732
commit 8f4dd5840d
478 changed files with 24313 additions and 8201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
tests/Service/Access/TenantAuthorizationPolicyTest.php
View File

@@ -10,6 +10,8 @@ use PHPUnit\Framework\TestCase;
class TenantAuthorizationPolicyTest extends TestCase
{
use AuthorizationPolicyTestSupport;
public function testViewRequiresTenantsViewPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
@@ -28,22 +30,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'actor_user_id' => 11,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('forbidden', $decision->error());
$this->assertForbiddenDecision($decision);
}
public function testViewReturnsCapabilitiesAndScopeData(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 11) {
return false;
}
return in_array($permission, [PermissionService::TENANTS_VIEW, PermissionService::TENANTS_CREATE], true);
});
$permissionGateway = $this->permissionGatewayAllowing([
11 => [PermissionService::TENANTS_VIEW, PermissionService::TENANTS_CREATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -85,21 +79,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'actor_user_id' => 11,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testCreateReturnsSsoAndCustomFieldCapabilities(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 11) {
return false;
}
return in_array($permission, [PermissionService::TENANTS_CREATE, PermissionService::TENANTS_SSO_MANAGE], true);
});
$permissionGateway = $this->permissionGatewayAllowing([
11 => [PermissionService::TENANTS_CREATE, PermissionService::TENANTS_SSO_MANAGE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new TenantAuthorizationPolicy($permissionGateway, $scopeGateway);
@@ -115,9 +102,9 @@ class TenantAuthorizationPolicyTest extends TestCase
public function testEditContextAllowsInScopeViewer(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 11 && $permission === PermissionService::TENANTS_VIEW);
$permissionGateway = $this->permissionGatewayAllowing([
11 => [PermissionService::TENANTS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -152,16 +139,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'target_tenant_id' => 22,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testEditSubmitRequiresTenantsUpdatePermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 11 && $permission === PermissionService::TENANTS_VIEW);
$permissionGateway = $this->permissionGatewayAllowing([
11 => [PermissionService::TENANTS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -176,18 +161,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'input' => ['description' => 'Tenant A'],
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('forbidden', $decision->error());
$this->assertForbiddenDecision($decision);
}
public function testEditSubmitDeniesSsoFieldsWithoutSsoPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
return $userId === 11 && ($permission === PermissionService::TENANTS_VIEW || $permission === PermissionService::TENANTS_UPDATE);
});
$permissionGateway = $this->permissionGatewayAllowing([
11 => [PermissionService::TENANTS_VIEW, PermissionService::TENANTS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -202,16 +183,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'input' => ['microsoft_enabled' => '1'],
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('forbidden', $decision->error());
$this->assertForbiddenDecision($decision);
}
public function testCustomFieldsManageRequiresPermissionAndScope(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 9 && $permission === PermissionService::CUSTOM_FIELDS_MANAGE);
$permissionGateway = $this->permissionGatewayAllowing([
9 => [PermissionService::CUSTOM_FIELDS_MANAGE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -230,9 +209,9 @@ class TenantAuthorizationPolicyTest extends TestCase
public function testCustomFieldsManageDeniedWhenOutOfScope(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 9 && $permission === PermissionService::CUSTOM_FIELDS_MANAGE);
$permissionGateway = $this->permissionGatewayAllowing([
9 => [PermissionService::CUSTOM_FIELDS_MANAGE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -246,15 +225,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'target_tenant_id' => 5,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testAvatarViewAllowsTenantViewerInScope(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 15 && $permission === PermissionService::TENANTS_VIEW);
$permissionGateway = $this->permissionGatewayAllowing([
15 => [PermissionService::TENANTS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -283,15 +261,14 @@ class TenantAuthorizationPolicyTest extends TestCase
'target_tenant_id' => 9,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame('forbidden', $decision->error());
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testDeleteRequiresPermissionAndScope(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 5 && $permission === PermissionService::TENANTS_DELETE);
$permissionGateway = $this->permissionGatewayAllowing([
5 => [PermissionService::TENANTS_DELETE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())