fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

major update

Browse Source
This commit is contained in:
Felix Schneider
2026-03-04 15:56:58 +01:00
parent 16759a2732
commit 8f4dd5840d
478 changed files with 24313 additions and 8201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

190
tests/Service/Access/UserAuthorizationPolicyTest.php
View File

@@ -10,6 +10,8 @@ use PHPUnit\Framework\TestCase;
class UserAuthorizationPolicyTest extends TestCase
{
use AuthorizationPolicyTestSupport;
public function testAdminViewRequiresUsersViewPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
@@ -24,9 +26,7 @@ class UserAuthorizationPolicyTest extends TestCase
'actor_user_id' => 13,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('forbidden', $decision->error());
$this->assertForbiddenDecision($decision);
}
public function testAdminCreateRequiresUsersCreatePermission(): void
@@ -43,8 +43,7 @@ class UserAuthorizationPolicyTest extends TestCase
'actor_user_id' => 13,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testAdminActivateRequiresUsersUpdatePermission(): void
@@ -64,16 +63,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 22,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('forbidden', $decision->error());
$this->assertForbiddenDecision($decision);
}
public function testAdminActivateReturnsPermissionDeniedWhenTenantScopeFails(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 11 && $permission === PermissionService::USERS_UPDATE);
$permissionGateway = $this->permissionGatewayAllowing([
11 => [PermissionService::USERS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -87,16 +84,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 22,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testAdminDeactivateAllowsSelfWithoutScopeLookup(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 9 && $permission === PermissionService::USERS_UPDATE);
$permissionGateway = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->never())->method('canAccess');
@@ -126,15 +121,14 @@ class UserAuthorizationPolicyTest extends TestCase
'bulk_action' => 'delete',
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testAdminDeleteReturnsPermissionDeniedWhenTenantScopeFails(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 7 && $permission === PermissionService::USERS_DELETE);
$permissionGateway = $this->permissionGatewayAllowing([
7 => [PermissionService::USERS_DELETE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -148,9 +142,7 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 17,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testAdminAccessPdfBulkRequiresPermission(): void
@@ -169,15 +161,14 @@ class UserAuthorizationPolicyTest extends TestCase
'actor_user_id' => 21,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testAdminApiTokensManageRequiresScopeForOtherUsers(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 8 && $permission === PermissionService::API_TOKENS_MANAGE);
$permissionGateway = $this->permissionGatewayAllowing([
8 => [PermissionService::API_TOKENS_MANAGE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -191,25 +182,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 18,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testAdminSendAccessAllowsSelfWithSelfUpdatePermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 30) {
return false;
}
if ($permission === PermissionService::USERS_SELF_UPDATE) {
return true;
}
return false;
});
$permissionGateway = $this->permissionGatewayAllowing([
30 => [PermissionService::USERS_SELF_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->never())->method('canAccess');
@@ -225,15 +205,9 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditContextAllowsOwnAccountWithUsersSelfUpdate(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 30) {
return false;
}
return $permission === PermissionService::USERS_SELF_UPDATE;
});
$permissionGateway = $this->permissionGatewayAllowing([
30 => [PermissionService::USERS_SELF_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->never())->method('canAccess');
@@ -272,22 +246,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 66,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testEditContextHidesSecurityArtifactsWithoutAuditPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 9) {
return false;
}
return $permission === PermissionService::USERS_VIEW;
});
$permissionGateway = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -311,15 +277,9 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditContextShowsSecurityArtifactsWithAuditPermission(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 9) {
return false;
}
return in_array($permission, [PermissionService::USERS_VIEW, PermissionService::USERS_VIEW_AUDIT], true);
});
$permissionGateway = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_VIEW, PermissionService::USERS_VIEW_AUDIT],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -343,15 +303,9 @@ class UserAuthorizationPolicyTest extends TestCase
public function testEditSubmitRejectsUserWithoutEditCapability(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static function (int $userId, string $permission): bool {
if ($userId !== 9) {
return false;
}
return $permission === PermissionService::USERS_VIEW;
});
$permissionGateway = $this->permissionGatewayAllowing([
9 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -369,16 +323,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 55,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('forbidden', $decision->error());
$this->assertForbiddenDecision($decision);
}
public function testAvatarUploadAllowsOwnAccountWithSelfUpdate(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 19 && $permission === PermissionService::USERS_SELF_UPDATE);
$permissionGateway = $this->permissionGatewayAllowing([
19 => [PermissionService::USERS_SELF_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->never())->method('canAccess');
@@ -407,15 +359,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 42,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame('permission_denied', $decision->error());
$this->assertDeniedDecision($decision, 403, 'permission_denied');
}
public function testAvatarViewAllowsInScopeAddressBookViewer(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 5 && $permission === PermissionService::ADDRESS_BOOK_VIEW);
$permissionGateway = $this->permissionGatewayAllowing([
5 => [PermissionService::ADDRESS_BOOK_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -449,15 +400,14 @@ class UserAuthorizationPolicyTest extends TestCase
'target_user_id' => 70,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame('forbidden', $decision->error());
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testApiShowReturnsNotFoundWhenTenantScopeFails(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 4 && $permission === PermissionService::USERS_VIEW);
$permissionGateway = $this->permissionGatewayAllowing([
4 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -472,16 +422,14 @@ class UserAuthorizationPolicyTest extends TestCase
'scoped_tenant_id' => null,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(404, $decision->status());
$this->assertSame('not_found', $decision->error());
$this->assertDeniedDecision($decision, 404, 'not_found');
}
public function testApiShowReturnsNotFoundForScopedTokenCrossTenantResource(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 4 && $permission === PermissionService::USERS_VIEW);
$permissionGateway = $this->permissionGatewayAllowing([
4 => [PermissionService::USERS_VIEW],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -500,16 +448,14 @@ class UserAuthorizationPolicyTest extends TestCase
'scoped_tenant_id' => 2,
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(404, $decision->status());
$this->assertSame('not_found', $decision->error());
$this->assertDeniedDecision($decision, 404, 'not_found');
}
public function testApiCreateForScopedTokenRejectsOutOfScopeTenantIds(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 5 && $permission === PermissionService::USERS_CREATE);
$permissionGateway = $this->permissionGatewayAllowing([
5 => [PermissionService::USERS_CREATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
@@ -520,16 +466,14 @@ class UserAuthorizationPolicyTest extends TestCase
'input' => ['tenant_ids' => [9, 10]],
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('tenant_scoped_token_forbidden', $decision->error());
$this->assertDeniedDecision($decision, 403, 'tenant_scoped_token_forbidden');
}
public function testApiCreateForScopedTokenEnforcesScopedTenantInInput(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 5 && $permission === PermissionService::USERS_CREATE);
$permissionGateway = $this->permissionGatewayAllowing([
5 => [PermissionService::USERS_CREATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$policy = new UserAuthorizationPolicy($permissionGateway, $scopeGateway);
@@ -547,9 +491,9 @@ class UserAuthorizationPolicyTest extends TestCase
public function testApiUpdateForScopedTokenRejectsOutOfScopePrimaryTenant(): void
{
$permissionGateway = $this->createMock(PermissionGateway::class);
$permissionGateway->method('userHas')
->willReturnCallback(static fn (int $userId, string $permission): bool => $userId === 6 && $permission === PermissionService::USERS_UPDATE);
$permissionGateway = $this->permissionGatewayAllowing([
6 => [PermissionService::USERS_UPDATE],
]);
$scopeGateway = $this->createMock(DirectoryScopeGateway::class);
$scopeGateway->expects($this->once())
@@ -569,8 +513,6 @@ class UserAuthorizationPolicyTest extends TestCase
'input' => ['primary_tenant_id' => 7],
]);
$this->assertFalse($decision->isAllowed());
$this->assertSame(403, $decision->status());
$this->assertSame('tenant_scoped_token_forbidden', $decision->error());
$this->assertDeniedDecision($decision, 403, 'tenant_scoped_token_forbidden');
}
}