agent foundation

tests/Service/Settings/SettingServiceTest.php

@@ -1,144 +0,0 @@
-<?php
-
-namespace MintyPHP\Tests\Service\Settings;
-
-use MintyPHP\Repository\Access\RoleRepository;
-use MintyPHP\Repository\Org\DepartmentRepository;
-use MintyPHP\Repository\Settings\SettingRepository;
-use MintyPHP\Repository\Tenant\TenantRepository;
-use MintyPHP\Service\Settings\SettingService;
-use MintyPHP\Service\Settings\ThemeConfigService;
-use PHPUnit\Framework\TestCase;
-
-class SettingServiceTest extends TestCase
-{
-    public function testSetDefaultTenantIdRejectsUnknownTenant(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->expects($this->never())->method('set');
-
-        $tenantRepository = $this->createMock(TenantRepository::class);
-        $tenantRepository->expects($this->once())->method('find')->with(99)->willReturn(null);
-
-        $service = $this->newService($settingRepository, $tenantRepository);
-        $this->assertFalse($service->setDefaultTenantId(99));
-    }
-
-    public function testSetApiTokenDefaultTtlDaysRejectsAboveCurrentMax(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->method('getValue')->willReturnCallback(
-            static function (string $key): ?string {
-                if ($key === SettingService::API_TOKEN_MAX_TTL_DAYS_KEY) {
-                    return '30';
-                }
-                return null;
-            }
-        );
-        $settingRepository->expects($this->never())->method('set');
-
-        $service = $this->newService($settingRepository);
-        $this->assertFalse($service->setApiTokenDefaultTtlDays(31));
-    }
-
-    public function testSetApiTokenMaxTtlDaysUpdatesDefaultWhenNeeded(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->method('getValue')->willReturnCallback(
-            static function (string $key): ?string {
-                if ($key === SettingService::API_TOKEN_DEFAULT_TTL_DAYS_KEY) {
-                    return '365';
-                }
-                return null;
-            }
-        );
-
-        $calls = [];
-        $settingRepository->expects($this->exactly(2))
-            ->method('set')
-            ->willReturnCallback(
-                static function (string $key, ?string $value, ?string $description) use (&$calls): bool {
-                    $calls[] = [$key, $value, $description];
-                    return true;
-                }
-            );
-
-        $service = $this->newService($settingRepository);
-        $this->assertTrue($service->setApiTokenMaxTtlDays(120));
-        $this->assertSame(
-            [
-                [SettingService::API_TOKEN_DEFAULT_TTL_DAYS_KEY, '120', 'setting.api_token_default_ttl_days'],
-                [SettingService::API_TOKEN_MAX_TTL_DAYS_KEY, '120', 'setting.api_token_max_ttl_days'],
-            ],
-            $calls
-        );
-    }
-
-    public function testSetUserInactivityDeleteDaysRequiresDeactivatePolicy(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->method('getValue')->willReturnCallback(
-            static function (string $key): ?string {
-                if ($key === SettingService::USER_INACTIVITY_DEACTIVATE_DAYS_KEY) {
-                    return '0';
-                }
-                return null;
-            }
-        );
-        $settingRepository->expects($this->never())->method('set');
-
-        $service = $this->newService($settingRepository);
-        $this->assertFalse($service->setUserInactivityDeleteDays(30));
-    }
-
-    public function testSetApiCorsAllowedOriginsRejectsInvalidOrigins(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->expects($this->never())->method('set');
-
-        $service = $this->newService($settingRepository);
-        $this->assertFalse($service->setApiCorsAllowedOrigins("https://ok.example\njavascript:alert(1)"));
-    }
-
-    public function testSetMicrosoftAuthorityRequiresHttps(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->expects($this->never())->method('set');
-
-        $service = $this->newService($settingRepository);
-        $this->assertFalse($service->setMicrosoftAuthority('http://login.microsoftonline.com/common/v2.0'));
-    }
-
-    public function testSetAppPrimaryColorNormalizesHexWithoutHash(): void
-    {
-        $settingRepository = $this->createMock(SettingRepository::class);
-        $settingRepository->expects($this->once())
-            ->method('set')
-            ->with(SettingService::APP_PRIMARY_COLOR_KEY, '#abc', 'setting.app_primary_color')
-            ->willReturn(true);
-
-        $service = $this->newService($settingRepository);
-        $this->assertTrue($service->setAppPrimaryColor('abc'));
-    }
-
-    private function newService(
-        SettingRepository $settingRepository,
-        ?TenantRepository $tenantRepository = null,
-        ?RoleRepository $roleRepository = null,
-        ?DepartmentRepository $departmentRepository = null
-    ): SettingService {
-        $tenantRepository = $tenantRepository ?? $this->createMock(TenantRepository::class);
-        $roleRepository = $roleRepository ?? $this->createMock(RoleRepository::class);
-        $departmentRepository = $departmentRepository ?? $this->createMock(DepartmentRepository::class);
-        $themeConfigService = $this->createMock(ThemeConfigService::class);
-        $themeConfigService->method('all')->willReturn(['light' => 'Light', 'dark' => 'Dark']);
-
-        return new SettingService(
-            $settingRepository,
-            $tenantRepository,
-            $roleRepository,
-            $departmentRepository,
-            $themeConfigService
-        );
-    }
-}

tests/Service/Settings/SettingsApiPolicyGatewayTest.php

@@ -0,0 +1,89 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsApiPolicyGateway;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsApiPolicyGatewayTest extends TestCase
+{
+    public function testSetApiTokenDefaultTtlDaysRejectsAboveCurrentMax(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnCallback(static function (string $key): ?string {
+            if ($key === 'api_token_max_ttl_days') {
+                return '30';
+            }
+            return null;
+        });
+        $settings->expects($this->never())->method('set');
+
+        $gateway = new SettingsApiPolicyGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setApiTokenDefaultTtlDays(31));
+    }
+
+    public function testSetApiTokenMaxTtlDaysUpdatesDefaultWhenNeeded(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnCallback(static function (string $key): ?string {
+            if ($key === 'api_token_default_ttl_days') {
+                return '365';
+            }
+            return null;
+        });
+
+        $calls = [];
+        $settings->expects($this->exactly(2))
+            ->method('set')
+            ->willReturnCallback(static function (string $key, ?string $value, ?string $description) use (&$calls): bool {
+                $calls[] = [$key, $value, $description];
+                return true;
+            });
+
+        $gateway = new SettingsApiPolicyGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->setApiTokenMaxTtlDays(120));
+        $this->assertSame(
+            [
+                ['api_token_default_ttl_days', '120', 'setting.api_token_default_ttl_days'],
+                ['api_token_max_ttl_days', '120', 'setting.api_token_max_ttl_days'],
+            ],
+            $calls
+        );
+    }
+
+    public function testSetApiCorsAllowedOriginsRejectsInvalidOrigins(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $gateway = new SettingsApiPolicyGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setApiCorsAllowedOrigins("https://ok.example\njavascript:alert(1)"));
+    }
+
+    public function testCorsOriginsRoundtripNormalizesAndDeduplicates(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $stored = null;
+        $settings->expects($this->once())
+            ->method('set')
+            ->willReturnCallback(static function (string $key, ?string $value) use (&$stored): bool {
+                if ($key === 'api_cors_allowed_origins') {
+                    $stored = $value;
+                }
+                return true;
+            });
+        $settings->method('getValue')->willReturnCallback(static function (string $key) use (&$stored): ?string {
+            if ($key === 'api_cors_allowed_origins') {
+                return $stored;
+            }
+            return null;
+        });
+
+        $gateway = new SettingsApiPolicyGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->setApiCorsAllowedOrigins("https://a.example,https://a.example/\nhttps://b.example:443"));
+        $this->assertSame(['https://a.example', 'https://b.example'], $gateway->getApiCorsAllowedOrigins());
+        $this->assertSame("https://a.example\nhttps://b.example", $gateway->getApiCorsAllowedOriginsText());
+    }
+}

tests/Service/Settings/SettingsAppGatewayTest.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsAppGateway;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use MintyPHP\Service\Settings\ThemeConfigService;
+use PHPUnit\Framework\TestCase;
+
+class SettingsAppGatewayTest extends TestCase
+{
+    public function testSetAppLocaleStoresNullForEmptyValue(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())->method('set')->with('app_locale', null, 'setting.app_locale')->willReturn(true);
+
+        $gateway = $this->newGateway($settings);
+        $this->assertTrue($gateway->setAppLocale(' '));
+    }
+
+    public function testSetAppThemeStoresNullForUnknownTheme(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())->method('set')->with('app_theme', null, 'setting.app_theme')->willReturn(true);
+
+        $gateway = $this->newGateway($settings);
+        $this->assertTrue($gateway->setAppTheme('unknown'));
+    }
+
+    public function testBooleanFlagsUseExpectedDefaults(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnMap([
+            ['app_theme_user', null],
+            ['app_registration', null],
+        ]);
+
+        $gateway = $this->newGateway($settings);
+        $this->assertTrue($gateway->isUserThemeAllowed());
+        $this->assertTrue($gateway->isRegistrationEnabled());
+    }
+
+    public function testSetAppPrimaryColorNormalizesHexWithoutHash(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())
+            ->method('set')
+            ->with('app_primary_color', '#abc', 'setting.app_primary_color')
+            ->willReturn(true);
+
+        $gateway = $this->newGateway($settings);
+        $this->assertTrue($gateway->setAppPrimaryColor('abc'));
+    }
+
+    public function testSetAppPrimaryColorRejectsInvalidValue(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $gateway = $this->newGateway($settings);
+        $this->assertFalse($gateway->setAppPrimaryColor('not-a-color'));
+    }
+
+    private function newGateway(SettingRepositoryInterface $settingRepository): SettingsAppGateway
+    {
+        $themeConfigService = $this->createMock(ThemeConfigService::class);
+        $themeConfigService->method('all')->willReturn(['light' => 'Light', 'dark' => 'Dark']);
+
+        return new SettingsAppGateway(new SettingsMetadataGateway($settingRepository), $themeConfigService);
+    }
+}

tests/Service/Settings/SettingsDefaultsGatewayTest.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Access\RoleRepositoryInterface;
+use MintyPHP\Repository\Org\DepartmentRepositoryInterface;
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Repository\Tenant\TenantRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsDefaultsGateway;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsDefaultsGatewayTest extends TestCase
+{
+    public function testSetDefaultTenantIdRejectsUnknownTenant(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $tenantRepository = $this->createMock(TenantRepositoryInterface::class);
+        $tenantRepository->expects($this->once())->method('find')->with(99)->willReturn(null);
+
+        $gateway = $this->newGateway($settings, $tenantRepository);
+        $this->assertFalse($gateway->setDefaultTenantId(99));
+    }
+
+    public function testSetDefaultRoleIdRejectsUnknownRole(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $roleRepository = $this->createMock(RoleRepositoryInterface::class);
+        $roleRepository->expects($this->once())->method('find')->with(55)->willReturn(null);
+
+        $gateway = $this->newGateway($settings, null, $roleRepository);
+        $this->assertFalse($gateway->setDefaultRoleId(55));
+    }
+
+    public function testSetDefaultDepartmentIdRejectsUnknownDepartment(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $departmentRepository = $this->createMock(DepartmentRepositoryInterface::class);
+        $departmentRepository->expects($this->once())->method('find')->with(77)->willReturn(null);
+
+        $gateway = $this->newGateway($settings, null, null, $departmentRepository);
+        $this->assertFalse($gateway->setDefaultDepartmentId(77));
+    }
+
+    public function testSettersPersistValidIds(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->exactly(3))
+            ->method('set')
+            ->willReturn(true);
+
+        $tenantRepository = $this->createMock(TenantRepositoryInterface::class);
+        $tenantRepository->method('find')->willReturn(['id' => 5]);
+
+        $roleRepository = $this->createMock(RoleRepositoryInterface::class);
+        $roleRepository->method('find')->willReturn(['id' => 6]);
+
+        $departmentRepository = $this->createMock(DepartmentRepositoryInterface::class);
+        $departmentRepository->method('find')->willReturn(['id' => 7]);
+
+        $gateway = $this->newGateway($settings, $tenantRepository, $roleRepository, $departmentRepository);
+        $this->assertTrue($gateway->setDefaultTenantId(5));
+        $this->assertTrue($gateway->setDefaultRoleId(6));
+        $this->assertTrue($gateway->setDefaultDepartmentId(7));
+    }
+
+    public function testSettersAllowResetToNull(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->exactly(3))->method('set')->willReturn(true);
+
+        $gateway = $this->newGateway($settings);
+        $this->assertTrue($gateway->setDefaultTenantId(null));
+        $this->assertTrue($gateway->setDefaultRoleId(null));
+        $this->assertTrue($gateway->setDefaultDepartmentId(null));
+    }
+
+    private function newGateway(
+        SettingRepositoryInterface $settingRepository,
+        ?TenantRepositoryInterface $tenantRepository = null,
+        ?RoleRepositoryInterface $roleRepository = null,
+        ?DepartmentRepositoryInterface $departmentRepository = null
+    ): SettingsDefaultsGateway {
+        $tenantRepository = $tenantRepository ?? $this->createMock(TenantRepositoryInterface::class);
+        $roleRepository = $roleRepository ?? $this->createMock(RoleRepositoryInterface::class);
+        $departmentRepository = $departmentRepository ?? $this->createMock(DepartmentRepositoryInterface::class);
+
+        return new SettingsDefaultsGateway(
+            new SettingsMetadataGateway($settingRepository),
+            $tenantRepository,
+            $roleRepository,
+            $departmentRepository
+        );
+    }
+}

tests/Service/Settings/SettingsFrontendTelemetryGatewayTest.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsFrontendTelemetryGateway;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsFrontendTelemetryGatewayTest extends TestCase
+{
+    public function testDefaultsAreUsedWhenSettingsMissing(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturn(null);
+
+        $gateway = new SettingsFrontendTelemetryGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->isFrontendTelemetryEnabled());
+        $this->assertSame(0.2, $gateway->getFrontendTelemetrySampleRate());
+        $this->assertSame(['warn_once', 'ajax_error'], $gateway->getFrontendTelemetryAllowedEvents());
+    }
+
+    public function testSetSampleRateRejectsOutOfRangeValues(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $gateway = new SettingsFrontendTelemetryGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setFrontendTelemetrySampleRate(1.5));
+    }
+
+    public function testSetAllowedEventsNormalizesValues(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())
+            ->method('set')
+            ->with(
+                'frontend_telemetry_allowed_events',
+                'ajax_error,warn_once',
+                'setting.frontend_telemetry_allowed_events'
+            )
+            ->willReturn(true);
+
+        $gateway = new SettingsFrontendTelemetryGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->setFrontendTelemetryAllowedEvents(['frontend.warn_once', 'ajax_error', 'invalid']));
+    }
+}

tests/Service/Settings/SettingsMicrosoftGatewayTest.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsCryptoGatewayInterface;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use MintyPHP\Service\Settings\SettingsMicrosoftGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsMicrosoftGatewayTest extends TestCase
+{
+    public function testSetMicrosoftAuthorityRequiresHttps(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $crypto = $this->createMock(SettingsCryptoGatewayInterface::class);
+        $gateway = new SettingsMicrosoftGateway(new SettingsMetadataGateway($settings), $crypto);
+
+        $this->assertFalse($gateway->setMicrosoftAuthority('http://login.microsoftonline.com/common/v2.0'));
+    }
+
+    public function testGetMicrosoftSharedClientSecretReturnsNullWhenDecryptFails(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturn('encrypted');
+
+        $crypto = $this->createMock(SettingsCryptoGatewayInterface::class);
+        $crypto->method('decryptString')->willThrowException(new \RuntimeException('bad secret'));
+
+        $gateway = new SettingsMicrosoftGateway(new SettingsMetadataGateway($settings), $crypto);
+        $this->assertNull($gateway->getMicrosoftSharedClientSecret());
+    }
+
+    public function testSetMicrosoftSharedClientSecretEncryptsAndPersists(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())
+            ->method('set')
+            ->with('microsoft_shared_client_secret_enc', 'enc-value', 'setting.microsoft_shared_client_secret_enc')
+            ->willReturn(true);
+
+        $crypto = $this->createMock(SettingsCryptoGatewayInterface::class);
+        $crypto->expects($this->once())
+            ->method('encryptString')
+            ->with('secret-value')
+            ->willReturn('enc-value');
+
+        $gateway = new SettingsMicrosoftGateway(new SettingsMetadataGateway($settings), $crypto);
+        $this->assertTrue($gateway->setMicrosoftSharedClientSecret('secret-value'));
+    }
+}

tests/Service/Settings/SettingsSmtpGatewayTest.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use MintyPHP\Service\Settings\SettingsSmtpGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsSmtpGatewayTest extends TestCase
+{
+    public function testGetSmtpSecureReturnsNullForNone(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnCallback(static function (string $key): ?string {
+            if ($key === 'smtp_secure') {
+                return 'none';
+            }
+            return null;
+        });
+
+        $gateway = new SettingsSmtpGateway(new SettingsMetadataGateway($settings));
+        $this->assertNull($gateway->getSmtpSecure());
+    }
+
+    public function testSetSmtpSecureRejectsInvalidValue(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $gateway = new SettingsSmtpGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setSmtpSecure('starttls'));
+    }
+
+    public function testSetSmtpHostPersistsNullForEmptyString(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())
+            ->method('set')
+            ->with('smtp_host', null, 'setting.smtp_host')
+            ->willReturn(true);
+
+        $gateway = new SettingsSmtpGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->setSmtpHost('  '));
+    }
+}

tests/Service/Settings/SettingsSystemAuditGatewayTest.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use MintyPHP\Service\Settings\SettingsSystemAuditGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsSystemAuditGatewayTest extends TestCase
+{
+    public function testIsSystemAuditEnabledUsesFallbackWhenMissing(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturn(null);
+
+        $gateway = new SettingsSystemAuditGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->isSystemAuditEnabled());
+    }
+
+    public function testRetentionFallsBackWhenOutOfRange(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturn('5');
+
+        $gateway = new SettingsSystemAuditGateway(new SettingsMetadataGateway($settings));
+        $this->assertSame(365, $gateway->getSystemAuditRetentionDays());
+    }
+
+    public function testSetSystemAuditRetentionRejectsOutOfRange(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->never())->method('set');
+
+        $gateway = new SettingsSystemAuditGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setSystemAuditRetentionDays(10));
+    }
+}

tests/Service/Settings/SettingsUserLifecycleGatewayTest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace MintyPHP\Tests\Service\Settings;
+
+use MintyPHP\Repository\Settings\SettingRepositoryInterface;
+use MintyPHP\Service\Settings\SettingsMetadataGateway;
+use MintyPHP\Service\Settings\SettingsUserLifecycleGateway;
+use PHPUnit\Framework\TestCase;
+
+class SettingsUserLifecycleGatewayTest extends TestCase
+{
+    public function testSetUserInactivityDeleteDaysRequiresDeactivatePolicy(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnCallback(static function (string $key): ?string {
+            if ($key === 'user_inactivity_deactivate_days') {
+                return '0';
+            }
+            return null;
+        });
+        $settings->expects($this->never())->method('set');
+
+        $gateway = new SettingsUserLifecycleGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setUserInactivityDeleteDays(30));
+    }
+
+    public function testSetUserInactivityDeactivateDaysSetsDeleteToZeroWhenDisabled(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->exactly(2))->method('set')->willReturn(true);
+
+        $gateway = new SettingsUserLifecycleGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->setUserInactivityDeactivateDays(0));
+    }
+
+    public function testGetUserInactivityDeleteDaysReturnsZeroWhenDeactivateDisabled(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnCallback(static function (string $key): ?string {
+            if ($key === 'user_inactivity_deactivate_days') {
+                return '0';
+            }
+            if ($key === 'user_inactivity_delete_days') {
+                return '180';
+            }
+            return null;
+        });
+
+        $gateway = new SettingsUserLifecycleGateway(new SettingsMetadataGateway($settings));
+        $this->assertSame(0, $gateway->getUserInactivityDeleteDays());
+    }
+}