Strengthen settings gateway tests

tests/Service/Settings/SettingsApiPolicyGatewayTest.php

@@ -24,6 +24,24 @@ class SettingsApiPolicyGatewayTest extends TestCase
         $this->assertFalse($gateway->setApiTokenDefaultTtlDays(31));
     }
 
+    public function testSetApiTokenMaxTtlDaysReturnsFalseWhenDefaultClampPersistFails(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->method('getValue')->willReturnCallback(static function (string $key): ?string {
+            if ($key === 'api_token_default_ttl_days') {
+                return '365';
+            }
+            return null;
+        });
+        $settings->expects($this->once())
+            ->method('set')
+            ->with('api_token_default_ttl_days', '120', 'setting.api_token_default_ttl_days')
+            ->willReturn(false);
+
+        $gateway = new SettingsApiPolicyGateway(new SettingsMetadataGateway($settings));
+        $this->assertFalse($gateway->setApiTokenMaxTtlDays(120));
+    }
+
     public function testSetApiTokenMaxTtlDaysUpdatesDefaultWhenNeeded(): void
     {
         $settings = $this->createMock(SettingRepositoryInterface::class);
@@ -86,4 +104,16 @@ class SettingsApiPolicyGatewayTest extends TestCase
         $this->assertSame(['https://a.example', 'https://b.example'], $gateway->getApiCorsAllowedOrigins());
         $this->assertSame("https://a.example\nhttps://b.example", $gateway->getApiCorsAllowedOriginsText());
     }
+
+    public function testSetApiCorsAllowedOriginsClearsSettingForEmptyInput(): void
+    {
+        $settings = $this->createMock(SettingRepositoryInterface::class);
+        $settings->expects($this->once())
+            ->method('set')
+            ->with('api_cors_allowed_origins', null, 'setting.api_cors_allowed_origins')
+            ->willReturn(true);
+
+        $gateway = new SettingsApiPolicyGateway(new SettingsMetadataGateway($settings));
+        $this->assertTrue($gateway->setApiCorsAllowedOrigins(" \n "));
+    }
 }