test(access): finalize operations authorization policy coverage
This commit is contained in:
237
tests/Service/Access/OperationsAuthorizationPolicyTest.php
Normal file
237
tests/Service/Access/OperationsAuthorizationPolicyTest.php
Normal file
@@ -0,0 +1,237 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Tests\Service\Access;
|
||||
|
||||
use MintyPHP\Service\Access\OperationsAuthorizationPolicy;
|
||||
use MintyPHP\Service\Access\PermissionService;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
class OperationsAuthorizationPolicyTest extends TestCase
|
||||
{
|
||||
use AuthorizationPolicyTestSupport;
|
||||
|
||||
// --- supports() ---
|
||||
|
||||
public function testSupportsReturnsTrueForKnownAbilities(): void
|
||||
{
|
||||
$policy = new OperationsAuthorizationPolicy($this->createMock(PermissionService::class));
|
||||
|
||||
$this->assertTrue($policy->supports(OperationsAuthorizationPolicy::ABILITY_ADDRESS_BOOK_VIEW));
|
||||
$this->assertTrue($policy->supports(OperationsAuthorizationPolicy::ABILITY_ADMIN_JOBS_VIEW));
|
||||
$this->assertTrue($policy->supports(OperationsAuthorizationPolicy::ABILITY_API_TENANTS_DELETE));
|
||||
$this->assertTrue($policy->supports(OperationsAuthorizationPolicy::ABILITY_API_TOKENS_SELF_MANAGE));
|
||||
$this->assertTrue($policy->supports(OperationsAuthorizationPolicy::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS));
|
||||
}
|
||||
|
||||
public function testSupportsReturnsFalseForUnknownAbility(): void
|
||||
{
|
||||
$policy = new OperationsAuthorizationPolicy($this->createMock(PermissionService::class));
|
||||
|
||||
$this->assertFalse($policy->supports('ops.nonexistent'));
|
||||
$this->assertFalse($policy->supports('admin.roles.view'));
|
||||
$this->assertFalse($policy->supports(''));
|
||||
}
|
||||
|
||||
// --- authorize: zero/negative actor_user_id ---
|
||||
|
||||
public function testAuthorizeDeniesWhenActorUserIdIsZero(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->expects($this->never())->method('userHas');
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADDRESS_BOOK_VIEW, [
|
||||
'actor_user_id' => 0,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
public function testAuthorizeDeniesWhenActorUserIdIsMissing(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->expects($this->never())->method('userHas');
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_STATS_VIEW, []);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
public function testAuthorizeDeniesWhenActorUserIdIsNegative(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->expects($this->never())->method('userHas');
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_STATS_VIEW, [
|
||||
'actor_user_id' => -1,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
// --- authorize: unsupported ability ---
|
||||
|
||||
public function testAuthorizeReturns500ForUnsupportedAbility(): void
|
||||
{
|
||||
$policy = new OperationsAuthorizationPolicy($this->createMock(PermissionService::class));
|
||||
$decision = $policy->authorize('ops.nonexistent', ['actor_user_id' => 1]);
|
||||
|
||||
$this->assertDeniedDecision($decision, 500, 'authorization_ability_not_supported');
|
||||
}
|
||||
|
||||
// --- authorize: allowIfHas (simple permission check) ---
|
||||
|
||||
public function testAddressBookViewAllowedWithPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
5 => [PermissionService::ADDRESS_BOOK_VIEW],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADDRESS_BOOK_VIEW, [
|
||||
'actor_user_id' => 5,
|
||||
]);
|
||||
|
||||
$this->assertTrue($decision->isAllowed());
|
||||
}
|
||||
|
||||
public function testAddressBookViewDeniedWithoutPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([5 => []]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADDRESS_BOOK_VIEW, [
|
||||
'actor_user_id' => 5,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
public function testJobsViewAllowedWithPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
10 => [PermissionService::JOBS_VIEW],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_JOBS_VIEW, [
|
||||
'actor_user_id' => 10,
|
||||
]);
|
||||
|
||||
$this->assertTrue($decision->isAllowed());
|
||||
}
|
||||
|
||||
public function testApiTenantsDeleteDeniedWithoutPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([8 => []]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_API_TENANTS_DELETE, [
|
||||
'actor_user_id' => 8,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
public function testSystemAuditPurgeAllowedWithPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
3 => [PermissionService::SYSTEM_AUDIT_PURGE],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_SYSTEM_AUDIT_PURGE, [
|
||||
'actor_user_id' => 3,
|
||||
]);
|
||||
|
||||
$this->assertTrue($decision->isAllowed());
|
||||
}
|
||||
|
||||
// --- authorize: authorizeUsersCreateCustomFields (requires TWO permissions) ---
|
||||
|
||||
public function testUsersCreateCustomFieldsAllowedWithBothPermissions(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
7 => [PermissionService::CUSTOM_FIELDS_EDIT_VALUES, PermissionService::USERS_UPDATE_ASSIGNMENTS],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS, [
|
||||
'actor_user_id' => 7,
|
||||
]);
|
||||
|
||||
$this->assertTrue($decision->isAllowed());
|
||||
}
|
||||
|
||||
public function testUsersCreateCustomFieldsDeniedWithoutCustomFieldsPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
7 => [PermissionService::USERS_UPDATE_ASSIGNMENTS],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS, [
|
||||
'actor_user_id' => 7,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
public function testUsersCreateCustomFieldsDeniedWithoutAssignmentsPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
7 => [PermissionService::CUSTOM_FIELDS_EDIT_VALUES],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS, [
|
||||
'actor_user_id' => 7,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
|
||||
// --- authorize: authorizeApiTokensSelfManage (requires EITHER permission) ---
|
||||
|
||||
public function testApiTokensSelfManageAllowedWithSelfUpdatePermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
9 => [PermissionService::USERS_SELF_UPDATE],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_API_TOKENS_SELF_MANAGE, [
|
||||
'actor_user_id' => 9,
|
||||
]);
|
||||
|
||||
$this->assertTrue($decision->isAllowed());
|
||||
}
|
||||
|
||||
public function testApiTokensSelfManageAllowedWithApiTokensManagePermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([
|
||||
9 => [PermissionService::API_TOKENS_MANAGE],
|
||||
]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_API_TOKENS_SELF_MANAGE, [
|
||||
'actor_user_id' => 9,
|
||||
]);
|
||||
|
||||
$this->assertTrue($decision->isAllowed());
|
||||
}
|
||||
|
||||
public function testApiTokensSelfManageDeniedWithoutEitherPermission(): void
|
||||
{
|
||||
$permissionService = $this->permissionGatewayAllowing([9 => []]);
|
||||
|
||||
$policy = new OperationsAuthorizationPolicy($permissionService);
|
||||
$decision = $policy->authorize(OperationsAuthorizationPolicy::ABILITY_API_TOKENS_SELF_MANAGE, [
|
||||
'actor_user_id' => 9,
|
||||
]);
|
||||
|
||||
$this->assertForbiddenDecision($decision);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user