test(security): cover tenant-scope, settings authz allow paths, auth gateways
Cluster 1 der Testabdeckungs-Initiative (.agents/runs/TEST-SEC-COVERAGE-001). +38 Tests / +233 Assertions, nur tests/** veraendert. - SettingsAuthorizationPolicyTest: Allow-Pfade fuer UPDATE/BRANDING_UPDATE/ TOKENS_REVOKE/USER_LIFECYCLE_RUN plus Unknown-Ability — schliesst die Halb-Test-Luecke, die zuvor nur Deny-Pfade fuer 4 von 5 Abilities pruefte. - AssignableRoleServiceTest: neu (GR-TEST-001, vorher nur transitiv via UserAssignmentServiceTest gedeckt). - AuthCryptoGatewayTest: neu (Roundtrip + Fehlerpfad, GR-SEC-005). - AuthSettingsGatewayTest: neu (Delegation zu 5 Settings-Sub-Gateways). - UserTenantContextServiceTest: neu, 18 Tests, Tenant-Scope-Logik (GR-SEC-009) — current/primary/fallback, inactive-filter, assign-checks. LdapConnectionGateway und OidcHttpGateway bleiben bewusst ohne Direkttests: beide sind architektonische Test-Seams (dokumentiert im Docblock bzw. reiner statischer Curl-Delegator). Ihre Logik ist ueber Konsumenten-Tests (LdapAuthServiceTest, MicrosoftOidcServiceTest) bereits gedeckt. Gates: QG-001 (1945 Tests) / QG-002 (PHPStan L5) / QG-003 (Architecture) / QG-006 (php-cs-fixer) pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
222
tests/Service/Access/AssignableRoleServiceTest.php
Normal file
222
tests/Service/Access/AssignableRoleServiceTest.php
Normal file
@@ -0,0 +1,222 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Tests\Service\Access;
|
||||
|
||||
use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
|
||||
use MintyPHP\Repository\Access\RoleRepositoryInterface;
|
||||
use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
|
||||
use MintyPHP\Service\Access\AssignableRoleService;
|
||||
use MintyPHP\Service\Access\PermissionService;
|
||||
use MintyPHP\Service\Audit\AuditRecorderInterface;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
class AssignableRoleServiceTest extends TestCase
|
||||
{
|
||||
public function testListReturnsEmptyForInvalidActorId(): void
|
||||
{
|
||||
$service = $this->makeService();
|
||||
|
||||
$this->assertSame([], $service->listAssignableRoleIdsForActor(0));
|
||||
$this->assertSame([], $service->listAssignableRoleIdsForActor(-5));
|
||||
}
|
||||
|
||||
public function testListReturnsAllActiveRolesWhenActorHasAssignAllPermission(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->expects($this->once())
|
||||
->method('userHas')
|
||||
->with(42, PermissionService::ROLES_ASSIGN_ALL)
|
||||
->willReturn(true);
|
||||
|
||||
$roleRepository = $this->createMock(RoleRepositoryInterface::class);
|
||||
$roleRepository->expects($this->once())
|
||||
->method('listActiveIds')
|
||||
->willReturn([1, 2, 3, 4]);
|
||||
|
||||
$service = $this->makeService(
|
||||
permissionService: $permissionService,
|
||||
roleRepository: $roleRepository,
|
||||
);
|
||||
|
||||
$this->assertSame([1, 2, 3, 4], $service->listAssignableRoleIdsForActor(42));
|
||||
}
|
||||
|
||||
public function testListReturnsEmptyWhenActorHasNoRoles(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->method('userHas')->willReturn(false);
|
||||
|
||||
$userRoleRepository = $this->createMock(UserRoleRepositoryInterface::class);
|
||||
$userRoleRepository->expects($this->once())
|
||||
->method('listRoleIdsByUserId')
|
||||
->with(42)
|
||||
->willReturn([]);
|
||||
|
||||
$service = $this->makeService(
|
||||
permissionService: $permissionService,
|
||||
userRoleRepository: $userRoleRepository,
|
||||
);
|
||||
|
||||
$this->assertSame([], $service->listAssignableRoleIdsForActor(42));
|
||||
}
|
||||
|
||||
public function testListReturnsUnionOfAssignableRoleIdsFromActorRoles(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->method('userHas')->willReturn(false);
|
||||
|
||||
$userRoleRepository = $this->createMock(UserRoleRepositoryInterface::class);
|
||||
$userRoleRepository->method('listRoleIdsByUserId')->willReturn([10, 11]);
|
||||
|
||||
$assignableRepo = $this->createMock(RoleAssignableRoleRepositoryInterface::class);
|
||||
$assignableRepo->expects($this->once())
|
||||
->method('listAssignableRoleIdsByRoleIds')
|
||||
->with([10, 11])
|
||||
->willReturn([20, 21, 22]);
|
||||
|
||||
$service = $this->makeService(
|
||||
permissionService: $permissionService,
|
||||
userRoleRepository: $userRoleRepository,
|
||||
assignableRoleRepository: $assignableRepo,
|
||||
);
|
||||
|
||||
$this->assertSame([20, 21, 22], $service->listAssignableRoleIdsForActor(42));
|
||||
}
|
||||
|
||||
public function testComputeEffectiveKeepsFrozenRolesAndAppliesSubmittedAssignableRoles(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->method('userHas')->willReturn(false);
|
||||
|
||||
$userRoleRepository = $this->createMock(UserRoleRepositoryInterface::class);
|
||||
$userRoleRepository->method('listRoleIdsByUserId')->willReturn([10]);
|
||||
|
||||
$assignableRepo = $this->createMock(RoleAssignableRoleRepositoryInterface::class);
|
||||
$assignableRepo->method('listAssignableRoleIdsByRoleIds')->willReturn([20, 21]);
|
||||
|
||||
$service = $this->makeService(
|
||||
permissionService: $permissionService,
|
||||
userRoleRepository: $userRoleRepository,
|
||||
assignableRoleRepository: $assignableRepo,
|
||||
);
|
||||
|
||||
// currentIds contains a non-assignable role 99 (frozen) plus assignable 20 (touchable).
|
||||
// submittedIds drops 20, adds 21, attempts to add 99 again and a forbidden 55.
|
||||
$result = $service->computeEffectiveRoleIds(
|
||||
actorUserId: 42,
|
||||
submittedIds: [21, 99, 55],
|
||||
currentIds: [99, 20],
|
||||
);
|
||||
|
||||
// Frozen: 99. Touched: 21. 55 is not assignable so dropped. 20 removed because actor chose not to keep it.
|
||||
$this->assertSame([99, 21], $result);
|
||||
}
|
||||
|
||||
public function testComputeEffectiveDropsNonAssignableSubmittedIds(): void
|
||||
{
|
||||
$permissionService = $this->createMock(PermissionService::class);
|
||||
$permissionService->method('userHas')->willReturn(true);
|
||||
|
||||
$roleRepository = $this->createMock(RoleRepositoryInterface::class);
|
||||
$roleRepository->method('listActiveIds')->willReturn([1, 2, 3]);
|
||||
|
||||
$service = $this->makeService(
|
||||
permissionService: $permissionService,
|
||||
roleRepository: $roleRepository,
|
||||
);
|
||||
|
||||
$result = $service->computeEffectiveRoleIds(42, [1, 999], []);
|
||||
|
||||
$this->assertSame([1], $result);
|
||||
}
|
||||
|
||||
public function testReplaceAssignableRolesRecordsAuditOnChange(): void
|
||||
{
|
||||
$assignableRepo = $this->createMock(RoleAssignableRoleRepositoryInterface::class);
|
||||
$assignableRepo->method('listAssignableRoleIdsByRoleId')
|
||||
->willReturnOnConsecutiveCalls([1, 2], [1, 2, 3]);
|
||||
$assignableRepo->expects($this->once())
|
||||
->method('replaceForRole')
|
||||
->with(10, [1, 2, 3])
|
||||
->willReturn(true);
|
||||
|
||||
$audit = $this->createMock(AuditRecorderInterface::class);
|
||||
$audit->expects($this->once())
|
||||
->method('record')
|
||||
->with(
|
||||
'admin.roles.assignable_roles.update',
|
||||
'success',
|
||||
$this->callback(static function (array $metadata): bool {
|
||||
return ($metadata['actor_user_id'] ?? null) === 42
|
||||
&& ($metadata['target_id'] ?? null) === 10
|
||||
&& ($metadata['before']['assignable_role_ids'] ?? null) === [1, 2]
|
||||
&& ($metadata['after']['assignable_role_ids'] ?? null) === [1, 2, 3];
|
||||
})
|
||||
);
|
||||
|
||||
$service = $this->makeService(
|
||||
assignableRoleRepository: $assignableRepo,
|
||||
systemAuditService: $audit,
|
||||
);
|
||||
|
||||
$this->assertTrue($service->replaceAssignableRoles(10, [1, 2, 3], 42));
|
||||
}
|
||||
|
||||
public function testReplaceAssignableRolesSkipsAuditWhenNothingChanged(): void
|
||||
{
|
||||
$assignableRepo = $this->createMock(RoleAssignableRoleRepositoryInterface::class);
|
||||
$assignableRepo->method('listAssignableRoleIdsByRoleId')
|
||||
->willReturnOnConsecutiveCalls([1, 2], [1, 2]);
|
||||
$assignableRepo->method('replaceForRole')->willReturn(true);
|
||||
|
||||
$audit = $this->createMock(AuditRecorderInterface::class);
|
||||
$audit->expects($this->never())->method('record');
|
||||
|
||||
$service = $this->makeService(
|
||||
assignableRoleRepository: $assignableRepo,
|
||||
systemAuditService: $audit,
|
||||
);
|
||||
|
||||
$this->assertTrue($service->replaceAssignableRoles(10, [1, 2], 42));
|
||||
}
|
||||
|
||||
public function testReplaceAssignableRolesNormalizesNonPositiveActorIdInAudit(): void
|
||||
{
|
||||
$assignableRepo = $this->createMock(RoleAssignableRoleRepositoryInterface::class);
|
||||
$assignableRepo->method('listAssignableRoleIdsByRoleId')
|
||||
->willReturnOnConsecutiveCalls([], [5]);
|
||||
$assignableRepo->method('replaceForRole')->willReturn(true);
|
||||
|
||||
$audit = $this->createMock(AuditRecorderInterface::class);
|
||||
$audit->expects($this->once())
|
||||
->method('record')
|
||||
->with(
|
||||
'admin.roles.assignable_roles.update',
|
||||
'success',
|
||||
$this->callback(static fn (array $m): bool => array_key_exists('actor_user_id', $m) && $m['actor_user_id'] === null)
|
||||
);
|
||||
|
||||
$service = $this->makeService(
|
||||
assignableRoleRepository: $assignableRepo,
|
||||
systemAuditService: $audit,
|
||||
);
|
||||
|
||||
$service->replaceAssignableRoles(10, [5], 0);
|
||||
}
|
||||
|
||||
private function makeService(
|
||||
?RoleAssignableRoleRepositoryInterface $assignableRoleRepository = null,
|
||||
?UserRoleRepositoryInterface $userRoleRepository = null,
|
||||
?PermissionService $permissionService = null,
|
||||
?RoleRepositoryInterface $roleRepository = null,
|
||||
?AuditRecorderInterface $systemAuditService = null,
|
||||
): AssignableRoleService {
|
||||
return new AssignableRoleService(
|
||||
$assignableRoleRepository ?? $this->createMock(RoleAssignableRoleRepositoryInterface::class),
|
||||
$userRoleRepository ?? $this->createMock(UserRoleRepositoryInterface::class),
|
||||
$permissionService ?? $this->createMock(PermissionService::class),
|
||||
$roleRepository ?? $this->createMock(RoleRepositoryInterface::class),
|
||||
$systemAuditService ?? $this->createMock(AuditRecorderInterface::class),
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user