fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

test(security): cover tenant-scope, settings authz allow paths, auth gateways

Browse Source 
Cluster 1 der Testabdeckungs-Initiative (.agents/runs/TEST-SEC-COVERAGE-001).
+38 Tests / +233 Assertions, nur tests/** veraendert.

- SettingsAuthorizationPolicyTest: Allow-Pfade fuer UPDATE/BRANDING_UPDATE/
  TOKENS_REVOKE/USER_LIFECYCLE_RUN plus Unknown-Ability — schliesst die
  Halb-Test-Luecke, die zuvor nur Deny-Pfade fuer 4 von 5 Abilities pruefte.
- AssignableRoleServiceTest: neu (GR-TEST-001, vorher nur transitiv via
  UserAssignmentServiceTest gedeckt).
- AuthCryptoGatewayTest: neu (Roundtrip + Fehlerpfad, GR-SEC-005).
- AuthSettingsGatewayTest: neu (Delegation zu 5 Settings-Sub-Gateways).
- UserTenantContextServiceTest: neu, 18 Tests, Tenant-Scope-Logik
  (GR-SEC-009) — current/primary/fallback, inactive-filter, assign-checks.

LdapConnectionGateway und OidcHttpGateway bleiben bewusst ohne Direkttests:
beide sind architektonische Test-Seams (dokumentiert im Docblock bzw. reiner
statischer Curl-Delegator). Ihre Logik ist ueber Konsumenten-Tests
(LdapAuthServiceTest, MicrosoftOidcServiceTest) bereits gedeckt.

Gates: QG-001 (1945 Tests) / QG-002 (PHPStan L5) / QG-003 (Architecture) /
QG-006 (php-cs-fixer) pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Felix Schneider
2026-04-22 18:57:43 +02:00
parent f793f5d493
commit d06df56c49
5 changed files with 745 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
tests/Service/Access/SettingsAuthorizationPolicyTest.php
View File

@@ -104,4 +104,73 @@ class SettingsAuthorizationPolicyTest extends TestCase
$this->assertDeniedDecision($decision, 403, 'forbidden');
}
public function testUpdateAllowsWhenPermissionGranted(): void
{
$permissionService = $this->permissionGatewayAllowing([
8 => [PermissionService::SETTINGS_UPDATE],
]);
$policy = new SettingsAuthorizationPolicy($permissionService);
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_UPDATE, [
'actor_user_id' => 8,
]);
$this->assertTrue($decision->isAllowed());
}
public function testBrandingUpdateAllowsWhenPermissionGranted(): void
{
$permissionService = $this->permissionGatewayAllowing([
8 => [PermissionService::SETTINGS_UPDATE],
]);
$policy = new SettingsAuthorizationPolicy($permissionService);
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE, [
'actor_user_id' => 8,
]);
$this->assertTrue($decision->isAllowed());
}
public function testTokenRevokeAllowsWhenPermissionGranted(): void
{
$permissionService = $this->permissionGatewayAllowing([
8 => [PermissionService::SETTINGS_UPDATE],
]);
$policy = new SettingsAuthorizationPolicy($permissionService);
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE, [
'actor_user_id' => 8,
]);
$this->assertTrue($decision->isAllowed());
}
public function testUserLifecycleRunAllowsWhenPermissionGranted(): void
{
$permissionService = $this->permissionGatewayAllowing([
8 => [PermissionService::SETTINGS_UPDATE],
]);
$policy = new SettingsAuthorizationPolicy($permissionService);
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN, [
'actor_user_id' => 8,
]);
$this->assertTrue($decision->isAllowed());
}
public function testUnknownAbilityIsDeniedWithServerError(): void
{
$permissionService = $this->createMock(PermissionService::class);
$permissionService->expects($this->never())->method('userHas');
$policy = new SettingsAuthorizationPolicy($permissionService);
$decision = $policy->authorize('admin.settings.nonexistent', [
'actor_user_id' => 8,
]);
$this->assertDeniedDecision($decision, 500, 'authorization_ability_not_supported');
}
}