119 lines
4.5 KiB
PHP
119 lines
4.5 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Tests\Service\Access;
|
|
|
|
use MintyPHP\Service\Access\PermissionGateway;
|
|
use MintyPHP\Service\Access\PermissionService;
|
|
use MintyPHP\Service\Access\SettingsAuthorizationPolicy;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class SettingsAuthorizationPolicyTest extends TestCase
|
|
{
|
|
public function testViewRequiresSettingsViewPermission(): void
|
|
{
|
|
$permissionGateway = $this->createMock(PermissionGateway::class);
|
|
$permissionGateway->expects($this->once())
|
|
->method('userHas')
|
|
->with(4, PermissionService::SETTINGS_VIEW)
|
|
->willReturn(false);
|
|
|
|
$policy = new SettingsAuthorizationPolicy($permissionGateway);
|
|
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_VIEW, [
|
|
'actor_user_id' => 4,
|
|
]);
|
|
|
|
$this->assertFalse($decision->isAllowed());
|
|
$this->assertSame(403, $decision->status());
|
|
$this->assertSame('forbidden', $decision->error());
|
|
}
|
|
|
|
public function testViewReturnsUpdateCapability(): void
|
|
{
|
|
$permissionGateway = $this->createMock(PermissionGateway::class);
|
|
$permissionGateway->method('userHas')
|
|
->willReturnCallback(static function (int $userId, string $permission): bool {
|
|
if ($userId !== 4) {
|
|
return false;
|
|
}
|
|
|
|
return in_array($permission, [PermissionService::SETTINGS_VIEW, PermissionService::SETTINGS_UPDATE], true);
|
|
});
|
|
|
|
$policy = new SettingsAuthorizationPolicy($permissionGateway);
|
|
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_VIEW, [
|
|
'actor_user_id' => 4,
|
|
]);
|
|
|
|
$this->assertTrue($decision->isAllowed());
|
|
$this->assertTrue((bool) ($decision->attribute('capabilities', [])['can_update_settings'] ?? false));
|
|
}
|
|
|
|
public function testUpdateRequiresSettingsUpdatePermission(): void
|
|
{
|
|
$permissionGateway = $this->createMock(PermissionGateway::class);
|
|
$permissionGateway->expects($this->once())
|
|
->method('userHas')
|
|
->with(8, PermissionService::SETTINGS_UPDATE)
|
|
->willReturn(false);
|
|
|
|
$policy = new SettingsAuthorizationPolicy($permissionGateway);
|
|
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_UPDATE, [
|
|
'actor_user_id' => 8,
|
|
]);
|
|
|
|
$this->assertFalse($decision->isAllowed());
|
|
$this->assertSame(403, $decision->status());
|
|
}
|
|
|
|
public function testBrandingUpdateRequiresSettingsUpdatePermission(): void
|
|
{
|
|
$permissionGateway = $this->createMock(PermissionGateway::class);
|
|
$permissionGateway->expects($this->once())
|
|
->method('userHas')
|
|
->with(8, PermissionService::SETTINGS_UPDATE)
|
|
->willReturn(false);
|
|
|
|
$policy = new SettingsAuthorizationPolicy($permissionGateway);
|
|
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE, [
|
|
'actor_user_id' => 8,
|
|
]);
|
|
|
|
$this->assertFalse($decision->isAllowed());
|
|
$this->assertSame(403, $decision->status());
|
|
}
|
|
|
|
public function testTokenRevokeRequiresSettingsUpdatePermission(): void
|
|
{
|
|
$permissionGateway = $this->createMock(PermissionGateway::class);
|
|
$permissionGateway->expects($this->once())
|
|
->method('userHas')
|
|
->with(8, PermissionService::SETTINGS_UPDATE)
|
|
->willReturn(false);
|
|
|
|
$policy = new SettingsAuthorizationPolicy($permissionGateway);
|
|
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE, [
|
|
'actor_user_id' => 8,
|
|
]);
|
|
|
|
$this->assertFalse($decision->isAllowed());
|
|
$this->assertSame(403, $decision->status());
|
|
}
|
|
|
|
public function testUserLifecycleRunRequiresSettingsUpdatePermission(): void
|
|
{
|
|
$permissionGateway = $this->createMock(PermissionGateway::class);
|
|
$permissionGateway->expects($this->once())
|
|
->method('userHas')
|
|
->with(8, PermissionService::SETTINGS_UPDATE)
|
|
->willReturn(false);
|
|
|
|
$policy = new SettingsAuthorizationPolicy($permissionGateway);
|
|
$decision = $policy->authorize(SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN, [
|
|
'actor_user_id' => 8,
|
|
]);
|
|
|
|
$this->assertFalse($decision->isAllowed());
|
|
$this->assertSame(403, $decision->status());
|
|
}
|
|
}
|