Files
breadcrumb-the-shire/tests/Architecture/AuditModuleIsolationContractTest.php
fs cc2cf3a254 feat(user-lifecycle): cockpit foundation — KPI row + aside quick actions
Phase 1 of the Stripe-style policy-cockpit redesign for the user-lifecycle
settings page. Pure server-rendering — no async, no JS components, no
sparklines yet (those land in later phases).

Adds a four-tile KPI row above the configuration form (Last run,
Deactivated/30d, Deleted/30d, Pending deletion/7d), populates the
previously empty aside with three quick actions (Run policy now,
Purge logs, Policy reference link), and surfaces a relative-time +
status hint under the existing Run-Now collapsible.

Module-isolation is preserved through a new read-side contract:

* core/Service/Audit/UserLifecycleAuditDashboardInterface — read-only
  pendant to the existing write-side UserLifecycleAuditInterface.
  Methods: lastRun(), summaryByAction(int days), countActionInWindow(...).
* core/Service/Audit/NullUserLifecycleAuditDashboard — fail-closed
  default when the audit module is disabled. KPI tiles 1-3 then
  render "—"; tile 4 (pending deletion) keeps working because it
  lives in the core domain.
* modules/audit/.../Service/UserLifecycleAuditDashboardService — the
  module's implementation; reads through the existing
  UserLifecycleAuditRepository (extended with three new aggregation
  queries: lastRun, countByActionStatusSinceTimestamp, countSinceTimestamp).
* AuditContainerRegistrar binds the interface to the module impl;
  registerContainer.php registers the Null fallback before module
  bindings, mirroring how the write-side audit interface is wired.

The new core service UserLifecyclePolicyDashboardService computes
the pending-deletion-window count from the users table directly
(no audit dependency) — defensive when both policy days are 0
(returns 0 rather than running an unbounded query).

New shared template partial templates/partials/app-kpi-row.phtml is
generic — accepts a $kpiTiles array of {label, count, icon, iconTone,
href, tooltip} and reuses the existing app-tile primitive. Other
settings pages can pick it up without ceremony.

Includes:
* PHPUnit tests for both new services (happy path + Null-fallback +
  policy-disabled edge cases).
* AuditModuleIsolationContractTest allowlist extended for the new
  interface and module service.
* 14 new translation keys in both default_de.json and default_en.json
  (i18n parity verified).

All six quality gates green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-26 20:36:28 +02:00

124 lines
4.8 KiB
PHP

<?php
namespace MintyPHP\Tests\Architecture;
use PHPUnit\Framework\TestCase;
final class AuditModuleIsolationContractTest extends TestCase
{
public function testCoreServiceAuditDirectoryContainsOnlyInterfaces(): void
{
$dir = dirname(__DIR__, 2) . '/core/Service/Audit';
self::assertDirectoryExists($dir);
$files = array_values(array_filter(
scandir($dir) ?: [],
static fn (string $f): bool => str_ends_with($f, '.php')
));
$allowed = [
'ApiAuditServiceInterface.php',
'ApiSystemAuditReporterInterface.php',
'AuditMetadataEnricherInterface.php',
'AuditRecorderInterface.php',
'ImportAuditInterface.php',
'NullApiAuditService.php',
'NullApiSystemAuditReporter.php',
'NullAuditMetadataEnricher.php',
'NullAuditRecorder.php',
'NullImportAudit.php',
'NullUserLifecycleAudit.php',
'NullUserLifecycleAuditDashboard.php',
'UserLifecycleAuditDashboardInterface.php',
'UserLifecycleAuditInterface.php',
];
sort($files);
sort($allowed);
self::assertSame(
$allowed,
$files,
'core/Service/Audit/ should contain only interfaces and null implementations, found: ' . implode(', ', $files)
);
}
public function testCoreRepositoryAuditDirectoryDoesNotExist(): void
{
$root = dirname(__DIR__, 2);
self::assertDirectoryDoesNotExist(
$root . '/core/Repository/Audit',
'Audit repository classes should live in modules/audit/lib, not in core/Repository/Audit'
);
}
public function testCoreDomainTaxonomyHasNoAuditEnums(): void
{
$dir = dirname(__DIR__, 2) . '/core/Domain/Taxonomy';
if (!is_dir($dir)) {
self::addToAssertionCount(1);
return;
}
$entries = scandir($dir) ?: [];
$auditFiles = array_filter($entries, static fn (string $f): bool => str_contains($f, 'Audit') || str_contains($f, 'Lifecycle'));
self::assertSame(
[],
array_values($auditFiles),
'core/Domain/Taxonomy/ still contains audit enum files: ' . implode(', ', $auditFiles)
);
}
public function testCoreAuditPagesRemoved(): void
{
$root = dirname(__DIR__, 2);
self::assertDirectoryDoesNotExist($root . '/pages/admin/api-audit');
self::assertDirectoryDoesNotExist($root . '/pages/admin/system-audit');
self::assertDirectoryDoesNotExist($root . '/pages/admin/import-audit');
self::assertDirectoryDoesNotExist($root . '/pages/admin/user-lifecycle-audit');
self::assertDirectoryDoesNotExist($root . '/pages/admin/frontend-telemetry');
}
public function testCoreJsHasNoAuditPageScripts(): void
{
$root = dirname(__DIR__, 2);
self::assertFileDoesNotExist($root . '/web/js/pages/admin-api-audit-index.js');
self::assertFileDoesNotExist($root . '/web/js/pages/admin-system-audit-index.js');
self::assertFileDoesNotExist($root . '/web/js/pages/admin-import-audit-index.js');
self::assertFileDoesNotExist($root . '/web/js/pages/admin-user-lifecycle-audit-index.js');
}
public function testCoreHttpHasNoConcreteAuditReporter(): void
{
$root = dirname(__DIR__, 2);
self::assertFileDoesNotExist(
$root . '/core/Http/ApiSystemAuditReporter.php',
'ApiSystemAuditReporter should live in modules/audit/lib, not in core/Http'
);
}
public function testCoreSidebarHasNoHardcodedAuditNavigation(): void
{
$file = dirname(__DIR__, 2) . '/templates/partials/app-main-aside.phtml';
$content = file_get_contents($file);
self::assertIsString($content);
self::assertStringNotContainsString('can_view_api_audit', $content);
self::assertStringNotContainsString('can_view_system_audit', $content);
self::assertStringNotContainsString('can_view_imports_audit', $content);
self::assertStringNotContainsString('can_view_user_lifecycle_audit', $content);
self::assertStringNotContainsString('admin/api-audit', $content);
self::assertStringNotContainsString('admin/system-audit', $content);
self::assertStringNotContainsString('admin/import-audit', $content);
self::assertStringNotContainsString('admin/user-lifecycle-audit', $content);
}
public function testCoreSchedulerHandlerRemoved(): void
{
$root = dirname(__DIR__, 2);
self::assertFileDoesNotExist(
$root . '/core/Service/Scheduler/Handler/SystemAuditPurgeJobHandler.php',
'SystemAuditPurgeJobHandler should live in modules/audit, not in Core'
);
}
}