breadcrumb-the-shire/tests/Architecture/SecurityCryptoContractTest.php

<?php

namespace MintyPHP\Tests\Architecture;

use PHPUnit\Framework\TestCase;

/**
 * GR-SEC-005: All encryption/decryption MUST use core/Support/Crypto.php.
 * No raw openssl_encrypt/decrypt calls outside that single file.
 */
class SecurityCryptoContractTest extends TestCase
{
    use ProjectFileAssertionSupport;

    private const CRYPTO_FILE = 'core/Support/Crypto.php';

    public function testNoRawOpensslEncryptOutsideCrypto(): void
    {
        $violations = array_merge(
            $this->findPatternMatchesInPhpFiles('core', '/\bopenssl_encrypt\s*\(/'),
            $this->findPatternMatchesInPhpFiles('pages', '/\bopenssl_encrypt\s*\(/')
        );

        $violations = array_values(array_filter(
            $violations,
            static fn (string $path): bool => $path !== self::CRYPTO_FILE
        ));

        $this->assertSame(
            [],
            $violations,
            "Raw openssl_encrypt() found outside Crypto.php (GR-SEC-005):\n" . implode("\n", $violations)
        );
    }

    public function testNoRawOpensslDecryptOutsideCrypto(): void
    {
        $violations = array_merge(
            $this->findPatternMatchesInPhpFiles('core', '/\bopenssl_decrypt\s*\(/'),
            $this->findPatternMatchesInPhpFiles('pages', '/\bopenssl_decrypt\s*\(/')
        );

        $violations = array_values(array_filter(
            $violations,
            static fn (string $path): bool => $path !== self::CRYPTO_FILE
        ));

        $this->assertSame(
            [],
            $violations,
            "Raw openssl_decrypt() found outside Crypto.php (GR-SEC-005):\n" . implode("\n", $violations)
        );
    }
}