forked from fa/breadcrumb-the-shire
fs
0c351f6aff
Move the entire audit subsystem (system audit, API audit, import audit, user lifecycle audit, frontend telemetry) from core into modules/audit/. Core decoupling via interface-based injection: - AuditRecorderInterface replaces SystemAuditService in 10+ core services - UserLifecycleAuditInterface / ImportAuditInterface for specialized flows - NullAuditRecorder fallback when audit module is disabled - ApiBootstrap/ApiResponse use null-safe callable resolvers Module structure (modules/audit/): - Manifest with routes, permissions, scheduler jobs, authorization policy - 9 services, 8 repositories, 6 domain enums, 4 job handlers - 33 page files, 4 JS files, 8 test files, migration scripts, i18n Core cleanup: - OperationsAuthorizationPolicy, UiCapabilityMap, PermissionService surgically cleaned of audit-specific constants - Sidebar template cleared of hardcoded audit navigation - AuditModuleIsolationContractTest ensures no future core→module coupling All quality gates pass: 1346 tests (19,276 assertions), PHPStan level 5 clean, architecture contracts verified. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
64 lines
2.3 KiB
PHP
64 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Tests\Architecture;
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class SecurityLoggingRedactionContractTest extends TestCase
|
|
{
|
|
use ProjectFileAssertionSupport;
|
|
|
|
public function testSystemAuditRedactionCoversCredentialsTokensAndEmailFields(): void
|
|
{
|
|
$content = $this->readProjectFile('modules/audit/lib/Module/Audit/Service/SystemAuditRedactionService.php');
|
|
|
|
foreach ([
|
|
"'password'",
|
|
"'access_token'",
|
|
"'refresh_token'",
|
|
"'id_token'",
|
|
"'authorization'",
|
|
"'api_key'",
|
|
"'client_secret'",
|
|
"'smtp_password'",
|
|
"'microsoft_shared_client_secret'",
|
|
"'email'",
|
|
"'to_email'",
|
|
] as $needle) {
|
|
self::assertStringContainsString($needle, $content);
|
|
}
|
|
|
|
self::assertStringContainsString("return str_contains(\$key, 'password')", $content);
|
|
self::assertStringContainsString("|| str_contains(\$key, 'secret')", $content);
|
|
self::assertStringContainsString("|| str_contains(\$key, 'token')", $content);
|
|
self::assertStringContainsString("|| str_contains(\$key, 'authorization')", $content);
|
|
self::assertStringContainsString("|| str_ends_with(\$key, '_key');", $content);
|
|
}
|
|
|
|
public function testApiAuditRedactionCoversCredentialsAndAuthorizationFields(): void
|
|
{
|
|
$content = $this->readProjectFile('modules/audit/lib/Module/Audit/Service/ApiAuditService.php');
|
|
|
|
foreach ([
|
|
"'token'",
|
|
"'access_token'",
|
|
"'refresh_token'",
|
|
"'id_token'",
|
|
"'secret'",
|
|
"'password'",
|
|
"'authorization'",
|
|
"'api_key'",
|
|
"'client_secret'",
|
|
"'key'",
|
|
] as $needle) {
|
|
self::assertStringContainsString($needle, $content);
|
|
}
|
|
|
|
self::assertStringContainsString("return str_contains(\$key, 'token')", $content);
|
|
self::assertStringContainsString("|| str_contains(\$key, 'secret')", $content);
|
|
self::assertStringContainsString("|| str_contains(\$key, 'password')", $content);
|
|
self::assertStringContainsString("|| str_contains(\$key, 'authorization')", $content);
|
|
self::assertStringContainsString("|| str_ends_with(\$key, '_key');", $content);
|
|
}
|
|
}
|