Jeppe Bundgaard
b291e959e0
- Integrate WebAuthn library for passkey authentication workflows, including assertion verification and improved error handling. - Add support for reCAPTCHA token validation across multiple endpoints for enhanced security. - Extend OpenAPI schema to document new fields and restructured payloads. - Add unit tests for WebAuthn flows, permission initialization, and route validation to ensure robustness and accuracy.
94 lines
3.5 KiB
PHP
94 lines
3.5 KiB
PHP
<?php
|
|
// Lightweight bootstrap for CLI execution without full index.php
|
|
if (!defined('WD')) {
|
|
define('WD', __DIR__ . '/../../');
|
|
}
|
|
|
|
require_once WD . 'classes/selfserve.php';
|
|
require_once WD . 'modules/selfserve/classes/selfserve_lane.php';
|
|
require_once WD . 'modules/selfserve/helpers/selfserve_lane_relay.php';
|
|
require_once WD . 'modules/selfserve/traits/selfserve_lane_cache_t.php';
|
|
require_once WD . 'objects/department_selfserve_tasks_o.php';
|
|
|
|
use classes\selfserve;
|
|
use modules\selfserve\helpers\selfserve_lane_relay;
|
|
|
|
function ok($message): void { echo "\n\033[32m✔ $message\033[0m\n"; }
|
|
function warn($message): void { echo "\n\033[33m! $message\033[0m\n"; }
|
|
function fail($message): void { echo "\n\033[31m✖ $message\033[0m\n"; }
|
|
|
|
echo "\nSelfServeRelayGatingTest starting...\n";
|
|
|
|
$selfserve = new selfserve();
|
|
|
|
// Use lane 1 for test purposes (must exist in the test environment)
|
|
$laneId = 1;
|
|
$lane = $selfserve->lane($laneId);
|
|
|
|
// Clear allowed services first
|
|
try {
|
|
$lane->setLaneCache($laneId, $lane::CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES, []);
|
|
ok('Cleared allowed services for lane ' . $laneId);
|
|
} catch (Exception $e) {
|
|
fail('Failed to clear allowed services: ' . $e->getMessage());
|
|
}
|
|
|
|
// 1) When MACHINE is not allowed, turning on relay must be blocked by gating
|
|
$thrown = false;
|
|
try {
|
|
// This should throw due to gating (NOT ALLOWED)
|
|
$lane->turnOnRelay(selfserve_lane_relay::MACHINE, 1);
|
|
} catch (Exception $e) {
|
|
$thrown = true;
|
|
if (stripos($e->getMessage(), 'not allowed') !== false) {
|
|
ok('Gating prevented relay enable without allowed services (as expected)');
|
|
} else {
|
|
fail('Unexpected exception message when gating: ' . $e->getMessage());
|
|
}
|
|
}
|
|
if (!$thrown) {
|
|
fail('Expected gating exception when MACHINE is not allowed');
|
|
}
|
|
|
|
// 2) Set allowed services to include MACHINE
|
|
try {
|
|
$lane->setLaneCache($laneId, $lane::CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES, ['MACHINE']);
|
|
$allowed = $lane->getLaneCache($laneId, $lane::CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES);
|
|
if (is_array($allowed) && in_array('MACHINE', $allowed, true)) {
|
|
ok('Allowed services updated to include MACHINE');
|
|
} else {
|
|
fail('Allowed services not updated as expected');
|
|
}
|
|
} catch (Exception $e) {
|
|
fail('Failed to set allowed services: ' . $e->getMessage());
|
|
}
|
|
|
|
// 3) We do NOT actually enable the relay in tests to avoid hitting hardware.
|
|
// Instead, we assert that the gating check would pass by attempting the call
|
|
// and immediately catching any non-gating error (e.g., hardware/network),
|
|
// considering that a pass of the gating layer.
|
|
|
|
$passedGating = false;
|
|
try {
|
|
$lane->turnOnRelay(selfserve_lane_relay::MACHINE, 1);
|
|
// If no exception at all, then gating passed and hardware also succeeded (in test env). Count as pass.
|
|
$passedGating = true;
|
|
warn('Relay enable returned without exception. Assuming test environment allowed a real toggle.');
|
|
} catch (Exception $e) {
|
|
if (stripos($e->getMessage(), 'not allowed') !== false) {
|
|
fail('Gating still blocked enable even though MACHINE is allowed');
|
|
} else {
|
|
// Non-gating error indicates we passed gating and then failed on hardware/network as expected in tests
|
|
ok('Gating layer passed when MACHINE allowed (hardware/network error after gating is acceptable in tests)');
|
|
$passedGating = true;
|
|
}
|
|
}
|
|
|
|
if ($passedGating) {
|
|
ok('SelfServeRelayGatingTest completed successfully.');
|
|
} else {
|
|
fail('SelfServeRelayGatingTest did not pass gating as expected.');
|
|
}
|
|
|
|
echo "\nSelfServeRelayGatingTest finished.\n";
|