76 lines
4.1 KiB
PHP
76 lines
4.1 KiB
PHP
<?php
|
|
|
|
it('registers the superuser security endpoints and permissions', function (): void {
|
|
$content = file_get_contents(app_path('routes/superuserSecurityRoute.php'));
|
|
|
|
expect($content)->not->toBeFalse();
|
|
expect($content)->toContain('/superuser/system/security/summary');
|
|
expect($content)->toContain('/superuser/system/security/settings');
|
|
expect($content)->toContain('/superuser/system/security/firewall-rules');
|
|
expect($content)->toContain('/superuser/system/security/firewall-rules/{id}');
|
|
expect($content)->toContain('/superuser/system/security/incidents');
|
|
expect($content)->toContain('/superuser/system/security/incidents/{id}');
|
|
expect($content)->toContain('/superuser/system/security/incidents/{id}/notes');
|
|
expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_view')");
|
|
expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_settings_manage')");
|
|
expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_firewall_manage')");
|
|
expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_incidents_manage')");
|
|
expect($content)->toContain("'superuser_security_limits_exempt' => 'Exempt requests from observe-mode security limit incidents'");
|
|
});
|
|
|
|
it('keeps superuser security controls unavailable to subuser sessions', function (): void {
|
|
$content = file_get_contents(app_path('routes/superuserSecurityRoute.php'));
|
|
|
|
expect($content)->not->toBeFalse();
|
|
expect($content)->toContain('private function requireClassicSuperuserPermission(string $permission): bool');
|
|
expect($content)->toContain('get_subuser() !== false');
|
|
expect($content)->toContain("Subuser sessions cannot manage security controls.");
|
|
expect($content)->toContain('return $this->requirePermission($permission);');
|
|
expect($content)->not->toContain("requirePermission('superuser_security_");
|
|
});
|
|
|
|
it('wires request and domain event observation into the backend', function (): void {
|
|
$routeTrait = file_get_contents(app_path('traits/route_t.php'));
|
|
$authRoute = file_get_contents(app_path('routes/authRoute.php'));
|
|
$bookingRoute = file_get_contents(app_path('routes/orderBookingRoute.php'));
|
|
$vehiclesRoute = file_get_contents(app_path('routes/vehiclesRoute.php'));
|
|
|
|
expect($routeTrait)->toContain('security_policy_service');
|
|
expect($routeTrait)->toContain('inspectRequest($route, $method)');
|
|
expect($authRoute)->toContain('observeLoginFailure(');
|
|
expect($bookingRoute)->toContain('observeBookingCreated');
|
|
expect($vehiclesRoute)->toContain('observeVehicleCreated');
|
|
});
|
|
|
|
it('defines persistent security tables for runtime and api tests', function (): void {
|
|
$runtimeSchema = file_get_contents(app_path('classes/security_schema_bootstrap.php'));
|
|
$testSchema = file_get_contents(app_path('tests/Support/Api/ApiSchemaBootstrap.php'));
|
|
|
|
foreach ([
|
|
'security_firewall_rules',
|
|
'security_policy_rules',
|
|
'security_policy_events',
|
|
'security_incidents',
|
|
'security_incident_notes',
|
|
] as $table) {
|
|
expect($runtimeSchema)->toContain($table);
|
|
expect($testSchema)->toContain($table);
|
|
}
|
|
});
|
|
|
|
it('documents superuser security endpoints in openapi', function (): void {
|
|
$content = file_get_contents(app_path('openapi.yaml'));
|
|
|
|
expect($content)->not->toBeFalse();
|
|
expect($content)->toContain('/superuser/system/security/summary:');
|
|
expect($content)->toContain('/superuser/system/security/settings:');
|
|
expect($content)->toContain('/superuser/system/security/firewall-rules:');
|
|
expect($content)->toContain('/superuser/system/security/firewall-rules/{id}:');
|
|
expect($content)->toContain('/superuser/system/security/incidents:');
|
|
expect($content)->toContain('/superuser/system/security/incidents/{id}:');
|
|
expect($content)->toContain('/superuser/system/security/incidents/{id}/notes:');
|
|
expect($content)->toContain('SuperuserSecuritySettingsUpdateRequest');
|
|
expect($content)->toContain('SuperuserSecurityFirewallRuleMutation');
|
|
expect($content)->toContain('SuperuserSecurityIncidentResponse');
|
|
});
|