Jeppe B
1e0e051775
Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
70 lines
3.8 KiB
PHP
70 lines
3.8 KiB
PHP
<?php
|
|
|
|
function public_subuser_registration_method(): string
|
|
{
|
|
$code = (string)file_get_contents(app_path('routes/subusersRoute.php'));
|
|
$start = strpos($code, 'private function registerPublicSubuser(): void');
|
|
$end = strpos($code, 'public function run(): void', $start === false ? 0 : $start);
|
|
|
|
if ($start === false || $end === false || $end <= $start) {
|
|
throw new RuntimeException('Unable to locate the public subuser registration handler.');
|
|
}
|
|
|
|
return substr($code, $start, $end - $start);
|
|
}
|
|
|
|
it('routes both public driver registration aliases through one canonical handler', function (): void {
|
|
$code = (string)file_get_contents(app_path('routes/subusersRoute.php'));
|
|
$normalized = preg_replace('/\s+/', ' ', $code);
|
|
|
|
expect($normalized)->toContain("\$this->post('/subusers', function () { \$this->registerPublicSubuser(); });");
|
|
expect($normalized)->toContain("\$this->post('/subusers/me', function () { \$this->registerPublicSubuser(); });");
|
|
expect(substr_count($normalized, '$this->registerPublicSubuser();'))->toBe(2);
|
|
});
|
|
|
|
it('requires abuse controls and serializes idempotent driver registration writes', function (): void {
|
|
$method = preg_replace('/\s+/', ' ', public_subuser_registration_method());
|
|
|
|
expect($method)->toContain('$this->requireRecaptcha();');
|
|
expect($method)->toContain("'public_registration_ip'");
|
|
expect($method)->toContain("'public_registration_identity'");
|
|
expect($method)->toContain("3, 60 * 60, false");
|
|
expect($method)->toContain('SELECT GET_LOCK(?, 5)');
|
|
expect($method)->toContain('$db->conn->begin_transaction();');
|
|
expect($method)->toContain('$db->conn->commit();');
|
|
expect($method)->toContain('SELECT RELEASE_LOCK(?)');
|
|
expect(strpos($method, '$db->conn->commit();'))->toBeLessThan(strpos($method, '$this->issueSetupInvite($subuser);'));
|
|
expect($method)->toContain('$this->storePublicRegistrationPending($setupToken, $customerNumber);');
|
|
expect($method)->not->toContain('(new subuser_grants_o())->add(');
|
|
});
|
|
|
|
it('never returns setup credentials from either public driver registration alias', function (): void {
|
|
$method = public_subuser_registration_method();
|
|
|
|
expect($method)->not->toContain("'setup_link'");
|
|
expect($method)->toContain("'message' => 'If the driver can be registered, setup instructions have been sent.'");
|
|
expect($method)->not->toContain("'customer_number'");
|
|
expect($method)->not->toContain("'already_registered'");
|
|
|
|
$openApi = (string)file_get_contents(app_path('openapi.yaml'));
|
|
$start = strpos($openApi, ' /subusers/me:');
|
|
$end = strpos($openApi, ' /subusers/me/verification:', $start === false ? 0 : $start);
|
|
$operation = $start === false || $end === false ? '' : substr($openApi, $start, $end - $start);
|
|
expect($operation)->toContain('- g_recaptcha_response');
|
|
expect($operation)->not->toContain('setup_token:');
|
|
expect($operation)->not->toContain('setup_link:');
|
|
});
|
|
|
|
it('creates and notifies a company grant only after the SMS setup token is completed', function (): void {
|
|
$code = preg_replace('/\s+/', ' ', (string)file_get_contents(app_path('routes/subusersRoute.php')));
|
|
$setupStart = strpos($code, "\$this->post('/subusers/setup', function () {");
|
|
$setupEnd = strpos($code, "\$this->post('/subusers/password-reset/request'", $setupStart === false ? 0 : $setupStart);
|
|
$setup = $setupStart === false || $setupEnd === false ? '' : substr($code, $setupStart, $setupEnd - $setupStart);
|
|
|
|
expect($setup)->toContain('$this->getPublicRegistrationPending($token)');
|
|
expect($setup)->toContain('(new subuser_grants_o())->add(');
|
|
expect($setup)->toContain('$this->notifyCustomerOfGrantRequest(');
|
|
expect($setup)->toContain('$this->clearPublicRegistrationPending($token)');
|
|
expect(strpos($setup, '$subuser->update('))->toBeLessThan(strpos($setup, '(new subuser_grants_o())->add('));
|
|
});
|