Josep Piguillem
5b46436641
Revisions now call publishing only what publishes: a project's status is whether the work is active, and a service is published by its flag. The fake identity server answers by token, so a test can sign in a second person. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
122 lines
3.9 KiB
PHP
122 lines
3.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Http;
|
|
|
|
/**
|
|
* Fakes the Pireon identity server so tests exercise the real OAuth code paths
|
|
* without any network access.
|
|
*/
|
|
trait FakesPireon
|
|
{
|
|
protected string $pireonServer = 'https://oauth.pireon.test';
|
|
|
|
/**
|
|
* Identity payloads by bearer token, for every user a test has signed in
|
|
* through the API.
|
|
*
|
|
* @var array<string, array<string, mixed>>
|
|
*/
|
|
protected array $pireonIdentities = [];
|
|
|
|
/**
|
|
* @param array<string, mixed> $identity Overrides for the GET /api/user payload.
|
|
* @param array<string, mixed> $token Overrides for the POST /oauth/token payload.
|
|
*/
|
|
protected function fakePireon(array $identity = [], array $token = []): void
|
|
{
|
|
Http::fake([
|
|
"{$this->pireonServer}/oauth/token" => Http::response([
|
|
'access_token' => 'fake-access-token',
|
|
'refresh_token' => 'fake-refresh-token',
|
|
'token_type' => 'Bearer',
|
|
'expires_in' => 3600,
|
|
'scope' => 'account:read',
|
|
...$token,
|
|
]),
|
|
|
|
"{$this->pireonServer}/api/user" => Http::response([
|
|
'id' => 4242,
|
|
'name' => 'Ada Lovelace',
|
|
'email' => 'ada@example.com',
|
|
'is_active' => true,
|
|
'roles' => ['user'],
|
|
'app_roles' => ['admin'],
|
|
'approved_at' => '2026-01-01T00:00:00+00:00',
|
|
'created_at' => '2025-12-01T00:00:00+00:00',
|
|
...$identity,
|
|
]),
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Make the identity server reject whatever token it is handed.
|
|
*/
|
|
protected function fakePireonRejectingTokens(): void
|
|
{
|
|
Http::fake([
|
|
"{$this->pireonServer}/api/user" => Http::response(['message' => 'Unauthenticated.'], 401),
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* A local user holding the given roles, as if they had already signed in.
|
|
*
|
|
* @param array<int, string>|string $roles
|
|
*/
|
|
protected function userWithRoles(array|string $roles, array $attributes = []): User
|
|
{
|
|
$user = User::factory()->create($attributes);
|
|
$user->syncRoles((array) $roles);
|
|
|
|
return $user->fresh();
|
|
}
|
|
|
|
/**
|
|
* Authenticate API requests as $user by faking the upstream introspection
|
|
* call that the "api" guard performs.
|
|
*/
|
|
protected function apiHeadersFor(User $user): array
|
|
{
|
|
$token = 'token-for-'.$user->oauth_id;
|
|
|
|
// Answered by token rather than with one fixed payload: the first
|
|
// `Http::fake` for a URL wins, so a test that signs in a second person
|
|
// would otherwise keep being told it was the first.
|
|
if ($this->pireonIdentities === []) {
|
|
Http::fake([
|
|
"{$this->pireonServer}/api/user" => function ($request) {
|
|
$presented = str_replace('Bearer ', '', $request->header('Authorization')[0] ?? '');
|
|
|
|
return isset($this->pireonIdentities[$presented])
|
|
? Http::response($this->pireonIdentities[$presented])
|
|
: Http::response(['message' => 'Unauthenticated.'], 401);
|
|
},
|
|
]);
|
|
}
|
|
|
|
$this->pireonIdentities[$token] = [
|
|
'id' => $user->oauth_id,
|
|
'name' => $user->name,
|
|
'email' => $user->email,
|
|
'is_active' => true,
|
|
'roles' => ['user'],
|
|
'app_roles' => [],
|
|
'approved_at' => '2026-01-01T00:00:00+00:00',
|
|
];
|
|
|
|
// The guard remembers whoever it resolved last; a test that switches
|
|
// people halfway has to make it ask again.
|
|
$this->app['auth']->forgetGuards();
|
|
|
|
return [
|
|
'Authorization' => 'Bearer '.$token,
|
|
'Accept' => 'application/json',
|
|
];
|
|
}
|
|
}
|