lyra
108e9623e6
Groundwork for passkey authentication, with the feature switched off by default and no behaviour change when it is off. Decision D1: passkeys require central authentication. A passkey is scoped to a relying party spanning the base domain, which only exists when SUBDOMAIN_REDIRECT is on and AUTH_SUBDOMAIN resolves to a base domain. The RP ID is therefore always that base domain, never the request host. Decision D4: HTTPS is required and is not exemptible. The allowed origin is built as https://{authSubdomain} from configuration and never from the request, so an http:// origin cannot be accepted, and isAvailableFor() additionally refuses to offer the UI on a non-secure connection. The deprecated setSecuredRelyingPartyId() escape hatch is not used and there is deliberately no override that could reintroduce one. Enabling PASSKEY_ENABLED without a usable configuration is a hard error via a non-optional cache warmer, because entrypoint.sh runs cache:warmup on every production boot: a misconfigured deployment fails to start instead of offering a button that cannot work. Also drops 12 obsolete phpstan-baseline entries for TotpTestHelper: adding #[\Override] to its anonymous clock removed the rule violation at its source rather than suppressing it. Suite: 333 tests / 770 assertions (was 313 / 738), 100% coverage on new files. phpstan level 6 clean, php-cs-fixer clean, conformance 35/35.
58 lines
2.2 KiB
XML
58 lines
2.2 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
|
|
<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
|
|
colors="true"
|
|
failOnDeprecation="true"
|
|
failOnNotice="true"
|
|
failOnWarning="true"
|
|
bootstrap="tests/bootstrap.php"
|
|
cacheDirectory=".phpunit.cache"
|
|
>
|
|
<php>
|
|
<ini name="display_errors" value="1" />
|
|
<ini name="error_reporting" value="-1" />
|
|
<server name="APP_ENV" value="test" force="true" />
|
|
<server name="SHELL_VERBOSITY" value="-1" />
|
|
<server name="KERNEL_CLASS" value="App\Tests\TestKernel" />
|
|
<!-- fixed TOTP secret so functional tests can compute valid codes -->
|
|
<server name="TOTP_URI" value="otpauth://totp/Test-TOTP?secret=JBSWY3DPEHPK3PXP" />
|
|
<server name="APP_SECRET" value="test_secret_key_change_me" />
|
|
<!-- high rate limits so functional tests don't get blocked -->
|
|
<server name="BURST_COUNT" value="10000" />
|
|
<server name="UPPER_COUNT" value="10000" />
|
|
<!-- public access: enable for functional tests with low limits -->
|
|
<server name="PUBLIC_PATHS" value="/public/**" />
|
|
<server name="PUBLIC_BURST_COUNT" value="3" />
|
|
<server name="PUBLIC_BURST_TIME" value="60" />
|
|
<server name="PUBLIC_UPPER_COUNT" value="10000" />
|
|
<server name="PUBLIC_UPPER_TIME" value="3600" />
|
|
</php>
|
|
|
|
<testsuites>
|
|
<testsuite name="Project Test Suite">
|
|
<directory>tests</directory>
|
|
</testsuite>
|
|
</testsuites>
|
|
|
|
<source ignoreSuppressionOfDeprecations="true"
|
|
ignoreIndirectDeprecations="true"
|
|
restrictNotices="true"
|
|
restrictWarnings="true"
|
|
>
|
|
<include>
|
|
<directory>src</directory>
|
|
</include>
|
|
|
|
<deprecationTrigger>
|
|
<method>Doctrine\Deprecations\Deprecation::trigger</method>
|
|
<method>Doctrine\Deprecations\Deprecation::delegateTriggerToBackend</method>
|
|
<function>trigger_deprecation</function>
|
|
</deprecationTrigger>
|
|
</source>
|
|
|
|
<extensions>
|
|
</extensions>
|
|
</phpunit>
|