Files
preauth/tests/Unit/PersistCacheTest.php
T
lyra 2064153cd3
Tests / test (pull_request) Successful in 1m10s
chore: adopt shared Guiding Light configs and fix conformance gaps
Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).

PHP toolchain (§1)
  - require.php  >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
    constraint also permitted PHP 9, which is not a promise we can keep.
    composer.lock regenerated with --lock: content-hash + platform-overrides
    only, zero dependency version movement.
  - friendsofphp/php-cs-fixer  * -> ^3.95. A wildcard meant CI was not
    reproducible.

PHPStan (§2.2)
  - vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
    187 errors are captured rather than fixed; the baseline should only shrink
    from here.
  - add phpstan/phpstan:^2.1 to require-dev.

Code style (§8.2)
  - vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
    declare_strict_types) and apply it: 59 of 67 files reformatted.
  - Verified this is a formatting change, not a behaviour change: all 313 tests
    pass after the reformat, all in_array() calls already passed strict=true,
    and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
    self:: over the class name).

Repository layout (§4.4)
  - docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
    example.env becoming the conventional .env.example. This is the layout
    GUIDING-LIGHT already cites preauth as doing correctly — it just needed
    renaming.
  - update the four readme.md references and a stale compose.yaml comment.
  - docs/v1.1-plan.md references are left alone deliberately: it is a historical
    plan recording what was done at the time, not live documentation.

Licence and security policy (§7)
  - add LICENSE (uniform MIT, matching composer.json).
  - add SECURITY.md describing the actual threat model: per-request
    allow/intercept, no caching of the login flow, app-set security headers,
    TOTP, and the fact that REMOTE_USER is trusted input.

Mobile accessibility (§3.3a)
  - templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
    preauth was the one app already past the font-size precondition (controls
    render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
    restores pinch-zoom for Android users.

Conformance tooling (§8.2)
  - vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
    from a checkout rather than fetching from the LAN-only private/ci.
  - .editorconfig synced from the version that keeps the Caddyfile tab rule.

Not included (blocked by the .gitea/workflows pre-receive hook):
  - ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
    Workflow files may only change via a trusted ref, so the caller files are
    staged but not committed.

Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.
2026-09-23 20:13:45 +00:00

232 lines
8.3 KiB
PHP

<?php
declare(strict_types=1);
namespace App\Tests\Unit;
use App\MonitorCacheKeys;
use App\PersistCache;
use PHPUnit\Framework\TestCase;
use Symfony\Component\Cache\Adapter\ArrayAdapter;
final class PersistCacheTest extends TestCase
{
public function test_boot_with_empty_storage_is_noop(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
// nothing was loaded since storage is empty
$monitor = new MonitorCacheKeys($sessionCache);
self::assertSame([], $monitor->getKeys());
}
public function test_boot_loads_from_storage_into_cache(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
// populate storage with some session data
$storageMonitor = new MonitorCacheKeys($sessionStorage);
$item = $storageMonitor->getItem('cookie_abc');
$item->set('user1');
$storageMonitor->save($item);
$storageMonitor->markClean();
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
// session cache should now contain the loaded data
$cacheMonitor = new MonitorCacheKeys($sessionCache);
self::assertContains('cookie_abc', $cacheMonitor->getKeys());
self::assertSame('user1', $cacheMonitor->getItem('cookie_abc')->get());
// boot should mark clean so no changes are pending
self::assertSame([], $cacheMonitor->getChanges());
}
public function test_boot_does_not_reload_when_cache_already_warm(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
// warm up the cache with existing data
$cacheMonitor = new MonitorCacheKeys($sessionCache);
$item = $cacheMonitor->getItem('cookie_existing');
$item->set('old-user');
$cacheMonitor->save($item);
// put different data in storage
$storageMonitor = new MonitorCacheKeys($sessionStorage);
$item = $storageMonitor->getItem('cookie_new');
$item->set('new-user');
$storageMonitor->save($item);
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
// existing data should be preserved, storage data NOT loaded
$monitor = new MonitorCacheKeys($sessionCache);
self::assertContains('cookie_existing', $monitor->getKeys());
self::assertNotContains('cookie_new', $monitor->getKeys());
}
public function test_persist_writes_changes_to_storage(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
// write something to the session cache
$cacheMonitor = new MonitorCacheKeys($sessionCache);
$item = $cacheMonitor->getItem('cookie_xyz');
$item->set('user2');
$cacheMonitor->save($item);
$persist->persist();
// storage should now contain the change
$storageMonitor = new MonitorCacheKeys($sessionStorage);
self::assertContains('cookie_xyz', $storageMonitor->getKeys());
self::assertSame('user2', $storageMonitor->getItem('cookie_xyz')->get());
}
public function test_persist_handles_removals(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
// seed storage with an item
$storageMonitor = new MonitorCacheKeys($sessionStorage);
$item = $storageMonitor->getItem('cookie_to_remove');
$item->set('user3');
$storageMonitor->save($item);
$storageMonitor->markClean();
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
// now delete it from session cache
$cacheMonitor = new MonitorCacheKeys($sessionCache);
$cacheMonitor->deleteItem('cookie_to_remove');
$persist->persist();
// storage should no longer have it
$storageMonitor = new MonitorCacheKeys($sessionStorage);
self::assertNotContains('cookie_to_remove', $storageMonitor->getKeys());
}
public function test_persist_is_noop_when_no_changes(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
$persist->persist();
$storageMonitor = new MonitorCacheKeys($sessionStorage);
self::assertSame([], $storageMonitor->getKeys());
}
public function test_full_boot_modify_persist_cycle(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
// boot (empty), add data, persist
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
$cacheMonitor = new MonitorCacheKeys($sessionCache);
$item = $cacheMonitor->getItem('cookie_cycle');
$item->set('cycled-user');
$cacheMonitor->save($item);
$persist->persist();
// simulate a new request: fresh cache, same storage
$newCache = new ArrayAdapter();
$persist2 = new PersistCache($newCache, $sessionStorage);
$persist2->boot();
$monitor = new MonitorCacheKeys($newCache);
self::assertContains('cookie_cycle', $monitor->getKeys());
self::assertSame('cycled-user', $monitor->getItem('cookie_cycle')->get());
}
public function test_persist_handles_mixed_updates_and_removals(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
// seed storage with two items
$storageMonitor = new MonitorCacheKeys($sessionStorage);
$item1 = $storageMonitor->getItem('cookie_keep');
$item1->set('user-keep');
$storageMonitor->save($item1);
$item2 = $storageMonitor->getItem('cookie_remove');
$item2->set('user-remove');
$storageMonitor->save($item2);
$storageMonitor->markClean();
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
// update one item and delete the other in the same cycle
$cacheMonitor = new MonitorCacheKeys($sessionCache);
$item1 = $cacheMonitor->getItem('cookie_keep');
$item1->set('user-updated');
$cacheMonitor->save($item1);
$cacheMonitor->deleteItem('cookie_remove');
$persist->persist();
// storage should reflect both changes
$storageMonitor = new MonitorCacheKeys($sessionStorage);
self::assertContains('cookie_keep', $storageMonitor->getKeys());
self::assertSame('user-updated', $storageMonitor->getItem('cookie_keep')->get());
self::assertNotContains('cookie_remove', $storageMonitor->getKeys());
}
public function test_multiple_boot_modify_persist_cycles(): void
{
$sessionCache = new ArrayAdapter();
$sessionStorage = new ArrayAdapter();
// cycle 1: add item A
$persist = new PersistCache($sessionCache, $sessionStorage);
$persist->boot();
$cacheMonitor = new MonitorCacheKeys($sessionCache);
$item = $cacheMonitor->getItem('cookie_a');
$item->set('user-a');
$cacheMonitor->save($item);
$persist->persist();
// cycle 2: fresh cache, add item B, keep A from storage
$newCache = new ArrayAdapter();
$persist2 = new PersistCache($newCache, $sessionStorage);
$persist2->boot();
$cacheMonitor2 = new MonitorCacheKeys($newCache);
$item = $cacheMonitor2->getItem('cookie_b');
$item->set('user-b');
$cacheMonitor2->save($item);
$persist2->persist();
// cycle 3: fresh cache, both A and B should be loaded from storage
$newCache2 = new ArrayAdapter();
$persist3 = new PersistCache($newCache2, $sessionStorage);
$persist3->boot();
$monitor = new MonitorCacheKeys($newCache2);
self::assertContains('cookie_a', $monitor->getKeys());
self::assertSame('user-a', $monitor->getItem('cookie_a')->get());
self::assertContains('cookie_b', $monitor->getKeys());
self::assertSame('user-b', $monitor->getItem('cookie_b')->get());
}
}