lyra
2064153cd3
Tests / test (pull_request) Successful in 1m10s
Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).
PHP toolchain (§1)
- require.php >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
constraint also permitted PHP 9, which is not a promise we can keep.
composer.lock regenerated with --lock: content-hash + platform-overrides
only, zero dependency version movement.
- friendsofphp/php-cs-fixer * -> ^3.95. A wildcard meant CI was not
reproducible.
PHPStan (§2.2)
- vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
187 errors are captured rather than fixed; the baseline should only shrink
from here.
- add phpstan/phpstan:^2.1 to require-dev.
Code style (§8.2)
- vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
declare_strict_types) and apply it: 59 of 67 files reformatted.
- Verified this is a formatting change, not a behaviour change: all 313 tests
pass after the reformat, all in_array() calls already passed strict=true,
and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
self:: over the class name).
Repository layout (§4.4)
- docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
example.env becoming the conventional .env.example. This is the layout
GUIDING-LIGHT already cites preauth as doing correctly — it just needed
renaming.
- update the four readme.md references and a stale compose.yaml comment.
- docs/v1.1-plan.md references are left alone deliberately: it is a historical
plan recording what was done at the time, not live documentation.
Licence and security policy (§7)
- add LICENSE (uniform MIT, matching composer.json).
- add SECURITY.md describing the actual threat model: per-request
allow/intercept, no caching of the login flow, app-set security headers,
TOTP, and the fact that REMOTE_USER is trusted input.
Mobile accessibility (§3.3a)
- templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
preauth was the one app already past the font-size precondition (controls
render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
restores pinch-zoom for Android users.
Conformance tooling (§8.2)
- vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
from a checkout rather than fetching from the LAN-only private/ci.
- .editorconfig synced from the version that keeps the Caddyfile tab rule.
Not included (blocked by the .gitea/workflows pre-receive hook):
- ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
Workflow files may only change via a trusted ref, so the caller files are
staged but not committed.
Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.
261 lines
11 KiB
PHP
261 lines
11 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Unit\Service;
|
|
|
|
use App\Service\PublicPathMatcher;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
/**
|
|
* Unit tests for PublicPathMatcher — path pattern parsing and matching.
|
|
*
|
|
* @covers \App\Service\PublicPathMatcher
|
|
*/
|
|
final class PublicPathMatcherTest extends TestCase
|
|
{
|
|
/* ── empty / disabled ──────────────────────────────────────────────── */
|
|
|
|
public function test_empty_string_results_in_no_patterns(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('');
|
|
self::assertTrue($matcher->isEmpty());
|
|
self::assertFalse($matcher->matches('example.com', '/public'));
|
|
}
|
|
|
|
public function test_whitespace_only_string_results_in_no_patterns(): void
|
|
{
|
|
$matcher = new PublicPathMatcher(' ');
|
|
self::assertTrue($matcher->isEmpty());
|
|
}
|
|
|
|
/* ── exact path matching ───────────────────────────────────────────── */
|
|
|
|
public function test_exact_path_match(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public');
|
|
self::assertTrue($matcher->matches('example.com', '/public'));
|
|
}
|
|
|
|
public function test_exact_path_does_not_match_subpath(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public');
|
|
self::assertFalse($matcher->matches('example.com', '/public/'));
|
|
self::assertFalse($matcher->matches('example.com', '/public/repo'));
|
|
}
|
|
|
|
public function test_exact_path_does_not_match_different_path(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public');
|
|
self::assertFalse($matcher->matches('example.com', '/private'));
|
|
self::assertFalse($matcher->matches('example.com', '/'));
|
|
}
|
|
|
|
/* ── single wildcard * ─────────────────────────────────────────────── */
|
|
|
|
public function test_single_wildcard_matches_one_segment(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/*');
|
|
self::assertTrue($matcher->matches('example.com', '/public/repo'));
|
|
self::assertTrue($matcher->matches('example.com', '/public/xyz'));
|
|
}
|
|
|
|
public function test_single_wildcard_does_not_match_base_path(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/*');
|
|
self::assertFalse($matcher->matches('example.com', '/public'));
|
|
}
|
|
|
|
public function test_single_wildcard_does_not_cross_segments(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/*');
|
|
self::assertFalse($matcher->matches('example.com', '/public/a/b'));
|
|
}
|
|
|
|
public function test_single_wildcard_does_not_match_empty_segment(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/*');
|
|
self::assertFalse($matcher->matches('example.com', '/public/'));
|
|
}
|
|
|
|
/* ── double wildcard ** ────────────────────────────────────────────── */
|
|
|
|
public function test_double_wildcard_matches_multiple_segments(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/**');
|
|
self::assertTrue($matcher->matches('example.com', '/public/a'));
|
|
self::assertTrue($matcher->matches('example.com', '/public/a/b/c'));
|
|
}
|
|
|
|
public function test_double_wildcard_does_not_match_base_path(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/**');
|
|
self::assertFalse($matcher->matches('example.com', '/public'));
|
|
}
|
|
|
|
public function test_double_wildcard_matches_trailing_slash(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/**');
|
|
self::assertTrue($matcher->matches('example.com', '/public/'));
|
|
}
|
|
|
|
/* ── mid-path wildcards ────────────────────────────────────────────── */
|
|
|
|
public function test_mid_path_single_wildcard(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/api/*/status');
|
|
self::assertTrue($matcher->matches('example.com', '/api/v1/status'));
|
|
self::assertTrue($matcher->matches('example.com', '/api/v2/status'));
|
|
self::assertFalse($matcher->matches('example.com', '/api/v1/v2/status'));
|
|
self::assertFalse($matcher->matches('example.com', '/api/status'));
|
|
}
|
|
|
|
public function test_mid_path_double_wildcard(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/api/**/status');
|
|
self::assertTrue($matcher->matches('example.com', '/api/v1/status'));
|
|
self::assertTrue($matcher->matches('example.com', '/api/v1/v2/status'));
|
|
self::assertTrue($matcher->matches('example.com', '/api/status'));
|
|
}
|
|
|
|
/* ── multiple patterns ─────────────────────────────────────────────── */
|
|
|
|
public function test_multiple_patterns_comma_separated(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/**,/api/status,/health');
|
|
self::assertTrue($matcher->matches('example.com', '/public/repo'));
|
|
self::assertTrue($matcher->matches('example.com', '/api/status'));
|
|
self::assertTrue($matcher->matches('example.com', '/health'));
|
|
self::assertFalse($matcher->matches('example.com', '/private'));
|
|
}
|
|
|
|
public function test_multiple_patterns_with_whitespace(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/**, /api/status, /health');
|
|
self::assertTrue($matcher->matches('example.com', '/public/repo'));
|
|
self::assertTrue($matcher->matches('example.com', '/api/status'));
|
|
self::assertTrue($matcher->matches('example.com', '/health'));
|
|
}
|
|
|
|
public function test_empty_segments_in_comma_list_are_ignored(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public,,/health,');
|
|
self::assertFalse($matcher->isEmpty());
|
|
self::assertTrue($matcher->matches('example.com', '/public'));
|
|
self::assertTrue($matcher->matches('example.com', '/health'));
|
|
}
|
|
|
|
/* ── domain-prefixed patterns ──────────────────────────────────────── */
|
|
|
|
public function test_domain_prefixed_pattern_matches_on_that_host(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('code.example.com/public/**');
|
|
self::assertTrue($matcher->matches('code.example.com', '/public/repo'));
|
|
}
|
|
|
|
public function test_domain_prefixed_pattern_does_not_match_other_host(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('code.example.com/public/**');
|
|
self::assertFalse($matcher->matches('other.example.com', '/public/repo'));
|
|
self::assertFalse($matcher->matches('example.com', '/public/repo'));
|
|
}
|
|
|
|
public function test_path_without_domain_prefix_matches_any_host(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/public/**');
|
|
self::assertTrue($matcher->matches('code.example.com', '/public/repo'));
|
|
self::assertTrue($matcher->matches('other.example.com', '/public/repo'));
|
|
self::assertTrue($matcher->matches('localhost', '/public/repo'));
|
|
}
|
|
|
|
public function test_mixed_domain_prefixed_and_plain_patterns(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/health,code.example.com/public/**');
|
|
self::assertTrue($matcher->matches('any.host', '/health'));
|
|
self::assertTrue($matcher->matches('code.example.com', '/public/repo'));
|
|
self::assertFalse($matcher->matches('other.host', '/public/repo'));
|
|
}
|
|
|
|
public function test_domain_prefixed_root_path_matches_root(): void
|
|
{
|
|
// host/ — the trailing slash is the entire path, nothing after it
|
|
$matcher = new PublicPathMatcher('code.example.com/');
|
|
self::assertTrue($matcher->matches('code.example.com', '/'));
|
|
self::assertFalse($matcher->matches('code.example.com', '/public'));
|
|
self::assertFalse($matcher->matches('other.example.com', '/'));
|
|
}
|
|
|
|
public function test_domain_prefixed_root_with_other_patterns(): void
|
|
{
|
|
// The exact scenario from the bug report
|
|
$matcher = new PublicPathMatcher('code.example.com/,code.example.com/public/**');
|
|
self::assertTrue($matcher->matches('code.example.com', '/'));
|
|
self::assertTrue($matcher->matches('code.example.com', '/public/repo'));
|
|
self::assertFalse($matcher->matches('code.example.com', '/private'));
|
|
self::assertFalse($matcher->matches('other.example.com', '/'));
|
|
}
|
|
|
|
public function test_domain_prefix_is_case_insensitive(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('Code.Example.COM/public/**');
|
|
self::assertTrue($matcher->matches('code.example.com', '/public/repo'));
|
|
self::assertTrue($matcher->matches('CODE.EXAMPLE.COM', '/public/repo'));
|
|
}
|
|
|
|
/* ── invalid patterns ──────────────────────────────────────────────── */
|
|
|
|
public function test_pattern_without_leading_slash_is_ignored(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('public');
|
|
self::assertTrue($matcher->isEmpty());
|
|
}
|
|
|
|
public function test_invalid_pattern_among_valid_ones_is_ignored(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('invalid,/public');
|
|
self::assertFalse($matcher->isEmpty());
|
|
self::assertTrue($matcher->matches('example.com', '/public'));
|
|
}
|
|
|
|
/* ── special regex characters in paths ─────────────────────────────── */
|
|
|
|
public function test_special_regex_characters_are_escaped(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/path.with.dots');
|
|
self::assertTrue($matcher->matches('example.com', '/path.with.dots'));
|
|
self::assertFalse($matcher->matches('example.com', '/pathXwithXdots'));
|
|
}
|
|
|
|
public function test_plus_character_is_literal(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/a+b');
|
|
self::assertTrue($matcher->matches('example.com', '/a+b'));
|
|
self::assertFalse($matcher->matches('example.com', '/aaab'));
|
|
}
|
|
|
|
/* ── root path ─────────────────────────────────────────────────────── */
|
|
|
|
public function test_root_path_match(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/');
|
|
self::assertTrue($matcher->matches('example.com', '/'));
|
|
self::assertFalse($matcher->matches('example.com', '/anything'));
|
|
}
|
|
|
|
public function test_wildcard_at_root(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/*');
|
|
self::assertTrue($matcher->matches('example.com', '/anything'));
|
|
self::assertFalse($matcher->matches('example.com', '/a/b'));
|
|
self::assertFalse($matcher->matches('example.com', '/'));
|
|
}
|
|
|
|
public function test_double_wildcard_at_root(): void
|
|
{
|
|
$matcher = new PublicPathMatcher('/**');
|
|
self::assertTrue($matcher->matches('example.com', '/'));
|
|
self::assertTrue($matcher->matches('example.com', '/anything'));
|
|
self::assertTrue($matcher->matches('example.com', '/a/b/c'));
|
|
}
|
|
}
|