lyra
2064153cd3
Tests / test (pull_request) Successful in 1m10s
Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).
PHP toolchain (§1)
- require.php >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
constraint also permitted PHP 9, which is not a promise we can keep.
composer.lock regenerated with --lock: content-hash + platform-overrides
only, zero dependency version movement.
- friendsofphp/php-cs-fixer * -> ^3.95. A wildcard meant CI was not
reproducible.
PHPStan (§2.2)
- vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
187 errors are captured rather than fixed; the baseline should only shrink
from here.
- add phpstan/phpstan:^2.1 to require-dev.
Code style (§8.2)
- vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
declare_strict_types) and apply it: 59 of 67 files reformatted.
- Verified this is a formatting change, not a behaviour change: all 313 tests
pass after the reformat, all in_array() calls already passed strict=true,
and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
self:: over the class name).
Repository layout (§4.4)
- docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
example.env becoming the conventional .env.example. This is the layout
GUIDING-LIGHT already cites preauth as doing correctly — it just needed
renaming.
- update the four readme.md references and a stale compose.yaml comment.
- docs/v1.1-plan.md references are left alone deliberately: it is a historical
plan recording what was done at the time, not live documentation.
Licence and security policy (§7)
- add LICENSE (uniform MIT, matching composer.json).
- add SECURITY.md describing the actual threat model: per-request
allow/intercept, no caching of the login flow, app-set security headers,
TOTP, and the fact that REMOTE_USER is trusted input.
Mobile accessibility (§3.3a)
- templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
preauth was the one app already past the font-size precondition (controls
render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
restores pinch-zoom for Android users.
Conformance tooling (§8.2)
- vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
from a checkout rather than fetching from the LAN-only private/ci.
- .editorconfig synced from the version that keeps the Caddyfile tab rule.
Not included (blocked by the .gitea/workflows pre-receive hook):
- ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
Workflow files may only change via a trusted ref, so the caller files are
staged but not committed.
Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.
119 lines
4.2 KiB
PHP
119 lines
4.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Unit\Trait;
|
|
|
|
use App\Tests\Support\TotpTestHelper;
|
|
use App\Trait\StringTrait;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class StringTraitTest extends TestCase
|
|
{
|
|
use StringTrait;
|
|
use TotpTestHelper;
|
|
|
|
public function test_make_cache_key_sanitizes_invalid_chars(): void
|
|
{
|
|
self::assertSame('hello_world', $this->makeCacheKey('hello world'));
|
|
self::assertSame('hello_world', $this->makeCacheKey('hello!world'));
|
|
self::assertSame('a_b_c_d', $this->makeCacheKey('a/b@c#d'));
|
|
}
|
|
|
|
public function test_make_cache_key_preserves_valid_chars(): void
|
|
{
|
|
self::assertSame('ABC_123.abc', $this->makeCacheKey('ABC_123.abc'));
|
|
}
|
|
|
|
public function test_make_cache_key_truncates_long_names(): void
|
|
{
|
|
$long = str_repeat('a', 300);
|
|
$result = $this->makeCacheKey($long);
|
|
self::assertSame(128, mb_strlen($result));
|
|
}
|
|
|
|
public function test_make_cache_key_empty_string(): void
|
|
{
|
|
self::assertSame('', $this->makeCacheKey(''));
|
|
}
|
|
|
|
public function test_make_cache_key_with_only_invalid_chars(): void
|
|
{
|
|
// preg_replace with + collapses consecutive invalid chars into one _
|
|
self::assertSame('_', $this->makeCacheKey('!!!'));
|
|
self::assertSame('_', $this->makeCacheKey(' '));
|
|
self::assertSame('_', $this->makeCacheKey('!@#'));
|
|
self::assertSame('_', $this->makeCacheKey('!@ #'));
|
|
}
|
|
|
|
public function test_make_cache_key_truncates_to_exactly128(): void
|
|
{
|
|
$input = str_repeat('a', 128);
|
|
self::assertSame(128, mb_strlen($this->makeCacheKey($input)));
|
|
self::assertSame($input, $this->makeCacheKey($input));
|
|
|
|
$input129 = str_repeat('a', 129);
|
|
self::assertSame(128, mb_strlen($this->makeCacheKey($input129)));
|
|
}
|
|
|
|
public function test_make_cache_key_with_multibyte_chars(): void
|
|
{
|
|
// multibyte chars are replaced with a single underscore
|
|
$result = $this->makeCacheKey('héllo wörld');
|
|
// é and ö are not in [A-Za-z0-9_.] so they become _
|
|
self::assertSame('h_llo_w_rld', $result);
|
|
}
|
|
|
|
public function test_make_cache_key_with_emoji(): void
|
|
{
|
|
$result = $this->makeCacheKey('a🎉b');
|
|
self::assertSame('a_b', $result);
|
|
}
|
|
|
|
/* ── authSuccessResponse ──────────────────────────────────────────── */
|
|
|
|
public function test_auth_success_response_session_mode(): void
|
|
{
|
|
$config = $this->makeConfig(remoteUserMode: 'session');
|
|
$response = $this->authSuccessResponse('alice', $config);
|
|
|
|
self::assertSame('hi alice', $response->getContent());
|
|
self::assertSame('text/plain', $response->headers->get('Content-Type'));
|
|
self::assertSame('alice', $response->headers->get('Remote-User'));
|
|
}
|
|
|
|
public function test_auth_success_response_static_mode(): void
|
|
{
|
|
$config = $this->makeConfig(remoteUserMode: 'static', remoteUserStatic: 'authenticated');
|
|
$response = $this->authSuccessResponse('alice', $config);
|
|
|
|
self::assertSame('hi alice', $response->getContent());
|
|
self::assertSame('authenticated', $response->headers->get('Remote-User'));
|
|
}
|
|
|
|
public function test_auth_success_response_mapped_mode(): void
|
|
{
|
|
$config = $this->makeConfig(remoteUserMode: 'mapped', remoteUserMap: 'alice:admin');
|
|
$response = $this->authSuccessResponse('alice', $config);
|
|
|
|
self::assertSame('admin', $response->headers->get('Remote-User'));
|
|
}
|
|
|
|
public function test_auth_success_response_mapped_mode_fallback(): void
|
|
{
|
|
$config = $this->makeConfig(remoteUserMode: 'mapped', remoteUserMap: 'alice:admin');
|
|
$response = $this->authSuccessResponse('unknown', $config);
|
|
|
|
self::assertSame('unknown', $response->headers->get('Remote-User'));
|
|
}
|
|
|
|
public function test_auth_success_response_none_mode_omits_header(): void
|
|
{
|
|
$config = $this->makeConfig(remoteUserMode: 'none');
|
|
$response = $this->authSuccessResponse('alice', $config);
|
|
|
|
self::assertSame('hi alice', $response->getContent());
|
|
self::assertFalse($response->headers->has('Remote-User'));
|
|
}
|
|
}
|