Kevin Adametz
c7bd940f28
Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):
0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
Config-Block + .env.example. Fund: auth.basic.* war nie als Config
definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
(Unique-Index auf circle existiert bereits). CreditWalletService war
bereits abgesichert (Unique-Index + createOrFirst).
Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
2 KiB
PHP
59 lines
2 KiB
PHP
<?php
|
|
|
|
use App\Http\Middleware\BasicAuthMiddleware;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
beforeEach(function () {
|
|
config()->set('auth.basic.enabled', true);
|
|
config()->set('auth.basic.user', 'staging');
|
|
config()->set('auth.basic.password', 'secret');
|
|
});
|
|
|
|
function handleBasicAuth(Request $request): Response
|
|
{
|
|
return (new BasicAuthMiddleware)->handle($request, fn () => response('ok'));
|
|
}
|
|
|
|
test('rejects request without credentials', function () {
|
|
$response = handleBasicAuth(Request::create('/dashboard', 'GET'));
|
|
|
|
expect($response->getStatusCode())->toBe(401)
|
|
->and($response->headers->get('WWW-Authenticate'))->toBe('Basic');
|
|
});
|
|
|
|
test('rejects request with wrong password', function () {
|
|
$request = Request::create('/dashboard', 'GET', server: [
|
|
'PHP_AUTH_USER' => 'staging',
|
|
'PHP_AUTH_PW' => 'wrong',
|
|
]);
|
|
|
|
expect(handleBasicAuth($request)->getStatusCode())->toBe(401);
|
|
});
|
|
|
|
test('passes request with correct credentials', function () {
|
|
$request = Request::create('/dashboard', 'GET', server: [
|
|
'PHP_AUTH_USER' => 'staging',
|
|
'PHP_AUTH_PW' => 'secret',
|
|
]);
|
|
|
|
expect(handleBasicAuth($request)->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips gate entirely when disabled', function () {
|
|
config()->set('auth.basic.enabled', false);
|
|
|
|
expect(handleBasicAuth(Request::create('/dashboard', 'GET'))->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips gate when credentials are not configured', function () {
|
|
config()->set('auth.basic.user', null);
|
|
config()->set('auth.basic.password', null);
|
|
|
|
expect(handleBasicAuth(Request::create('/dashboard', 'GET'))->getStatusCode())->toBe(200);
|
|
});
|
|
|
|
test('skips basic auth for api and livewire routes', function () {
|
|
expect(handleBasicAuth(Request::create('/api/v1/press-releases', 'GET'))->getStatusCode())->toBe(200)
|
|
->and(handleBasicAuth(Request::create('/livewire/update', 'POST'))->getStatusCode())->toBe(200);
|
|
});
|