5835be0e66
Implemente mlt.md section 12 : AUTHENTICATE_USER (12.1), LOGOUT_USER (12.2), RESET_PASSWORD (12.3). Sessions PHP + argon2id, regeneration d'ID a la connexion, idle 4h / absolu 10h via SessionGuard (cable en P3), jeton CSRF synchroniseur, backoff degressif anti brute-force par compte et par IP source (login_throttle), audit_log append-only (login_success/failed, password_reset), defenses anti-enumeration d'email (timing + profil d'ecritures identique), fail-closed sur erreur base. Vues login/forgot/reset rendues serveur. Routes posees sur le vhost admin (pas de prefixe /admin : docroot = public/admin). PHPUnit sans Composer (unit + integration DB auto-skippee sans base) et PHPStan L6 restent verts.
30 lines
1.1 KiB
XML
30 lines
1.1 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
Configuration PHPUnit sans Composer : le bootstrap charge l'autoloader manuel
|
|
du Core (PSR-4 maison). Lance via le .phar autonome (php phpunit.phar -c phpunit.xml),
|
|
conformement a la stack lockee (PROJECT_CONTEXT.md section 6 : tests via .phar).
|
|
-->
|
|
<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/11.5/phpunit.xsd"
|
|
bootstrap="tests/bootstrap.php"
|
|
colors="true"
|
|
failOnRisky="true"
|
|
failOnWarning="true"
|
|
beStrictAboutOutputDuringTests="true"
|
|
beStrictAboutTestsThatDoNotTestAnything="true"
|
|
cacheDirectory=".phpunit.cache">
|
|
<testsuites>
|
|
<testsuite name="unit">
|
|
<directory>tests/Unit</directory>
|
|
</testsuite>
|
|
<!-- Tests d'integration DB : auto-skip si WAKDO_DB_TESTS != 1 (CI sans base). -->
|
|
<testsuite name="integration">
|
|
<directory>tests/Integration</directory>
|
|
</testsuite>
|
|
</testsuites>
|
|
<source>
|
|
<include>
|
|
<directory>src</directory>
|
|
</include>
|
|
</source>
|
|
</phpunit>
|