341 lines
10 KiB
PHP
341 lines
10 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Support;
|
|
|
|
use App\Core\DatabaseInterface;
|
|
use Throwable;
|
|
|
|
/**
|
|
* Double de test de DatabaseInterface : aucune connexion reelle. Les lectures
|
|
* sont scriptees par des "boutons" types (userRow, ipLockoutUntil,
|
|
* ipFailedAttempts), les ecritures sont enregistrees pour assertion, et les
|
|
* transactions tracent begin/commit/rollback. Permet de tester les branches de
|
|
* securite d'AuthService / PasswordResetService sans base de donnees.
|
|
*/
|
|
final class FakeDatabase implements DatabaseInterface
|
|
{
|
|
/**
|
|
* Reponse de la recherche utilisateur (RG-1) ; null = email inconnu.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $userRow = null;
|
|
|
|
/** lockout_until renvoye pour la porte de throttling IP ; null = pas de verrou. */
|
|
public ?string $ipLockoutUntil = null;
|
|
|
|
/**
|
|
* Compteur login_throttle relu apres l'upsert atomique (sert au calcul du
|
|
* backoff IP en PHP) ; null => 1 par defaut cote service.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $throttleRow = null;
|
|
|
|
/**
|
|
* Reponse de la recherche par token de reinitialisation (12.3) ; null = aucun.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $resetUserRow = null;
|
|
|
|
/**
|
|
* Reponse de la recherche par email (phase demande de reinitialisation) ; null = inconnu.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $emailLookupRow = null;
|
|
|
|
/**
|
|
* Reponse de la verification is_active du SessionGuard (RG-T02) ; null = absent.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $guardUserRow = null;
|
|
|
|
/** Resultat de Authorizer::can() (true = permission accordee). */
|
|
public bool $canResult = false;
|
|
|
|
/** Etat role.is_active modelise pour can()/permissionsFor() ; false => rien accorde. */
|
|
public bool $roleActive = true;
|
|
|
|
/**
|
|
* Trace des lectures (fetch/fetchAll) pour asserter les parametres lies
|
|
* (ex. liaison par code de permission, RG-T03), pendant que $writes trace les ecritures.
|
|
*
|
|
* @var list<array{sql: string, params: array<string|int, mixed>}>
|
|
*/
|
|
public array $reads = [];
|
|
|
|
/**
|
|
* Codes de permission renvoyes par Authorizer::permissionsFor().
|
|
*
|
|
* @var list<string>
|
|
*/
|
|
public array $permissionCodes = [];
|
|
|
|
/**
|
|
* Ligne role renvoyee pour la lecture du code de role (/api/me) ; null = absent.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $roleRow = null;
|
|
|
|
/**
|
|
* Ligne user renvoyee pour la verification du PIN (RG-T13) ; null = absent/inactif.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $pinUserRow = null;
|
|
|
|
/**
|
|
* Ligne renvoyee pour UserDirectory::displayInfo (nom + libelle role) ; null = absent.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $userDisplayRow = null;
|
|
|
|
/**
|
|
* Lignes renvoyees par CategoryRepository::all().
|
|
*
|
|
* @var list<array<string, mixed>>
|
|
*/
|
|
public array $categoriesRows = [];
|
|
|
|
/**
|
|
* Ligne renvoyee par CategoryRepository::find() ; null = introuvable.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $categoryRow = null;
|
|
|
|
/** Resultat de CategoryRepository::nameExists(). */
|
|
public bool $categoryNameTaken = false;
|
|
|
|
/** Resultat de CategoryRepository::slugExists(). */
|
|
public bool $categorySlugTaken = false;
|
|
|
|
/** Resultat de UserRepository::pinIsSet() (true = un PIN est defini). */
|
|
public bool $userPinSet = false;
|
|
|
|
/**
|
|
* Lignes renvoyees par ProductRepository::all().
|
|
*
|
|
* @var list<array<string, mixed>>
|
|
*/
|
|
public array $productsRows = [];
|
|
|
|
/**
|
|
* Ligne renvoyee par ProductRepository::find() ; null = introuvable.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $productRow = null;
|
|
|
|
/**
|
|
* Ligne renvoyee pour PinVerifier::resolveActingUser (id, role_id, pin_hash) ;
|
|
* null = email inconnu/inactif.
|
|
*
|
|
* @var array<string, mixed>|null
|
|
*/
|
|
public ?array $actingUserRow = null;
|
|
|
|
/**
|
|
* lockout_until renvoye pour la porte du throttle PIN (RG-T22, PinThrottle::isLocked) ;
|
|
* null = pas de verrou.
|
|
*/
|
|
public ?string $pinThrottleLockoutUntil = null;
|
|
|
|
/** Compteur pin_throttle relu apres l'upsert (PinThrottle::recordFailure) ; 1 par defaut. */
|
|
public int $pinThrottleAttempts = 1;
|
|
|
|
/** Si non nul, execute() leve cette exception (simulation panne DB / violation de contrainte). */
|
|
public ?Throwable $failOnExecute = null;
|
|
|
|
/** Nombre de lignes affectees renvoye par execute() (1 par defaut). */
|
|
public int $executeRowCount = 1;
|
|
|
|
/** @var list<array{sql: string, params: array<string|int, mixed>}> */
|
|
public array $writes = [];
|
|
|
|
/** @var list<string> */
|
|
public array $transactionEvents = [];
|
|
|
|
/**
|
|
* Journal ordonne entrelacant ecritures et bornes de transaction, pour
|
|
* verifier qu'une ecriture (ex. audit_log) tombe bien ENTRE begin et commit
|
|
* (atomicite RG-T08), ce que deux listes disjointes ne prouvent pas.
|
|
*
|
|
* @var list<string>
|
|
*/
|
|
public array $eventLog = [];
|
|
|
|
public function fetch(string $sql, array $params = []): ?array
|
|
{
|
|
$this->reads[] = ['sql' => $sql, 'params' => $params];
|
|
|
|
// Doit passer AVANT le lookup auth : la requete displayInfo contient aussi
|
|
// 'FROM user u JOIN role' mais selectionne 'AS role_label'.
|
|
if (str_contains($sql, 'AS role_label')) {
|
|
return $this->userDisplayRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM user u JOIN role')) {
|
|
return $this->userRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'password_reset_token_hash')) {
|
|
return $this->resetUserRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'SELECT id FROM user WHERE email')) {
|
|
return $this->emailLookupRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'SELECT is_active FROM user WHERE id')) {
|
|
return $this->guardUserRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'SELECT 1 AS granted FROM role_permission')) {
|
|
return ($this->canResult && $this->roleActive) ? ['granted' => 1] : null;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM role r WHERE r.id')) {
|
|
return $this->roleRow;
|
|
}
|
|
|
|
// Exige le predicat is_active = 1 : si la production le retirait, le double
|
|
// renverrait null et le test verify-true virerait au rouge (garde RG-T13).
|
|
if (str_contains($sql, 'SELECT pin_hash FROM user WHERE id') && str_contains($sql, 'is_active = 1')) {
|
|
return $this->pinUserRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM user WHERE id = :id AND pin_hash IS NOT NULL')) {
|
|
return $this->userPinSet ? ['id' => 1] : null;
|
|
}
|
|
|
|
// Exige is_active = 1 (garde RG-T13) : retirer le predicat en production
|
|
// ferait virer au rouge les tests de resolveActingUser.
|
|
if (str_contains($sql, 'pin_hash FROM user WHERE email') && str_contains($sql, 'is_active = 1')) {
|
|
return $this->actingUserRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM product WHERE id = :id')) {
|
|
return $this->productRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM category WHERE id = :id')) {
|
|
return $this->categoryRow;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM category WHERE name = :name')) {
|
|
return $this->categoryNameTaken ? ['id' => 1] : null;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM category WHERE slug = :slug')) {
|
|
return $this->categorySlugTaken ? ['id' => 1] : null;
|
|
}
|
|
|
|
if (str_contains($sql, 'lockout_until FROM pin_throttle')) {
|
|
return ['lockout_until' => $this->pinThrottleLockoutUntil];
|
|
}
|
|
|
|
if (str_contains($sql, 'failed_attempts FROM pin_throttle')) {
|
|
return ['failed_attempts' => $this->pinThrottleAttempts];
|
|
}
|
|
|
|
if (str_contains($sql, 'SELECT lockout_until FROM login_throttle')) {
|
|
return ['lockout_until' => $this->ipLockoutUntil];
|
|
}
|
|
|
|
if (str_contains($sql, 'SELECT failed_attempts FROM login_throttle')) {
|
|
return $this->throttleRow;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
public function fetchAll(string $sql, array $params = []): array
|
|
{
|
|
$this->reads[] = ['sql' => $sql, 'params' => $params];
|
|
|
|
if (str_contains($sql, 'FROM category ORDER BY')) {
|
|
return $this->categoriesRows;
|
|
}
|
|
|
|
if (str_contains($sql, 'FROM product p JOIN category')) {
|
|
return $this->productsRows;
|
|
}
|
|
|
|
if (str_contains($sql, 'SELECT p.code FROM role_permission')) {
|
|
if (!$this->roleActive) {
|
|
return [];
|
|
}
|
|
|
|
return array_map(static fn (string $code): array => ['code' => $code], $this->permissionCodes);
|
|
}
|
|
|
|
return [];
|
|
}
|
|
|
|
public function execute(string $sql, array $params = []): int
|
|
{
|
|
if ($this->failOnExecute !== null) {
|
|
throw $this->failOnExecute;
|
|
}
|
|
|
|
$this->writes[] = ['sql' => $sql, 'params' => $params];
|
|
$this->eventLog[] = 'write:' . substr($sql, 0, 24);
|
|
|
|
return $this->executeRowCount;
|
|
}
|
|
|
|
public function transaction(callable $fn): void
|
|
{
|
|
$this->transactionEvents[] = 'begin';
|
|
$this->eventLog[] = 'begin';
|
|
|
|
try {
|
|
$fn($this);
|
|
$this->transactionEvents[] = 'commit';
|
|
$this->eventLog[] = 'commit';
|
|
} catch (\Throwable $exception) {
|
|
$this->transactionEvents[] = 'rollback';
|
|
$this->eventLog[] = 'rollback';
|
|
|
|
throw $exception;
|
|
}
|
|
}
|
|
|
|
public function wrote(string $needle): bool
|
|
{
|
|
foreach ($this->writes as $write) {
|
|
if (str_contains($write['sql'], $needle)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Codes d'action audit_log inseres (dans l'ordre).
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
public function auditActions(): array
|
|
{
|
|
$codes = [];
|
|
|
|
foreach ($this->writes as $write) {
|
|
if (str_contains($write['sql'], 'INSERT INTO audit_log')) {
|
|
$code = $write['params']['code'] ?? null;
|
|
$codes[] = is_string($code) ? $code : '';
|
|
}
|
|
}
|
|
|
|
return $codes;
|
|
}
|
|
}
|