54 lines
1.7 KiB
PHP
54 lines
1.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests\Security;
|
|
|
|
use App\Security\Role;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class RoleTest extends TestCase
|
|
{
|
|
public function testBothEligibleRolesAreRecognised(): void
|
|
{
|
|
self::assertSame([Role::EMPLOYEE, Role::ADMIN], Role::eligibleOnly(['ROLE_ADMIN', 'ROLE_EMPLOYEE']));
|
|
}
|
|
|
|
public function testEitherRoleOnItsOwnIsEnough(): void
|
|
{
|
|
self::assertSame([Role::EMPLOYEE], Role::eligibleOnly(['ROLE_EMPLOYEE']));
|
|
self::assertSame([Role::ADMIN], Role::eligibleOnly(['ROLE_ADMIN']));
|
|
}
|
|
|
|
/**
|
|
* The whole point of the whitelist: myep knows roles this application assigns no meaning to,
|
|
* and an injected one must not become storable just because it was in the response.
|
|
*/
|
|
public function testRolesThisApplicationDoesNotKnowAreDropped(): void
|
|
{
|
|
$claimed = ['ROLE_TEAMER', 'ROLE_CUSTOMER', 'ROLE_HOUSE_MANAGER', 'ROLE_SUPER_ADMIN', 'ROLE_EMPLOYEE'];
|
|
|
|
self::assertSame([Role::EMPLOYEE], Role::eligibleOnly($claimed));
|
|
}
|
|
|
|
public function testAPendingMarkerDoesNotCountAsTheRole(): void
|
|
{
|
|
// myep strips these before exporting, but that is its policy and not our guarantee.
|
|
self::assertSame([], Role::eligibleOnly(['ROLE_ADMIN_PENDING']));
|
|
}
|
|
|
|
public function testTheOrderIsStableRegardlessOfWhatMyepSends(): void
|
|
{
|
|
self::assertSame(
|
|
Role::eligibleOnly(['ROLE_ADMIN', 'ROLE_EMPLOYEE']),
|
|
Role::eligibleOnly(['ROLE_EMPLOYEE', 'ROLE_ADMIN']),
|
|
);
|
|
}
|
|
|
|
public function testAnEmptyClaimYieldsNothing(): void
|
|
{
|
|
self::assertSame([], Role::eligibleOnly([]));
|
|
self::assertSame([], Role::eligibleOnly(['ROLE_USER']));
|
|
}
|
|
}
|