678 lines
24 KiB
PHP
678 lines
24 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Api\Admin\Identity;
|
|
|
|
use App\Models\IdentityPolicy;
|
|
use App\Models\Role;
|
|
use App\Models\User;
|
|
use App\Services\IdentityPolicyService;
|
|
use Database\Seeders\RolePermissionSeeder;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* 관리자 — IDV 정책 CRUD (Service + HTTP 통합 테스트).
|
|
*
|
|
* Service 비즈니스 규칙 + HTTP 라우트 권한 가드 양쪽을 검증합니다.
|
|
*/
|
|
class AdminIdentityPolicyCrudTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private IdentityPolicyService $service;
|
|
|
|
private User $admin;
|
|
|
|
private string $token;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
$this->service = $this->app->make(IdentityPolicyService::class);
|
|
|
|
$this->seed(RolePermissionSeeder::class);
|
|
$this->admin = User::factory()->create(['is_super' => true]);
|
|
$adminRole = Role::where('identifier', 'admin')->first();
|
|
if ($adminRole) {
|
|
$this->admin->roles()->attach($adminRole->id, [
|
|
'assigned_at' => now(),
|
|
'assigned_by' => null,
|
|
]);
|
|
}
|
|
$this->admin = $this->admin->fresh();
|
|
$this->token = $this->admin->createToken('test-token')->plainTextToken;
|
|
}
|
|
|
|
/**
|
|
* 인증 헤더 헬퍼.
|
|
*/
|
|
private function authRequest(): static
|
|
{
|
|
return $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->token,
|
|
'Accept' => 'application/json',
|
|
]);
|
|
}
|
|
|
|
public function test_create_admin_policy_stores_with_admin_source(): void
|
|
{
|
|
$policy = $this->service->createAdminPolicy([
|
|
'key' => 'admin.new.policy',
|
|
'scope' => 'route',
|
|
'target' => 'api.some.route',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'enabled' => true,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
]);
|
|
|
|
$this->assertSame('admin', $policy->source_type->value);
|
|
$this->assertSame('admin.new.policy', $policy->key);
|
|
$this->assertDatabaseHas('identity_policies', [
|
|
'key' => 'admin.new.policy',
|
|
'source_type' => 'admin',
|
|
]);
|
|
}
|
|
|
|
public function test_update_policy_appends_user_overrides_for_non_admin_source(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'core.editable.policy',
|
|
'source_type' => 'core',
|
|
'source_identifier' => 'core',
|
|
'grace_minutes' => 0,
|
|
]));
|
|
|
|
// 관리자가 grace_minutes 만 수정 (제한 필드)
|
|
$this->service->updatePolicy($policy, ['grace_minutes' => 30]);
|
|
|
|
$policy->refresh();
|
|
$this->assertSame(30, $policy->grace_minutes);
|
|
$this->assertContains('grace_minutes', $policy->user_overrides ?? []);
|
|
}
|
|
|
|
public function test_update_admin_policy_applies_all_fields(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'admin.edit.policy',
|
|
'source_type' => 'admin',
|
|
'source_identifier' => 'admin',
|
|
]));
|
|
|
|
$this->service->updatePolicy($policy, ['grace_minutes' => 15, 'target' => 'api.new.target']);
|
|
|
|
$policy->refresh();
|
|
$this->assertSame(15, $policy->grace_minutes);
|
|
$this->assertSame('api.new.target', $policy->target);
|
|
// admin source 는 config 에 없으므로 user_overrides 기록이 stale cleanup 에 영향 없음 (정책상 무해)
|
|
}
|
|
|
|
public function test_delete_admin_policy_removes_row(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'admin.to.delete',
|
|
'source_type' => 'admin',
|
|
'source_identifier' => 'admin',
|
|
]));
|
|
|
|
$this->assertTrue($this->service->deleteAdminPolicy($policy));
|
|
$this->assertDatabaseMissing('identity_policies', ['key' => 'admin.to.delete']);
|
|
}
|
|
|
|
public function test_delete_core_policy_returns_false(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'core.protected.policy',
|
|
'source_type' => 'core',
|
|
'source_identifier' => 'core',
|
|
]));
|
|
|
|
$this->assertFalse($this->service->deleteAdminPolicy($policy));
|
|
$this->assertDatabaseHas('identity_policies', ['key' => 'core.protected.policy']);
|
|
}
|
|
|
|
public function test_search_paginates_policies(): void
|
|
{
|
|
for ($i = 1; $i <= 3; $i++) {
|
|
IdentityPolicy::create($this->makePolicyData(['key' => "search.item.{$i}"]));
|
|
}
|
|
|
|
$paginated = $this->service->search([], 10);
|
|
|
|
$this->assertGreaterThanOrEqual(3, $paginated->total());
|
|
}
|
|
|
|
public function test_search_orders_policies_by_most_recent_first(): void
|
|
{
|
|
$first = IdentityPolicy::create($this->makePolicyData(['key' => 'recent.order.first']));
|
|
$first->forceFill(['created_at' => now()->subMinutes(10)])->save();
|
|
|
|
$second = IdentityPolicy::create($this->makePolicyData(['key' => 'recent.order.second']));
|
|
$second->forceFill(['created_at' => now()->subMinutes(5)])->save();
|
|
|
|
$third = IdentityPolicy::create($this->makePolicyData(['key' => 'recent.order.third']));
|
|
$third->forceFill(['created_at' => now()])->save();
|
|
|
|
$paginated = $this->service->search([], 10);
|
|
$keys = collect($paginated->items())->pluck('key')->all();
|
|
|
|
$idxFirst = array_search('recent.order.first', $keys, true);
|
|
$idxSecond = array_search('recent.order.second', $keys, true);
|
|
$idxThird = array_search('recent.order.third', $keys, true);
|
|
|
|
$this->assertLessThan($idxSecond, $idxThird, '최근 생성된 정책이 더 앞에 위치해야 함');
|
|
$this->assertLessThan($idxFirst, $idxSecond, '최근 생성된 정책이 더 앞에 위치해야 함');
|
|
}
|
|
|
|
// ====================================================================
|
|
// HTTP E2E — 라우트 + permission 미들웨어 연결 검증
|
|
// ====================================================================
|
|
|
|
public function test_http_index_returns_paginated_policies(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData(['key' => 'http.idx.1']));
|
|
IdentityPolicy::create($this->makePolicyData(['key' => 'http.idx.2']));
|
|
|
|
$response = $this->authRequest()->getJson('/api/admin/identity/policies');
|
|
|
|
$response->assertStatus(200)
|
|
->assertJsonPath('success', true);
|
|
$this->assertGreaterThanOrEqual(2, count($response->json('data.data')));
|
|
}
|
|
|
|
public function test_http_store_creates_admin_policy(): void
|
|
{
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.store.policy',
|
|
'scope' => 'route',
|
|
'target' => 'api.http.some',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
]);
|
|
|
|
$response->assertStatus(201)
|
|
->assertJsonPath('data.source_type', 'admin')
|
|
->assertJsonPath('data.key', 'http.store.policy');
|
|
}
|
|
|
|
public function test_http_store_accepts_module_raw_identifier_as_source(): void
|
|
{
|
|
// 모듈 환경설정 탭에서 운영자가 추가하는 정책 — source_identifier 는 raw 모듈 식별자.
|
|
// 모듈/플러그인 sync 경로 및 목록 필터가 모두 raw identifier 컨벤션이므로 동일 형식 허용.
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.store.module.scoped',
|
|
'scope' => 'route',
|
|
'target' => 'api.shop.checkout',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
'source_identifier' => 'sirsoft-ecommerce',
|
|
]);
|
|
|
|
$response->assertStatus(201)
|
|
->assertJsonPath('data.source_identifier', 'sirsoft-ecommerce');
|
|
}
|
|
|
|
public function test_http_store_rejects_invalid_source_identifier_format(): void
|
|
{
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.store.invalid.source',
|
|
'scope' => 'route',
|
|
'target' => 'api.some.route',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
'source_identifier' => 'Invalid Source!',
|
|
]);
|
|
|
|
$response->assertStatus(422)
|
|
->assertJsonValidationErrors(['source_identifier']);
|
|
}
|
|
|
|
public function test_http_update_policy(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.update.policy',
|
|
'source_type' => 'admin',
|
|
'source_identifier' => 'admin',
|
|
]));
|
|
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$policy->id}", [
|
|
'grace_minutes' => 42,
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
$this->assertSame(42, $policy->fresh()->grace_minutes);
|
|
}
|
|
|
|
/**
|
|
* 모듈 선언 정책의 conditions 운영자 편집 — 297-groovy-pixel B안 리팩토링.
|
|
*
|
|
* 회원가입 단계(signup_stage) 등 정책 조건은 운영자가 화면에서 직접 변경할 수 있어야 하며,
|
|
* 변경 시 user_overrides 에 'conditions' 가 추가되어 모듈 재sync 시 운영자 값이 보존된다.
|
|
*/
|
|
public function test_http_update_module_policy_persists_conditions_change(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.module.signup_before_submit',
|
|
'source_type' => 'module',
|
|
'source_identifier' => 'sirsoft-board',
|
|
'purpose' => 'signup',
|
|
'scope' => 'route',
|
|
'target' => 'api.auth.register',
|
|
'conditions' => ['signup_stage' => 'before_submit'],
|
|
]));
|
|
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$policy->id}", [
|
|
'conditions' => ['signup_stage' => 'after_create'],
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$fresh = $policy->fresh();
|
|
$this->assertSame(['signup_stage' => 'after_create'], $fresh->conditions);
|
|
$this->assertContains('conditions', $fresh->user_overrides ?? []);
|
|
}
|
|
|
|
/**
|
|
* 모듈 선언 정책의 purpose(인증 목적) 운영자 편집.
|
|
*
|
|
* 인증 목적은 어떤 정책이든 운영자가 자유로이 부여할 수 있어야 한다.
|
|
* 변경 시 user_overrides 에 'purpose' 가 추가되어 모듈 재sync 시 운영자 값이 보존된다.
|
|
*/
|
|
public function test_http_update_module_policy_persists_purpose_change(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.module.purpose',
|
|
'source_type' => 'module',
|
|
'source_identifier' => 'sirsoft-board',
|
|
'purpose' => 'sensitive_action',
|
|
'scope' => 'hook',
|
|
'target' => 'sirsoft-board.post.before_create',
|
|
]));
|
|
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$policy->id}", [
|
|
'purpose' => 'inicis.adult_verification',
|
|
]);
|
|
|
|
$response->assertStatus(200)
|
|
->assertJsonPath('data.purpose', 'inicis.adult_verification');
|
|
|
|
$fresh = $policy->fresh();
|
|
$this->assertSame('inicis.adult_verification', $fresh->purpose);
|
|
$this->assertContains('purpose', $fresh->user_overrides ?? []);
|
|
}
|
|
|
|
/**
|
|
* 모듈 선언 정책의 applies_to(적용 대상) / priority 운영자 편집.
|
|
*
|
|
* 키/시점(scope)/위치(target) 외의 필드는 운영자가 자유로이 수정 가능.
|
|
*/
|
|
public function test_http_update_module_policy_persists_applies_to_and_priority(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.module.applies',
|
|
'source_type' => 'module',
|
|
'source_identifier' => 'sirsoft-board',
|
|
'applies_to' => 'both',
|
|
'priority' => 100,
|
|
]));
|
|
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$policy->id}", [
|
|
'applies_to' => 'self',
|
|
'priority' => 50,
|
|
]);
|
|
|
|
$response->assertStatus(200)
|
|
->assertJsonPath('data.applies_to', 'self')
|
|
->assertJsonPath('data.priority', 50);
|
|
|
|
$fresh = $policy->fresh();
|
|
$this->assertSame('self', $fresh->applies_to->value);
|
|
$this->assertSame(50, $fresh->priority);
|
|
$this->assertContains('applies_to', $fresh->user_overrides ?? []);
|
|
$this->assertContains('priority', $fresh->user_overrides ?? []);
|
|
}
|
|
|
|
/**
|
|
* 모듈 선언 정책의 key/scope/target 은 readonly — 훅 지점 식별자라 운영자 변경 불가.
|
|
*
|
|
* 이 3개 필드는 update 요청에 실려와도 Controller 화이트리스트에서 드롭되어 원래 값을 유지한다.
|
|
*/
|
|
public function test_http_update_module_policy_drops_key_scope_target(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.module.readonly',
|
|
'source_type' => 'module',
|
|
'source_identifier' => 'sirsoft-board',
|
|
'scope' => 'hook',
|
|
'target' => 'sirsoft-board.post.before_create',
|
|
]));
|
|
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$policy->id}", [
|
|
'key' => 'tampered.key',
|
|
'scope' => 'route',
|
|
'target' => 'tampered.target',
|
|
'grace_minutes' => 7,
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$fresh = $policy->fresh();
|
|
$this->assertSame('http.module.readonly', $fresh->key);
|
|
$this->assertSame('hook', $fresh->scope->value);
|
|
$this->assertSame('sirsoft-board.post.before_create', $fresh->target);
|
|
// 화이트리스트 필드는 정상 반영
|
|
$this->assertSame(7, $fresh->grace_minutes);
|
|
// readonly 필드는 user_overrides 에 기록되지 않음
|
|
$this->assertNotContains('key', $fresh->user_overrides ?? []);
|
|
$this->assertNotContains('scope', $fresh->user_overrides ?? []);
|
|
$this->assertNotContains('target', $fresh->user_overrides ?? []);
|
|
}
|
|
|
|
public function test_http_update_admin_policy_persists_conditions_change(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.admin.signup',
|
|
'source_type' => 'admin',
|
|
'source_identifier' => 'admin',
|
|
'purpose' => 'signup',
|
|
'conditions' => null,
|
|
]));
|
|
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$policy->id}", [
|
|
'conditions' => ['signup_stage' => 'after_create'],
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
$this->assertSame(['signup_stage' => 'after_create'], $policy->fresh()->conditions);
|
|
}
|
|
|
|
public function test_http_destroy_rejects_core_policy(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.core.protected',
|
|
'source_type' => 'core',
|
|
'source_identifier' => 'core',
|
|
]));
|
|
|
|
$response = $this->authRequest()->deleteJson("/api/admin/identity/policies/{$policy->id}");
|
|
|
|
$response->assertStatus(403);
|
|
}
|
|
|
|
public function test_http_destroy_deletes_admin_policy(): void
|
|
{
|
|
$policy = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.admin.delete',
|
|
'source_type' => 'admin',
|
|
'source_identifier' => 'admin',
|
|
]));
|
|
|
|
$response = $this->authRequest()->deleteJson("/api/admin/identity/policies/{$policy->id}");
|
|
|
|
$response->assertStatus(200);
|
|
$this->assertDatabaseMissing('identity_policies', ['key' => 'http.admin.delete']);
|
|
}
|
|
|
|
/**
|
|
* 정책 저장 — 필수 필드 누락 시 422 응답 + 필드별 errors 배열 + 한국어 attribute 메시지.
|
|
*
|
|
* 회귀 방지: 모달 저장 시 errors 객체가 비어 있거나 영어 메시지만 떨어지면
|
|
* 프런트의 "상단 에러 나열 / 필드별 테두리/문구" UI 가 동작하지 않는다.
|
|
*/
|
|
public function test_http_store_returns_422_with_field_errors_and_localized_messages(): void
|
|
{
|
|
app()->setLocale('ko');
|
|
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
// key/scope/target/purpose/grace_minutes/applies_to/fail_mode 모두 누락
|
|
]);
|
|
|
|
$response->assertStatus(422)
|
|
->assertJsonValidationErrors([
|
|
'key',
|
|
'scope',
|
|
'target',
|
|
'purpose',
|
|
'grace_minutes',
|
|
'applies_to',
|
|
'fail_mode',
|
|
]);
|
|
|
|
// 한국어 attribute 메시지 노출 확인 (예: "정책 키")
|
|
$errors = $response->json('errors');
|
|
$this->assertIsArray($errors);
|
|
$this->assertNotEmpty($errors['key'] ?? null);
|
|
$keyMessage = $errors['key'][0] ?? '';
|
|
$this->assertSame('정책 키를 입력해주세요.', $keyMessage);
|
|
}
|
|
|
|
/**
|
|
* 정책 저장 — 중복 key 는 422.
|
|
*/
|
|
public function test_http_store_returns_422_for_duplicate_key(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.dup.policy',
|
|
'source_type' => 'admin',
|
|
]));
|
|
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.dup.policy',
|
|
'scope' => 'route',
|
|
'target' => 'api.dup',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
]);
|
|
|
|
$response->assertStatus(422)
|
|
->assertJsonValidationErrors(['key']);
|
|
}
|
|
|
|
public function test_http_unauthenticated_returns_401(): void
|
|
{
|
|
$response = $this->withHeaders(['Accept' => 'application/json'])
|
|
->getJson('/api/admin/identity/policies');
|
|
|
|
$response->assertStatus(401);
|
|
}
|
|
|
|
// ====================================================================
|
|
// priority 동률 차단 — 같은 scope+target 에 동일 priority 활성 정책 거부
|
|
// ====================================================================
|
|
|
|
/**
|
|
* 같은 scope+target 에 동일 priority 활성 정책이 이미 있으면 신규 저장은 422.
|
|
*/
|
|
public function test_http_store_rejects_duplicate_priority_on_same_target(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.existing',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target',
|
|
'priority' => 100,
|
|
'enabled' => true,
|
|
]));
|
|
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.tie.new',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
'enabled' => true,
|
|
'priority' => 100,
|
|
]);
|
|
|
|
$response->assertStatus(422)
|
|
->assertJsonValidationErrors(['priority']);
|
|
}
|
|
|
|
/**
|
|
* 같은 scope+target 이라도 priority 가 다르면 저장 허용.
|
|
*/
|
|
public function test_http_store_allows_different_priority_on_same_target(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.existing2',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target2',
|
|
'priority' => 100,
|
|
'enabled' => true,
|
|
]));
|
|
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.tie.new2',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target2',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
'enabled' => true,
|
|
'priority' => 90,
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
}
|
|
|
|
/**
|
|
* 기존 정책이 비활성이면 동일 priority 라도 저장 허용 (비활성은 enforce 안 되어 무해).
|
|
*/
|
|
public function test_http_store_allows_duplicate_priority_when_existing_disabled(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.disabled',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target3',
|
|
'priority' => 100,
|
|
'enabled' => false,
|
|
]));
|
|
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.tie.new3',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target3',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
'enabled' => true,
|
|
'priority' => 100,
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
}
|
|
|
|
/**
|
|
* 신규 정책이 비활성이면 동률이어도 저장 허용 (비활성은 enforce 안 됨).
|
|
*/
|
|
public function test_http_store_allows_duplicate_priority_when_new_disabled(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.active',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target4',
|
|
'priority' => 100,
|
|
'enabled' => true,
|
|
]));
|
|
|
|
$response = $this->authRequest()->postJson('/api/admin/identity/policies', [
|
|
'key' => 'http.tie.new4',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.target4',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
'enabled' => false,
|
|
'priority' => 100,
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
}
|
|
|
|
/**
|
|
* 수정 시 동일 priority 활성 정책이 다른 행에 있으면 422 (자기 자신은 제외).
|
|
*/
|
|
public function test_http_update_rejects_duplicate_priority_against_other_policy(): void
|
|
{
|
|
IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.update.a',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.update',
|
|
'priority' => 100,
|
|
'enabled' => true,
|
|
]));
|
|
$editing = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.update.b',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.update',
|
|
'priority' => 50,
|
|
'enabled' => true,
|
|
]));
|
|
|
|
// editing 정책을 100 으로 바꾸면 a 와 동률 → 거부
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$editing->id}", [
|
|
'priority' => 100,
|
|
]);
|
|
|
|
$response->assertStatus(422)
|
|
->assertJsonValidationErrors(['priority']);
|
|
}
|
|
|
|
/**
|
|
* 수정 시 자기 자신의 기존 priority 를 그대로 두는 변경(다른 필드만 수정)은 통과 — self 제외 확인.
|
|
*/
|
|
public function test_http_update_allows_keeping_own_priority(): void
|
|
{
|
|
$editing = IdentityPolicy::create($this->makePolicyData([
|
|
'key' => 'http.tie.update.self',
|
|
'scope' => 'route',
|
|
'target' => 'api.tie.update.self',
|
|
'priority' => 100,
|
|
'enabled' => true,
|
|
]));
|
|
|
|
// 자기 자신만 그 target+priority 를 점유 — priority 100 유지하며 grace 변경
|
|
$response = $this->authRequest()->putJson("/api/admin/identity/policies/{$editing->id}", [
|
|
'priority' => 100,
|
|
'grace_minutes' => 33,
|
|
]);
|
|
|
|
$response->assertStatus(200)
|
|
->assertJsonPath('data.priority', 100);
|
|
$this->assertSame(33, $editing->fresh()->grace_minutes);
|
|
}
|
|
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
private function makePolicyData(array $overrides = []): array
|
|
{
|
|
return array_merge([
|
|
'key' => 'test.default.key',
|
|
'scope' => 'route',
|
|
'target' => 'api.test.default',
|
|
'purpose' => 'sensitive_action',
|
|
'grace_minutes' => 0,
|
|
'enabled' => true,
|
|
'priority' => 100,
|
|
'source_type' => 'admin',
|
|
'source_identifier' => 'admin',
|
|
'applies_to' => 'both',
|
|
'fail_mode' => 'block',
|
|
], $overrides);
|
|
}
|
|
}
|