update controllers logic

tests/CreatesApplication.php

@@ -3,10 +3,11 @@
 namespace Tests;
 
 use Illuminate\Contracts\Console\Kernel;
+use Illuminate\Foundation\Application;
 
 trait CreatesApplication
 {
-    public function createApplication()
+    public function createApplication(): Application
     {
         $app = require __DIR__.'/../bootstrap/app.php';
 

tests/Feature/HealthEndpointTest.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Tests\Feature;
+
+use Tests\TestCase;
+
+final class HealthEndpointTest extends TestCase
+{
+    public function test_health_endpoint_is_reachable(): void
+    {
+        $this->get('/up')->assertSuccessful();
+    }
+}

tests/TestCase.php

@@ -2,24 +2,9 @@
 
 namespace Tests;
 
-use Illuminate\Support\Facades\DB;
 use Illuminate\Foundation\Testing\TestCase as BaseTestCase;
 
 abstract class TestCase extends BaseTestCase
 {
     use CreatesApplication;
-
-    protected function tearDown(): void
-    {
-        try {
-            $connection = DB::connection();
-            $pdo = $connection->getPdo();
-            if ($pdo->inTransaction()) {
-                $connection->rollBack();
-            }
-        } catch (\Throwable $e) {
-        }
-
-        parent::tearDown();
-    }
 }

tests/Unit/ApiDocsServiceTest.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Models\User;
+use App\Services\ApplicationUrlService;
+use App\Services\Docs\ApiDocsService;
+use PHPUnit\Framework\TestCase;
+
+class ApiDocsServiceTest extends TestCase
+{
+    private function docsService(): ApiDocsService
+    {
+        $urls = $this->createMock(ApplicationUrlService::class);
+        $urls->method('docsSwaggerMergedJsonUrl')->with(false)->willReturn('/api/documentation/swagger.json');
+
+        return new ApiDocsService($urls);
+    }
+
+    public function test_public_bootstrap_matches_ci_public_flags(): void
+    {
+        $svc = $this->docsService();
+        $b = $svc->bootstrap(null, true);
+
+        $this->assertFalse($b['try_it_out_enabled']);
+        $this->assertFalse($b['persist_authorization']);
+        $this->assertFalse($b['show_authorize_button']);
+        $this->assertSame('public', $b['variant']);
+        $this->assertNull($b['welcome_name']);
+    }
+
+    public function test_full_bootstrap_enables_try_and_welcome(): void
+    {
+        $user = new User([
+            'firstname' => 'A',
+            'lastname' => 'B',
+            'email' => 'x@y.z',
+        ]);
+        $svc = $this->docsService();
+        $b = $svc->bootstrap($user, false);
+
+        $this->assertTrue($b['try_it_out_enabled']);
+        $this->assertTrue($b['persist_authorization']);
+        $this->assertTrue($b['show_authorize_button']);
+        $this->assertSame('full', $b['variant']);
+        $this->assertSame('A B', $b['welcome_name']);
+    }
+}

tests/Unit/ApiLoginSecurityServiceTest.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Services\Auth\ApiLoginSecurityService;
+use PHPUnit\Framework\TestCase;
+
+class ApiLoginSecurityServiceTest extends TestCase
+{
+    public function test_roles_object_map_matches_codeigniter_encoding(): void
+    {
+        $service = new ApiLoginSecurityService();
+        $map = $service->rolesToObjectMap(['Teacher', 'Admin']);
+
+        $this->assertTrue($map->Teacher);
+        $this->assertTrue($map->Admin);
+
+        $payload = json_encode(['roles' => $map]);
+        $this->assertIsString($payload);
+        $this->assertStringContainsString('"Teacher":true', $payload);
+        $this->assertStringContainsString('"Admin":true', $payload);
+    }
+}

tests/Unit/AuthSessionServiceTest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Services\ApplicationUrlService;
+use App\Services\Auth\AuthSessionService;
+use PHPUnit\Framework\TestCase;
+
+class AuthSessionServiceTest extends TestCase
+{
+    private AuthSessionService $svc;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $urls = $this->createMock(ApplicationUrlService::class);
+        $urls->method('docsHomeUrl')->willReturn('http://example.org');
+        $this->svc = new AuthSessionService($urls);
+    }
+
+    public function test_sanitize_redirect_relative(): void
+    {
+        $this->assertSame('/dashboard', $this->svc->sanitizeRedirectTarget('/dashboard'));
+        $this->assertSame('/dash?q=1', $this->svc->sanitizeRedirectTarget('/dash?q=1'));
+    }
+
+    public function test_sanitize_redirect_empty(): void
+    {
+        $this->assertNull($this->svc->sanitizeRedirectTarget(''));
+        $this->assertNull($this->svc->sanitizeRedirectTarget('   '));
+    }
+
+    public function test_sanitize_rejects_protocol_relative(): void
+    {
+        $this->assertNull($this->svc->sanitizeRedirectTarget('//evil.example/path'));
+    }
+}