update controllers logic

tests/Unit/ApiDocsServiceTest.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Models\User;
+use App\Services\ApplicationUrlService;
+use App\Services\Docs\ApiDocsService;
+use PHPUnit\Framework\TestCase;
+
+class ApiDocsServiceTest extends TestCase
+{
+    private function docsService(): ApiDocsService
+    {
+        $urls = $this->createMock(ApplicationUrlService::class);
+        $urls->method('docsSwaggerMergedJsonUrl')->with(false)->willReturn('/api/documentation/swagger.json');
+
+        return new ApiDocsService($urls);
+    }
+
+    public function test_public_bootstrap_matches_ci_public_flags(): void
+    {
+        $svc = $this->docsService();
+        $b = $svc->bootstrap(null, true);
+
+        $this->assertFalse($b['try_it_out_enabled']);
+        $this->assertFalse($b['persist_authorization']);
+        $this->assertFalse($b['show_authorize_button']);
+        $this->assertSame('public', $b['variant']);
+        $this->assertNull($b['welcome_name']);
+    }
+
+    public function test_full_bootstrap_enables_try_and_welcome(): void
+    {
+        $user = new User([
+            'firstname' => 'A',
+            'lastname' => 'B',
+            'email' => 'x@y.z',
+        ]);
+        $svc = $this->docsService();
+        $b = $svc->bootstrap($user, false);
+
+        $this->assertTrue($b['try_it_out_enabled']);
+        $this->assertTrue($b['persist_authorization']);
+        $this->assertTrue($b['show_authorize_button']);
+        $this->assertSame('full', $b['variant']);
+        $this->assertSame('A B', $b['welcome_name']);
+    }
+}

tests/Unit/ApiLoginSecurityServiceTest.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Services\Auth\ApiLoginSecurityService;
+use PHPUnit\Framework\TestCase;
+
+class ApiLoginSecurityServiceTest extends TestCase
+{
+    public function test_roles_object_map_matches_codeigniter_encoding(): void
+    {
+        $service = new ApiLoginSecurityService();
+        $map = $service->rolesToObjectMap(['Teacher', 'Admin']);
+
+        $this->assertTrue($map->Teacher);
+        $this->assertTrue($map->Admin);
+
+        $payload = json_encode(['roles' => $map]);
+        $this->assertIsString($payload);
+        $this->assertStringContainsString('"Teacher":true', $payload);
+        $this->assertStringContainsString('"Admin":true', $payload);
+    }
+}

tests/Unit/AuthSessionServiceTest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Services\ApplicationUrlService;
+use App\Services\Auth\AuthSessionService;
+use PHPUnit\Framework\TestCase;
+
+class AuthSessionServiceTest extends TestCase
+{
+    private AuthSessionService $svc;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $urls = $this->createMock(ApplicationUrlService::class);
+        $urls->method('docsHomeUrl')->willReturn('http://example.org');
+        $this->svc = new AuthSessionService($urls);
+    }
+
+    public function test_sanitize_redirect_relative(): void
+    {
+        $this->assertSame('/dashboard', $this->svc->sanitizeRedirectTarget('/dashboard'));
+        $this->assertSame('/dash?q=1', $this->svc->sanitizeRedirectTarget('/dash?q=1'));
+    }
+
+    public function test_sanitize_redirect_empty(): void
+    {
+        $this->assertNull($this->svc->sanitizeRedirectTarget(''));
+        $this->assertNull($this->svc->sanitizeRedirectTarget('   '));
+    }
+
+    public function test_sanitize_rejects_protocol_relative(): void
+    {
+        $this->assertNull($this->svc->sanitizeRedirectTarget('//evil.example/path'));
+    }
+}