root
47 lines
2.3 KiB
PHP
47 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Api\V1\FullSurface;
|
|
|
|
use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
|
|
|
|
class ApiAuditLogAndAdministrativeTraceabilityContractTest extends FullSurfaceE2EContractCase
|
|
{
|
|
public function test_admin_mutations_return_traceable_status_without_exposing_internal_log_records(): void
|
|
{
|
|
$routes = $this->apiRoutesContainingAny(['users', 'students', 'school-years', 'finance', 'inventory', 'permissions', 'roles', 'settings']);
|
|
|
|
foreach ($routes as $route) {
|
|
$method = $this->primaryMethod($route);
|
|
if (! in_array($method, ['POST', 'PUT', 'PATCH', 'DELETE'], true)) {
|
|
continue;
|
|
}
|
|
|
|
$uri = $route->uri();
|
|
$response = $this->requestAs($this->admin, $method, $uri, $this->payloadFor($method, $uri));
|
|
|
|
$this->assertNoServerError($response, "$method $uri admin mutation traceability");
|
|
$this->assertControlled($response, $method, $uri);
|
|
$this->assertStringNotContainsStringIgnoringCase('audit_log_id', $response->getContent(), $uri . ' should not leak raw internal audit identifiers by accident.');
|
|
$this->assertStringNotContainsStringIgnoringCase('stack_trace', $response->getContent(), $uri . ' should not leak stack traces in mutation responses.');
|
|
}
|
|
}
|
|
|
|
public function test_audit_and_log_routes_are_not_mutable_by_public_or_low_privilege_users(): void
|
|
{
|
|
$routes = $this->apiRoutesContainingAny(['audit', 'logs', 'activity', 'history']);
|
|
|
|
foreach ($routes as $route) {
|
|
$method = $this->primaryMethod($route);
|
|
$uri = $route->uri();
|
|
|
|
$public = $this->json($method, $this->materializePath($uri), $this->payloadFor($method, $uri));
|
|
$parent = $this->requestAs($this->parent, $method, $uri, $this->payloadFor($method, $uri));
|
|
|
|
$this->assertNoServerError($public, "$method $uri public audit route");
|
|
$this->assertNoServerError($parent, "$method $uri parent audit route");
|
|
$this->assertStatusIn($public, [302, 400, 401, 403, 404, 405, 419, 422], "$method $uri public audit route");
|
|
$this->assertStatusIn($parent, [302, 400, 401, 403, 404, 405, 419, 422], "$method $uri parent audit route");
|
|
}
|
|
}
|
|
}
|