root
40 lines
2.0 KiB
PHP
40 lines
2.0 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Api\V1\FullSurface;
|
|
|
|
use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
|
|
|
|
class ApiBatch12RouteMetadataRiskRegisterTest extends FullSurfaceE2EContractCase
|
|
{
|
|
public function test_high_risk_route_families_exist_in_the_contract_risk_register(): void
|
|
{
|
|
$riskRegister = [
|
|
'identity' => ['auth', 'login', 'logout', 'profile', 'frontend'],
|
|
'authorization' => ['roles', 'permissions', 'switch-role', 'impersonate'],
|
|
'student_privacy' => ['students', 'parents', 'family', 'guardian'],
|
|
'attendance_safety' => ['attendance', 'late', 'dismissal', 'absence'],
|
|
'academic_records' => ['scores', 'grades', 'report-card', 'certificate'],
|
|
'financial_records' => ['finance', 'invoice', 'payment', 'refund', 'receipt'],
|
|
'files' => ['upload', 'download', 'import', 'export', 'print'],
|
|
'external_integrations' => ['webhook', 'callback', 'paypal', 'email', 'whatsapp'],
|
|
'operations' => ['settings', 'configuration', 'health', 'debug', 'logs'],
|
|
];
|
|
|
|
foreach ($riskRegister as $risk => $needles) {
|
|
$this->assertNotEmpty($this->apiRoutesContainingAny($needles), 'Batch 12 risk register missing route family: '.$risk);
|
|
}
|
|
}
|
|
|
|
public function test_mutating_high_risk_routes_have_specific_route_names_when_available(): void
|
|
{
|
|
foreach (array_slice($this->apiRoutesContainingAny(['finance', 'attendance', 'users', 'roles', 'permissions', 'settings', 'import', 'webhook']), 0, 180) as $route) {
|
|
if (! in_array($this->primaryMethod($route), ['POST', 'PUT', 'PATCH', 'DELETE'], true)) {
|
|
continue;
|
|
}
|
|
|
|
$name = $route->getName();
|
|
$this->assertTrue($name === null || ! preg_match('/(^|\.)(store|update|destroy)$/', $name) || substr_count((string) $name, '.') >= 2, 'High-risk route name is too generic: '.($name ?? '[unnamed]').' '.$route->uri());
|
|
}
|
|
}
|
|
}
|