root
88 lines
3.7 KiB
PHP
88 lines
3.7 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Api\V1\FullSurface;
|
|
|
|
use Illuminate\Routing\Route as LaravelRoute;
|
|
use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
|
|
|
|
class ApiDestructiveActionSafeguardContractTest extends FullSurfaceE2EContractCase
|
|
{
|
|
public function test_delete_routes_handle_missing_and_foreign_ids_without_crashing(): void
|
|
{
|
|
foreach ($this->deleteRoutes() as $route) {
|
|
$uri = $this->replaceAllPlaceholdersWithMissingId($route->uri());
|
|
$response = $this->requestAs($this->actorFor($route->uri()), 'DELETE', $uri);
|
|
|
|
$this->assertStatusIn($response, [200, 202, 204, 302, 400, 401, 403, 404, 405, 409, 419, 422], "DELETE missing $uri");
|
|
$this->assertNoServerError($response, "DELETE missing $uri");
|
|
}
|
|
}
|
|
|
|
public function test_bulk_delete_style_routes_require_explicit_targets(): void
|
|
{
|
|
foreach ($this->bulkDestructiveRoutes() as $route) {
|
|
$method = $this->primaryMethod($route);
|
|
$uri = $route->uri();
|
|
$response = $this->requestAs($this->actorFor($uri), $method, $uri, [
|
|
'ids' => [],
|
|
'confirm' => false,
|
|
]);
|
|
|
|
$this->assertStatusIn($response, [200, 202, 204, 302, 400, 401, 403, 404, 405, 409, 419, 422], "$method $uri empty bulk destructive payload");
|
|
$this->assertNoServerError($response, "$method $uri empty bulk destructive payload");
|
|
|
|
if ($response->getStatusCode() >= 200 && $response->getStatusCode() < 300) {
|
|
$this->assertTrue(
|
|
in_array($response->getStatusCode(), [200, 202, 204], true),
|
|
"$method $uri may succeed only as an explicit no-op, never by deleting an unspecified set."
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
public function test_archive_remove_cancel_and_void_routes_are_idempotent_or_conflict_safe(): void
|
|
{
|
|
foreach ($this->softDestructiveRoutes() as $route) {
|
|
$method = $this->primaryMethod($route);
|
|
$uri = $route->uri();
|
|
$first = $this->requestAs($this->actorFor($uri), $method, $uri, $this->payloadFor($method, $uri));
|
|
$second = $this->requestAs($this->actorFor($uri), $method, $uri, $this->payloadFor($method, $uri));
|
|
|
|
$this->assertControlled($first, $method, $uri);
|
|
$this->assertControlled($second, $method, $uri);
|
|
$this->assertNoServerError($first, "$method $uri first soft destructive attempt");
|
|
$this->assertNoServerError($second, "$method $uri second soft destructive attempt");
|
|
}
|
|
}
|
|
|
|
/** @return list<LaravelRoute> */
|
|
private function deleteRoutes(): array
|
|
{
|
|
return array_slice(array_filter($this->apiRoutes(), fn (LaravelRoute $route): bool => $this->primaryMethod($route) === 'DELETE'), 0, 80);
|
|
}
|
|
|
|
/** @return list<LaravelRoute> */
|
|
private function bulkDestructiveRoutes(): array
|
|
{
|
|
return array_slice(array_filter($this->apiRoutes(), function (LaravelRoute $route): bool {
|
|
$uri = $route->uri();
|
|
|
|
return in_array($this->primaryMethod($route), ['POST', 'DELETE'], true)
|
|
&& preg_match('/bulk|batch|mass|selected|purge|delete/i', $uri) === 1;
|
|
}), 0, 60);
|
|
}
|
|
|
|
/** @return list<LaravelRoute> */
|
|
private function softDestructiveRoutes(): array
|
|
{
|
|
return array_slice(array_filter($this->apiRoutes(), function (LaravelRoute $route): bool {
|
|
return preg_match('/archive|remove|cancel|void|resolve|close|reopen|restore/i', $route->uri()) === 1;
|
|
}), 0, 80);
|
|
}
|
|
|
|
private function replaceAllPlaceholdersWithMissingId(string $uri): string
|
|
{
|
|
return preg_replace('/\{[^}]+\}/', '999999999', $uri) ?? $uri;
|
|
}
|
|
}
|