refactor(core) : RBAC #344 - polish review - narrow rbac read group + fail-fast processors

tests/Module/Core/Infrastructure/ApiPlatform/State/Processor/RoleProcessorTest.php

@@ -12,10 +12,12 @@ use App\Module\Core\Domain\Entity\Role;
 use App\Module\Core\Infrastructure\ApiPlatform\State\Processor\RoleProcessor;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\ORM\UnitOfWork;
+use LogicException;
 use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 use ReflectionClass;
+use stdClass;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 
@@ -199,6 +201,19 @@ final class RoleProcessorTest extends TestCase
         self::assertSame($role, $result);
     }
 
+    public function testProcessNonRoleDataThrowsLogicException(): void
+    {
+        // Garde-fou contre une misconfiguration : ce processor est wire
+        // exclusivement sur les operations Role.
+        $this->persistProcessor->expects(self::never())->method('process');
+        $this->removeProcessor->expects(self::never())->method('process');
+
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('RoleProcessor attend une instance de');
+
+        $this->processor->process(new stdClass(), new Patch());
+    }
+
     /**
      * Positionne l'id d'un Role via reflection pour simuler une entite deja
      * persistee (les mocks d'UnitOfWork n'alimentent pas l'id tout seul).

tests/Module/Core/Infrastructure/ApiPlatform/State/Processor/UserRbacProcessorTest.php

@@ -12,10 +12,12 @@ use App\Module\Core\Domain\Entity\User;
 use App\Module\Core\Infrastructure\ApiPlatform\State\Processor\UserRbacProcessor;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\ORM\UnitOfWork;
+use LogicException;
 use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 use ReflectionClass;
+use stdClass;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 
@@ -196,6 +198,18 @@ final class UserRbacProcessorTest extends TestCase
         self::assertSame($self, $result);
     }
 
+    public function testProcessNonUserDataThrowsLogicException(): void
+    {
+        // Garde-fou contre une misconfiguration : ce processor est wire
+        // exclusivement sur l'operation user_rbac_patch (cible User).
+        $this->persistProcessor->expects(self::never())->method('process');
+
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('UserRbacProcessor attend une instance de');
+
+        $this->processor->process(new stdClass(), new Patch());
+    }
+
     /**
      * Construit un User avec un id force via reflection (les mocks
      * d'UnitOfWork n'alimentent pas l'id tout seul).