MALIO-DEV/Coltura
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(review) : resout findings 3e passe review (HIGH frontend + MEDIUMs backend/frontend/E2E)

Browse Source 
Backend :
- AuditLogWriter::stripSensitive rendu reellement recursif (matche doc).
- Tests GET /api/permissions/{id} non-admin pour chaque branche OR (gap Codex).
- Gardes non-regression UserRbacProcessor : PATCH /rbac sans clef sites ne
  doit ni auto-selectionner currentSite ni exiger sites.manage.

Frontend :
- useAuditLog : renomme export trompeur fetchLogs -> fetchLogsCached, le
  nom reflete desormais le comportement (cache pollue sinon).
- RoleDrawer / UserRbacDrawer : catch explicite + message d'erreur +
  bouton save disabled si le chargement des referentiels a echoue (evite
  un ecrasement silencieux des droits).
- AuditTimeline / AuditLogDetail : `oui`/`non` passent par common.yes/no.
- AuditTimeline : Intl.RelativeTimeFormat et toLocaleString suivent la
  locale i18n courante (plus de hardcode 'fr').

E2E :
- sidebar-visibility.spec : remplace waitForLoadState('networkidle')
  fragile par attente semantique sur accountDashboardLink (stable en CI).

Tests : 237/237 green, eslint clean, php-cs-fixer clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matthieu
2026-04-23 10:31:03 +02:00
parent 25cd6a1ecc
commit b1255bb57a
12 changed files with 271 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
tests/Module/Core/Api/PermissionApiTest.php
View File

@@ -226,6 +226,51 @@ final class PermissionApiTest extends AbstractApiTestCase
self::assertResponseIsSuccessful();
}
public function testNonAdminWithPermissionViewCanGetItem(): void
{
// Miroir item de testNonAdminWithPermissionViewCanListPermissions :
// la security expression OR est repliquee sur `new Get(...)` et doit
// donc aussi s'appliquer ici.
$permission = $this->getEm()->getRepository(Permission::class)
->findOneBy(['code' => 'test.core.users.view'])
;
self::assertNotNull($permission);
$creds = $this->createUserWithPermission('core.permissions.view');
$client = $this->authenticatedClient($creds['username'], $creds['password']);
$client->request('GET', '/api/permissions/'.$permission->getId());
self::assertResponseIsSuccessful();
}
public function testNonAdminWithUsersManageCanGetItem(): void
{
$permission = $this->getEm()->getRepository(Permission::class)
->findOneBy(['code' => 'test.core.users.view'])
;
self::assertNotNull($permission);
$creds = $this->createUserWithPermission('core.users.manage');
$client = $this->authenticatedClient($creds['username'], $creds['password']);
$client->request('GET', '/api/permissions/'.$permission->getId());
self::assertResponseIsSuccessful();
}
public function testNonAdminWithRolesManageCanGetItem(): void
{
$permission = $this->getEm()->getRepository(Permission::class)
->findOneBy(['code' => 'test.core.users.view'])
;
self::assertNotNull($permission);
$creds = $this->createUserWithPermission('core.roles.manage');
$client = $this->authenticatedClient($creds['username'], $creds['password']);
$client->request('GET', '/api/permissions/'.$permission->getId());
self::assertResponseIsSuccessful();
}
private function cleanupTestPermissions(): void
{
$em = $this->getEm();

75
tests/Module/Core/Api/UserRbacSitesApiTest.php
View File

@@ -174,6 +174,81 @@ final class UserRbacSitesApiTest extends AbstractApiTestCase
self::assertSame('Chatellerault', $reloaded->getSites()->first()->getName());
}
public function testRbacPatchWithoutSitesKeyDoesNotAutoSwitchCurrentSiteWhenNull(): void
{
// Scenario : alice a des sites mais currentSite=null. Un PATCH /rbac
// qui ne touche PAS a la clef `sites` ne doit PAS auto-selectionner
// silencieusement un site via ensureCurrentSiteConsistency.
//
// Sans ce garde, un payload { "isAdmin": false } pourrait, si la
// denormalisation marque la collection `sites` dirty a tort (ou si
// la logique de detection se base sur PersistentCollection::isDirty()
// avant restauration), declencher ensureCurrentSiteConsistency et
// recaler currentSite sur sites->first() — ce qui est un effet de
// bord indetectable par le client.
$em = $this->getEm();
$alice = $em->getRepository(User::class)->findOneBy(['username' => 'alice']);
$aliceId = $alice->getId();
$alice->setCurrentSite(null);
$em->flush();
$em->clear();
$client = $this->authenticatedClient('admin', 'admin');
$client->request('PATCH', '/api/users/'.$aliceId.'/rbac', [
'headers' => ['Content-Type' => 'application/merge-patch+json'],
'json' => ['isAdmin' => false],
]);
self::assertResponseIsSuccessful();
$em = $this->getEm();
$em->clear();
$reloaded = $em->getRepository(User::class)->find($aliceId);
self::assertNotNull($reloaded);
// currentSite doit rester null : PATCH /rbac sans clef `sites` ne doit
// pas muter la selection de site courant de l'user.
self::assertNull(
$reloaded->getCurrentSite(),
'PATCH /rbac sans clef `sites` ne doit pas auto-selectionner un site.',
);
// Les sites eux-memes doivent etre preserves.
self::assertCount(1, $reloaded->getSites());
$this->restoreAliceSites();
}
public function testRbacPatchWithoutSitesKeyDoesNotRequireSitesManagePermission(): void
{
// Scenario Codex : un user non-admin qui porte `core.users.manage`
// mais PAS `sites.manage` doit pouvoir PATCHer /rbac sans clef `sites`
// sans se faire refuser l'acces.
//
// Si sitesWereMutated se base uniquement sur PersistentCollection::isDirty()
// calcule avant restoreAbsentCollections, une denormalisation qui
// marque a tort la collection dirty lorsque la clef est absente du
// payload lancerait un 403 parasite. La source de verite doit etre
// la presence de la clef dans le payload JSON.
$this->skipIfSitesModuleDisabled();
$em = $this->getEm();
$alice = $em->getRepository(User::class)->findOneBy(['username' => 'alice']);
$aliceId = $alice->getId();
$em->clear();
// User jetable : core.users.manage uniquement (pas sites.manage).
$creds = $this->createUserWithPermission('core.users.manage');
$client = $this->authenticatedClient($creds['username'], $creds['password']);
$client->request('PATCH', '/api/users/'.$aliceId.'/rbac', [
'headers' => ['Content-Type' => 'application/merge-patch+json'],
'json' => ['isAdmin' => false],
]);
// Pas de 403 : la requete ne touche pas aux sites, sites.manage n'est
// pas requis.
self::assertResponseIsSuccessful();
}
/**
* Remet alice dans l'etat des fixtures : un seul site Chatellerault,
* currentSite Chatellerault. Evite la pollution inter-tests.

27
tests/Module/Core/Infrastructure/Audit/AuditLogWriterTest.php
View File

@@ -111,6 +111,33 @@ final class AuditLogWriterTest extends TestCase
$this->assertSame('bob@example.com', $changes['email']);
}
public function testStripsSensitiveKeysRecursively(): void
{
// Defense-in-depth : un appelant direct peut passer un payload
// imbrique (ex: relations embarquees). Les cles sensibles doivent
// etre supprimees a tous les niveaux de profondeur.
$security = $this->buildSecurityWithUser('alice');
$writer = new AuditLogWriter($this->connection, $security, $this->requestStack, $this->requestIdProvider);
$writer->log('core.User', '1', 'create', [
'username' => 'bob',
'profile' => [
'email' => 'bob@example.com',
'password' => 'leaked_in_nested',
'nested' => [
'token' => 'should_be_stripped',
'harmless' => 'kept',
],
],
]);
$changes = $this->capturedInsert[1]['changes'];
$this->assertArrayNotHasKey('password', $changes['profile']);
$this->assertArrayNotHasKey('token', $changes['profile']['nested']);
$this->assertSame('kept', $changes['profile']['nested']['harmless']);
$this->assertSame('bob@example.com', $changes['profile']['email']);
}
public function testCapturesIpAddressWhenRequestPresent(): void
{
$request = Request::create('/api/users', 'POST');