MALIO-DEV/Starseed
3
0
Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix(commercial) : robust gating + strict category denormalizer + provider via EM (review ERP-55)

Browse Source
This commit is contained in:
Matthieu
2026-06-01 12:15:33 +02:00
parent d9a6d0fa5a
commit 13eb0722dc
5 changed files with 315 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Module/Commercial/Unit/ClientProcessorTest.php
+112 -11
View File
@@ -16,6 +16,8 @@ use App\Module\Commercial\Domain\Entity\PaymentType;
use App\Module\Commercial\Infrastructure\ApiPlatform\State\Processor\ClientProcessor;
use App\Shared\Domain\Contract\BusinessRoleAwareInterface;
use App\Shared\Domain\Security\BusinessRoles;
use Doctrine\ORM\EntityManagerInterface;
use Doctrine\ORM\UnitOfWork;
use PHPUnit\Framework\TestCase;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Request;
@@ -36,45 +38,126 @@ final class ClientProcessorTest extends TestCase
{
public function testAccountingFieldWithoutPermissionIsForbidden(): void
{
// RG-1.28 : un champ comptable sans accounting.manage -> 403.
// RG-1.28 : la modification effective d'un champ comptable sans
// accounting.manage -> 403. En creation (POST), positionner siren est un
// changement vs l'etat persiste vide.
$client = $this->minimalClient();
$client->setSiren('123456789');
$processor = $this->makeProcessor(granted: [], payload: ['siren' => '123456789']);
$this->expectException(AccessDeniedHttpException::class);
$processor->process($this->minimalClient(), $this->operation());
$processor->process($client, $this->operation());
}
public function testStrictMixWithAccountingFieldIsForbidden(): void
{
// RG-1.28 : payload mixant main + accounting sans la permission -> 403
// sur l'ensemble (pas de filtrage silencieux).
$client = $this->minimalClient();
$client->setCompanyName('X');
$client->setSiren('123456789');
$processor = $this->makeProcessor(
granted: [],
payload: ['companyName' => 'X', 'siren' => '123456789'],
);
$this->expectException(AccessDeniedHttpException::class);
$processor->process($this->minimalClient(), $this->operation());
$processor->process($client, $this->operation());
}
public function testArchiveWithoutPermissionIsForbidden(): void
{
// RG-1.22 : isArchived sans la permission archive -> 403.
$processor = $this->makeProcessor(granted: [], payload: ['isArchived' => true]);
// RG-1.22 : basculer isArchived sans la permission archive -> 403.
$client = $this->minimalClient();
$client->setIsArchived(true);
$processor = $this->makeProcessor(
granted: [],
payload: ['isArchived' => true],
managed: true,
originalData: ['isArchived' => false],
);
$this->expectException(AccessDeniedHttpException::class);
$processor->process($this->minimalClient(), $this->operation());
$processor->process($client, $this->operation());
}
public function testArchiveWithOtherFieldIsUnprocessable(): void
{
// RG-1.22 : une requete d'archivage ne modifie aucun autre champ.
$client = $this->minimalClient();
$client->setIsArchived(true);
$client->setCompanyName('X');
$processor = $this->makeProcessor(
granted: ['commercial.clients.archive'],
payload: ['isArchived' => true, 'companyName' => 'X'],
managed: true,
originalData: ['isArchived' => false],
);
$this->expectException(UnprocessableEntityHttpException::class);
$processor->process($this->minimalClient(), $this->operation());
$processor->process($client, $this->operation());
}
public function testPostWithIsArchivedFalseIsNotGated(): void
{
// Bug review ERP-55 : un POST renvoyant isArchived:false (valeur par
// defaut) ne doit declencher ni 403 (archive) ni 422, meme sans
// permission. L'entite n'est pas encore geree par l'ORM.
$client = $this->minimalClient(); // isArchived = false par defaut
$processor = $this->makeProcessor(
granted: [],
payload: ['companyName' => 'Test Co', 'isArchived' => false],
managed: false,
);
self::assertInstanceOf(Client::class, $processor->process($client, $this->operation()));
}
public function testFullRepresentationPatchWithUnchangedArchiveIsNotGated(): void
{
// Bug review ERP-55 : un PATCH « representation complete » renvoyant
// isArchived inchange + des cles JSON-LD (@id, @context) ne doit pas etre
// gate (ni 403 archive ni 422), meme sans permission.
$client = $this->minimalClient(); // isArchived = false (inchange)
$processor = $this->makeProcessor(
granted: [],
payload: [
'@id' => '/api/clients/1',
'@context' => '/api/contexts/Client',
'companyName' => 'Test Co',
'isArchived' => false,
],
managed: true,
originalData: ['isArchived' => false],
);
self::assertInstanceOf(Client::class, $processor->process($client, $this->operation()));
}
public function testUnchangedAccountingFieldOnPatchIsNotGated(): void
{
// Bug review ERP-55 : renvoyer un champ comptable a sa valeur persistee
// (PATCH representation complete) ne change rien -> pas d'exigence
// accounting.manage.
$client = $this->minimalClient();
$client->setSiren('123456789'); // identique a l'etat persiste
$processor = $this->makeProcessor(
granted: [],
payload: ['companyName' => 'Test Co', 'siren' => '123456789'],
managed: true,
// getOriginalEntityData renvoie tous les champs mappes d'une entite
// geree : isArchived (non-null) y figure toujours.
originalData: ['siren' => '123456789', 'isArchived' => false],
);
self::assertInstanceOf(Client::class, $processor->process($client, $this->operation()));
}
public function testVirementWithoutBankIsUnprocessable(): void
@@ -170,11 +253,18 @@ final class ClientProcessorTest extends TestCase
}
/**
* @param list<string> $granted Permissions accordees a l'utilisateur courant
* @param array<string, mixed> $payload Corps JSON simule de la requete
* @param list<string> $granted Permissions accordees a l'utilisateur courant
* @param array<string, mixed> $payload Corps JSON simule de la requete
* @param bool $managed true = entite geree par l'ORM (PATCH), false = creation (POST)
* @param array<string, mixed> $originalData Etat persiste simule (getOriginalEntityData) pour la detection de changement
*/
private function makeProcessor(array $granted, array $payload, ?UserInterface $user = null): ClientProcessor
{
private function makeProcessor(
array $granted,
array $payload,
?UserInterface $user = null,
bool $managed = false,
array $originalData = [],
): ClientProcessor {
$persist = new class implements ProcessorInterface {
public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
{
@@ -191,12 +281,23 @@ final class ClientProcessorTest extends TestCase
$requestStack = new RequestStack();
$requestStack->push(new Request([], [], [], [], [], [], json_encode($payload, JSON_THROW_ON_ERROR)));
// EntityManager stub : contains() distingue creation (POST) et mise a
// jour (PATCH) ; getOriginalEntityData() fournit l'etat persiste compare
// par le gating (RG-1.22 / RG-1.28).
$uow = $this->createMock(UnitOfWork::class);
$uow->method('getOriginalEntityData')->willReturn($originalData);
$em = $this->createMock(EntityManagerInterface::class);
$em->method('contains')->willReturn($managed);
$em->method('getUnitOfWork')->willReturn($uow);
return new ClientProcessor(
$persist,
new ClientFieldNormalizer(),
new ClientInformationCompletenessValidator(),
$security,
$requestStack,
$em,
);
}