test(technique) : couvrir RG-3.x PHPUnit + capturer le contrat JSON (ERP-139) (#100)
Auto Tag Develop / tag (push) Successful in 11s
Auto Tag Develop / tag (push) Successful in 11s
Ticket Lesstime #139 (M3 — Répertoire prestataires, position 1.9). DoD back avant le front : suite PHPUnit consolidée sur la matrice § 8.1 + captures JSON réelles dans la spec § 4.0.bis. ## Contenu - **Fix réfs comptables** : `provider:read:accounting` ajouté sur `TvaMode`/`PaymentDelay`/`PaymentType`/`Bank` — sans ça elles sortaient en IRI nu dans le détail prestataire (réplique du fix ERP-92 du M2, piège #1 § 4.0.bis). - **`ProviderSerializationContractTest`** (13 tests) : gating RIB/scalaires par omission, réfs compta en objet `{id,code,label}`, `isArchived`, embed categories/sites liste+détail, sous-collections, enveloppe AP4 ; `testDodReferenceJsonShape` dumpe le JSON réel (`PROVIDER_DOD_DUMP=1`). - **`ProviderAuditTest`** (5 tests) : create/update/archive (`technique.Provider`), iban/bic dans le diff (`technique.ProviderRib`, pas dAuditIgnore), trace M2M `sites`. - **`ProviderListTest`** étendu : `?pagination=false`, anti-N+1, filtre `?typeCode=PRESTATAIRE`. - **`ProviderRbacGatingTest`** étendu : restauration en conflit de nom → 409 (RG-3.14). - **`ProviderFixtures`** (§ 8.4) : démo idempotente (complet VIREMENT+banque+RIB, LCR+RIB, CHEQUE multi-cat, minimal, archivé) répartie sur sites 86/17/82 ; skip en env `test`. - Helper `seedCompleteProvider` ; spec § 4.0.bis : gabarits remplacés par les captures réelles (liste + détail avec/sans accounting.view). ## Vérifications - `make php-cs-fixer-allow-risky` → 0 fichier - `make test` → OK, 677 tests, 3328 assertions (garde-fous globaux verts) ## Notes - MR stackée sur ERP-138 (base = sa branche). - Fixtures démo exercées en dev via `make fixtures` (autowiring vérifié). --------- Co-authored-by: Matthieu <contact@malio.fr> Reviewed-on: #100
This commit was merged in pull request #100.
This commit is contained in:
@@ -0,0 +1,489 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use ApiPlatform\Symfony\Bundle\Test\Client;
|
||||
use App\Module\Catalog\Domain\Entity\Category;
|
||||
use App\Module\Catalog\Domain\Entity\CategoryType;
|
||||
use App\Module\Commercial\Domain\Entity\Bank;
|
||||
use App\Module\Commercial\Domain\Entity\PaymentDelay;
|
||||
use App\Module\Commercial\Domain\Entity\PaymentType;
|
||||
use App\Module\Commercial\Domain\Entity\TvaMode;
|
||||
use App\Module\Core\Domain\Entity\Permission;
|
||||
use App\Module\Core\Domain\Entity\Role;
|
||||
use App\Module\Core\Domain\Entity\User;
|
||||
use App\Module\Sites\Domain\Entity\Site;
|
||||
use App\Module\Technique\Domain\Entity\Provider;
|
||||
use App\Module\Technique\Domain\Entity\ProviderAddress;
|
||||
use App\Module\Technique\Domain\Entity\ProviderContact;
|
||||
use App\Module\Technique\Domain\Entity\ProviderRib;
|
||||
use App\Tests\Module\Core\Api\AbstractApiTestCase;
|
||||
use DateTimeImmutable;
|
||||
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
|
||||
|
||||
/**
|
||||
* Base des tests fonctionnels du repertoire prestataires (M3 — module Technique).
|
||||
* Jumelle de la base fournisseurs (M2), recentree sur le perimetre ERP-134
|
||||
* (Provider + Processor + cloisonnement site).
|
||||
*
|
||||
* Donnees (RETEX M1/M2 — pas de fixtures globales pour les tests) : chaque test
|
||||
* seede ses prestataires en base via les helpers ci-dessous, puis le tearDown les
|
||||
* purge. Les 3 sites (Chatellerault 86 / Saint-Jean 17 / Pommevic 82) sont seedes
|
||||
* par SitesFixtures (make test-db-setup) ; on les recupere par code postal.
|
||||
*
|
||||
* Categories : `providerCategory('NETTOYAGE')` fetch-or-create une categorie de
|
||||
* type PRESTATAIRE (requis par RG-3.09). Pour fabriquer une categorie d'un AUTRE
|
||||
* type (test de rejet RG-3.09), utiliser `foreignCategory()`.
|
||||
*
|
||||
* Cleanup : tearDown purge prestataires AVANT categories/users (provider_category
|
||||
* et provider_site sont ON DELETE CASCADE cote provider — le DELETE DQL sur
|
||||
* Provider libere categories et sites pour les purges suivantes).
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
abstract class AbstractProviderApiTestCase extends AbstractApiTestCase
|
||||
{
|
||||
protected const string LD = 'application/ld+json';
|
||||
protected const string MERGE = 'application/merge-patch+json';
|
||||
|
||||
protected const string TEST_CATEGORY_PREFIX = 'test_prov_cat_';
|
||||
|
||||
/** Codes postaux des 3 sites fixtures (cf. SitesFixtures). */
|
||||
protected const string SITE_86 = '86100'; // Chatellerault
|
||||
protected const string SITE_17 = '17400'; // Saint-Jean
|
||||
protected const string SITE_82 = '82400'; // Pommevic
|
||||
|
||||
/** IBAN / BIC valides (memes valeurs que les tests M2) pour les RIB. */
|
||||
protected const string VALID_IBAN = 'FR1420041010050500013M02606';
|
||||
protected const string VALID_BIC = 'BNPAFRPPXXX';
|
||||
/** BIC d'un autre pays (DE) : controle croise pays BIC/IBAN. */
|
||||
protected const string FOREIGN_BIC = 'DEUTDEFFXXX';
|
||||
|
||||
protected function tearDown(): void
|
||||
{
|
||||
$em = $this->getEm();
|
||||
|
||||
$em->createQuery('DELETE FROM '.Provider::class)->execute();
|
||||
$em->createQuery('DELETE FROM '.Category::class.' c WHERE c.name LIKE :prefix')
|
||||
->setParameter('prefix', self::TEST_CATEGORY_PREFIX.'%')->execute()
|
||||
;
|
||||
$em->createQuery('DELETE FROM '.User::class.' u WHERE u.username LIKE :prefix')
|
||||
->setParameter('prefix', 'test_%')->execute()
|
||||
;
|
||||
$em->createQuery('DELETE FROM '.Role::class.' r WHERE r.code LIKE :prefix')
|
||||
->setParameter('prefix', 'test_%')->execute()
|
||||
;
|
||||
|
||||
parent::tearDown();
|
||||
}
|
||||
|
||||
protected function createAdminClient(): Client
|
||||
{
|
||||
return $this->authenticatedClient('admin', 'admin');
|
||||
}
|
||||
|
||||
/**
|
||||
* Recupere (ou cree) le type PRESTATAIRE. Idempotent (unicite category_type.code).
|
||||
*/
|
||||
protected function providerCategoryType(): CategoryType
|
||||
{
|
||||
$em = $this->getEm();
|
||||
$existing = $em->getRepository(CategoryType::class)->findOneBy(['code' => 'PRESTATAIRE']);
|
||||
if (null !== $existing) {
|
||||
return $existing;
|
||||
}
|
||||
|
||||
$type = new CategoryType();
|
||||
$type->setCode('PRESTATAIRE');
|
||||
$type->setLabel('Prestataire');
|
||||
$em->persist($type);
|
||||
$em->flush();
|
||||
|
||||
return $type;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch-or-create une categorie de type PRESTATAIRE par code (defaut NETTOYAGE).
|
||||
* Idempotent (lookup par code, aligne sur l'index unique partiel uq_category_code)
|
||||
* et auto-suffisant. Nom prefixe -> purge par tearDown.
|
||||
*/
|
||||
protected function providerCategory(string $code = 'NETTOYAGE'): Category
|
||||
{
|
||||
$em = $this->getEm();
|
||||
$existing = $em->getRepository(Category::class)->findOneBy(['code' => $code, 'deletedAt' => null]);
|
||||
if (null !== $existing) {
|
||||
return $existing;
|
||||
}
|
||||
|
||||
$category = new Category();
|
||||
$category->setName(self::TEST_CATEGORY_PREFIX.strtolower($code));
|
||||
$category->setCode($code);
|
||||
$category->addCategoryType($this->providerCategoryType());
|
||||
$em->persist($category);
|
||||
$em->flush();
|
||||
|
||||
return $category;
|
||||
}
|
||||
|
||||
/**
|
||||
* Cree une categorie d'un type DIFFERENT de PRESTATAIRE (pour tester le rejet
|
||||
* RG-3.09). Code unique pour ne pas collisionner avec une categorie existante.
|
||||
*/
|
||||
protected function foreignCategory(): Category
|
||||
{
|
||||
$em = $this->getEm();
|
||||
$suffix = substr(bin2hex(random_bytes(4)), 0, 8);
|
||||
|
||||
$type = $em->getRepository(CategoryType::class)->findOneBy(['code' => 'CLIENT']);
|
||||
if (null === $type) {
|
||||
$type = new CategoryType();
|
||||
$type->setCode('CLIENT');
|
||||
$type->setLabel('Client');
|
||||
$em->persist($type);
|
||||
}
|
||||
|
||||
$category = new Category();
|
||||
$category->setName(self::TEST_CATEGORY_PREFIX.'foreign_'.$suffix);
|
||||
$category->setCode('FOREIGN_'.strtoupper($suffix));
|
||||
$category->addCategoryType($type);
|
||||
$em->persist($category);
|
||||
$em->flush();
|
||||
|
||||
return $category;
|
||||
}
|
||||
|
||||
/**
|
||||
* Recupere un site fixture par code postal (cf. SitesFixtures). Echoue
|
||||
* explicitement si absent (fixtures non chargees / module Sites off).
|
||||
*/
|
||||
protected function site(string $postalCode): Site
|
||||
{
|
||||
$site = $this->getEm()->getRepository(Site::class)->findOneBy(['postalCode' => $postalCode]);
|
||||
|
||||
self::assertNotNull(
|
||||
$site,
|
||||
sprintf('Site fixture "%s" introuvable : SitesFixtures charge (make test-db-setup) ?', $postalCode),
|
||||
);
|
||||
|
||||
return $site;
|
||||
}
|
||||
|
||||
/**
|
||||
* Seede directement un Provider minimal (sans passer par l'API), pour les tests
|
||||
* de liste / archivage / cloisonnement. Nom stocke en MAJUSCULES pour refleter
|
||||
* l'etat normalise (RG-3.11) qu'aurait produit le ProviderProcessor. Porte une
|
||||
* categorie PRESTATAIRE + les sites donnes (par code postal).
|
||||
*
|
||||
* @param list<string> $sitePostalCodes codes postaux des sites a rattacher
|
||||
*/
|
||||
protected function seedProvider(
|
||||
string $companyName,
|
||||
array $sitePostalCodes = [self::SITE_86],
|
||||
bool $isArchived = false,
|
||||
string $categoryCode = 'NETTOYAGE',
|
||||
?string $siren = null,
|
||||
): Provider {
|
||||
$em = $this->getEm();
|
||||
$provider = new Provider();
|
||||
$provider->setCompanyName(mb_strtoupper($companyName, 'UTF-8'));
|
||||
$provider->addCategory($this->providerCategory($categoryCode));
|
||||
foreach ($sitePostalCodes as $postalCode) {
|
||||
$provider->addSite($this->site($postalCode));
|
||||
}
|
||||
if (null !== $siren) {
|
||||
$provider->setSiren($siren);
|
||||
}
|
||||
$provider->setIsArchived($isArchived);
|
||||
if ($isArchived) {
|
||||
$provider->setArchivedAt(new DateTimeImmutable());
|
||||
}
|
||||
$em->persist($provider);
|
||||
$em->flush();
|
||||
|
||||
return $provider;
|
||||
}
|
||||
|
||||
/**
|
||||
* Payload minimal valide du formulaire principal (companyName + 1 categorie
|
||||
* PRESTATAIRE + sites donnes). Categorie NETTOYAGE par defaut.
|
||||
*
|
||||
* @param list<string> $sitePostalCodes
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
protected function validMainPayload(string $companyName, array $sitePostalCodes = [self::SITE_86]): array
|
||||
{
|
||||
$siteIris = array_map(fn (string $pc): string => '/api/sites/'.$this->site($pc)->getId(), $sitePostalCodes);
|
||||
|
||||
return [
|
||||
'companyName' => $companyName,
|
||||
'categories' => ['/api/categories/'.$this->providerCategory()->getId()],
|
||||
'sites' => $siteIris,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Cree un utilisateur non-admin CLOISONNE : porte les permissions donnees via
|
||||
* un role jetable, rattache aux seuls sites donnes (par code postal), avec un
|
||||
* currentSite positionne. N'a PAS `sites.bypass_scope` (sauf si fourni dans
|
||||
* $permissionCodes) -> sujet ideal des tests de cloisonnement (RG-3.17).
|
||||
*
|
||||
* Contrairement a createUserWithPermissions() (parent, qui attache TOUS les
|
||||
* sites et ne pose pas de currentSite), ce helper controle finement le
|
||||
* perimetre site de l'user.
|
||||
*
|
||||
* @param list<string> $permissionCodes
|
||||
* @param list<string> $sitePostalCodes sites a rattacher (user_site)
|
||||
*
|
||||
* @return array{username: string, password: string}
|
||||
*/
|
||||
protected function createScopedUser(
|
||||
array $permissionCodes,
|
||||
array $sitePostalCodes,
|
||||
?string $currentSitePostalCode = null,
|
||||
): array {
|
||||
$em = $this->getEm();
|
||||
|
||||
$suffix = substr(bin2hex(random_bytes(4)), 0, 8);
|
||||
$username = 'test_scoped_'.$suffix;
|
||||
$password = 'testpass';
|
||||
|
||||
/** @var UserPasswordHasherInterface $hasher */
|
||||
$hasher = self::getContainer()->get(UserPasswordHasherInterface::class);
|
||||
|
||||
$role = new Role('test_'.$suffix, 'Test Role '.$suffix, false);
|
||||
foreach ($permissionCodes as $code) {
|
||||
$permission = $em->getRepository(Permission::class)->findOneBy(['code' => $code]);
|
||||
self::assertNotNull($permission, sprintf('Permission "%s" introuvable (app:sync-permissions ?).', $code));
|
||||
$role->addPermission($permission);
|
||||
}
|
||||
$em->persist($role);
|
||||
|
||||
$user = new User();
|
||||
$user->setUsername($username);
|
||||
$user->setIsAdmin(false);
|
||||
$user->setPassword($hasher->hashPassword($user, $password));
|
||||
$user->addRbacRole($role);
|
||||
|
||||
foreach ($sitePostalCodes as $postalCode) {
|
||||
$user->addSite($this->site($postalCode));
|
||||
}
|
||||
if (null !== $currentSitePostalCode) {
|
||||
$user->setCurrentSite($this->site($currentSitePostalCode));
|
||||
}
|
||||
|
||||
$em->persist($user);
|
||||
$em->flush();
|
||||
$em->clear();
|
||||
|
||||
return ['username' => $username, 'password' => $password];
|
||||
}
|
||||
|
||||
/**
|
||||
* Ajoute un contact a un prestataire deja persiste (seed direct).
|
||||
*/
|
||||
protected function addContact(
|
||||
Provider $provider,
|
||||
?string $firstName = 'Marie',
|
||||
?string $lastName = 'Martin',
|
||||
?string $phonePrimary = null,
|
||||
?string $email = null,
|
||||
int $position = 0,
|
||||
): ProviderContact {
|
||||
$contact = new ProviderContact();
|
||||
$contact->setProvider($provider);
|
||||
$contact->setFirstName($firstName);
|
||||
$contact->setLastName($lastName);
|
||||
$contact->setPhonePrimary($phonePrimary);
|
||||
$contact->setEmail($email);
|
||||
$contact->setPosition($position);
|
||||
$provider->addContact($contact);
|
||||
$this->getEm()->persist($contact);
|
||||
$this->getEm()->flush();
|
||||
|
||||
return $contact;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ajoute un RIB a un prestataire deja persiste (seed direct).
|
||||
*/
|
||||
protected function addRib(Provider $provider, string $label = 'Compte principal'): ProviderRib
|
||||
{
|
||||
$rib = new ProviderRib();
|
||||
$rib->setProvider($provider);
|
||||
$rib->setLabel($label);
|
||||
$rib->setBic(self::VALID_BIC);
|
||||
$rib->setIban(self::VALID_IBAN);
|
||||
$provider->addRib($rib);
|
||||
$this->getEm()->persist($rib);
|
||||
$this->getEm()->flush();
|
||||
|
||||
return $rib;
|
||||
}
|
||||
|
||||
/**
|
||||
* Seede un prestataire COMPLET (sans passer par l'API — validations applicatives
|
||||
* non rejouees mais CHECK BDD respectes) : bloc comptable non nul (SIREN + refs),
|
||||
* >= 1 RIB, >= 2 sites en relation DIRECTE (formulaire principal, RG-3.03), >= 1
|
||||
* adresse multi-sites (>= 2 sites) avec >= 1 categorie PRESTATAIRE et >= 1 contact,
|
||||
* >= 1 contact et >= 1 categorie sur le prestataire. Socle du contrat de
|
||||
* serialisation et de la DoD (§ 4.0.bis), jumeau de seedCompleteSupplier (M2)
|
||||
* mais SANS onglet Information (absent au M3) et AVEC sites directs sur le
|
||||
* prestataire (NOUVEAU M3 — la liste affiche provider.sites, pas un agregat
|
||||
* d'adresses).
|
||||
*
|
||||
* @param string $paymentTypeCode code du type de reglement a poser (defaut LCR,
|
||||
* coherent avec le RIB seede ; RG-3.08)
|
||||
*/
|
||||
protected function seedCompleteProvider(string $companyName, string $paymentTypeCode = 'LCR'): Provider
|
||||
{
|
||||
$em = $this->getEm();
|
||||
|
||||
// Nom unique parmi les actifs (index partiel uq_provider_company_name_active).
|
||||
$suffix = substr(bin2hex(random_bytes(3)), 0, 6);
|
||||
|
||||
$provider = new Provider();
|
||||
$provider->setCompanyName(mb_strtoupper($companyName.' '.$suffix, 'UTF-8'));
|
||||
$provider->addCategory($this->providerCategory('NETTOYAGE'));
|
||||
|
||||
// Bloc comptable non nul (gating par omission cote sans accounting.view).
|
||||
$provider->setSiren('987654321');
|
||||
$provider->setAccountNumber('P0001');
|
||||
$provider->setNTva('FR00987654321');
|
||||
$provider->setTvaMode($this->tvaMode('FRANCE_VENTES'));
|
||||
$provider->setPaymentDelay($this->paymentDelay('J30'));
|
||||
$provider->setPaymentType($this->paymentType($paymentTypeCode));
|
||||
if ('VIREMENT' === $paymentTypeCode) {
|
||||
$provider->setBank($this->bank('SG'));
|
||||
}
|
||||
|
||||
// >= 2 sites fixtures : relation DIRECTE provider.sites (RG-3.03) pour la
|
||||
// LISTE + reutilises sur l'adresse multi-sites pour le DETAIL.
|
||||
$sites = $em->getRepository(Site::class)->findBy([], null, 2);
|
||||
self::assertGreaterThanOrEqual(2, count($sites), 'Au moins 2 sites fixtures requis (SitesFixtures).');
|
||||
foreach ($sites as $site) {
|
||||
$provider->addSite($site);
|
||||
}
|
||||
$em->persist($provider);
|
||||
|
||||
$contact = new ProviderContact();
|
||||
$contact->setProvider($provider);
|
||||
$contact->setFirstName('Marie');
|
||||
$contact->setLastName('Martin');
|
||||
$contact->setJobTitle('Responsable');
|
||||
$contact->setPhonePrimary('0612345678');
|
||||
$contact->setEmail('marie.martin@seed.test');
|
||||
$provider->addContact($contact);
|
||||
$em->persist($contact);
|
||||
|
||||
// Adresse simplifiee M3 (PAS de addressType / bennes / triageProvider).
|
||||
$address = new ProviderAddress();
|
||||
$address->setProvider($provider);
|
||||
$address->setCountry('France');
|
||||
$address->setPostalCode('86000');
|
||||
$address->setCity('Poitiers');
|
||||
$address->setStreet('12 rue des Acacias');
|
||||
foreach ($sites as $site) {
|
||||
$address->addSite($site);
|
||||
}
|
||||
$address->addCategory($this->providerCategory('NETTOYAGE'));
|
||||
$address->addContact($contact);
|
||||
$provider->addAddress($address);
|
||||
$em->persist($address);
|
||||
|
||||
$rib = new ProviderRib();
|
||||
$rib->setProvider($provider);
|
||||
$rib->setLabel('Compte principal');
|
||||
$rib->setBic(self::VALID_BIC);
|
||||
$rib->setIban(self::VALID_IBAN);
|
||||
$provider->addRib($rib);
|
||||
$em->persist($rib);
|
||||
|
||||
$em->flush();
|
||||
|
||||
return $provider;
|
||||
}
|
||||
|
||||
/**
|
||||
* Recupere un mode de TVA seede (CommercialReferentialFixtures) par code (ex.
|
||||
* FRANCE_VENTES). Echoue explicitement si absent (fixtures non chargees).
|
||||
*/
|
||||
protected function tvaMode(string $code): TvaMode
|
||||
{
|
||||
$tvaMode = $this->getEm()->getRepository(TvaMode::class)->findOneBy(['code' => $code]);
|
||||
|
||||
self::assertNotNull(
|
||||
$tvaMode,
|
||||
sprintf('Mode de TVA "%s" introuvable : fixtures comptables chargees (make test-db-setup) ?', $code),
|
||||
);
|
||||
|
||||
return $tvaMode;
|
||||
}
|
||||
|
||||
/**
|
||||
* Recupere un delai de reglement seede (CommercialReferentialFixtures) par code
|
||||
* (ex. J30). Echoue explicitement si absent (fixtures non chargees).
|
||||
*/
|
||||
protected function paymentDelay(string $code): PaymentDelay
|
||||
{
|
||||
$paymentDelay = $this->getEm()->getRepository(PaymentDelay::class)->findOneBy(['code' => $code]);
|
||||
|
||||
self::assertNotNull(
|
||||
$paymentDelay,
|
||||
sprintf('Delai de reglement "%s" introuvable : fixtures comptables chargees (make test-db-setup) ?', $code),
|
||||
);
|
||||
|
||||
return $paymentDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* Recupere un type de reglement seede (CommercialReferentialFixtures) par code
|
||||
* (ex. LCR, VIREMENT). Echoue explicitement si absent (fixtures non chargees).
|
||||
*/
|
||||
protected function paymentType(string $code): PaymentType
|
||||
{
|
||||
$paymentType = $this->getEm()->getRepository(PaymentType::class)->findOneBy(['code' => $code]);
|
||||
|
||||
self::assertNotNull(
|
||||
$paymentType,
|
||||
sprintf('Type de reglement "%s" introuvable : fixtures comptables chargees (make test-db-setup) ?', $code),
|
||||
);
|
||||
|
||||
return $paymentType;
|
||||
}
|
||||
|
||||
/**
|
||||
* Recupere une banque seedee (CommercialReferentialFixtures) par code (ex. SG).
|
||||
* Echoue explicitement si absente (fixtures non chargees).
|
||||
*/
|
||||
protected function bank(string $code): Bank
|
||||
{
|
||||
$bank = $this->getEm()->getRepository(Bank::class)->findOneBy(['code' => $code]);
|
||||
|
||||
self::assertNotNull(
|
||||
$bank,
|
||||
sprintf('Banque "%s" introuvable : fixtures comptables chargees (make test-db-setup) ?', $code),
|
||||
);
|
||||
|
||||
return $bank;
|
||||
}
|
||||
|
||||
/**
|
||||
* Indexe les violations d'un corps 422 par propertyPath (assert ciblee).
|
||||
*
|
||||
* @param array<string, mixed> $body corps decode (toArray(false))
|
||||
*
|
||||
* @return array<string, string> propertyPath => message
|
||||
*/
|
||||
protected function violationsByPath(array $body): array
|
||||
{
|
||||
$byPath = [];
|
||||
foreach ($body['violations'] ?? [] as $v) {
|
||||
$byPath[$v['propertyPath']] = $v['message'];
|
||||
}
|
||||
|
||||
return $byPath;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
/**
|
||||
* Tests fonctionnels des RG comptables inter-champs portees par les Assert\Callback
|
||||
* de l'entite Provider (M3, RG-3.07 / RG-3.08), via le PATCH de l'onglet
|
||||
* Comptabilite (groupe provider:write:accounting). On asserte le code HTTP et le
|
||||
* propertyPath de la violation (consommable par extractApiViolations cote front,
|
||||
* ERP-101). Jumeau de SupplierAccountingApiTest (M2), sans le bloc « completude de
|
||||
* l'onglet » : le prestataire est minimal et n'impose pas les six scalaires
|
||||
* comptables (spec M3 § 3.1).
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderAccountingValidationTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
// === RG-3.07 : Virement impose une banque ===
|
||||
|
||||
public function testVirementWithoutBankReturns422OnBankPath(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Virement No Bank');
|
||||
|
||||
$response = $client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE, 'Accept' => self::LD],
|
||||
'json' => ['paymentType' => '/api/payment_types/'.$this->paymentType('VIREMENT')->getId()],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
self::assertArrayHasKey('bank', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testVirementWithBankReturns200(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Virement With Bank');
|
||||
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => [
|
||||
'paymentType' => '/api/payment_types/'.$this->paymentType('VIREMENT')->getId(),
|
||||
'bank' => '/api/banks/'.$this->bank('SG')->getId(),
|
||||
],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
}
|
||||
|
||||
// === RG-3.08 : LCR impose au moins un RIB (volet ecriture du formulaire) ===
|
||||
|
||||
public function testLcrWithoutRibReturns422OnPaymentTypePath(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Lcr No Rib');
|
||||
|
||||
$response = $client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE, 'Accept' => self::LD],
|
||||
'json' => ['paymentType' => '/api/payment_types/'.$this->paymentType('LCR')->getId()],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
// Miroir client : violation portee sur `paymentType` (select « Type de
|
||||
// règlement »), les RIB n'ayant pas de champ de formulaire pour l'ancrer.
|
||||
self::assertArrayHasKey('paymentType', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testLcrWithRibReturns200(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Lcr With Rib');
|
||||
$this->addRib($seed);
|
||||
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['paymentType' => '/api/payment_types/'.$this->paymentType('LCR')->getId()],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
}
|
||||
|
||||
// violationsByPath() : helper mutualise dans AbstractProviderApiTestCase.
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
/**
|
||||
* Tests fonctionnels du formulaire principal prestataire (POST + PATCH) — ERP-134.
|
||||
* Couvre : creation (RG-3.03 sites obligatoires, RG-3.09 type categorie),
|
||||
* normalisation companyName (RG-3.11), 409 doublon (RG-3.10).
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderApiTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
public function testPostMainCreatesProvider(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Maintenance Pro', [self::SITE_86]),
|
||||
]);
|
||||
|
||||
self::assertSame(201, $response->getStatusCode());
|
||||
$body = $response->toArray();
|
||||
// RG-3.11 : companyName normalise en MAJUSCULES.
|
||||
self::assertSame('MAINTENANCE PRO', $body['companyName']);
|
||||
self::assertArrayHasKey('id', $body);
|
||||
// sites embarque (relation directe, site:read) avec name/postalCode.
|
||||
self::assertCount(1, $body['sites']);
|
||||
self::assertSame('86100', $body['sites'][0]['postalCode']);
|
||||
}
|
||||
|
||||
public function testPostWithoutSiteIsRejected(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
|
||||
$payload = $this->validMainPayload('Sans Site', [self::SITE_86]);
|
||||
$payload['sites'] = [];
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $payload,
|
||||
]);
|
||||
|
||||
// RG-3.03 : au moins un site obligatoire.
|
||||
self::assertSame(422, $response->getStatusCode());
|
||||
self::assertArrayHasKey('sites', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testPostWithoutCategoryIsRejected(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
|
||||
$payload = $this->validMainPayload('Sans Categorie', [self::SITE_86]);
|
||||
$payload['categories'] = [];
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $payload,
|
||||
]);
|
||||
|
||||
// RG-3.09 : au moins une categorie obligatoire.
|
||||
self::assertSame(422, $response->getStatusCode());
|
||||
self::assertArrayHasKey('categories', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testPostWithForeignCategoryTypeIsRejected(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$foreign = $this->foreignCategory();
|
||||
|
||||
$payload = $this->validMainPayload('Mauvais Type', [self::SITE_86]);
|
||||
$payload['categories'] = ['/api/categories/'.$foreign->getId()];
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $payload,
|
||||
]);
|
||||
|
||||
// RG-3.09 : categorie hors type PRESTATAIRE -> 422 sur `categories`.
|
||||
self::assertSame(422, $response->getStatusCode());
|
||||
self::assertArrayHasKey('categories', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testDuplicateCompanyNameReturns409(): void
|
||||
{
|
||||
$this->seedProvider('Doublon Sarl', [self::SITE_86]);
|
||||
$client = $this->createAdminClient();
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
// Casse differente : l'unicite est insensible a la casse (LOWER).
|
||||
'json' => $this->validMainPayload('doublon sarl', [self::SITE_86]),
|
||||
]);
|
||||
|
||||
// RG-3.10 : doublon de nom (case-insensitive) -> 409.
|
||||
self::assertSame(409, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testSameNameAfterArchiveIsAllowed(): void
|
||||
{
|
||||
// Index partiel : l'unicite ignore les archives -> reutilisation du nom OK.
|
||||
$this->seedProvider('Recyclage Express', [self::SITE_86], isArchived: true);
|
||||
$client = $this->createAdminClient();
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Recyclage Express', [self::SITE_86]),
|
||||
]);
|
||||
|
||||
self::assertSame(201, $response->getStatusCode());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use Doctrine\DBAL\Connection;
|
||||
|
||||
/**
|
||||
* Tests Audit du repertoire prestataires (M3, spec § 6). Jumeau du
|
||||
* {@see \App\Tests\Module\Commercial\Api\SupplierAuditTest} (M2). Couvre :
|
||||
* - POST / PATCH / archivage -> ligne audit_log entity_type='technique.Provider'
|
||||
* avec l'action et le diff attendus ;
|
||||
* - RIB : `#[Auditable]` SANS `#[AuditIgnore]` sur iban/bic -> ces champs sensibles
|
||||
* DOIVENT apparaitre dans le diff audite (decision § 2.7, miroir M1/M2) ;
|
||||
* - M2M `sites` : un PATCH du formulaire principal qui modifie les sites trace la
|
||||
* relation many-to-many (audit M2M automatique, § 2.7).
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderAuditTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
private const string PROVIDER_TYPE = 'technique.Provider';
|
||||
private const string RIB_TYPE = 'technique.ProviderRib';
|
||||
|
||||
private ?Connection $auditConnection = null;
|
||||
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
self::bootKernel();
|
||||
|
||||
/** @var Connection $conn */
|
||||
$conn = self::getContainer()->get('doctrine.dbal.audit_connection');
|
||||
$this->auditConnection = $conn;
|
||||
}
|
||||
|
||||
protected function tearDown(): void
|
||||
{
|
||||
if (null !== $this->auditConnection) {
|
||||
$this->auditConnection->close();
|
||||
}
|
||||
parent::tearDown();
|
||||
}
|
||||
|
||||
public function testPostProviderIsAudited(): void
|
||||
{
|
||||
$admin = $this->createAdminClient();
|
||||
$payload = $this->validMainPayload('Audit Created Co', [self::SITE_86]);
|
||||
|
||||
$created = $admin->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $payload,
|
||||
])->toArray();
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
|
||||
self::assertGreaterThanOrEqual(
|
||||
1,
|
||||
$this->countAudit(self::PROVIDER_TYPE, (string) $created['id'], 'create'),
|
||||
'Un audit_log "create" doit etre genere pour le prestataire.',
|
||||
);
|
||||
}
|
||||
|
||||
public function testPatchProviderIsAudited(): void
|
||||
{
|
||||
$admin = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Audit Patch Co', [self::SITE_86]);
|
||||
|
||||
$admin->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['companyName' => 'Audit Patch Renamed'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
self::assertGreaterThanOrEqual(
|
||||
1,
|
||||
$this->countAudit(self::PROVIDER_TYPE, (string) $seed->getId(), 'update'),
|
||||
'Un audit_log "update" doit etre genere pour le PATCH.',
|
||||
);
|
||||
}
|
||||
|
||||
public function testArchiveProviderIsAudited(): void
|
||||
{
|
||||
$admin = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Audit Archive Co', [self::SITE_86]);
|
||||
|
||||
$admin->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
$changes = $this->latestChanges(self::PROVIDER_TYPE, (string) $seed->getId(), 'update');
|
||||
self::assertArrayHasKey('isArchived', $changes, 'Le diff d\'archivage doit tracer isArchived.');
|
||||
}
|
||||
|
||||
public function testPatchSitesIsAuditedAsManyToMany(): void
|
||||
{
|
||||
$admin = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Audit Sites Co', [self::SITE_86]);
|
||||
|
||||
// PATCH du formulaire principal : on passe a 2 sites (86 + 17). L'audit M2M
|
||||
// automatique (§ 2.7) doit tracer la relation `sites` dans le diff.
|
||||
$admin->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['sites' => [
|
||||
'/api/sites/'.$this->site(self::SITE_86)->getId(),
|
||||
'/api/sites/'.$this->site(self::SITE_17)->getId(),
|
||||
]],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
$changes = $this->latestChanges(self::PROVIDER_TYPE, (string) $seed->getId(), 'update');
|
||||
self::assertArrayHasKey('sites', $changes, 'La modification M2M des sites doit etre tracee.');
|
||||
}
|
||||
|
||||
public function testRibCreateAuditIncludesIbanAndBic(): void
|
||||
{
|
||||
$admin = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Rib Audit Host', [self::SITE_86]);
|
||||
|
||||
$rib = $admin->request('POST', '/api/providers/'.$seed->getId().'/ribs', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'label' => 'Compte audite',
|
||||
'bic' => self::VALID_BIC,
|
||||
'iban' => self::VALID_IBAN,
|
||||
],
|
||||
])->toArray();
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
|
||||
$changes = $this->latestChanges(self::RIB_TYPE, (string) $rib['id'], 'create');
|
||||
self::assertArrayHasKey('iban', $changes, 'iban doit figurer dans le diff audite (pas d\'AuditIgnore).');
|
||||
self::assertArrayHasKey('bic', $changes, 'bic doit figurer dans le diff audite (pas d\'AuditIgnore).');
|
||||
self::assertSame(self::VALID_IBAN, $changes['iban']);
|
||||
self::assertSame(self::VALID_BIC, $changes['bic']);
|
||||
}
|
||||
|
||||
/**
|
||||
* Decode le `changes` (diff) de la derniere ligne audit_log correspondante.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
private function latestChanges(string $type, string $id, string $action): array
|
||||
{
|
||||
$rows = $this->auditConnection->fetchAllAssociative(
|
||||
'SELECT changes FROM audit_log WHERE entity_type = :type AND entity_id = :id AND action = :action ORDER BY performed_at DESC',
|
||||
['type' => $type, 'id' => $id, 'action' => $action],
|
||||
);
|
||||
self::assertGreaterThanOrEqual(1, count($rows), sprintf('Un audit_log "%s" doit exister pour %s#%s.', $action, $type, $id));
|
||||
|
||||
return json_decode((string) $rows[0]['changes'], true, flags: JSON_THROW_ON_ERROR);
|
||||
}
|
||||
|
||||
private function countAudit(string $type, string $id, string $action): int
|
||||
{
|
||||
return (int) $this->auditConnection->fetchOne(
|
||||
'SELECT COUNT(*) FROM audit_log WHERE entity_type = :type AND entity_id = :id AND action = :action',
|
||||
['type' => $type, 'id' => $id, 'action' => $action],
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,319 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use PhpOffice\PhpSpreadsheet\IOFactory;
|
||||
|
||||
/**
|
||||
* Tests fonctionnels de l'export XLSX du repertoire prestataires (M3, § 4.6).
|
||||
* Jumeau du {@see \App\Tests\Module\Commercial\Api\SupplierExportControllerTest}
|
||||
* (M2), augmente du cloisonnement par site (§ 2.13, propre au M3).
|
||||
*
|
||||
* Couvre : reponse 200 (Content-Type + Content-Disposition), exclusion des
|
||||
* archives par defaut, respect du filtre ?search, peuplement des colonnes contact
|
||||
* principal / categories / sites (relation directe provider.sites), gating de la
|
||||
* colonne SIREN selon technique.providers.accounting.view (admin ET user minimal a
|
||||
* permission explicite), dedup (prestataire multi-categories rendu sur une seule
|
||||
* ligne), cloisonnement par site (un user cloisonne n'exporte que son site), 403
|
||||
* sans technique.providers.view, 401 anonyme.
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderExportControllerTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
private const string XLSX_MIME = 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet';
|
||||
private const string EXPORT_URL = '/api/providers/export.xlsx';
|
||||
|
||||
public function testExportReturnsXlsxResponseWithAttachmentFilename(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$this->seedProvider('Export Alpha');
|
||||
|
||||
$response = $client->request('GET', self::EXPORT_URL);
|
||||
|
||||
self::assertResponseIsSuccessful();
|
||||
$headers = $response->getHeaders(false);
|
||||
self::assertStringContainsString(self::XLSX_MIME, $headers['content-type'][0] ?? '');
|
||||
|
||||
$disposition = $headers['content-disposition'][0] ?? '';
|
||||
self::assertStringContainsString('attachment; filename="repertoire-prestataires-', $disposition);
|
||||
self::assertMatchesRegularExpression(
|
||||
'/filename="repertoire-prestataires-\d{8}\.xlsx"/',
|
||||
$disposition,
|
||||
);
|
||||
|
||||
// Le binaire est un XLSX relisible dont la 1re ligne porte les en-tetes.
|
||||
$grid = $this->gridFromResponse($response->getContent());
|
||||
$headers = $grid[0];
|
||||
self::assertSame('Nom prestataire', $headers[0]);
|
||||
self::assertContains('Contact principal', $headers);
|
||||
self::assertContains('Téléphone principal', $headers);
|
||||
self::assertContains('Téléphone secondaire', $headers);
|
||||
self::assertContains('Email', $headers);
|
||||
self::assertContains('Catégories', $headers);
|
||||
self::assertContains('Sites', $headers);
|
||||
self::assertContains('Date de création', $headers);
|
||||
}
|
||||
|
||||
public function testExportExcludesArchivedByDefault(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$this->seedProvider('Active One');
|
||||
$this->seedProvider('Archived One', [self::SITE_86], true);
|
||||
|
||||
$names = $this->companyNames($client->request('GET', self::EXPORT_URL)->getContent());
|
||||
|
||||
self::assertContains('ACTIVE ONE', $names);
|
||||
self::assertNotContains('ARCHIVED ONE', $names);
|
||||
}
|
||||
|
||||
public function testExportRespectsSearchFilter(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$this->seedProvider('Searchable Alpha');
|
||||
$this->seedProvider('Other Beta');
|
||||
|
||||
$names = $this->companyNames(
|
||||
$client->request('GET', self::EXPORT_URL.'?search=alpha')->getContent(),
|
||||
);
|
||||
|
||||
self::assertContains('SEARCHABLE ALPHA', $names);
|
||||
self::assertNotContains('OTHER BETA', $names);
|
||||
}
|
||||
|
||||
/**
|
||||
* Les colonnes contact sont alimentees par le CONTACT PRINCIPAL : le contact
|
||||
* de plus petit `position` (decision D2, § 4.6). On seede deux contacts en
|
||||
* ordre de position inverse pour garantir que c'est bien le principal (et non
|
||||
* le premier insere) qui alimente la ligne.
|
||||
*/
|
||||
public function testExportUsesPrincipalContactColumns(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$provider = $this->seedProvider('Contact Co');
|
||||
|
||||
// position 1 (secondaire) insere en premier...
|
||||
$this->addContact($provider, 'Bob', 'Secondaire', '0600000001', 'bob@contact.co', 1);
|
||||
// ...position 0 (principal) insere ensuite : c'est lui qui doit gagner.
|
||||
$principal = $this->addContact($provider, 'Alice', 'Principal', '0612345678', 'alice@contact.co', 0);
|
||||
// Le telephone secondaire n'est pas porte par le helper de base : on le pose
|
||||
// directement sur le contact principal pour alimenter la colonne dediee.
|
||||
$principal->setPhoneSecondary('0698765432');
|
||||
$this->getEm()->flush();
|
||||
|
||||
$row = $this->rowFor($client->request('GET', self::EXPORT_URL)->getContent(), 'CONTACT CO');
|
||||
|
||||
self::assertNotNull($row, 'Ligne « CONTACT CO » introuvable dans l\'export.');
|
||||
self::assertSame('Principal Alice', $row[1]);
|
||||
self::assertSame('0612345678', $row[2]);
|
||||
self::assertSame('0698765432', $row[3]);
|
||||
self::assertSame('alice@contact.co', $row[4]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Colonnes « Catégories » et « Sites » : un oubli d'hydratation les rendrait
|
||||
* vides sans erreur (cf. ERP-100 cote client). Le site est porte EN DIRECT par
|
||||
* le prestataire (RG-3.03), contrairement au fournisseur M2 (via l'adresse).
|
||||
*/
|
||||
public function testExportPopulatesCategoryAndSiteColumns(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$this->seedProvider('Hydrate Co', [self::SITE_86], false, 'NETTOYAGE');
|
||||
|
||||
$flat = $this->flatten($this->gridFromResponse($client->request('GET', self::EXPORT_URL)->getContent()));
|
||||
|
||||
// Colonne « Catégories » : libelle de la categorie PRESTATAIRE (getName()).
|
||||
// Derive du helper de base (idempotent) plutot que de hardcoder le prefixe.
|
||||
self::assertStringContainsString((string) $this->providerCategory('NETTOYAGE')->getName(), $flat);
|
||||
// Colonne « Sites » : site rattache en direct au prestataire (RG-3.03).
|
||||
self::assertStringContainsString((string) $this->site(self::SITE_86)->getName(), $flat);
|
||||
}
|
||||
|
||||
public function testSirenColumnPresentWithAccountingView(): void
|
||||
{
|
||||
// L'admin bypass le RBAC : il a donc accounting.view -> colonne SIREN.
|
||||
$client = $this->createAdminClient();
|
||||
$this->seedProvider('Siren Co', [self::SITE_86], false, 'NETTOYAGE', '123456789');
|
||||
|
||||
$grid = $this->gridFromResponse($client->request('GET', self::EXPORT_URL)->getContent());
|
||||
|
||||
self::assertContains('SIREN', $grid[0]);
|
||||
self::assertStringContainsString('123456789', $this->flatten($grid));
|
||||
}
|
||||
|
||||
public function testSirenColumnAbsentWithoutAccountingView(): void
|
||||
{
|
||||
// Seed via admin, puis relecture par un user qui n'a QUE providers.view.
|
||||
$this->createAdminClient();
|
||||
$this->seedProvider('No Siren Co', [self::SITE_86], false, 'NETTOYAGE', '987654321');
|
||||
|
||||
$creds = $this->createUserWithPermission('technique.providers.view');
|
||||
$viewer = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$grid = $this->gridFromResponse($viewer->request('GET', self::EXPORT_URL)->getContent());
|
||||
|
||||
self::assertNotContains('SIREN', $grid[0]);
|
||||
self::assertStringNotContainsString('987654321', $this->flatten($grid));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gating SIREN prouve via une permission EXPLICITE (et non le bypass admin) :
|
||||
* un user minimal portant uniquement technique.providers.view +
|
||||
* technique.providers.accounting.view voit bien la colonne SIREN et sa valeur.
|
||||
* Complement de testSirenColumnPresentWithAccountingView (admin), qui ne prouve
|
||||
* pas que accounting.view SEULE suffit (l'admin bypasse le RBAC). Le pendant
|
||||
* negatif est couvert par testSirenColumnAbsentWithoutAccountingView.
|
||||
*/
|
||||
public function testSirenColumnPresentForMinimalUserWithAccountingView(): void
|
||||
{
|
||||
// Seed via admin, puis relecture par un user non-admin a 2 permissions.
|
||||
$this->createAdminClient();
|
||||
$this->seedProvider('Gated Siren Co', [self::SITE_86], false, 'NETTOYAGE', '456789123');
|
||||
|
||||
$creds = $this->createUserWithPermissions([
|
||||
'technique.providers.view',
|
||||
'technique.providers.accounting.view',
|
||||
]);
|
||||
$viewer = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$grid = $this->gridFromResponse($viewer->request('GET', self::EXPORT_URL)->getContent());
|
||||
|
||||
self::assertContains('SIREN', $grid[0]);
|
||||
self::assertStringContainsString('456789123', $this->flatten($grid));
|
||||
}
|
||||
|
||||
/**
|
||||
* Dedup : un prestataire portant >= 2 categories PRESTATAIRE est multiplie par
|
||||
* la jointure (selection/hydratation des collections) ; l'export doit le rendre
|
||||
* sur UNE SEULE ligne. On seede un prestataire a 2 categories et on assert qu'il
|
||||
* n'apparait qu'une fois dans la colonne « Nom prestataire ».
|
||||
*/
|
||||
public function testExportDeduplicatesProviderWithMultipleCategories(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$provider = $this->seedProvider('Multi Cat Co', [self::SITE_86], false, 'NETTOYAGE');
|
||||
// 2e categorie PRESTATAIRE sur le meme prestataire.
|
||||
$provider->addCategory($this->providerCategory('SECURITE'));
|
||||
$this->getEm()->flush();
|
||||
|
||||
$names = $this->companyNames($client->request('GET', self::EXPORT_URL)->getContent());
|
||||
|
||||
$occurrences = count(array_filter($names, static fn (string $name): bool => 'MULTI CAT CO' === $name));
|
||||
self::assertSame(
|
||||
1,
|
||||
$occurrences,
|
||||
'Un prestataire multi-categories doit apparaitre sur une seule ligne (dedup).',
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Cloisonnement par site (RG-3.17, § 2.13) : un user non-bypass cloisonne sur
|
||||
* le site 86 n'exporte QUE les prestataires rattaches au site 86 — les
|
||||
* prestataires des sites 17 / 82 sont exclus, comme dans la liste. Pendant
|
||||
* export de ProviderSiteScopeTest::testListIsScopedToCurrentSiteForNonBypassUser.
|
||||
*/
|
||||
public function testExportIsScopedToCurrentSiteForNonBypassUser(): void
|
||||
{
|
||||
// Pre-requis : module Sites actif (sinon currentSite = null, cloisonnement
|
||||
// no-op et ce test perd son sens).
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$this->createAdminClient();
|
||||
$this->seedProvider('Presta Site 86', [self::SITE_86]);
|
||||
$this->seedProvider('Presta Site 17', [self::SITE_17]);
|
||||
$this->seedProvider('Presta Site 82', [self::SITE_82]);
|
||||
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$names = $this->companyNames($client->request('GET', self::EXPORT_URL)->getContent());
|
||||
|
||||
self::assertContains('PRESTA SITE 86', $names);
|
||||
self::assertNotContains('PRESTA SITE 17', $names);
|
||||
self::assertNotContains('PRESTA SITE 82', $names);
|
||||
}
|
||||
|
||||
public function testForbiddenWithoutProvidersViewPermission(): void
|
||||
{
|
||||
$creds = $this->createUserWithPermission('core.users.view');
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$client->request('GET', self::EXPORT_URL);
|
||||
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testUnauthorizedWhenAnonymous(): void
|
||||
{
|
||||
$client = self::createClient();
|
||||
$client->request('GET', self::EXPORT_URL);
|
||||
|
||||
self::assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
/**
|
||||
* Relit le binaire XLSX d'une reponse et renvoie la grille de cellules.
|
||||
*
|
||||
* @return array<int, array<int, mixed>>
|
||||
*/
|
||||
private function gridFromResponse(string $binary): array
|
||||
{
|
||||
$tmp = tempnam(sys_get_temp_dir(), 'xlsx_export_test_');
|
||||
self::assertIsString($tmp);
|
||||
file_put_contents($tmp, $binary);
|
||||
|
||||
try {
|
||||
return IOFactory::load($tmp)->getActiveSheet()->toArray();
|
||||
} finally {
|
||||
@unlink($tmp);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Extrait la colonne « Nom prestataire » (1re colonne) des lignes de donnees.
|
||||
*
|
||||
* @return list<string>
|
||||
*/
|
||||
private function companyNames(string $binary): array
|
||||
{
|
||||
$grid = $this->gridFromResponse($binary);
|
||||
$rows = array_slice($grid, 1); // saute l'en-tete
|
||||
|
||||
return array_values(array_map(static fn (array $row): string => (string) ($row[0] ?? ''), $rows));
|
||||
}
|
||||
|
||||
/**
|
||||
* Renvoie la ligne de donnees dont la 1re colonne (nom) vaut $companyName.
|
||||
*
|
||||
* @return null|array<int, mixed>
|
||||
*/
|
||||
private function rowFor(string $binary, string $companyName): ?array
|
||||
{
|
||||
foreach (array_slice($this->gridFromResponse($binary), 1) as $row) {
|
||||
if ((string) ($row[0] ?? '') === $companyName) {
|
||||
return $row;
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Aplatit toute la grille en une chaine, pour les assertions de presence.
|
||||
*
|
||||
* @param array<int, array<int, mixed>> $grid
|
||||
*/
|
||||
private function flatten(array $grid): string
|
||||
{
|
||||
return implode('|', array_map(
|
||||
static fn (array $row): string => implode('|', array_map(static fn ($cell): string => (string) $cell, $row)),
|
||||
$grid,
|
||||
));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
/**
|
||||
* Tests de la liste paginee /api/providers (ProviderProvider) — ERP-134.
|
||||
* Couvre : envelope Hydra, tri companyName ASC, exclusion des archives,
|
||||
* ?includeArchived (RG-3.16). Joue en admin (bypass_scope -> pas de cloisonnement).
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderListTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
public function testListReturnsHydraEnvelopeSortedByName(): void
|
||||
{
|
||||
$this->seedProvider('Zeta Services', [self::SITE_86]);
|
||||
$this->seedProvider('Alpha Nettoyage', [self::SITE_86]);
|
||||
$this->seedProvider('Mu Maintenance', [self::SITE_86]);
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('GET', '/api/providers', [
|
||||
'headers' => ['Accept' => self::LD],
|
||||
]);
|
||||
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
$body = $response->toArray();
|
||||
|
||||
// Envelope Hydra : totalItems present + member.
|
||||
self::assertSame(3, $body['totalItems']);
|
||||
$names = array_column($body['member'], 'companyName');
|
||||
// Tri companyName ASC (RG-3.16) — noms normalises en MAJUSCULES.
|
||||
self::assertSame(['ALPHA NETTOYAGE', 'MU MAINTENANCE', 'ZETA SERVICES'], $names);
|
||||
}
|
||||
|
||||
public function testListExcludesArchivedByDefault(): void
|
||||
{
|
||||
$this->seedProvider('Actif Sas', [self::SITE_86]);
|
||||
$this->seedProvider('Archive Sarl', [self::SITE_86], isArchived: true);
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('GET', '/api/providers', [
|
||||
'headers' => ['Accept' => self::LD],
|
||||
]);
|
||||
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
$body = $response->toArray();
|
||||
self::assertSame(1, $body['totalItems']);
|
||||
self::assertSame('ACTIF SAS', $body['member'][0]['companyName']);
|
||||
}
|
||||
|
||||
public function testListIncludeArchivedReintegratesArchived(): void
|
||||
{
|
||||
$this->seedProvider('Actif Sas', [self::SITE_86]);
|
||||
$this->seedProvider('Archive Sarl', [self::SITE_86], isArchived: true);
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('GET', '/api/providers?includeArchived=true', [
|
||||
'headers' => ['Accept' => self::LD],
|
||||
]);
|
||||
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
self::assertSame(2, $response->toArray()['totalItems']);
|
||||
}
|
||||
|
||||
public function testListFiltersBySiteIdViaDirectRelation(): void
|
||||
{
|
||||
$this->seedProvider('Site 86 Only', [self::SITE_86]);
|
||||
$this->seedProvider('Site 17 Only', [self::SITE_17]);
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$site17 = $this->site(self::SITE_17);
|
||||
$response = $client->request('GET', '/api/providers?siteId='.$site17->getId(), [
|
||||
'headers' => ['Accept' => self::LD],
|
||||
]);
|
||||
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
$body = $response->toArray();
|
||||
self::assertSame(1, $body['totalItems']);
|
||||
self::assertSame('SITE 17 ONLY', $body['member'][0]['companyName']);
|
||||
}
|
||||
|
||||
public function testPaginationDisabledReturnsFullCollection(): void
|
||||
{
|
||||
$token = $this->token();
|
||||
for ($i = 0; $i < 3; ++$i) {
|
||||
$this->seedProvider($token.' Item'.$i, [self::SITE_86]);
|
||||
}
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
// ?pagination=false : echappatoire pour alimenter un <select> (regle n°13).
|
||||
$data = $client->request('GET', '/api/providers?search='.$token.'&pagination=false', [
|
||||
'headers' => ['Accept' => self::LD],
|
||||
])->toArray();
|
||||
|
||||
self::assertArrayHasKey('member', $data);
|
||||
self::assertCount(3, $data['member']);
|
||||
}
|
||||
|
||||
/**
|
||||
* Anti N+1 (§ 2.12) : le nombre de requetes SQL de la liste ne doit PAS croitre
|
||||
* avec le nombre de prestataires. On mesure pour N=2 puis N=4 (memes relations
|
||||
* embarquees : categories + sites directs + adresses.sites) et on exige un
|
||||
* compte IDENTIQUE — preuve que l'hydratation est batchee (WHERE IN) et non par
|
||||
* ligne.
|
||||
*/
|
||||
public function testListQueryCountDoesNotGrowWithRowCount(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
$token = $this->token();
|
||||
|
||||
$this->seedCompleteProvider($token.' A');
|
||||
$this->seedCompleteProvider($token.' B');
|
||||
$countFor2 = $this->countListQueries($token);
|
||||
|
||||
$this->seedCompleteProvider($token.' C');
|
||||
$this->seedCompleteProvider($token.' D');
|
||||
$countFor4 = $this->countListQueries($token);
|
||||
|
||||
self::assertSame(
|
||||
$countFor2,
|
||||
$countFor4,
|
||||
sprintf('Anti N+1 : le nombre de requetes liste doit etre constant (%d pour 2, %d pour 4).', $countFor2, $countFor4),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Filtre ?typeCode= (cree au M2, reutilise au M3) : GET /api/categories?typeCode=
|
||||
* PRESTATAIRE ne renvoie QUE les categories de type PRESTATAIRE — prerequis des
|
||||
* multi-selects Categorie du prestataire (DoD § 4.7).
|
||||
*/
|
||||
public function testCategoriesTypeCodeFilterReturnsOnlyPrestataire(): void
|
||||
{
|
||||
$prestataire = $this->providerCategory('NETTOYAGE');
|
||||
$foreign = $this->foreignCategory();
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$data = $client->request('GET', '/api/categories?typeCode=PRESTATAIRE&pagination=false', [
|
||||
'headers' => ['Accept' => self::LD],
|
||||
])->toArray();
|
||||
|
||||
$ids = array_column($data['member'], 'id');
|
||||
self::assertContains($prestataire->getId(), $ids, 'La categorie PRESTATAIRE doit etre presente.');
|
||||
self::assertNotContains($foreign->getId(), $ids, 'Une categorie d\'un autre type doit etre filtree.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Compte les requetes SQL emises par UN GET liste filtre, via le data holder de
|
||||
* debug Doctrine. Le holder est remis a zero juste avant la requete pour isoler
|
||||
* ses requetes (hors login).
|
||||
*/
|
||||
private function countListQueries(string $token): int
|
||||
{
|
||||
$http = $this->createAdminClient();
|
||||
$holder = self::getContainer()->get('doctrine.debug_data_holder');
|
||||
$holder->reset();
|
||||
|
||||
$http->request('GET', '/api/providers?search='.$token, ['headers' => ['Accept' => self::LD]]);
|
||||
|
||||
$data = $holder->getData();
|
||||
|
||||
return count($data['default'] ?? []);
|
||||
}
|
||||
|
||||
private function token(): string
|
||||
{
|
||||
return 'List'.substr(bin2hex(random_bytes(4)), 0, 8);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,279 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use ApiPlatform\Symfony\Bundle\Test\Client;
|
||||
use App\Module\Core\Infrastructure\DataFixtures\RbacDemoFixtures;
|
||||
use Symfony\Bundle\FrameworkBundle\Console\Application;
|
||||
use Symfony\Component\Console\Input\ArrayInput;
|
||||
use Symfony\Component\Console\Output\NullOutput;
|
||||
|
||||
/**
|
||||
* Matrice RBAC complete du repertoire prestataires par role metier (spec-back M3
|
||||
* § 2.9 + § 2.13, ERP-138). Valide 200/403 par verbe et par onglet pour
|
||||
* bureau / compta / commerciale / usine, le gating des champs comptables en
|
||||
* lecture (omission de cle) et le cloisonnement par site de l'Usine.
|
||||
*
|
||||
* Les comptes demo et la matrice sont seedes via la commande reelle
|
||||
* `app:seed-rbac --with-demo-users` (le MEME chemin qu'en recette), idempotente —
|
||||
* pas de mock de role. Jumeau de SupplierRBACMatrixTest (M2), avec la difference
|
||||
* structurante du M3 : l'Usine n'est plus « 403 partout » mais possede
|
||||
* `technique.providers.view` en lecture seule, CLOISONNEE a son site courant
|
||||
* (pas de `sites.bypass_scope`).
|
||||
*
|
||||
* Matrice § 2.9 (ERP-138) — rappel :
|
||||
* - bureau : providers.view + manage (ni accounting, ni archive) + bypass_scope
|
||||
* - compta : providers.view + accounting.view + accounting.manage (PAS manage) + bypass_scope
|
||||
* - commerciale : providers.view + manage (PAS accounting) + bypass_scope
|
||||
* - usine : providers.view seul, SANS bypass_scope (cloisonne a son site)
|
||||
* - archive : admin seul (aucun role metier)
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderRBACMatrixTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
private const string PWD = RbacDemoFixtures::DEMO_PASSWORD;
|
||||
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
|
||||
// Seed idempotent via la commande applicative (roles + matrice § 2.9 +
|
||||
// comptes demo). Exerce aussi le chemin de code prod.
|
||||
self::bootKernel();
|
||||
$application = new Application(self::$kernel);
|
||||
$application->setAutoExit(false);
|
||||
$exit = $application->run(
|
||||
new ArrayInput([
|
||||
'command' => 'app:seed-rbac',
|
||||
'--with-demo-users' => true,
|
||||
'--password' => self::PWD,
|
||||
]),
|
||||
new NullOutput(),
|
||||
);
|
||||
self::assertSame(
|
||||
0,
|
||||
$exit,
|
||||
'app:seed-rbac a echoue : les permissions technique.providers.* sont-elles synchronisees (app:sync-permissions) ?',
|
||||
);
|
||||
|
||||
self::ensureKernelShutdown();
|
||||
}
|
||||
|
||||
public function testBureauHasViewAndManageButNoAccountingNoArchive(): void
|
||||
{
|
||||
$seed = $this->seedProvider('Bureau Cible');
|
||||
$client = $this->authAs('bureau');
|
||||
|
||||
// view
|
||||
$client->request('GET', '/api/providers', ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// manage : creation OK (bypass_scope -> peut attacher le site 86)
|
||||
$client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Bureau Cree'),
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
|
||||
// manage : edition onglet principal OK
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['companyName' => 'Bureau Renomme'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// PAS accounting : edition onglet Comptabilite refusee
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['siren' => '123456789'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// PAS archive : archivage refuse
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testBureauDetailHasNoAccountingFields(): void
|
||||
{
|
||||
// Bureau a view mais PAS accounting.view : les champs comptables sont
|
||||
// ABSENTS du JSON (gating par omission, pas null).
|
||||
$provider = $this->seedProvider('Bureau Gating Co', [self::SITE_86], siren: '123456789');
|
||||
$client = $this->authAs('bureau');
|
||||
|
||||
$data = $client->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertArrayNotHasKey('siren', $data);
|
||||
self::assertArrayNotHasKey('accountNumber', $data);
|
||||
self::assertArrayNotHasKey('nTva', $data);
|
||||
self::assertArrayNotHasKey('tvaMode', $data);
|
||||
self::assertArrayNotHasKey('paymentType', $data);
|
||||
self::assertArrayNotHasKey('ribs', $data);
|
||||
}
|
||||
|
||||
public function testComptaCanEditAccountingOnly(): void
|
||||
{
|
||||
$seed = $this->seedProvider('Compta Cible');
|
||||
$client = $this->authAs('compta');
|
||||
|
||||
// view
|
||||
$client->request('GET', '/api/providers', ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// PAS manage : creation refusee
|
||||
$client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Compta Post'),
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// accounting.manage : edition onglet Comptabilite OK
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['siren' => '123456789'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// PAS manage : edition onglet principal refusee (mode strict RG-3.15)
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['companyName' => 'Compta Renomme'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// PAS archive : archivage refuse
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testComptaDetailHasAccountingFields(): void
|
||||
{
|
||||
// Compta a accounting.view : siren + ribs presents dans le JSON.
|
||||
$provider = $this->seedProvider('Compta View Co', [self::SITE_86], siren: '987654321');
|
||||
$this->addRib($provider);
|
||||
$client = $this->authAs('compta');
|
||||
|
||||
$data = $client->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertArrayHasKey('siren', $data);
|
||||
self::assertSame('987654321', $data['siren']);
|
||||
self::assertArrayHasKey('ribs', $data);
|
||||
self::assertNotEmpty($data['ribs']);
|
||||
}
|
||||
|
||||
public function testCommercialeHasViewAndManageButNoAccountingNoArchive(): void
|
||||
{
|
||||
$seed = $this->seedProvider('Commerciale Cible');
|
||||
$client = $this->authAs('commerciale');
|
||||
|
||||
// view
|
||||
$client->request('GET', '/api/providers', ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// manage : creation OK
|
||||
$client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Commerciale Cree'),
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
|
||||
// PAS accounting : edition onglet Comptabilite refusee
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['siren' => '123456789'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// PAS archive : archivage refuse
|
||||
$client->request('PATCH', '/api/providers/'.$seed->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testCommercialeDetailHasNoAccountingFields(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Commerciale Gating Co', [self::SITE_86], siren: '123456789');
|
||||
$client = $this->authAs('commerciale');
|
||||
|
||||
$data = $client->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertArrayNotHasKey('siren', $data);
|
||||
self::assertArrayNotHasKey('accountNumber', $data);
|
||||
self::assertArrayNotHasKey('nTva', $data);
|
||||
self::assertArrayNotHasKey('tvaMode', $data);
|
||||
self::assertArrayNotHasKey('paymentType', $data);
|
||||
self::assertArrayNotHasKey('ribs', $data);
|
||||
}
|
||||
|
||||
public function testUsineHasReadOnlyAccessScopedToItsSite(): void
|
||||
{
|
||||
// Usine a view (lecture seule), SANS manage / accounting / archive, et
|
||||
// SANS bypass_scope -> cloisonnee a son site courant (Chatellerault,
|
||||
// site 86, pose par ensureDemoUsers).
|
||||
$inScope = $this->seedProvider('Usine InScope', [self::SITE_86]);
|
||||
$client = $this->authAs('usine');
|
||||
|
||||
// view : liste OK (pas un 403 comme au M2)
|
||||
$client->request('GET', '/api/providers', ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// view : detail d'un prestataire de SON site OK
|
||||
$client->request('GET', '/api/providers/'.$inScope->getId(), ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
|
||||
// PAS manage : creation refusee
|
||||
$client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Usine Post'),
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// PAS manage : edition onglet principal refusee
|
||||
$client->request('PATCH', '/api/providers/'.$inScope->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['companyName' => 'Renomme Par Usine'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// PAS accounting : edition onglet Comptabilite refusee
|
||||
$client->request('PATCH', '/api/providers/'.$inScope->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['siren' => '123456789'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
// PAS archive : archivage refuse
|
||||
$client->request('PATCH', '/api/providers/'.$inScope->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testUsineCannotSeeProviderOutOfItsSite(): void
|
||||
{
|
||||
// Cloisonnement § 2.13 : un prestataire hors du site courant de l'Usine
|
||||
// (site 17, l'Usine est sur le site 86) -> 404 (ne pas reveler la ligne).
|
||||
$outOfScope = $this->seedProvider('Usine OutOfScope', [self::SITE_17]);
|
||||
$client = $this->authAs('usine');
|
||||
|
||||
$client->request('GET', '/api/providers/'.$outOfScope->getId(), ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertResponseStatusCodeSame(404);
|
||||
}
|
||||
|
||||
private function authAs(string $role): Client
|
||||
{
|
||||
return $this->authenticatedClient($role, self::PWD);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,176 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use App\Module\Technique\Domain\Entity\Provider;
|
||||
|
||||
/**
|
||||
* Tests du gating comptabilite + mode strict par groupe (ProviderProcessor /
|
||||
* ProviderReadGroupContextBuilder) — ERP-134.
|
||||
*
|
||||
* Couvre : gating accounting PAR OMISSION (siren/ribs absents sans accounting.view,
|
||||
* bug #4 M1), mode strict RG-3.15 (403 sur tout le payload), gating archive (RG-3.13).
|
||||
*
|
||||
* Les users sont crees via createUserWithPermissions() (parent) : rattaches a TOUS
|
||||
* les sites SANS currentSite -> CurrentSiteProvider::get() = null -> aucun
|
||||
* cloisonnement, on isole ainsi le comportement RBAC du comportement site.
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderRbacGatingTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
public function testAccountingFieldsOmittedWithoutAccountingView(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Compta Masquee', [self::SITE_86], siren: '123456789');
|
||||
$id = $provider->getId();
|
||||
|
||||
// Profil type Commerciale : view + manage SANS accounting.view.
|
||||
$creds = $this->createUserWithPermissions(['technique.providers.view']);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('GET', '/api/providers/'.$id, ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
|
||||
$body = $response->toArray();
|
||||
// Gating par omission : scalaires comptables ET ribs totalement absents.
|
||||
self::assertArrayNotHasKey('siren', $body);
|
||||
self::assertArrayNotHasKey('ribs', $body);
|
||||
// isArchived reste expose (bug #3 M1 : la cle ne doit pas etre droppee).
|
||||
self::assertArrayHasKey('isArchived', $body);
|
||||
}
|
||||
|
||||
public function testAccountingFieldsPresentWithAccountingView(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Compta Visible', [self::SITE_86], siren: '987654321');
|
||||
$id = $provider->getId();
|
||||
|
||||
$creds = $this->createUserWithPermissions([
|
||||
'technique.providers.view',
|
||||
'technique.providers.accounting.view',
|
||||
]);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('GET', '/api/providers/'.$id, ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
|
||||
$body = $response->toArray();
|
||||
self::assertSame('987654321', $body['siren']);
|
||||
// La cle ribs apparait (collection vide ici, mais presente).
|
||||
self::assertArrayHasKey('ribs', $body);
|
||||
}
|
||||
|
||||
public function testStrictModeRejectsMixedGroupsForManageOnlyUser(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Strict Cible', [self::SITE_86]);
|
||||
$id = $provider->getId();
|
||||
|
||||
// Profil type Bureau : manage SANS accounting.manage.
|
||||
$creds = $this->createUserWithPermissions([
|
||||
'technique.providers.view',
|
||||
'technique.providers.manage',
|
||||
]);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('PATCH', '/api/providers/'.$id, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['companyName' => 'Renomme', 'siren' => '111222333'],
|
||||
]);
|
||||
|
||||
// RG-3.15 : payload melangeant main + accounting sans accounting.manage
|
||||
// -> 403 sur tout le payload (mode strict, pas de filtrage silencieux).
|
||||
self::assertSame(403, $response->getStatusCode());
|
||||
|
||||
// Aucun champ n'a ete persiste (rollback du mode strict).
|
||||
$this->getEm()->clear();
|
||||
$reloaded = $this->getEm()->getRepository(Provider::class)->find($id);
|
||||
self::assertSame('STRICT CIBLE', $reloaded->getCompanyName());
|
||||
self::assertNull($reloaded->getSiren());
|
||||
}
|
||||
|
||||
public function testAccountingOnlyUserCanPatchAccountingButNotMain(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Compta Editrice', [self::SITE_86]);
|
||||
$id = $provider->getId();
|
||||
|
||||
// Profil type Compta : accounting.view + accounting.manage SANS manage.
|
||||
$creds = $this->createUserWithPermissions([
|
||||
'technique.providers.view',
|
||||
'technique.providers.accounting.view',
|
||||
'technique.providers.accounting.manage',
|
||||
]);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
// PATCH accounting -> 200.
|
||||
$ok = $client->request('PATCH', '/api/providers/'.$id, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['siren' => '555666777'],
|
||||
]);
|
||||
self::assertSame(200, $ok->getStatusCode());
|
||||
|
||||
// PATCH main (companyName) -> 403 (pas de permission manage).
|
||||
$ko = $client->request('PATCH', '/api/providers/'.$id, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['companyName' => 'Interdit'],
|
||||
]);
|
||||
self::assertSame(403, $ko->getStatusCode());
|
||||
}
|
||||
|
||||
public function testArchiveRequiresArchivePermission(): void
|
||||
{
|
||||
$provider = $this->seedProvider('A Archiver', [self::SITE_86]);
|
||||
$id = $provider->getId();
|
||||
|
||||
// Bureau (manage) sans archive -> 403.
|
||||
$creds = $this->createUserWithPermissions([
|
||||
'technique.providers.view',
|
||||
'technique.providers.manage',
|
||||
]);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('PATCH', '/api/providers/'.$id, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
|
||||
// RG-3.13 : l'archivage exige technique.providers.archive.
|
||||
self::assertSame(403, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testAdminCanArchiveAndSetsArchivedAt(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Archivable', [self::SITE_86]);
|
||||
$id = $provider->getId();
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('PATCH', '/api/providers/'.$id, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => true],
|
||||
]);
|
||||
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
|
||||
$this->getEm()->clear();
|
||||
$reloaded = $this->getEm()->getRepository(Provider::class)->find($id);
|
||||
self::assertTrue($reloaded->isArchived());
|
||||
self::assertNotNull($reloaded->getArchivedAt());
|
||||
}
|
||||
|
||||
public function testRestoreWithNameConflictReturns409(): void
|
||||
{
|
||||
// Un prestataire archive porte un nom qu'un prestataire ACTIF a repris
|
||||
// entre-temps (autorise par l'index partiel : l'archive n'y figure pas).
|
||||
$archived = $this->seedProvider('Conflit Co', [self::SITE_86], isArchived: true);
|
||||
$this->seedProvider('Conflit Co', [self::SITE_86]); // actif, meme nom normalise
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('PATCH', '/api/providers/'.$archived->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['isArchived' => false],
|
||||
]);
|
||||
|
||||
// RG-3.14 : restaurer ferait deux actifs homonymes -> 409 (pas de 500 SQL).
|
||||
self::assertSame(409, $response->getStatusCode());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,365 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
/**
|
||||
* Tests anti-regression du CONTRAT DE SERIALISATION du repertoire prestataires
|
||||
* (M3, spec-back § 4.0 / § 4.0.bis). Jumeau du
|
||||
* {@see \App\Tests\Module\Commercial\Api\SupplierSerializationContractTest} (M2),
|
||||
* il reverifie sur le JSON REEL les pieges silencieux herites du M1/M2 :
|
||||
* - #4 : fuite RIB (IBAN/BIC) vers un user sans accounting.view -> cle `ribs`
|
||||
* ABSENTE pour un profil type Commerciale (gating par omission).
|
||||
* - #3 : booleens droppes (Groups sur la propriete `isX`, getter derivant `x`)
|
||||
* -> isArchived present dans le detail.
|
||||
* - #1 : categories embarquees sans code/name -> code + name presents en LISTE
|
||||
* ET DETAIL (provider ET adresse).
|
||||
* - #2 : sites embarques en IRI nu -> name + postalCode presents en LISTE
|
||||
* (relation DIRECTE provider.sites — RG-3.03) ET DETAIL (addresses[].sites[]).
|
||||
* - ERP-92 : refs comptables (tvaMode/paymentDelay/paymentType/bank) embarquees
|
||||
* {id, code, label} et non IRI nu (le groupe provider:read:accounting doit
|
||||
* etre porte par les entites partagees — fix ERP-139, sinon IRI nu).
|
||||
* Plus l'enveloppe AP4 (member/totalItems/view sans prefixe hydra:, archives exclus).
|
||||
*
|
||||
* REGLE D'OR : ces tests assertent sur le CORPS JSON reel, jamais sur les
|
||||
* annotations. Toute regression de groupe de serialisation casse ici.
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderSerializationContractTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
// === #4 — Gating des RIB par accounting.view ===
|
||||
|
||||
public function testRibsPresentForAdminWithAccountingView(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Rib Admin Co');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// Admin bypass RBAC -> accounting.view -> RIB embarques (label/bic/iban).
|
||||
self::assertArrayHasKey('ribs', $data);
|
||||
self::assertNotEmpty($data['ribs']);
|
||||
self::assertSame('Compte principal', $data['ribs'][0]['label']);
|
||||
self::assertSame(self::VALID_IBAN, $data['ribs'][0]['iban']);
|
||||
self::assertSame(self::VALID_BIC, $data['ribs'][0]['bic']);
|
||||
}
|
||||
|
||||
public function testRibsAbsentForUserWithoutAccountingView(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Rib Commerciale Co');
|
||||
|
||||
// Profil type Commerciale : technique.providers.view SANS accounting.view.
|
||||
// createUserWithPermissions n'attache pas de currentSite -> pas de
|
||||
// cloisonnement, on isole le gating comptable du comportement site.
|
||||
$creds = $this->createUserWithPermissions(['technique.providers.view']);
|
||||
$http = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// La cle `ribs` est ABSENTE (pas null) : le groupe provider:read:accounting
|
||||
// n'est pas ajoute au contexte -> getRibs() jamais serialise. Fin de la
|
||||
// fuite IBAN/BIC (piege n°4 du M1).
|
||||
self::assertArrayNotHasKey('ribs', $data);
|
||||
}
|
||||
|
||||
// === #4.bis — Gating par OMISSION des scalaires comptables ===
|
||||
|
||||
public function testAccountingScalarsGatedByOmission(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Compta Gating Co');
|
||||
$id = $provider->getId();
|
||||
|
||||
// Admin : scalaires comptables presents.
|
||||
$admin = $this->createAdminClient();
|
||||
$adminData = $admin->request('GET', '/api/providers/'.$id, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
self::assertArrayHasKey('siren', $adminData);
|
||||
self::assertSame('987654321', $adminData['siren']);
|
||||
self::assertArrayHasKey('accountNumber', $adminData);
|
||||
self::assertArrayHasKey('paymentType', $adminData);
|
||||
|
||||
// Sans accounting.view : scalaires comptables ABSENTS (omission, pas null).
|
||||
$creds = $this->createUserWithPermissions(['technique.providers.view']);
|
||||
$http = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
$data = $http->request('GET', '/api/providers/'.$id, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertArrayNotHasKey('siren', $data);
|
||||
self::assertArrayNotHasKey('accountNumber', $data);
|
||||
self::assertArrayNotHasKey('nTva', $data);
|
||||
self::assertArrayNotHasKey('tvaMode', $data);
|
||||
self::assertArrayNotHasKey('paymentType', $data);
|
||||
self::assertArrayNotHasKey('ribs', $data);
|
||||
}
|
||||
|
||||
// === ERP-139 — Refs comptables embarquees {id, code, label} et non IRI nu ===
|
||||
|
||||
public function testAccountingReferentialsEmbedIdCodeLabel(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
// Reglement VIREMENT -> banque renseignee : on couvre les 4 referentiels.
|
||||
$provider = $this->seedCompleteProvider('Refs Embed Co', 'VIREMENT');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// Avant fix ERP-139 : ces refs sortaient en IRI nu ("/api/tva_modes/30")
|
||||
// car les entites partagees ne portaient que client:/supplier:read:accounting,
|
||||
// pas provider:read:accounting. Apres fix : objet {id, code, label} embarque
|
||||
// (le front consultation/edition affiche le libelle sans fetch — § 4.0.bis).
|
||||
foreach (['tvaMode', 'paymentDelay', 'paymentType', 'bank'] as $ref) {
|
||||
self::assertArrayHasKey($ref, $data, sprintf('Le ref comptable "%s" doit etre present.', $ref));
|
||||
self::assertIsArray($data[$ref], sprintf('Le ref "%s" doit etre un objet embarque, pas un IRI nu.', $ref));
|
||||
self::assertArrayHasKey('id', $data[$ref]);
|
||||
self::assertArrayHasKey('label', $data[$ref]);
|
||||
self::assertNotSame('', (string) $data[$ref]['label']);
|
||||
}
|
||||
|
||||
// paymentType embarque aussi son code (logique front VIREMENT/LCR).
|
||||
self::assertArrayHasKey('code', $data['paymentType']);
|
||||
self::assertSame('VIREMENT', $data['paymentType']['code']);
|
||||
}
|
||||
|
||||
// === #3 — Booleen isArchived present dans le JSON ===
|
||||
|
||||
public function testProviderIsArchivedBooleanIsPresentInDetail(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Bool Archived Co');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// isArchived expose via Groups + SerializedName('isArchived') sur le getter :
|
||||
// sans cela Symfony exposerait la cle "archived" et la droppait (piege n°3 M1).
|
||||
self::assertArrayHasKey('isArchived', $data);
|
||||
self::assertFalse($data['isArchived']);
|
||||
}
|
||||
|
||||
// === #1 — Embed code/name des Category (liste ET detail) ===
|
||||
|
||||
public function testCategoriesEmbedCodeAndNameInDetail(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Embed Cat Detail Co');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertNotEmpty($data['categories']);
|
||||
$category = $data['categories'][0];
|
||||
// Avant correctif : seuls @id/@type (category:read absent du contexte).
|
||||
// Apres : code + name embarques.
|
||||
self::assertArrayHasKey('code', $category);
|
||||
self::assertArrayHasKey('name', $category);
|
||||
self::assertSame('NETTOYAGE', $category['code']);
|
||||
|
||||
// Categories d'adresse aussi (category:read dans le contexte du detail).
|
||||
self::assertArrayHasKey('categories', $data['addresses'][0]);
|
||||
self::assertNotEmpty($data['addresses'][0]['categories']);
|
||||
self::assertArrayHasKey('code', $data['addresses'][0]['categories'][0]);
|
||||
}
|
||||
|
||||
public function testCategoriesEmbedCodeAndNameInList(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$token = 'CatList'.substr(bin2hex(random_bytes(3)), 0, 6);
|
||||
$provider = $this->seedCompleteProvider($token);
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$list = $http->request('GET', '/api/providers?search='.$token, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
$row = $this->memberById($list, (int) $provider->getId());
|
||||
self::assertNotNull($row, 'Le prestataire seede doit apparaitre dans la liste filtree.');
|
||||
self::assertNotEmpty($row['categories']);
|
||||
self::assertArrayHasKey('code', $row['categories'][0]);
|
||||
self::assertArrayHasKey('name', $row['categories'][0]);
|
||||
self::assertSame('NETTOYAGE', $row['categories'][0]['code']);
|
||||
}
|
||||
|
||||
// === #2 — Embed name/postalCode des Site (liste via relation directe + detail) ===
|
||||
|
||||
public function testSitesEmbedNameAndPostalCodeInList(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$token = 'SiteList'.substr(bin2hex(random_bytes(3)), 0, 6);
|
||||
$provider = $this->seedCompleteProvider($token);
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$list = $http->request('GET', '/api/providers?search='.$token, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
$row = $this->memberById($list, (int) $provider->getId());
|
||||
self::assertNotNull($row);
|
||||
// sites en relation DIRECTE provider.sites (RG-3.03) : objet Site entier
|
||||
// (name + postalCode), pas un IRI nu (piege n°2 M1). Multi-sites (>= 2).
|
||||
self::assertArrayHasKey('sites', $row);
|
||||
self::assertGreaterThanOrEqual(2, count($row['sites']));
|
||||
self::assertArrayHasKey('name', $row['sites'][0]);
|
||||
self::assertArrayHasKey('postalCode', $row['sites'][0]);
|
||||
self::assertNotSame('', (string) $row['sites'][0]['name']);
|
||||
}
|
||||
|
||||
public function testSitesEmbedNameAndPostalCodeInDetail(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Site Detail Co');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// Sites du formulaire principal (relation directe).
|
||||
self::assertArrayHasKey('sites', $data);
|
||||
self::assertGreaterThanOrEqual(2, count($data['sites']));
|
||||
self::assertArrayHasKey('name', $data['sites'][0]);
|
||||
self::assertArrayHasKey('postalCode', $data['sites'][0]);
|
||||
|
||||
// Sites de l'adresse (addresses[].sites[]).
|
||||
$address = $data['addresses'][0];
|
||||
self::assertArrayHasKey('sites', $address);
|
||||
self::assertGreaterThanOrEqual(2, count($address['sites']), 'L\'adresse seedee est multi-sites.');
|
||||
self::assertArrayHasKey('name', $address['sites'][0]);
|
||||
self::assertArrayHasKey('postalCode', $address['sites'][0]);
|
||||
self::assertNotSame('', (string) $address['sites'][0]['name']);
|
||||
}
|
||||
|
||||
// === Detail : sous-collections embarquees ===
|
||||
|
||||
public function testDetailEmbedsContactsAddressesRibs(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('Embed Subres Co');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertNotEmpty($data['contacts']);
|
||||
self::assertSame('Marie', $data['contacts'][0]['firstName']);
|
||||
self::assertSame('Martin', $data['contacts'][0]['lastName']);
|
||||
self::assertArrayHasKey('email', $data['contacts'][0]);
|
||||
|
||||
self::assertNotEmpty($data['addresses']);
|
||||
// M3 : adresse simplifiee, PAS de addressType.
|
||||
self::assertArrayNotHasKey('addressType', $data['addresses'][0]);
|
||||
self::assertSame('Poitiers', $data['addresses'][0]['city']);
|
||||
|
||||
self::assertNotEmpty($data['ribs']);
|
||||
}
|
||||
|
||||
// === refonte-contact V0.2 : pas de contact inline sur le prestataire ===
|
||||
|
||||
public function testProviderHasNoInlineContactFields(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$provider = $this->seedCompleteProvider('No Inline Contact Co');
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$data = $http->request('GET', '/api/providers/'.$provider->getId(), ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// Les champs de contact vivent UNIQUEMENT sous contacts[] (refonte-contact).
|
||||
foreach (['firstName', 'lastName', 'phonePrimary', 'phoneSecondary', 'email'] as $key) {
|
||||
self::assertArrayNotHasKey($key, $data, sprintf('Le champ inline "%s" ne doit plus exister au niveau du prestataire.', $key));
|
||||
}
|
||||
}
|
||||
|
||||
// === Enveloppe AP4 (sans prefixe hydra:) + exclusion des archives ===
|
||||
|
||||
public function testCollectionEnvelopeShapeAndArchivedExcluded(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$http = $this->createAdminClient();
|
||||
$token = 'EnvCheck'.substr(bin2hex(random_bytes(3)), 0, 6);
|
||||
|
||||
$this->seedProvider($token.' Active', [self::SITE_86]);
|
||||
$this->seedProvider($token.' Archived', [self::SITE_86], isArchived: true);
|
||||
|
||||
// Liste par defaut filtree sur le token : enveloppe member/totalItems sans
|
||||
// prefixe hydra:, archive EXCLU du totalItems (RG-3.16).
|
||||
$default = $http->request('GET', '/api/providers?search='.$token, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
self::assertArrayHasKey('member', $default);
|
||||
self::assertArrayHasKey('totalItems', $default);
|
||||
self::assertArrayNotHasKey('hydra:member', $default);
|
||||
self::assertArrayNotHasKey('hydra:totalItems', $default);
|
||||
self::assertSame(1, $default['totalItems'], 'Archive exclu du totalItems par defaut.');
|
||||
|
||||
// includeArchived : l'archive reintegre le total.
|
||||
$all = $http->request('GET', '/api/providers?search='.$token.'&includeArchived=true', ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
self::assertSame(2, $all['totalItems']);
|
||||
|
||||
// `view` (PartialCollectionView) sans prefixe hydra:.
|
||||
$paged = $http->request('GET', '/api/providers?search='.$token.'&includeArchived=true&itemsPerPage=1', ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
self::assertArrayHasKey('view', $paged);
|
||||
self::assertArrayNotHasKey('hydra:view', $paged);
|
||||
}
|
||||
|
||||
/**
|
||||
* DoD (§ 4.0.bis) : capture des reponses JSON REELLES (liste + detail admin +
|
||||
* detail sans accounting.view) pour les coller dans la spec avant de lancer les
|
||||
* tickets front. Le test asserte la forme ; si la variable d'env
|
||||
* PROVIDER_DOD_DUMP est positionnee, il ecrit aussi les 3 corps formates sous
|
||||
* /tmp pour copie.
|
||||
*/
|
||||
public function testDodReferenceJsonShape(): void
|
||||
{
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
|
||||
$token = 'DoD'.substr(bin2hex(random_bytes(3)), 0, 6);
|
||||
$provider = $this->seedCompleteProvider($token);
|
||||
$id = (int) $provider->getId();
|
||||
|
||||
$admin = $this->createAdminClient();
|
||||
$list = $admin->request('GET', '/api/providers?search='.$token, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
$detailAdmin = $admin->request('GET', '/api/providers/'.$id, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
$creds = $this->createUserWithPermissions(['technique.providers.view']);
|
||||
$restricted = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
$detailRestricted = $restricted->request('GET', '/api/providers/'.$id, ['headers' => ['Accept' => self::LD]])->toArray();
|
||||
|
||||
// Forme minimale attendue (la DoD valide que tout champ front est present).
|
||||
self::assertArrayHasKey('member', $list);
|
||||
self::assertArrayHasKey('siren', $detailAdmin);
|
||||
self::assertArrayHasKey('ribs', $detailAdmin);
|
||||
self::assertArrayNotHasKey('siren', $detailRestricted);
|
||||
self::assertArrayNotHasKey('ribs', $detailRestricted);
|
||||
|
||||
if (false !== getenv('PROVIDER_DOD_DUMP')) {
|
||||
$flags = JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES;
|
||||
file_put_contents('/tmp/provider-dod-list.json', json_encode($list, $flags));
|
||||
file_put_contents('/tmp/provider-dod-detail-admin.json', json_encode($detailAdmin, $flags));
|
||||
file_put_contents('/tmp/provider-dod-detail-restricted.json', json_encode($detailRestricted, $flags));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrouve un membre de la collection par son id (liste filtree).
|
||||
*
|
||||
* @param array<string, mixed> $collection
|
||||
*
|
||||
* @return array<string, mixed>|null
|
||||
*/
|
||||
private function memberById(array $collection, int $id): ?array
|
||||
{
|
||||
foreach ($collection['member'] ?? [] as $member) {
|
||||
if (($member['id'] ?? null) === $id) {
|
||||
return $member;
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,171 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
/**
|
||||
* Tests du cloisonnement par site pilote par l'utilisateur (RG-3.17 / § 2.13) —
|
||||
* ERP-134. Couvre la LECTURE (liste filtree avant pagination + totalItems, detail
|
||||
* 404 hors perimetre, bypass voit tout) et l'ECRITURE (sites hors user_site -> 422).
|
||||
*
|
||||
* Cloisonnement pilote par l'USER (pas le role) : on cree des users non-admin SANS
|
||||
* `sites.bypass_scope`, rattaches a un site precis avec un currentSite. L'admin
|
||||
* (isAdmin -> bypass total) sert de temoin « voit tout ».
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderSiteScopeTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
// Pre-requis : le module Sites doit etre actif (sinon currentSite = null,
|
||||
// cloisonnement no-op et ces tests perdent leur sens).
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
}
|
||||
|
||||
public function testListIsScopedToCurrentSiteForNonBypassUser(): void
|
||||
{
|
||||
$this->seedProvider('Presta Site 86', [self::SITE_86]);
|
||||
$this->seedProvider('Presta Site 17', [self::SITE_17]);
|
||||
$this->seedProvider('Presta Site 82', [self::SITE_82]);
|
||||
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('GET', '/api/providers', ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
|
||||
$body = $response->toArray();
|
||||
// totalItems reflete le PERIMETRE de l'user (filtre avant pagination).
|
||||
self::assertSame(1, $body['totalItems']);
|
||||
self::assertSame('PRESTA SITE 86', $body['member'][0]['companyName']);
|
||||
}
|
||||
|
||||
public function testDetailOutOfScopeReturns404(): void
|
||||
{
|
||||
$inScope = $this->seedProvider('Dans Perimetre', [self::SITE_86]);
|
||||
$outOfScope = $this->seedProvider('Hors Perimetre', [self::SITE_17]);
|
||||
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
// In-scope -> 200.
|
||||
$ok = $client->request('GET', '/api/providers/'.$inScope->getId(), ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(200, $ok->getStatusCode());
|
||||
|
||||
// Out-of-scope -> 404 (ne pas reveler l'existence hors perimetre).
|
||||
$ko = $client->request('GET', '/api/providers/'.$outOfScope->getId(), ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(404, $ko->getStatusCode());
|
||||
}
|
||||
|
||||
public function testBypassUserSeesAllSites(): void
|
||||
{
|
||||
$this->seedProvider('Presta Site 86', [self::SITE_86]);
|
||||
$this->seedProvider('Presta Site 17', [self::SITE_17]);
|
||||
$this->seedProvider('Presta Site 82', [self::SITE_82]);
|
||||
|
||||
// Admin = bypass total.
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('GET', '/api/providers', ['headers' => ['Accept' => self::LD]]);
|
||||
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
self::assertSame(3, $response->toArray()['totalItems']);
|
||||
}
|
||||
|
||||
public function testWriteOutOfScopeSiteRejectedAtIriResolution(): void
|
||||
{
|
||||
// User non-bypass / non-read_ref : la resolution de l'IRI du site hors
|
||||
// perimetre echoue en amont (SiteCollectionScopedExtension : item Site
|
||||
// « introuvable ») -> 400 anti-enumeration, avant le ProviderProcessor.
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view', 'technique.providers.manage'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Hors Scope Sas', [self::SITE_17]),
|
||||
]);
|
||||
|
||||
self::assertSame(400, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testWriteOutOfScopeSiteRejectedByProcessorGuard(): void
|
||||
{
|
||||
// User `sites.read_ref` : peut RESOUDRE n'importe quel site (referentiel
|
||||
// transverse) mais n'opere que sur ses user_site. La garde guardSiteScope
|
||||
// du ProviderProcessor est alors l'enforcement autoritaire de RG-3.17
|
||||
// -> 422 sur `sites` (mappable inline, ERP-101).
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view', 'technique.providers.manage', 'sites.read_ref'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Hors Scope Guard', [self::SITE_17]),
|
||||
]);
|
||||
|
||||
self::assertSame(422, $response->getStatusCode());
|
||||
self::assertArrayHasKey('sites', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testWriteAllowsSiteWithinUserScope(): void
|
||||
{
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view', 'technique.providers.manage'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
// Site 86 = un des user_site -> 201.
|
||||
$response = $client->request('POST', '/api/providers', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => $this->validMainPayload('Dans Scope Sas', [self::SITE_86]),
|
||||
]);
|
||||
|
||||
self::assertSame(201, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testPatchAddingOutOfScopeSiteIsRejected(): void
|
||||
{
|
||||
$provider = $this->seedProvider('Patch Sites', [self::SITE_86]);
|
||||
$id = $provider->getId();
|
||||
|
||||
// read_ref pour pouvoir resoudre l'IRI du site 17 (sinon 400 en amont) et
|
||||
// exercer la garde guardSiteScope sur le PATCH.
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view', 'technique.providers.manage', 'sites.read_ref'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$site86 = $this->site(self::SITE_86)->getId();
|
||||
$site17 = $this->site(self::SITE_17)->getId();
|
||||
|
||||
$response = $client->request('PATCH', '/api/providers/'.$id, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['sites' => ['/api/sites/'.$site86, '/api/sites/'.$site17]],
|
||||
]);
|
||||
|
||||
// RG-3.17 : ajouter un site hors user_site -> 422 (garde Processor).
|
||||
self::assertSame(422, $response->getStatusCode());
|
||||
self::assertArrayHasKey('sites', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,411 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use App\Module\Technique\Domain\Entity\Provider;
|
||||
|
||||
/**
|
||||
* Tests fonctionnels des sous-ressources Contacts / Adresses / RIB du prestataire
|
||||
* (M3, spec § 4.5 — ERP-135). Couvrent : normalisation contact (RG-3.11), RG-3.04
|
||||
* (au moins un champ parmi prenom/nom/fonction/telephone/email), RG-3.05 (>= 1 site sur
|
||||
* l'adresse), RG-3.06 (code postal), RG-3.09 (categorie PRESTATAIRE sur adresse),
|
||||
* le cloisonnement d'ecriture des sites de l'adresse (§ 2.13 -> 422 sur `sites`),
|
||||
* RG-3.08 (DELETE dernier RIB sous LCR -> 409), DELETE contact libre au M3 (pas de
|
||||
* garde « dernier contact ») et le gating selon permission (Contacts/Adresses =
|
||||
* manage, RIB = accounting.manage). Jumeau de SupplierSubResourceApiTest.
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderSubResourceApiTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
// seedProvider exige >= 1 site (RG-3.03) : le module Sites doit etre actif.
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
}
|
||||
|
||||
// === Contacts (security: technique.providers.manage) ===
|
||||
|
||||
public function testPostContactNormalizesFields(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Contact Host');
|
||||
|
||||
$data = $client->request('POST', '/api/providers/'.$seed->getId().'/contacts', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'firstName' => 'JEAN',
|
||||
'lastName' => 'dupont',
|
||||
'phonePrimary' => '06.12.34.56.78',
|
||||
'email' => 'Jean.DUPONT@ACME.FR',
|
||||
],
|
||||
])->toArray();
|
||||
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
// RG-3.11 : prenom/nom Title Case, telephone chiffres seuls, email lowercase.
|
||||
self::assertSame('Jean', $data['firstName']);
|
||||
self::assertSame('Dupont', $data['lastName']);
|
||||
self::assertSame('0612345678', $data['phonePrimary']);
|
||||
self::assertSame('jean.dupont@acme.fr', $data['email']);
|
||||
}
|
||||
|
||||
/**
|
||||
* RG-3.04 : un bloc Contact est valide des qu'AU MOINS UN champ est rempli parmi
|
||||
* prenom / nom / FONCTION / telephone / email (spec § RG-3.04, ligne 926). Ici
|
||||
* seul jobTitle (Fonction) est fourni -> le bloc est valide -> 201.
|
||||
*/
|
||||
public function testPostContactWithOnlyJobTitleReturns201(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Contact JobTitle Only');
|
||||
|
||||
$data = $client->request('POST', '/api/providers/'.$seed->getId().'/contacts', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => ['jobTitle' => 'Directeur'],
|
||||
])->toArray();
|
||||
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
self::assertSame('Directeur', $data['jobTitle']);
|
||||
}
|
||||
|
||||
/**
|
||||
* RG-3.04 : un bloc Contact TOTALEMENT vide (aucun champ du CHECK
|
||||
* chk_provider_contact_name) est rejete avant la base -> 422 rattachee a
|
||||
* firstName. Une Fonction vide (apres normalisation) ne suffit pas a valider.
|
||||
*/
|
||||
public function testPostContactCompletelyEmptyReturns422OnFirstNamePath(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Contact No Field');
|
||||
|
||||
$response = $client->request('POST', '/api/providers/'.$seed->getId().'/contacts', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => ['jobTitle' => ' '],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
self::assertArrayHasKey('firstName', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testPostContactOnMissingProviderReturns404(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
|
||||
$client->request('POST', '/api/providers/999999/contacts', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => ['firstName' => 'Orphan'],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(404);
|
||||
}
|
||||
|
||||
public function testPatchContactNormalizesFields(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Contact Patch');
|
||||
$contact = $this->addContact($seed, 'Marie', 'Martin');
|
||||
|
||||
$data = $client->request('PATCH', '/api/provider_contacts/'.$contact->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['lastName' => 'durand'],
|
||||
])->toArray();
|
||||
|
||||
self::assertResponseStatusCodeSame(200);
|
||||
// Normalisation aussi sur PATCH : "durand" -> "Durand".
|
||||
self::assertSame('Durand', $data['lastName']);
|
||||
}
|
||||
|
||||
public function testDeleteLastContactReturns204(): void
|
||||
{
|
||||
// M3 : pas de garde « dernier contact » (RG-3.12 front-driven) — la
|
||||
// suppression du dernier contact est libre (204).
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Contact Solo');
|
||||
$contact = $this->addContact($seed, 'Unique', 'Contact');
|
||||
|
||||
$client->request('DELETE', '/api/provider_contacts/'.$contact->getId());
|
||||
|
||||
self::assertResponseStatusCodeSame(204);
|
||||
}
|
||||
|
||||
public function testContactWriteWithoutManageReturns403(): void
|
||||
{
|
||||
// Un user sans permission technique.providers.manage -> 403 sur la sous-ressource.
|
||||
$seed = $this->seedProvider('Contact Forbidden');
|
||||
$creds = $this->createUserWithPermission('core.users.view');
|
||||
$http = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$http->request('POST', '/api/providers/'.$seed->getId().'/contacts', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => ['firstName' => 'Nope'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
// === Adresses (security: technique.providers.manage) ===
|
||||
|
||||
public function testPostAddressWithValidPayloadReturns201(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Address Host');
|
||||
$category = $this->providerCategory('NETTOYAGE');
|
||||
|
||||
$data = $client->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '86100',
|
||||
'city' => 'Châtellerault',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => ['/api/sites/'.$this->site(self::SITE_86)->getId()],
|
||||
'categories' => ['/api/categories/'.$category->getId()],
|
||||
],
|
||||
])->toArray();
|
||||
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
self::assertSame('Châtellerault', $data['city']);
|
||||
}
|
||||
|
||||
public function testPostAddressWithoutSiteReturns422(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Address No Site');
|
||||
|
||||
$client->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '86100',
|
||||
'city' => 'Châtellerault',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => [],
|
||||
'categories' => ['/api/categories/'.$this->providerCategory()->getId()],
|
||||
],
|
||||
]);
|
||||
|
||||
// RG-3.05 (Assert\Count min 1 sur sites).
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
}
|
||||
|
||||
public function testPostAddressWithInvalidPostalCodeReturns422(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Address Bad CP');
|
||||
|
||||
$client->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '123',
|
||||
'city' => 'Châtellerault',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => ['/api/sites/'.$this->site(self::SITE_86)->getId()],
|
||||
'categories' => ['/api/categories/'.$this->providerCategory()->getId()],
|
||||
],
|
||||
]);
|
||||
|
||||
// RG-3.06 (Assert\Regex ^[0-9]{4,5}$).
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
}
|
||||
|
||||
public function testPostAddressWithNonPrestataireCategoryReturns422(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Address Bad Cat');
|
||||
$foreign = $this->foreignCategory(); // type CLIENT -> interdite (RG-3.09).
|
||||
|
||||
$response = $client->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '86100',
|
||||
'city' => 'Châtellerault',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => ['/api/sites/'.$this->site(self::SITE_86)->getId()],
|
||||
'categories' => ['/api/categories/'.$foreign->getId()],
|
||||
],
|
||||
]);
|
||||
|
||||
// RG-3.09 -> 422 rattachee a categories.
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
self::assertArrayHasKey('categories', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
public function testDeleteAddressReturns204(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Address Delete');
|
||||
$category = $this->providerCategory('NETTOYAGE');
|
||||
|
||||
$created = $client->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '86100',
|
||||
'city' => 'Châtellerault',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => ['/api/sites/'.$this->site(self::SITE_86)->getId()],
|
||||
'categories' => ['/api/categories/'.$category->getId()],
|
||||
],
|
||||
])->toArray();
|
||||
|
||||
$client->request('DELETE', $created['@id']);
|
||||
self::assertResponseStatusCodeSame(204);
|
||||
}
|
||||
|
||||
public function testAddressWriteWithoutManageReturns403(): void
|
||||
{
|
||||
$seed = $this->seedProvider('Address Forbidden');
|
||||
$creds = $this->createUserWithPermission('core.users.view');
|
||||
$http = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$http->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '86100',
|
||||
'city' => 'Châtellerault',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => ['/api/sites/'.$this->site(self::SITE_86)->getId()],
|
||||
],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
/**
|
||||
* § 2.13 / RG-3.05 (cloisonnement d'ECRITURE sur l'adresse) : un user non-bypass
|
||||
* `sites.read_ref` (qui peut resoudre n'importe quel IRI de site, sinon 400 en
|
||||
* amont) ne peut attacher a l'adresse que ses propres user_site. Site hors
|
||||
* perimetre -> 422 sur `sites` (garde ProviderAddressProcessor).
|
||||
*/
|
||||
public function testPostAddressWithOutOfScopeSiteReturns422OnSitesPath(): void
|
||||
{
|
||||
$seed = $this->seedProvider('Address Scope', [self::SITE_86]);
|
||||
$category = $this->providerCategory('NETTOYAGE');
|
||||
|
||||
$creds = $this->createScopedUser(
|
||||
['technique.providers.view', 'technique.providers.manage', 'sites.read_ref'],
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
$client = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$response = $client->request('POST', '/api/providers/'.$seed->getId().'/addresses', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => [
|
||||
'postalCode' => '17400',
|
||||
'city' => 'Saint-Jean-d\'Angély',
|
||||
'street' => '1 rue du Test',
|
||||
'sites' => ['/api/sites/'.$this->site(self::SITE_17)->getId()], // hors user_site
|
||||
'categories' => ['/api/categories/'.$category->getId()],
|
||||
],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
self::assertArrayHasKey('sites', $this->violationsByPath($response->toArray(false)));
|
||||
}
|
||||
|
||||
// === RIBs (security: technique.providers.accounting.manage) ===
|
||||
|
||||
public function testPostRibByAdminReturns201(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Rib Host');
|
||||
|
||||
$data = $client->request('POST', '/api/providers/'.$seed->getId().'/ribs', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => [
|
||||
'label' => 'Compte principal',
|
||||
'bic' => self::VALID_BIC,
|
||||
'iban' => self::VALID_IBAN,
|
||||
],
|
||||
])->toArray();
|
||||
|
||||
self::assertResponseStatusCodeSame(201);
|
||||
self::assertSame('Compte principal', $data['label']);
|
||||
}
|
||||
|
||||
public function testPostRibWithInvalidIbanReturns422(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Rib Bad Iban');
|
||||
|
||||
$client->request('POST', '/api/providers/'.$seed->getId().'/ribs', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => ['label' => 'Compte invalide', 'bic' => self::VALID_BIC, 'iban' => 'INVALID-IBAN'],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
}
|
||||
|
||||
/**
|
||||
* Controle croise pays BIC/IBAN (Assert\Bic ibanPropertyPath) : un BIC (DE) et
|
||||
* un IBAN (FR) valides isolement mais de pays differents -> 422 sur `bic`.
|
||||
*/
|
||||
public function testPostRibWithBicIbanCountryMismatchReturns422OnBic(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Rib Pays Mismatch');
|
||||
|
||||
$response = $client->request('POST', '/api/providers/'.$seed->getId().'/ribs', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => ['label' => 'Compte incoherent', 'bic' => self::FOREIGN_BIC, 'iban' => self::VALID_IBAN],
|
||||
]);
|
||||
|
||||
self::assertResponseStatusCodeSame(422);
|
||||
$byPath = $this->violationsByPath($response->toArray(false));
|
||||
self::assertArrayHasKey('bic', $byPath);
|
||||
self::assertSame('Le BIC ne correspond pas au pays de l\'IBAN.', $byPath['bic']);
|
||||
}
|
||||
|
||||
public function testDeleteRibNonLcrReturns204(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Rib Non LCR');
|
||||
$rib = $this->addRib($seed);
|
||||
|
||||
$client->request('DELETE', '/api/provider_ribs/'.$rib->getId());
|
||||
|
||||
self::assertResponseStatusCodeSame(204);
|
||||
}
|
||||
|
||||
public function testDeleteLastRibUnderLcrReturns409(): void
|
||||
{
|
||||
$client = $this->createAdminClient();
|
||||
$seed = $this->seedProvider('Rib LCR Solo');
|
||||
$rib = $this->addRib($seed);
|
||||
|
||||
// Passe le prestataire en LCR (seed direct).
|
||||
$em = $this->getEm();
|
||||
$managed = $em->getRepository(Provider::class)->find($seed->getId());
|
||||
$managed->setPaymentType($this->paymentType('LCR'));
|
||||
$em->flush();
|
||||
|
||||
$client->request('DELETE', '/api/provider_ribs/'.$rib->getId());
|
||||
|
||||
// RG-3.08 : LCR exige >= 1 RIB -> suppression du dernier refusee.
|
||||
self::assertResponseStatusCodeSame(409);
|
||||
}
|
||||
|
||||
public function testRibWriteWithoutAccountingManageReturns403(): void
|
||||
{
|
||||
// Un user portant seulement technique.providers.manage (sans accounting.manage)
|
||||
// ne peut ni creer, ni modifier, ni supprimer un RIB (gating renforce § 4.5).
|
||||
$seed = $this->seedProvider('Rib Forbidden');
|
||||
$rib = $this->addRib($seed);
|
||||
$creds = $this->createUserWithPermission('technique.providers.manage');
|
||||
$http = $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
|
||||
$http->request('POST', '/api/providers/'.$seed->getId().'/ribs', [
|
||||
'headers' => ['Content-Type' => self::LD],
|
||||
'json' => ['label' => 'X', 'bic' => self::VALID_BIC, 'iban' => self::VALID_IBAN],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
$http->request('PATCH', '/api/provider_ribs/'.$rib->getId(), [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['label' => 'Y'],
|
||||
]);
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
|
||||
$http->request('DELETE', '/api/provider_ribs/'.$rib->getId());
|
||||
self::assertResponseStatusCodeSame(403);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,154 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Module\Technique\Api;
|
||||
|
||||
use ApiPlatform\Symfony\Bundle\Test\Client;
|
||||
|
||||
/**
|
||||
* Tests du cloisonnement par site des SOUS-RESSOURCES d'un prestataire (Contacts /
|
||||
* Adresses / RIB) — § 2.13 / RG-3.17. Complement de ProviderSiteScopeTest (qui ne
|
||||
* couvrait que le Provider lui-meme).
|
||||
*
|
||||
* Sans garde dedie, un user cloisonne pouvait lire / editer / supprimer une
|
||||
* sous-ressource d'un prestataire HORS de son site (le detail Provider est garde en
|
||||
* 404, mais les sous-ressources passent par le provider Doctrine par defaut, non
|
||||
* cloisonne — et SiteScopedQueryExtension ne filtre que les SiteAwareInterface).
|
||||
* Le RIB est particulierement sensible (IBAN / BIC).
|
||||
*
|
||||
* Garde pose par ProviderSubResourceItemProvider (Get/Patch/Delete -> 404 hors
|
||||
* perimetre) + ProviderSiteScopeChecker::assertInScope dans les processors (POST
|
||||
* sur parent hors perimetre -> 404). Decision de scope partagee (source unique).
|
||||
*
|
||||
* @internal
|
||||
*/
|
||||
final class ProviderSubResourceSiteScopeTest extends AbstractProviderApiTestCase
|
||||
{
|
||||
/** Permissions completes pour exercer view + manage + accounting sur tous les chemins. */
|
||||
private const array FULL_PERMS = [
|
||||
'technique.providers.view',
|
||||
'technique.providers.manage',
|
||||
'technique.providers.accounting.view',
|
||||
'technique.providers.accounting.manage',
|
||||
];
|
||||
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
$this->skipIfSitesModuleDisabled();
|
||||
}
|
||||
|
||||
public function testGetContactOutOfScopeReturns404ButInScope200(): void
|
||||
{
|
||||
$inScope = $this->seedProvider('Presta In Scope', [self::SITE_86]);
|
||||
$inContactId = $this->addContact($inScope, 'Marie', 'Martin')->getId();
|
||||
|
||||
$outScope = $this->seedProvider('Presta Out Scope', [self::SITE_17]);
|
||||
$outContactId = $this->addContact($outScope, 'Paul', 'Durand')->getId();
|
||||
|
||||
$client = $this->scopedClient();
|
||||
|
||||
$ok = $client->request('GET', '/api/provider_contacts/'.$inContactId, ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(200, $ok->getStatusCode());
|
||||
|
||||
// Hors perimetre : 404 (ne pas reveler l'existence du contact d'un autre site).
|
||||
$ko = $client->request('GET', '/api/provider_contacts/'.$outContactId, ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(404, $ko->getStatusCode());
|
||||
}
|
||||
|
||||
public function testGetRibOutOfScopeReturns404(): void
|
||||
{
|
||||
// RIB = donnee bancaire sensible (IBAN/BIC) : le cas le plus critique.
|
||||
$outScope = $this->seedProvider('Presta Out Rib', [self::SITE_17]);
|
||||
$ribId = $this->addRib($outScope)->getId();
|
||||
|
||||
$client = $this->scopedClient();
|
||||
|
||||
$response = $client->request('GET', '/api/provider_ribs/'.$ribId, ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(404, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testPatchRibOutOfScopeReturns404(): void
|
||||
{
|
||||
$outScope = $this->seedProvider('Presta Patch Rib', [self::SITE_17]);
|
||||
$ribId = $this->addRib($outScope)->getId();
|
||||
|
||||
$client = $this->scopedClient();
|
||||
|
||||
$response = $client->request('PATCH', '/api/provider_ribs/'.$ribId, [
|
||||
'headers' => ['Content-Type' => self::MERGE],
|
||||
'json' => ['label' => 'Hacked'],
|
||||
]);
|
||||
self::assertSame(404, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testDeleteContactOutOfScopeReturns404(): void
|
||||
{
|
||||
$outScope = $this->seedProvider('Presta Del Contact', [self::SITE_17]);
|
||||
$contactId = $this->addContact($outScope, 'Paul', 'Durand')->getId();
|
||||
|
||||
$client = $this->scopedClient();
|
||||
|
||||
$response = $client->request('DELETE', '/api/provider_contacts/'.$contactId);
|
||||
self::assertSame(404, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testPostContactOnOutOfScopeProviderReturns404(): void
|
||||
{
|
||||
$outScope = $this->seedProvider('Presta Post Contact', [self::SITE_17]);
|
||||
$id = $outScope->getId();
|
||||
|
||||
$client = $this->scopedClient();
|
||||
|
||||
$response = $client->request('POST', '/api/providers/'.$id.'/contacts', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => ['firstName' => 'Intrus'],
|
||||
]);
|
||||
self::assertSame(404, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testPostRibOnOutOfScopeProviderReturns404(): void
|
||||
{
|
||||
$outScope = $this->seedProvider('Presta Post Rib', [self::SITE_17]);
|
||||
$id = $outScope->getId();
|
||||
|
||||
$client = $this->scopedClient();
|
||||
|
||||
$response = $client->request('POST', '/api/providers/'.$id.'/ribs', [
|
||||
'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
|
||||
'json' => [
|
||||
'label' => 'Intrus',
|
||||
'iban' => self::VALID_IBAN,
|
||||
'bic' => self::VALID_BIC,
|
||||
],
|
||||
]);
|
||||
self::assertSame(404, $response->getStatusCode());
|
||||
}
|
||||
|
||||
public function testBypassUserReachesSubResourceOnAnySite(): void
|
||||
{
|
||||
// Temoin : l'admin (bypass total) lit bien un contact hors « son » site.
|
||||
$outScope = $this->seedProvider('Presta Admin Reach', [self::SITE_17]);
|
||||
$contactId = $this->addContact($outScope, 'Marie', 'Martin')->getId();
|
||||
|
||||
$client = $this->createAdminClient();
|
||||
$response = $client->request('GET', '/api/provider_contacts/'.$contactId, ['headers' => ['Accept' => self::LD]]);
|
||||
self::assertSame(200, $response->getStatusCode());
|
||||
}
|
||||
|
||||
/**
|
||||
* Client authentifie comme un user NON-bypass rattache au seul site 86 (avec
|
||||
* currentSite 86) — sujet des tests de cloisonnement des sous-ressources.
|
||||
*/
|
||||
private function scopedClient(): Client
|
||||
{
|
||||
$creds = $this->createScopedUser(
|
||||
self::FULL_PERMS,
|
||||
sitePostalCodes: [self::SITE_86],
|
||||
currentSitePostalCode: self::SITE_86,
|
||||
);
|
||||
|
||||
return $this->authenticatedClient($creds['username'], $creds['password']);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user