backend/tests/company_profile_contract.phpPHP
<?php
declare(strict_types=1);
use Machweis\Backend\Auth\TokenService;
use Machweis\Backend\CompanyProfileService;
use Machweis\Backend\Config;
use Machweis\Backend\Kernel;
use Machweis\Backend\Logger;
use Machweis\Backend\Request;
require dirname(__DIR__) . '/src/autoload.php';
function companyCheck(bool $condition, string $message): void { if (!$condition) throw new RuntimeException($message); }
function companyUuid(): string { $hex = bin2hex(random_bytes(16)); return substr($hex,0,8).'-'.substr($hex,8,4).'-4'.substr($hex,13,3).'-8'.substr($hex,17,3).'-'.substr($hex,20); }
$config = new Config('test', false, (string)getenv('DB_HOST'), (int)getenv('DB_PORT'), (string)getenv('DB_NAME'), (string)getenv('DB_USER'), (string)getenv('DB_PASSWORD'), [], true, str_repeat('company-profile-secret-', 2));
$pdo = new PDO(sprintf('mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4', $config->dbHost, $config->dbPort, $config->dbName), $config->dbUser, $config->dbPassword, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false]);
$tenantA = companyUuid(); $tenantB = companyUuid();
$pdo->prepare('INSERT INTO tenants (id,name,status,created_at) VALUES (?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, UTC_TIMESTAMP())')->execute([$tenantA, 'Firma A', 'active', $tenantB, 'Firma B', 'active']);
$service = new CompanyProfileService($pdo);
companyCheck($service->one($tenantA)['name'] === 'Firma A', 'tenant name must be the initial profile name');
$updated = $service->update($tenantA, ['name'=>'Firma A Neu','owner'=>'Ada Admin','email'=>'office@example.test','phone'=>'+49 30 1','address'=>'Hauptstraße 1','taxNumber'=>'12/345','reportFooter'=>'Danke']);
companyCheck($updated['name'] === 'Firma A Neu' && $updated['owner'] === 'Ada Admin', 'profile must persist all normalized fields');
companyCheck($service->one($tenantB)['name'] === 'Firma B' && $service->one($tenantB)['owner'] === '', 'profile access must remain tenant isolated');
try { $service->update($tenantA, ['name'=>'', 'email'=>'invalid']); throw new RuntimeException('invalid profile accepted'); } catch (InvalidArgumentException) {}
$tokens = new TokenService($config); $kernel = new Kernel($config, new Logger('test'));
foreach (['owner','office'] as $role) {
$token = $tokens->issueAccess(['sub'=>companyUuid(),'tid'=>$tenantA,'role'=>$role]);
$response = $kernel->handle(new Request('PATCH','/api/v1/company-profile',['authorization'=>'Bearer '.$token],json_encode(['name'=>'Firma '.$role], JSON_THROW_ON_ERROR)));
companyCheck($response->status === 200, "$role must update the company profile");
}
foreach (['supervisor','technician'] as $role) {
$token = $tokens->issueAccess(['sub'=>companyUuid(),'tid'=>$tenantA,'role'=>$role]);
$read = $kernel->handle(new Request('GET','/api/v1/company-profile',['authorization'=>'Bearer '.$token]));
companyCheck($read->status === 200, "$role must read the company profile");
$write = $kernel->handle(new Request('PATCH','/api/v1/company-profile',['authorization'=>'Bearer '.$token],'{"name":"Nicht erlaubt"}'));
companyCheck($write->status === 403, "$role must not update the company profile");
}
companyCheck($service->one($tenantB)['name'] === 'Firma B', 'HTTP updates must not cross tenant boundaries');
$pdo->prepare('DELETE FROM tenant_company_profiles WHERE tenant_id IN (?, ?)')->execute([$tenantA,$tenantB]);
$pdo->prepare('DELETE FROM tenants WHERE id IN (?, ?)')->execute([$tenantA,$tenantB]);
fwrite(STDOUT, "company_profile_contract: OK\n");