backend/tests/invitations_contract.phpPHP
<?php
declare(strict_types=1);
use Machweis\Backend\Auth\TokenService;
use Machweis\Backend\Config;
use Machweis\Backend\EmployeeProfileService;
use Machweis\Backend\Kernel;
use Machweis\Backend\Logger;
use Machweis\Backend\Request;
require dirname(__DIR__) . '/src/autoload.php';
function invitationCheck(bool $condition, string $message): void { if (!$condition) throw new RuntimeException($message); }
function invitationUuid(): string { $hex = bin2hex(random_bytes(16)); return substr($hex,0,8).'-'.substr($hex,8,4).'-4'.substr($hex,13,3).'-8'.substr($hex,17,3).'-'.substr($hex,20); }
$config = new Config('test', false, (string)getenv('DB_HOST'), (int)getenv('DB_PORT'), (string)getenv('DB_NAME'), (string)getenv('DB_USER'), (string)getenv('DB_PASSWORD'), [], true, str_repeat('invitation-contract-secret-', 2));
$pdo = new PDO(sprintf('mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4', $config->dbHost, $config->dbPort, $config->dbName), $config->dbUser, $config->dbPassword, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false]);
$tenantA = invitationUuid(); $tenantB = invitationUuid(); $owner = invitationUuid(); $office = invitationUuid();
$pdo->prepare('INSERT INTO tenants (id,name,status,created_at) VALUES (?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, UTC_TIMESTAMP())')->execute([$tenantA,'Invitation A','active',$tenantB,'Invitation B','active']);
$pdo->prepare('INSERT INTO users (id,email,password_hash,status,created_at) VALUES (?, ?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, ?, UTC_TIMESTAMP())')->execute([$owner,'owner-'.substr($owner,0,8).'@example.test',password_hash('owner-password', PASSWORD_ARGON2ID),'active',$office,'office-'.substr($office,0,8).'@example.test',password_hash('office-password', PASSWORD_ARGON2ID),'active']);
$ownerRole = $pdo->query("SELECT id FROM roles WHERE code='owner'")->fetchColumn(); $officeRole = $pdo->query("SELECT id FROM roles WHERE code='office'")->fetchColumn();
$pdo->prepare('INSERT INTO tenant_memberships (id,tenant_id,user_id,role_id,status,created_at) VALUES (?, ?, ?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, ?, ?, UTC_TIMESTAMP())')->execute([invitationUuid(),$tenantA,$owner,$ownerRole,'active',invitationUuid(),$tenantA,$office,$officeRole,'active']);
$tokens = new TokenService($config); $kernel = new Kernel($config, new Logger('test')); $ownerToken = $tokens->issueAccess(['sub'=>$owner,'tid'=>$tenantA,'role'=>'owner']); $officeToken = $tokens->issueAccess(['sub'=>$office,'tid'=>$tenantA,'role'=>'office']);
$create = $kernel->handle(new Request('POST','/api/v1/invitations',['authorization'=>'Bearer '.$ownerToken],json_encode(['email'=>'new.employee@example.test','firstName'=>'Nina','lastName'=>'Neu','employeeNumber'=>'M-100','phone'=>'+49 30 123','role'=>'supervisor'], JSON_THROW_ON_ERROR)));
invitationCheck($create->status === 201, 'owner must create an invitation'); $invitation = $create->body['data']; $token = (string)$invitation['token']; invitationCheck($token !== '' && strlen($token) >= 40, 'invitation token must be returned once');
$inspect = $kernel->handle(new Request('POST','/api/v1/invitations/inspect',[],json_encode(['token'=>$token], JSON_THROW_ON_ERROR))); invitationCheck($inspect->status === 200 && $inspect->body['data']['email'] === 'new.employee@example.test' && $inspect->body['data']['role'] === 'supervisor', 'invitation details must be inspectable without authentication');
$list = $kernel->handle(new Request('GET','/api/v1/invitations',['authorization'=>'Bearer '.$officeToken])); invitationCheck($list->status === 200 && count($list->body['data']['items']) === 1 && !isset($list->body['data']['items'][0]['token']), 'admins may list invitations without exposing tokens');
$accept = $kernel->handle(new Request('POST','/api/v1/invitations/accept',[],json_encode(['token'=>$token,'password'=>'a-very-secure-password'], JSON_THROW_ON_ERROR))); invitationCheck($accept->status === 200 && $accept->body['data']['role'] === 'supervisor', 'acceptance must create and sign in the invited account');
$acceptedUser = (string) ($accept->body['data']['user']['id'] ?? ''); invitationCheck($acceptedUser !== '', 'acceptance must return the created user');
$profile = $pdo->prepare('SELECT user_id FROM employee_profiles WHERE tenant_id=? AND email=?'); $profile->execute([$tenantA,'new.employee@example.test']); invitationCheck(is_string($profile->fetchColumn()), 'accepted invitation must link the user to the employee profile');
$employees = (new EmployeeProfileService($pdo))->list($tenantA, '', 1, 10); invitationCheck($employees['items'][0]['role'] === 'supervisor', 'employee role must come from the linked membership');
$replay = $kernel->handle(new Request('POST','/api/v1/invitations/accept',[],json_encode(['token'=>$token,'password'=>'a-very-secure-password'], JSON_THROW_ON_ERROR))); invitationCheck($replay->status === 422, 'accepted invitations must be single use');
$forbidden = $kernel->handle(new Request('POST','/api/v1/invitations',['authorization'=>'Bearer '.$tokens->issueAccess(['sub'=>invitationUuid(),'tid'=>$tenantA,'role'=>'supervisor'])],json_encode(['email'=>'blocked@example.test','firstName'=>'Blocked','lastName'=>'User','employeeNumber'=>'M-101'], JSON_THROW_ON_ERROR))); invitationCheck($forbidden->status === 403, 'non-admin roles must not create invitations');
$invalid = $kernel->handle(new Request('POST','/api/v1/invitations/inspect',[],json_encode(['token'=>'invalid'], JSON_THROW_ON_ERROR))); invitationCheck($invalid->status === 422, 'invalid invitation must be rejected');
$pdo->prepare('DELETE FROM refresh_tokens WHERE user_id IN (?,?,?)')->execute([$owner,$office,$acceptedUser]); $pdo->prepare('DELETE FROM employee_invitations WHERE tenant_id IN (?,?)')->execute([$tenantA,$tenantB]); $pdo->prepare('DELETE FROM employee_profiles WHERE tenant_id IN (?,?)')->execute([$tenantA,$tenantB]); $pdo->prepare('DELETE FROM tenant_memberships WHERE tenant_id IN (?,?)')->execute([$tenantA,$tenantB]); $pdo->prepare('DELETE FROM users WHERE id IN (?,?) OR email=?')->execute([$owner,$office,'new.employee@example.test']); $pdo->prepare('DELETE FROM tenants WHERE id IN (?,?)')->execute([$tenantA,$tenantB]);
fwrite(STDOUT, "invitations_contract: OK\n");