backend/tests/master_data_contract.phpPHP
<?php
declare(strict_types=1);
use Machweis\Backend\Auth\AuthGuard;
use Machweis\Backend\Auth\AuthorizationException;
use Machweis\Backend\Auth\TokenService;
use Machweis\Backend\Config;
use Machweis\Backend\EmployeeProfilePolicy;
use Machweis\Backend\Kernel;
use Machweis\Backend\Logger;
use Machweis\Backend\Request;
require dirname(__DIR__) . '/src/autoload.php';
$tokens=new TokenService(new Config('test',false,'',3306,'','','',[],false,str_repeat('x',32)));
$token=$tokens->issueAccess(['sub'=>'user-a','tid'=>'tenant-a','role'=>'owner']);
$guard=new AuthGuard($tokens);$identity=$guard->requireIdentity(new Request('GET','/api/v1/customers',['authorization'=>'Bearer '.$token]));
assert($identity['tid']==='tenant-a');$guard->requireRole($identity,'owner');
try{$guard->requireRole($identity,'technician');assert(false);}catch(AuthorizationException){}
$office=$tokens->verifyAccess($tokens->issueAccess(['sub'=>'user-b','tid'=>'tenant-a','role'=>'office']));
$supervisor=$tokens->verifyAccess($tokens->issueAccess(['sub'=>'user-c','tid'=>'tenant-a','role'=>'supervisor']));
$technician=$tokens->verifyAccess($tokens->issueAccess(['sub'=>'user-d','tid'=>'tenant-a','role'=>'technician']));
$guard->requireRole($office,'owner','office');
$guard->requireRole($supervisor,'owner','office','supervisor','technician');
$guard->requireRole($technician,'owner','office','supervisor','technician');
foreach ([$supervisor,$technician] as $readOnly) {
try{$guard->requireRole($readOnly,'owner','office');assert(false);}catch(AuthorizationException){}
}
$kernel=new Kernel(new Config('test',false,'',3306,'','','',[],false,str_repeat('x',32)),new Logger('test'));
$technicianToken=$tokens->issueAccess(['sub'=>'user-d','tid'=>'tenant-a','role'=>'technician']);
$forbidden=$kernel->handle(new Request('POST','/api/v1/employees',['authorization'=>'Bearer '.$technicianToken],'{}'));
assert($forbidden->status===403);
assert($forbidden->body['error']['code']==='forbidden');
EmployeeProfilePolicy::assertAssignable(['tenant_id'=>'tenant-a','is_active'=>1,'deleted_at'=>null],'tenant-a');
foreach ([
false,
['tenant_id'=>'tenant-b','is_active'=>1,'deleted_at'=>null],
['tenant_id'=>'tenant-a','is_active'=>0,'deleted_at'=>null],
['tenant_id'=>'tenant-a','is_active'=>1,'deleted_at'=>'2026-08-29 12:00:00'],
] as $unavailable) {
try{EmployeeProfilePolicy::assertAssignable($unavailable,'tenant-a');assert(false);}catch(InvalidArgumentException){}
}
fwrite(STDOUT,"master_data_contract: OK\n");