backend/tests/permissions_contract.phpPHP
<?php
declare(strict_types=1);
use Machweis\Backend\AuditService;
use Machweis\Backend\CompanyProfileService;
use Machweis\Backend\Config;
use Machweis\Backend\EmployeeProfileService;
use Machweis\Backend\PermissionService;
require dirname(__DIR__) . '/src/autoload.php';
function permissionCheck(bool $condition, string $message): void { if (!$condition) throw new RuntimeException($message); }
function permissionUuid(): string { $hex = bin2hex(random_bytes(16)); return substr($hex, 0, 8) . '-' . substr($hex, 8, 4) . '-4' . substr($hex, 13, 3) . '-8' . substr($hex, 17, 3) . '-' . substr($hex, 20); }
$config = new Config('test', false, (string) getenv('DB_HOST'), (int) getenv('DB_PORT'), (string) getenv('DB_NAME'), (string) getenv('DB_USER'), (string) getenv('DB_PASSWORD'), [], true, str_repeat('permissions-secret-', 2));
$pdo = new PDO(sprintf('mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4', $config->dbHost, $config->dbPort, $config->dbName), $config->dbUser, $config->dbPassword, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false]);
$tenantA = permissionUuid(); $tenantB = permissionUuid(); $owner = permissionUuid(); $target = permissionUuid();
$pdo->prepare('INSERT INTO tenants (id,name,status,created_at) VALUES (?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, UTC_TIMESTAMP())')->execute([$tenantA, 'Berechtigung A', 'active', $tenantB, 'Berechtigung B', 'active']);
$ownerRole = $pdo->query("SELECT id FROM roles WHERE code = 'owner'")->fetchColumn(); $supervisorRole = $pdo->query("SELECT id FROM roles WHERE code = 'supervisor'")->fetchColumn();
$pdo->prepare('INSERT INTO users (id,email,password_hash,status,created_at) VALUES (?, ?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, ?, UTC_TIMESTAMP())')->execute([$owner, 'owner-' . $owner . '@example.test', 'hash', 'active', $target, 'target-' . $target . '@example.test', 'hash', 'active']);
$pdo->prepare('INSERT INTO tenant_memberships (id,tenant_id,user_id,role_id,status,created_at) VALUES (?, ?, ?, ?, ?, UTC_TIMESTAMP()), (?, ?, ?, ?, ?, UTC_TIMESTAMP())')->execute([permissionUuid(), $tenantA, $owner, $ownerRole, 'active', permissionUuid(), $tenantA, $target, $supervisorRole, 'active']);
$profileId = permissionUuid();
$pdo->prepare('INSERT INTO employee_profiles (id,tenant_id,user_id,employee_number,first_name,last_name,email,phone,is_active,created_at,updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, TRUE, UTC_TIMESTAMP(), UTC_TIMESTAMP())')->execute([$profileId, $tenantA, $target, 'P-100', 'Test', 'Mitarbeiter', 'target@example.test', '',]);
$permissions = new PermissionService($pdo);
permissionCheck($permissions->allows($tenantA, 'owner', 'reports.create'), 'owner defaults must allow report creation');
permissionCheck($permissions->allows($tenantA, 'technician', 'reports.create') === false, 'technician defaults must deny report creation');
permissionCheck($permissions->allows($tenantB, 'office', 'reports.send'), 'tenant defaults must be independent');
$changed = $permissions->set($tenantA, $owner, 'owner', 'office', 'reports.send', false);
permissionCheck($changed['granted'] === false && $changed['overridden'] === true, 'permission override must be persisted');
permissionCheck($permissions->allows($tenantA, 'office', 'reports.send') === false, 'tenant permission override must be enforced');
permissionCheck($permissions->allows($tenantB, 'office', 'reports.send'), 'permission override must not cross tenants');
try { $permissions->set($tenantA, $target, 'supervisor', 'office', 'reports.send', true); throw new RuntimeException('unauthorized permission change accepted'); } catch (Machweis\Backend\Auth\AuthorizationException) {}
$employees = new EmployeeProfileService($pdo);
$updated = $employees->changeRole($tenantA, $profileId, $owner, 'owner', 'technician');
permissionCheck($updated['role'] === 'technician', 'role change must update the active membership');
try { $employees->changeRole($tenantA, $profileId, $target, 'technician', 'office'); throw new RuntimeException('unauthorized role change accepted'); } catch (Machweis\Backend\Auth\AuthorizationException) {}
$company = new CompanyProfileService($pdo);
$company->update($tenantA, ['name' => 'Berechtigung A Neu'], $owner);
$audit = (new AuditService($pdo))->list($tenantA);
$types = array_column($audit, 'event_type');
permissionCheck(in_array('permission_changed', $types, true), 'permission changes must be audited');
permissionCheck(in_array('role_changed', $types, true), 'role changes must be audited');
permissionCheck(in_array('company_profile_updated', $types, true), 'company profile changes must be audited');
permissionCheck((new AuditService($pdo))->list($tenantB) === [], 'audit list must remain tenant isolated');
fwrite(STDOUT, "permissions_contract: OK\n");