Tests: Wave 3 — /api service + auth-engine spine (135 tests, one bug fixed)#62
Merged
Conversation
…caffolding
The tiger-core integration base migrated a DB but had no way to test an /api SERVICE (which gates on
an authenticated identity + ACL). Adds:
- login(userId, orgId, role) — writes a non-persistent Zend_Auth identity {user_id,org_id,role} so a
service's _isAdmin()/ACL gate + $this->_user_id/_org_id see an actor, stamps the model actor+org, and
registers the REAL shipped policy (new Tiger_Acl_Acl — core + every module acl.ini) so isAllowed()
reflects real rules, not a fixture. loginAs(role) shorthand; logout() reverts to guest; tearDown clears.
- ServiceScaffoldTest (5) — proves it end-to-end against a real admin-gated service (Access_Service_User):
identity+actor set, the shipped acl.ini decides (admin allowed / user+guest denied), guest is refused
dispatching datatable, admin clears the gate. Unblocks the Wave-3 Signup/Modules/Code/Auth service tests.
Note for service tests: a MODULE service class isn't on the harness autoload path — require_once its file
(it only extends the autoloadable Tiger_Service_Service). Kernel services (Tiger_Service_*) autoload.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The test harness deliberately never boots ZF1's module resource loader, so a module's classes (Access_Service_User, Signup_Form_Signup, …) weren't on the autoload path — a service test had to require_once the file by hand. Register a LAST-resort module autoloader that maps `Mod_Type_Name` → modules/<mod>/<types>/ Name.php (and `Mod_XController` → controllers/), so a real /api service + its form/model instantiate naturally. Drops the require_once from ServiceScaffoldTest; it now doubles as proof the loader resolves a real admin-gated service. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…n COVERAGE-PLAN §9 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collect four parallel Wave-3 branches (own worktree + DB each) onto one DB and
verify together: the combined integration suite is 250 tests / 845 assertions green.
Coverage:
- Signup/SignupServiceTest (19) — guest tenant-graph create, validation+rollback,
duplicate/disable/CSRF guards, verifyEmail redeem.
- Code/{Runtime,CodeService} + System/{Modules,Updates} + License/Checker (35) —
the code-exec/install cluster: the compile-gate RCE boundary (server PHP compiles
only from org_id='' rows, asserted on compiled bytes), superadmin deny-by-default,
nag-never-disable fail-open licensing.
- Access/{User,Org} + Cms/{Page,Menu,Settings} (55) — admin CRUD: deny-by-default
ACL, DataTables envelope + permission flags, validate->transaction, soft-delete,
page version-on-save + slug 301, menu subtree reorder, settings->config tier.
- Service/AuthenticationTest (26) — kernel login engine: password login + org-resolved
role + audit, no-enumeration parity, brute-force lockout, pepper migration, one-time
challenges (code-login/reset), TOTP 2FA orchestration, session/lock/return-to. Runs
the REAL session paths via Zend_Session::$_unitTestEnabled.
Bug fixed (a test surfaced it): Signup_Service_Signup::create() committed the tenant
graph, then issued the email_verify challenge + mailed OUTSIDE the mail try/catch — a
challenge-write throw reported result=0 on a fully-committed, un-recreatable account.
Now the challenge is issued INSIDE the transaction (atomic with the user); mail is
best-effort post-commit.
Also: gitignore the PHPUnit result cache + the code runtime's storage/public artifacts.
Findings #7-#10 (nested-transaction isolation follow-up, non-atomic settings save, et al.)
logged in COVERAGE-PLAN §9.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The integration suite passed but PHPUnit exited non-zero: in CI (no MTA) PHP mail() fails, and the signup/OTP swallow-and-error_log paths then printed during 4 tests, which strict-output flags as "risky". Give Tiger_Mail a process-wide default-transport override (mirrors Zend_Mail::setDefaultTransport but is honored by the wrapper, which always resolves its own transport) — precedence: explicit per-call > process default > config-resolved. Null in production, so zero behavior change there. The test bootstrap points it at a Zend_Mail_Transport_File writing to a throwaway dir, so every send() captures-instead-of-delivers and never fails. No more risky tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Wave 3 of the test backfill: the
/apiservice layer + the kernel auth engine — the highest-value, highest-risk surface in the platform. Built by four parallel agents (each in its own worktree + isolated DB), then collected onto one DB and verified together.Combined integration suite: 250 tests / 845 assertions green (was 116). Unit suite unchanged (247, green).
Base scaffolding (unblocks all service tests)
IntegrationTestCase::login()/loginAs()/logout()— set a real non-persistentZend_Authidentity and register the actual shippedTiger_Acl_Aclpolicy, so a service's_isAdmin()/ACL gate decides against the rules that really ship, not a fixture.tests/bootstrap.phpmodule-class autoloader (Mod_Type_Name→modules/<mod>/<types>/Name.php), registered last — a real/apiservice + its form/model instantiate with norequire_onceand no ZF1 module-resource-loader boot.ServiceScaffoldTest(5) proves it against the real admin-gatedAccess_Service_User.Coverage (135 new tests)
verifyEmailredeem.org_id=''rows, asserted on the compiled bytes), superadmin deny-by-default (guest and plain admin denied), nag-never-disable fail-open licensing (Tiger_License_Checker,System_Service_Updates).Access_Service_User/Org,Cms_Service_Page/Menu/Settings: deny-by-default ACL, the DataTables{draw,recordsTotal,recordsFiltered,data}envelope + server-computed permission flags, validate→transaction, soft-delete/restore, page version-on-save + slug 301, menu subtree reorder, settings→configtier.Tiger_Service_Authentication: password login + org-resolved role + audit row, no-enumeration parity, brute-force lockout, pepper migration, one-time challenges (code-login / reset), TOTP 2FA orchestration, session/lock/return-to. Exercises the real session paths viaZend_Session::$_unitTestEnabled(array-backed), not stubs.Bug fixed (a test surfaced it)
Signup_Service_Signup::create()committed the tenant graph in_transaction(), then issued theemail_verifychallenge + sent mail after commit — with the challengeissue()outside the mail try/catch. A throw there unwound intocreate()'s catch →result=0on a fully-committed account the user could neither use nor re-create (email-uniqueness). Fix: issue the challenge inside the transaction (atomic with the user — a challenge-write failure now rolls the whole signup back);_sendVerificationreduced to best-effort post-commit mail.Also
storage/+public/_code/artifacts.COVERAGE-PLAN §9(not fixed — characterized green): the base per-test transaction can't nest a service's own_transaction()→ follow-up: a savepoint-aware isolation mode (hit by 3 agents);Cms_Service_Settings::savewrites two config rows non-atomically; DataTables filter scopesrecordsTotal(by design).Only test files + the single signup fix +
.gitignorechange; no other framework/module source touched.🤖 Generated with Claude Code