refactor(tests): Move cookie-related tests from ServerRequestAdapterTest to new CookiesPsr7Test class for better organization and clarity.
#81
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…Test` to new `CookiesPsr7Test` class for better organization and clarity.
WalkthroughThis update restructures and expands test coverage for cookie handling and validation in the PSR-7 request adapter. Cookie-related tests are moved from Changes
Sequence Diagram(s)sequenceDiagram
participant Test as Test Case
participant Adapter as PSR-7 Request Adapter
participant App as Application
Test->>Adapter: Create adapter with cookies (valid/invalid)
Test->>Adapter: Call getCookies()
Adapter-->>Test: Return CookieCollection (filtered/validated)
Test->>Adapter: Attempt mutation (if applicable)
Adapter-->>Test: Throw exception if immutable
Note over Test,Adapter: For application-level tests:
Test->>App: Simulate HTTP request with cookies
App->>Adapter: Access cookies via request component
Adapter-->>App: Return validated cookies
App-->>Test: Return JSON response with cookies
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~15–20 minutes Possibly related PRs
Poem
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
…rity instance in `CookiesPsr7Test` for improved clarity and consistency.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
src/adapter/ServerRequestAdapter.php(2 hunks)tests/adapter/CookiesPsr7Test.php(1 hunks)tests/adapter/ServerRequestAdapterTest.php(1 hunks)
🧰 Additional context used
🧠 Learnings (12)
📓 Common learnings
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
📚 Learning: 2025-07-22T01:01:13.426Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/http/PSR7ResponseTest.php:0-0
Timestamp: 2025-07-22T01:01:13.426Z
Learning: In yii2-extensions/psr-bridge, expired cookies should not be hashed/validated because they are deletion cookies meant to remove existing cookies from the client browser. The validation logic should only apply to live cookies (expire=0 or expire >= current time) and skip validation for both the special Yii2 deletion case (expire=1) and regular expired cookies.
Applied to files:
src/adapter/ServerRequestAdapter.phptests/adapter/ServerRequestAdapterTest.phptests/adapter/CookiesPsr7Test.php
📚 Learning: 2025-07-22T00:50:26.546Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/http/PSR7ResponseTest.php:0-0
Timestamp: 2025-07-22T00:50:26.546Z
Learning: In yii2-extensions/psr-bridge, the ResponseAdapter::formatCookieHeader() method uses `$expire !== 1` to skip validation for Yii2's special deletion cookies, but this should be extended to handle all expired cookies, not just the special case where expire=1.
Applied to files:
src/adapter/ServerRequestAdapter.phptests/adapter/ServerRequestAdapterTest.phptests/adapter/CookiesPsr7Test.php
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Applied to files:
src/adapter/ServerRequestAdapter.phptests/adapter/ServerRequestAdapterTest.phptests/adapter/CookiesPsr7Test.php
📚 Learning: 2025-07-21T23:28:20.089Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: src/adapter/ResponseAdapter.php:86-98
Timestamp: 2025-07-21T23:28:20.089Z
Learning: In Yii2, cookies with `expire == 1` are treated as delete cookies and cookie validation is skipped for them. The official Yii2 Response::sendCookies() method uses `if ($expire != 1 && isset($validationKey))` to determine when to apply validation hashing.
Applied to files:
src/adapter/ServerRequestAdapter.php
📚 Learning: 2025-07-22T10:56:44.424Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/adapter/ResponseAdapterTest.php:436-450
Timestamp: 2025-07-22T10:56:44.424Z
Learning: In yii2-extensions/psr-bridge cookie validation logic, a cookie is only considered expired when expire < current time (strictly less than). When expire == current time, the cookie is still valid and validation/hashing should apply. Only cookies with expire < current time should skip validation.
Applied to files:
src/adapter/ServerRequestAdapter.php
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Applied to files:
tests/adapter/ServerRequestAdapterTest.phptests/adapter/CookiesPsr7Test.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:33:57.495Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-08T15:24:06.045Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Applied to files:
tests/adapter/ServerRequestAdapterTest.phptests/adapter/CookiesPsr7Test.php
📚 Learning: 2025-08-06T22:52:05.608Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#64
File: tests/http/StatelessApplicationTest.php:1939-1967
Timestamp: 2025-08-06T22:52:05.608Z
Learning: In yii2-extensions/psr-bridge tests, when testing specific component methods like Request::resolve(), it's necessary to call $app->handle($request) first to initialize all application components before testing the method in isolation. This ensures proper component lifecycle initialization.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
🪛 Gitleaks (8.27.2)
tests/adapter/CookiesPsr7Test.php
35-35: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
84-84: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
127-127: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
157-157: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
203-203: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
258-258: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
276-276: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
356-356: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
377-377: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
431-431: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
502-502: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
- GitHub Check: phpunit / PHP 8.4-windows-latest
- GitHub Check: phpunit / PHP 8.2-windows-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
🔇 Additional comments (4)
src/adapter/ServerRequestAdapter.php (2)
423-423: Good optimization: reuse the Security instance inside the loop.Reduces repeated component retrieval and allocations during validation.
9-9: Import looks correct.Bringing
Securityviayii\base\Securityaligns with usage below.tests/adapter/ServerRequestAdapterTest.php (1)
9-10: LGTM on import adjustments.No issues; consistent with current usages in this file.
tests/adapter/CookiesPsr7Test.php (1)
272-291: Signing flow mirrors adapter validation logic.Using
Security::hashData(Json::encode([$name, $value]), $validationKey)matches the adapter’svalidateData()->Json::decode()flow and is correct.
…t in `CookiesPsr7Test` for consistency and maintainability.
…ter` and add comprehensive tests in `StatelessApplicationTest` for improved validation handling.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
tests/http/StatelessApplicationTest.php (3)
998-1029: Strengthen test with status code and content-type assertionsAdd basic response metadata checks for consistency with the rest of the suite.
$response = $app->handle( FactoryHelper::createRequest('GET', 'site/getcookies') ->withCookieParams( [ 'invalid_cookie' => 'invalid_data', 'empty_cookie' => '', ], ), ); + self::assertSame( + 200, + $response->getStatusCode(), + "Response 'status code' should be '200' for 'site/getcookies' with validation enabled.", + ); + self::assertSame( + 'application/json; charset=UTF-8', + $response->getHeaders()['content-type'][0] ?? '', + "Response 'content-type' should be 'application/json; charset=UTF-8' for 'site/getcookies'.", + ); self::assertSame( '[]', $response->getBody()->getContents(), 'CookieCollection should be empty when validation is enabled but cookies are invalid.', );Note: Good use of self::COOKIE_VALIDATION_KEY per project convention.
1349-1447: Improve clarity and robustness: assert metadata and rename local var
- Add status/code content-type checks.
- Rename $expectedCookies to a more accurate name.
- Assert decoded type explicitly.
$response = $app->handle( FactoryHelper::createRequest('GET', 'site/getcookies') ->withCookieParams($signedCookies), ); - /** + /** * @phpstan-var array< * string, * array{ * name: string, * value: string, * domain: string, * expire: ?int, * path: string, * secure: bool, * httpOnly: bool, * sameSite: string * } * > */ - $expectedCookies = Json::decode($response->getBody()->getContents()); + self::assertSame( + 200, + $response->getStatusCode(), + "Response 'status code' should be '200' for 'site/getcookies' route in 'StatelessApplication'.", + ); + self::assertSame( + 'application/json; charset=UTF-8', + $response->getHeaders()['content-type'][0] ?? '', + "Response 'content-type' should be 'application/json; charset=UTF-8' for 'site/getcookies'.", + ); + $cookies = Json::decode($response->getBody()->getContents()); + self::assertIsArray($cookies); self::assertCount( 4, - $expectedCookies, + $cookies, "Should return all '4' validated cookies, not just '1'.", ); foreach ($cookies as $name => $value) { self::assertSame( $name, - $expectedCookies[$name]['name'] ?? null, + $cookies[$name]['name'] ?? null, "Cookie name for '{$name}' should match the original cookie name in 'StatelessApplication'.", ); self::assertSame( $value, - $expectedCookies[$name]['value'], + $cookies[$name]['value'], "Cookie value for '{$name}' should match the original cookie value in 'StatelessApplication'.", ); self::assertEmpty( - $expectedCookies[$name]['domain'], + $cookies[$name]['domain'], "Cookie 'domain' for '{$name}' should be an empty string in 'StatelessApplication'.", ); self::assertNull( - $expectedCookies[$name]['expire'], + $cookies[$name]['expire'], "Cookie 'expire' for '{$name}' should be 'null' in 'StatelessApplication'.", ); self::assertSame( '/', - $expectedCookies[$name]['path'], + $cookies[$name]['path'], "Cookie 'path' for '{$name}' should be '/' in 'StatelessApplication'.", ); self::assertFalse( - $expectedCookies[$name]['secure'], + $cookies[$name]['secure'], "Cookie 'secure' flag for '{$name}' should be 'false' in 'StatelessApplication'.", ); self::assertTrue( - $expectedCookies[$name]['httpOnly'], + $cookies[$name]['httpOnly'], "Cookie 'httpOnly' flag for '{$name}' should be 'true' in 'StatelessApplication'.", ); self::assertSame( 'Lax', - $expectedCookies[$name]['sameSite'], + $cookies[$name]['sameSite'], "Cookie 'sameSite' for '{$name}' should be 'Lax' in 'StatelessApplication'.", ); }
1665-1711: Fix assertion message: cookie name typoAssertion message mentions 'validated_session' but the actual cookie name is 'valid_session'.
self::assertSame( <<<JSON {"valid_session":{"name":"valid_session","value":"abc123session","domain":"","expire":null,"path":"/","secure":false,"httpOnly":true,"sameSite":"Lax"}} JSON, $response->getBody()->getContents(), - "Response 'body' should match expected JSON string for cookie 'validated_session' on 'site/getcookies' " . + "Response 'body' should match expected JSON string for cookie 'valid_session' on 'site/getcookies' " . "route in 'StatelessApplication'.", );
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
src/adapter/ServerRequestAdapter.php(1 hunks)tests/adapter/CookiesPsr7Test.php(1 hunks)tests/http/StatelessApplicationTest.php(4 hunks)
✅ Files skipped from review due to trivial changes (1)
- src/adapter/ServerRequestAdapter.php
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/adapter/CookiesPsr7Test.php
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Applied to files:
tests/http/StatelessApplicationTest.php
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Applied to files:
tests/http/StatelessApplicationTest.php
📚 Learning: 2025-08-08T15:24:06.045Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Applied to files:
tests/http/StatelessApplicationTest.php
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: phpunit / PHP 8.4-windows-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
🔇 Additional comments (2)
tests/http/StatelessApplicationTest.php (2)
19-19: LGTM: Cookie import addition is fineImport aligns with expanded cookie-related tests; no issues.
1713-1754: LGTM: Validated cookie preserves the correct name and attributesGood use of self::COOKIE_VALIDATION_KEY and end-to-end verification.
…RequestAdapter` for cleaner code.
…st` and remove unused import in `StatelessApplicationTest` for improved clarity.
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
tests/adapter/ServerRequestAdapterTest.php (1)
731-777: Ensure runtime directory exists and clean up uploaded files in ServerRequestAdapterTestTo prevent leftover files in
runtimefrom affecting other tests, updatetests/adapter/ServerRequestAdapterTest.phpas follows:
- Before calling
saveAs(), verify (and create) theruntimedirectory.- After
assertFileExists(), remove the saved file.Suggested diff:
--- a/tests/adapter/ServerRequestAdapterTest.php +++ b/tests/adapter/ServerRequestAdapterTest.php @@ lines 740-760 - self::assertTrue( + // ensure the runtime directory exists + if (!is_dir($runtimePath)) { + self::assertTrue( + @mkdir($runtimePath, 0777, true), + "Failed to create runtime directory: {$runtimePath}" + ); + } + self::assertTrue( $uploadedFile->saveAs("{$runtimePath}/{$uploadedFile->name}", false), "Uploaded file '{$uploadedFile->name}' should be saved to the runtime directory successfully.", ); self::assertFileExists( "{$runtimePath}/{$uploadedFile->name}", "Uploaded file '{$uploadedFile->name}' should exist in the runtime directory after saving.", ); + // clean up to avoid test interference + @unlink("{$runtimePath}/{$uploadedFile->name}");
🧹 Nitpick comments (1)
tests/adapter/ServerRequestAdapterTest.php (1)
714-729: Typo: $expectedUpdloadedFiles -> $expectedUploadedFilesMinor naming nit; typo appears in two places and subsequent references. Consider renaming for clarity.
Also applies to: 822-837
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
tests/adapter/ServerRequestAdapterTest.php(1 hunks)tests/http/StatelessApplicationTest.php(3 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/http/StatelessApplicationTest.php
🧰 Additional context used
🧠 Learnings (10)
📓 Common learnings
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-22T00:50:26.546Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/http/PSR7ResponseTest.php:0-0
Timestamp: 2025-07-22T00:50:26.546Z
Learning: In yii2-extensions/psr-bridge, the ResponseAdapter::formatCookieHeader() method uses `$expire !== 1` to skip validation for Yii2's special deletion cookies, but this should be extended to handle all expired cookies, not just the special case where expire=1.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:33:57.495Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-08T15:24:06.045Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-06T22:52:05.608Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#64
File: tests/http/StatelessApplicationTest.php:1939-1967
Timestamp: 2025-08-06T22:52:05.608Z
Learning: In yii2-extensions/psr-bridge tests, when testing specific component methods like Request::resolve(), it's necessary to call $app->handle($request) first to initialize all application components before testing the method in isolation. This ensures proper component lifecycle initialization.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-22T01:01:13.426Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/http/PSR7ResponseTest.php:0-0
Timestamp: 2025-07-22T01:01:13.426Z
Learning: In yii2-extensions/psr-bridge, expired cookies should not be hashed/validated because they are deletion cookies meant to remove existing cookies from the client browser. The validation logic should only apply to live cookies (expire=0 or expire >= current time) and skip validation for both the special Yii2 deletion case (expire=1) and regular expired cookies.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: phpunit / PHP 8.1-windows-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
🔇 Additional comments (2)
tests/adapter/ServerRequestAdapterTest.php (2)
270-279: No action required:createTmpFile()helper is available
Confirmed thatcreateTmpFile()is implemented intests/TestCase.php(line 95) and inherited byServerRequestAdapterTest.
9-10: Confirmed: Cookie-related imports trimmed and new cookie tests correctly use shared key
- ServerRequestAdapterTest.php no longer contains any cookie-related imports or usages.
- tests/adapter/CookiesPsr7Test.php is present and consistently sets
$request->cookieValidationKey = self::COOKIE_VALIDATION_KEY.- All cookie scenarios in tests/http/StatelessApplicationTest.php reference
self::COOKIE_VALIDATION_KEY(no hardcoded keys).No issues found.
… to `$expectedUploadedFiles` in `ServerRequestAdapterTest` for consistency and clarity.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
tests/adapter/ServerRequestAdapterTest.php (4)
714-729: Optional: reduce duplication when building expected uploaded file metadataThe explicit expected map is correct. Since a very similar structure is rebuilt in another test below, consider a small helper for readability/DRY.
For example, add a helper method in this class (outside the shown range):
private function expectedUploadedFiles(array $entries): array { // $entries: ['key' => ['name' => ..., 'type' => ..., 'tempName' => ..., 'size' => ...]] $out = []; foreach ($entries as $key => $e) { $out[$key] = [ 'name' => $e['name'], 'type' => $e['type'], 'tempName' => $e['tempName'], 'error' => UPLOAD_ERR_OK, 'size' => $e['size'], ]; } return $out; }Then here:
-$expectedUploadedFiles = [ - 'file1' => [ - 'name' => 'test1.txt', - 'type' => 'text/plain', - 'tempName' => $file1, - 'error' => UPLOAD_ERR_OK, - 'size' => $size1, - ], - 'file2' => [ - 'name' => 'test2.php', - 'type' => 'application/x-php', - 'tempName' => $file2, - 'error' => UPLOAD_ERR_OK, - 'size' => $size2, - ], -]; +$expectedUploadedFiles = $this->expectedUploadedFiles([ + 'file1' => ['name' => 'test1.txt', 'type' => 'text/plain', 'tempName' => $file1, 'size' => $size1], + 'file2' => ['name' => 'test2.php', 'type' => 'application/x-php', 'tempName' => $file2, 'size' => $size2], +]);
744-744: Tighten assertions: avoid null coalescing when keys are guaranteedThe expected keys always exist. Removing “?? null” strengthens failures and avoids masking typos in expected map keys.
Apply:
- $expectedUploadedFiles[$name]['name'] ?? null, + $expectedUploadedFiles[$name]['name'],- $expectedUploadedFiles[$name]['type'] ?? null, + $expectedUploadedFiles[$name]['type'],- $expectedUploadedFiles[$name]['tempName'] ?? null, + $expectedUploadedFiles[$name]['tempName'],- $expectedUploadedFiles[$name]['error'] ?? null, + $expectedUploadedFiles[$name]['error'],- $expectedUploadedFiles[$name]['size'] ?? null, + $expectedUploadedFiles[$name]['size'],Also applies to: 749-749, 754-754, 759-759, 764-764
822-837: DRY: duplicate expectedUploadedFiles map appears twiceSame expected structure as earlier test. Consider using the same helper to keep one source of truth for names/types/temp/size.
Example:
-$expectedUploadedFiles = [ - 'file1' => [ - 'name' => 'test1.txt', - 'type' => 'text/plain', - 'tempName' => $file1, - 'error' => UPLOAD_ERR_OK, - 'size' => $size1, - ], - 'file2' => [ - 'name' => 'test2.php', - 'type' => 'application/x-php', - 'tempName' => $file2, - 'error' => UPLOAD_ERR_OK, - 'size' => $size2, - ], -]; +$expectedUploadedFiles = $this->expectedUploadedFiles([ + 'file1' => ['name' => 'test1.txt', 'type' => 'text/plain', 'tempName' => $file1, 'size' => $size1], + 'file2' => ['name' => 'test2.php', 'type' => 'application/x-php', 'tempName' => $file2, 'size' => $size2], +]);
853-853: Tighten assertions: remove unnecessary null coalescingAs above, the expected keys are guaranteed. Drop “?? null”.
Apply:
- $expectedUploadedFiles[$name]['name'] ?? null, + $expectedUploadedFiles[$name]['name'],- $expectedUploadedFiles[$name]['type'] ?? null, + $expectedUploadedFiles[$name]['type'],- $expectedUploadedFiles[$name]['tempName'] ?? null, + $expectedUploadedFiles[$name]['tempName'],- $expectedUploadedFiles[$name]['error'] ?? null, + $expectedUploadedFiles[$name]['error'],- $expectedUploadedFiles[$name]['size'] ?? null, + $expectedUploadedFiles[$name]['size'],Also applies to: 858-858, 863-863, 868-868, 873-873
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
tests/adapter/ServerRequestAdapterTest.php(5 hunks)tests/http/StatelessApplicationTest.php(3 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/http/StatelessApplicationTest.php
🧰 Additional context used
🧠 Learnings (10)
📓 Common learnings
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-08T15:28:00.137Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-22T00:50:26.546Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/http/PSR7ResponseTest.php:0-0
Timestamp: 2025-07-22T00:50:26.546Z
Learning: In yii2-extensions/psr-bridge, the ResponseAdapter::formatCookieHeader() method uses `$expire !== 1` to skip validation for Yii2's special deletion cookies, but this should be extended to handle all expired cookies, not just the special case where expire=1.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-20T16:33:57.495Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-08T15:24:06.045Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-08-06T22:52:05.608Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#64
File: tests/http/StatelessApplicationTest.php:1939-1967
Timestamp: 2025-08-06T22:52:05.608Z
Learning: In yii2-extensions/psr-bridge tests, when testing specific component methods like Request::resolve(), it's necessary to call $app->handle($request) first to initialize all application components before testing the method in isolation. This ensures proper component lifecycle initialization.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
📚 Learning: 2025-07-22T01:01:13.426Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#21
File: tests/http/PSR7ResponseTest.php:0-0
Timestamp: 2025-07-22T01:01:13.426Z
Learning: In yii2-extensions/psr-bridge, expired cookies should not be hashed/validated because they are deletion cookies meant to remove existing cookies from the client browser. The validation logic should only apply to live cookies (expire=0 or expire >= current time) and skip validation for both the special Yii2 deletion case (expire=1) and regular expired cookies.
Applied to files:
tests/adapter/ServerRequestAdapterTest.php
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: phpunit / PHP 8.4-windows-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
- GitHub Check: phpunit / PHP 8.2-windows-latest
🔇 Additional comments (1)
tests/adapter/ServerRequestAdapterTest.php (1)
9-10: Imports look correct and scoped to current usageUsing yii\base\InvalidConfigException and yii\web\UploadedFile matches actual usage in this class after cookie-test extraction.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit