feat: pemissions

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Integration/IntegrationTestCase.php

@@ -7,6 +7,7 @@ namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
 use KTXC\Http\Request\Request;
 use KTXC\Http\Response\Response;
 use KTXC\Server;
+use KTXC\Stores\UserRolesStore;
 use PHPUnit\Framework\TestCase;
 
 /**
@@ -67,14 +68,21 @@ abstract class IntegrationTestCase extends TestCase
     // =========================================================================
 
     /**
-     * Provision a user (optionally with a password credential) and return
-     * its uid, so tests can exercise admin endpoints that operate by uid.
+     * Provision a user (optionally with a password credential and roles) and
+     * return its uid, so tests can exercise admin endpoints that operate by uid.
+     *
+     * @param string[] $roles Role IDs to assign (see createRoleWithPermissions())
      */
-    protected static function createUser(string $identity, ?string $password = null): string
+    protected static function createUser(string $identity, ?string $password = null, array $roles = []): string
     {
         $uid = bin2hex(random_bytes(8));
 
-        static::runConsole(['user:create', static::$tenantIdentifier, $identity, '--uid', $uid]);
+        $args = ['user:create', static::$tenantIdentifier, $identity, '--uid', $uid];
+        foreach ($roles as $role) {
+            $args[] = '--role';
+            $args[] = $role;
+        }
+        static::runConsole($args);
 
         if ($password !== null) {
             static::runConsole(['user:password', static::$tenantIdentifier, $identity, $password]);
@@ -83,6 +91,34 @@ abstract class IntegrationTestCase extends TestCase
         return $uid;
     }
 
+    /**
+     * Create a role granting the given permissions and return its role id.
+     *
+     * There's no `bin/console` command for role management, so this goes
+     * straight through the DI container to UserRolesStore — the same store
+     * the real UserRolesController uses — rather than calling controllers
+     * directly.
+     *
+     * @param string[] $permissions
+     */
+    protected static function createRoleWithPermissions(array $permissions, string $label = 'Test Role'): string
+    {
+        $server = static::buildServer();
+        try {
+            $server->kernel()->boot();
+            $store = $server->container()->get(UserRolesStore::class);
+            $role = $store->createRole(static::$tenantIdentifier, [
+                'label' => $label,
+                'permissions' => $permissions,
+            ]);
+        } finally {
+            restore_error_handler();
+            restore_exception_handler();
+        }
+
+        return $role['rid'];
+    }
+
     /**
      * Run a bin/console command as a real subprocess and fail the test on
      * a non-zero exit code.