feat: implement console command

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

.github/workflows/build-test.yml

@@ -1,42 +0,0 @@
-name: Build Test
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install Server
-        uses: ./action-server-install
-        with:
-          install-php: 'false'
-          install-node: 'true'
-          php-version: '8.5'
-          node-version: '24'
-          server-path: './server'
-
-      - name: Checkout Pull Request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Build
-        run: npm run build
-        working-directory: server/modules/authentication_provider_password

.github/workflows/integration-tests.yml

@@ -1,4 +1,4 @@
-name: PHP Integration Tests
+name: Integration Tests
 
 on:
   pull_request:
@@ -10,12 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     services:
       mongo:
-        image: mongo:8
+        image: mongo:7
-        options: >-
+        ports:
-          --health-cmd "mongosh --quiet --eval \"db.adminCommand('ping')\""
+          - 27017:27017
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 12
 
     steps:
       - name: Retrieve Server Install Action
@@ -32,7 +29,7 @@ jobs:
           install-php: 'true'
           php-version: '8.5'
           server-path: './server'
-          database-uri: 'mongodb://mongo:27017/?tls=false'
+          database-uri: 'mongodb://127.0.0.1:27017/?tls=false'
           database-name: 'ktrix_ci'
           app-environment: 'test'
 
@@ -44,10 +41,6 @@ jobs:
           path: server/modules/authentication_provider_password
           github-server-url: https://git.ktrix.dev
 
-      - name: Install module dependencies
-        run: composer install --prefer-dist --no-progress
-        working-directory: server/modules/authentication_provider_password
-
       - name: Install and enable module
         working-directory: server
         run: |

.github/workflows/js-unit-tests.yml

@@ -1,42 +0,0 @@
-name: JS Unit Tests
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install Server
-        uses: ./action-server-install
-        with:
-          install-php: 'false'
-          install-node: 'true'
-          php-version: '8.5'
-          node-version: '24'
-          server-path: './server'
-
-      - name: Checkout Pull Request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Run tests
-        run: npm run test:unit
-        working-directory: server/modules/authentication_provider_password

.github/workflows/php-unit-tests.yml

@@ -1,42 +0,0 @@
-name: PHP Unit Tests
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install Server
-        uses: ./action-server-install
-        with:
-          install-php: 'true'
-          install-node: 'false'
-          php-version: '8.5'
-          node-version: '24'
-          server-path: './server'
-
-      - name: Checkout Pull Request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install dependencies
-        run: composer install --prefer-dist --no-progress
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Run tests
-        run: composer test:unit
-        working-directory: server/modules/authentication_provider_password

.gitignore

@@ -15,7 +15,11 @@ node_modules/
 /vendor/
 /lib/vendor/
 coverage/
-*.cache
+phpunit.xml.cache
+.phpunit.cache/
+.phpunit.result.cache
+.php-cs-fixer.cache
+.phpstan.cache
 .phpactor/
 
 # Editors

composer.json

@@ -8,18 +8,9 @@
     }
   },
   "require": {
-    "php": ">=8.3"
+    "php": ">=8.2"
-  },
-  "require-dev": {
-    "phpunit/phpunit": "^12.0"
-  },
-  "autoload-dev": {
-    "psr-4": {
-      "KTXT\\AuthenticationProviderPassword\\Tests\\": "tests/php/"
-    }
   },
   "scripts": {
-    "test:unit": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Unit Tests\" --colors=always --testdox",
+    "test:integration": "../../vendor/bin/phpunit --configuration tests/php/phpunit.integration.xml --colors=always --testdox"
-    "test:integration": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Integration Tests\" --colors=always --testdox"
   }
 }

lib/Controllers/PasswordController.php

@@ -4,8 +4,8 @@ namespace KTXM\AuthenticationProviderPassword\Controllers;
 
 use KTXC\Http\Response\JsonResponse;
 use KTXC\Service\UserAccountsService;
-use KTXC\Context\IdentityContextInterface;
+use KTXC\SessionIdentity;
-use KTXC\Context\TenantContextInterface;
+use KTXC\SessionTenant;
 use KTXF\Controller\ControllerAbstract;
 use KTXF\Routing\Attributes\AuthenticatedRoute;
 use KTXF\Security\Crypto;
@@ -15,8 +15,8 @@ use KTXM\AuthenticationProviderPassword\Stores\CredentialStore;
 class PasswordController extends ControllerAbstract
 {
     public function __construct(
-        private readonly IdentityContextInterface $identityContext,
+        private readonly SessionIdentity $sessionIdentity,
-        private readonly TenantContextInterface $tenantContext,
+        private readonly SessionTenant $sessionTenant,
         private readonly CredentialStore $credentialStore,
         private readonly Provider $provider,
         private readonly Crypto $crypto,
@@ -27,8 +27,8 @@ class PasswordController extends ControllerAbstract
     #[AuthenticatedRoute('/password/update', name: 'password.update', methods: ['POST'])]
     public function update(string $current_password, string $new_password): JsonResponse
     {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();
-        $identifier = $this->identityContext->mailAddress();
+        $identifier = $this->sessionIdentity->mailAddress();
 
         if ($tenantId === null || $identifier === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
@@ -53,15 +53,17 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Get credential status for a user
      */
-    #[AuthenticatedRoute('/status', name: 'password.admin.status', methods: ['POST'], permissions: ['authentication_provider_password.admin.view', 'authentication_provider_password.admin.manage'])]
+    #[AuthenticatedRoute('/admin/status/{uid}', name: 'password.admin.status', methods: ['GET'])]
     public function getStatus(string $uid): JsonResponse
     {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
+        // TODO: Add permission check for admin operations
+
         $user = $this->userAccountsService->fetchByIdentifier($uid);
         if (!$user) {
             return new JsonResponse(['error' => 'User not found'], 404);
@@ -79,15 +81,17 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Set/reset user password
      */
-    #[AuthenticatedRoute('/reset', name: 'password.admin.reset', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
+    #[AuthenticatedRoute('/admin/reset', name: 'password.admin.reset', methods: ['POST'])]
     public function adminReset(string $uid, string $password): JsonResponse
     {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
+        // TODO: Add permission check for admin operations
+
         if (strlen($password) < 8) {
             return new JsonResponse(['error' => 'Password must be at least 8 characters'], 400);
         }
@@ -110,15 +114,17 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Remove user password
      */
-    #[AuthenticatedRoute('/remove', name: 'password.admin.remove', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
+    #[AuthenticatedRoute('/admin/remove/{uid}', name: 'password.admin.remove', methods: ['DELETE'])]
     public function adminRemove(string $uid): JsonResponse
     {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
+        // TODO: Add permission check for admin operations
+
         $user = $this->userAccountsService->fetchByIdentifier($uid);
         if (!$user) {
             return new JsonResponse(['error' => 'User not found'], 404);

lib/Module.php

@@ -5,7 +5,6 @@ declare(strict_types=1);
 namespace KTXM\AuthenticationProviderPassword;
 
 use KTXC\Resource\ProviderManager;
-use KTXF\Module\ModuleBrowserInterface;
 use KTXF\Module\ModuleConsoleInterface;
 use KTXF\Module\ModuleInstanceAbstract;
 use KTXM\AuthenticationProviderPassword\Console\UserPasswordCommand;
@@ -14,7 +13,7 @@ use KTXM\AuthenticationProviderPassword\Console\UserPasswordCommand;
  * Default Identity Provider Module
  * Provides local database authentication
  */
-class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, ModuleBrowserInterface
+class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface
 {
     public function __construct(
         private readonly ProviderManager $providerManager,
@@ -53,16 +52,6 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
                 'description' => 'View and access the password authentication provider module',
                 'group' => 'Authentication Providers'
             ],
-            'authentication_provider_password.admin.view' => [
-                'label' => 'View Password Status',
-                'description' => 'View whether another user has a password credential configured',
-                'group' => 'Authentication Providers'
-            ],
-            'authentication_provider_password.admin.manage' => [
-                'label' => 'Manage User Passwords',
-                'description' => 'Set, reset, or remove password credentials for other users',
-                'group' => 'Authentication Providers'
-            ],
         ];
     }
     

package.json

@@ -11,23 +11,15 @@
     "dev": "vite build --mode development --config vite.config.ts",
     "watch": "vite build --mode development --watch --config vite.config.ts",
     "typecheck": "vue-tsc --noEmit",
-    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
+    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
-    "test": "vitest run --config tests/js/vitest.config.ts",
-    "test:unit": "vitest run --config tests/js/vitest.config.ts",
-    "test:watch": "vitest watch --config tests/js/vitest.config.ts",
-    "test:coverage": "vitest run --coverage --config tests/js/vitest.config.ts"
   },
   "dependencies": {
     "vue": "^3.5.13"
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.0",
-    "typescript": "~6.0.0",
+    "typescript": "~7.0.0",
     "vite": "^8.0.0",
-    "vue-tsc": "^3.0.0",
+    "vue-tsc": "^3.0.0"
-    "@vitest/coverage-v8": "^4.1.6",
-    "@vue/test-utils": "^2.4.10",
-    "jsdom": "^29.1.1",
-    "vitest": "^4.1.6"
   }
 }

src/components/AdminSecurityPanel.vue

@@ -30,15 +30,8 @@ const confirmPassword = ref('');
 const loadStatus = async () => {
   statusLoading.value = true;
   try {
-    const response = await fetch('/m/authentication_provider_password/status', {
+    const response = await fetch(`/m/authentication_provider_password/admin/status/${props.user.uid}`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
       credentials: 'include',
-      body: JSON.stringify({
-        uid: props.user.uid,
-      }),
     });
     
     if (response.ok) {
@@ -67,7 +60,7 @@ const resetPassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/reset', {
+    const response = await fetch('/m/authentication_provider_password/admin/reset', {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -102,15 +95,9 @@ const removePassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/remove', {
+    const response = await fetch(`/m/authentication_provider_password/admin/remove/${props.user.uid}`, {
-      method: 'POST',
+      method: 'DELETE',
-      headers: {
-        'Content-Type': 'application/json',
-      },
       credentials: 'include',
-      body: JSON.stringify({
-        uid: props.user.uid,
-      }),
     });
 
     if (response.ok) {
@@ -215,23 +202,19 @@ onMounted(() => {
           <VForm @submit.prevent="resetPassword">
             <VTextField
               v-model="newPassword"
-              name="new-password"
               label="New Password"
               type="password"
               variant="outlined"
               class="mb-4"
               required
               hint="Minimum 8 characters"
-              autocomplete="suppress"
             />
             <VTextField
               v-model="confirmPassword"
-              name="confirm-password"
               label="Confirm Password"
               type="password"
               variant="outlined"
               required
-              autocomplete="suppress"
               :error="confirmPassword.length > 0 && confirmPassword !== newPassword"
               :error-messages="confirmPassword.length > 0 && confirmPassword !== newPassword ? ['Passwords do not match'] : []"
             />

src/components/CredentialSetupPanel.vue

@@ -34,7 +34,7 @@ const setPassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/reset', {
+    const response = await fetch('/m/authentication_provider_password/admin/reset', {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -110,7 +110,6 @@ const setPassword = async () => {
         <VForm @submit.prevent="setPassword">
           <VTextField
             v-model="password"
-            name="new-password"
             label="Password"
             type="password"
             variant="outlined"
@@ -118,16 +117,13 @@ const setPassword = async () => {
             required
             hint="Minimum 8 characters"
             persistent-hint
-            autocomplete="suppress"
           />
           <VTextField
             v-model="confirmPassword"
-            name="confirm-password"
             label="Confirm Password"
             type="password"
             variant="outlined"
             required
-            autocomplete="suppress"
             :error="confirmPassword.length > 0 && confirmPassword !== password"
             :error-messages="confirmPassword.length > 0 && confirmPassword !== password ? ['Passwords do not match'] : []"
           />

src/views/UserSettingsSecurityPanel.vue

@@ -133,7 +133,7 @@ const saveChanges = async () => {
               label="Current Password"
               placeholder="············"
               variant="outlined"
-              autocomplete="new-password"
+              autocomplete="off"
               @click:append-inner="isCurrentPasswordVisible = !isCurrentPasswordVisible"
             />
           </VCol>
@@ -144,7 +144,6 @@ const saveChanges = async () => {
           <VCol cols="12">
             <VTextField
               v-model="newPassword"
-              name="new-password"
               :type="isNewPasswordVisible ? 'text' : 'password'"
               :append-inner-icon="isNewPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
               label="New Password"
@@ -158,7 +157,6 @@ const saveChanges = async () => {
           <VCol cols="12">
             <VTextField
               v-model="confirmPassword"
-              name="confirm-password"
               :type="isConfirmPasswordVisible ? 'text' : 'password'"
               :append-inner-icon="isConfirmPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
               label="Confirm New Password"

tests/js/unit/base.test.ts

@@ -1,30 +0,0 @@
-import { describe, it, expect } from 'vitest'
-
-describe('Basic Tests', () => {
-  it('should perform basic assertion', () => {
-    expect(true).toBe(true)
-  })
-
-  it('should test array operations', () => {
-    const array = ['foo', 'bar', 'baz']
-
-    expect(array).toHaveLength(3)
-    expect(array).toContain('bar')
-    expect(array[0]).toBe('foo')
-  })
-
-  it('should test string operations', () => {
-    const string = 'Hello, World!'
-
-    expect(string).toContain('World')
-    expect(string.length).toBe(13)
-  })
-
-  it('should test object operations', () => {
-    const obj = { foo: 'bar', count: 42 }
-
-    expect(obj).toHaveProperty('foo')
-    expect(obj.foo).toBe('bar')
-    expect(obj.count).toBeGreaterThan(40)
-  })
-})

tests/js/vitest.config.ts

@@ -1,33 +0,0 @@
-import { fileURLToPath } from 'node:url'
-import { defineConfig, configDefaults } from 'vitest/config'
-import vue from '@vitejs/plugin-vue'
-import path from 'path'
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = path.dirname(__filename)
-
-export default defineConfig({
-  plugins: [vue()],
-  resolve: {
-    alias: {
-      '@': path.resolve(__dirname, '../../src'),
-      '@KTXC': path.resolve(__dirname, '../../../../core/src'),
-    },
-  },
-  test: {
-    environment: 'jsdom',
-    exclude: [...configDefaults.exclude, 'e2e/**'],
-    root: fileURLToPath(new URL('../../', import.meta.url)),
-    coverage: {
-      provider: 'v8',
-      reporter: ['text', 'json', 'html'],
-      exclude: [
-        'node_modules/',
-        'tests/',
-        '**/*.d.ts',
-        '**/*.config.*',
-        '**/dist/**',
-      ],
-    },
-  },
-})

tests/php/Integration/IntegrationTestCase.php

@@ -6,8 +6,7 @@ namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
 
 use KTXC\Http\Request\Request;
 use KTXC\Http\Response\Response;
-use KTXC\Application;
+use KTXC\Server;
-use KTXC\Stores\UserRolesStore;
 use PHPUnit\Framework\TestCase;
 
 /**
@@ -19,11 +18,11 @@ use PHPUnit\Framework\TestCase;
  * through the real HTTP kernel (routing, tenant resolution, auth middleware,
  * controller), not by calling controllers directly.
  *
- * A fresh Application (and DI container) is built for every request() call,
+ * A fresh Server (and DI container) is built for every request() call,
  * mirroring the one-process-per-request model this app is actually
  * deployed under. Session identity is a container-lifetime singleton that
  * AuthenticationMiddleware only ever sets, never clears, so reusing one
- * Application across requests would leak an authenticated identity from one
+ * Server across requests would leak an authenticated identity from one
  * "request" into the next — a problem that can't occur in production,
  * where each request gets its own process, but very much can here.
  *
@@ -37,7 +36,7 @@ abstract class IntegrationTestCase extends TestCase
 
     public static function setUpBeforeClass(): void
     {
-        if (static::buildApplication()->environment() === 'prod') {
+        if (static::buildServer()->environment() === 'prod') {
             self::fail('Refusing to run integration tests against a server configured for the "prod" environment.');
         }
 
@@ -58,9 +57,9 @@ abstract class IntegrationTestCase extends TestCase
         }
     }
 
-    protected static function buildApplication(): Application
+    protected static function buildServer(): Server
     {
-        return Application::create(SERVER_ROOT);
+        return new Server(KTRIX_SERVER_ROOT);
     }
 
     // =========================================================================
@@ -68,21 +67,14 @@ abstract class IntegrationTestCase extends TestCase
     // =========================================================================
 
     /**
-     * Provision a user (optionally with a password credential and roles) and
+     * Provision a user (optionally with a password credential) and return
-     * return its uid, so tests can exercise admin endpoints that operate by uid.
+     * its uid, so tests can exercise admin endpoints that operate by uid.
-     *
-     * @param string[] $roles Role IDs to assign (see createRoleWithPermissions())
      */
-    protected static function createUser(string $identity, ?string $password = null, array $roles = []): string
+    protected static function createUser(string $identity, ?string $password = null): string
     {
         $uid = bin2hex(random_bytes(8));
 
-        $args = ['user:create', static::$tenantIdentifier, $identity, '--uid', $uid];
+        static::runConsole(['user:create', static::$tenantIdentifier, $identity, '--uid', $uid]);
-        foreach ($roles as $role) {
-            $args[] = '--role';
-            $args[] = $role;
-        }
-        static::runConsole($args);
 
         if ($password !== null) {
             static::runConsole(['user:password', static::$tenantIdentifier, $identity, $password]);
@@ -91,33 +83,6 @@ abstract class IntegrationTestCase extends TestCase
         return $uid;
     }
 
-    /**
-     * Create a role granting the given permissions and return its role id.
-     *
-     * There's no `bin/console` command for role management, so this goes
-     * straight through the DI container to UserRolesStore — the same store
-     * the real UserRolesController uses — rather than calling controllers
-     * directly.
-     *
-     * @param string[] $permissions
-     */
-    protected static function createRoleWithPermissions(array $permissions, string $label = 'Test Role'): string
-    {
-        $application = static::buildApplication();
-        try {
-            $application->kernel()->boot();
-            $store = $application->container()->get(UserRolesStore::class);
-            $role = $store->createRole(static::$tenantIdentifier, [
-                'label' => $label,
-                'permissions' => $permissions,
-            ]);
-        } finally {
-            $application->shutdown();
-        }
-
-        return $role['rid'];
-    }
-
     /**
      * Run a bin/console command as a real subprocess and fail the test on
      * a non-zero exit code.
@@ -126,7 +91,7 @@ abstract class IntegrationTestCase extends TestCase
      */
     protected static function runConsole(array $args): string
     {
-        $command = escapeshellcmd(PHP_BINARY) . ' ' . escapeshellarg(SERVER_ROOT . '/bin/console');
+        $command = escapeshellcmd(PHP_BINARY) . ' ' . escapeshellarg(KTRIX_SERVER_ROOT . '/bin/console');
         foreach ($args as $arg) {
             $command .= ' ' . escapeshellarg((string) $arg);
         }
@@ -173,13 +138,15 @@ abstract class IntegrationTestCase extends TestCase
         $uri = 'http://' . static::$tenantDomain . $path;
         $request = Request::create($uri, $method, [], [], [], $server, $content);
 
-        // A fresh application mirrors production while shutdown restores its
+        // Kernel::boot() registers a global error/exception handler per
-        // process-level error handler after the in-process request.
+        // instance and never removes it (fine under one-process-per-request
-        $application = static::buildApplication();
+        // in production; here it would otherwise stack a handler per test).
+        // Pop back to whatever was in place before this request.
         try {
-            $response = $application->runHttpRequest($request);
+            $response = static::buildServer()->handle($request);
         } finally {
-            $application->shutdown();
+            restore_error_handler();
+            restore_exception_handler();
         }
 
         $body = $response->getContent();

tests/php/Integration/PasswordControllerTest.php

@@ -63,13 +63,12 @@ class PasswordControllerTest extends IntegrationTestCase
 
     public function testAdminStatusReflectsEnrollment(): void
     {
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.view']);
+        $enrolledUid = static::createUser('grace@example.test', 'Grace-Pass-1!');
-        $enrolledUid = static::createUser('grace@example.test', 'Grace-Pass-1!', [$roleId]);
         $unenrolledUid = static::createUser('heidi@example.test');
         $accessToken = static::loginWithPassword('grace@example.test', 'Grace-Pass-1!')['accessToken'];
 
-        $enrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $enrolledUid]);
+        $enrolledStatus = static::authorizedRequest($accessToken, 'GET', self::BASE . "/admin/status/{$enrolledUid}");
-        $unenrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $unenrolledUid]);
+        $unenrolledStatus = static::authorizedRequest($accessToken, 'GET', self::BASE . "/admin/status/{$unenrolledUid}");
 
         $this->assertTrue($enrolledStatus['body']['enrolled'] ?? null);
         $this->assertFalse($unenrolledStatus['body']['enrolled'] ?? null);
@@ -78,12 +77,11 @@ class PasswordControllerTest extends IntegrationTestCase
     public function testAdminResetSetsAPasswordThatCanLogIn(): void
     {
         $uid = static::createUser('ivan@example.test');
-        // Bootstrap an authenticated actor with permission to call the admin endpoint
+        // Bootstrap an authenticated actor to call the admin endpoint
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor1@example.test', 'Actor-Pass-1!');
-        static::createUser('actor1@example.test', 'Actor-Pass-1!', [$roleId]);
         $accessToken = static::loginWithPassword('actor1@example.test', 'Actor-Pass-1!')['accessToken'];
 
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/admin/reset', [
             'uid' => $uid,
             'password' => 'Reset-By-Admin-1!',
         ]);
@@ -98,11 +96,10 @@ class PasswordControllerTest extends IntegrationTestCase
     public function testAdminResetRejectsShortPasswords(): void
     {
         $uid = static::createUser('judy@example.test');
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor2@example.test', 'Actor-Pass-2!');
-        static::createUser('actor2@example.test', 'Actor-Pass-2!', [$roleId]);
         $accessToken = static::loginWithPassword('actor2@example.test', 'Actor-Pass-2!')['accessToken'];
 
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/admin/reset', [
             'uid' => $uid,
             'password' => 'short',
         ]);
@@ -113,41 +110,17 @@ class PasswordControllerTest extends IntegrationTestCase
     public function testAdminRemoveRevokesLogin(): void
     {
         $uid = static::createUser('kevin@example.test', 'Kevin-Pass-1!');
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor3@example.test', 'Actor-Pass-3!');
-        static::createUser('actor3@example.test', 'Actor-Pass-3!', [$roleId]);
         $accessToken = static::loginWithPassword('actor3@example.test', 'Actor-Pass-3!')['accessToken'];
 
-        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $uid]);
+        $remove = static::authorizedRequest($accessToken, 'DELETE', self::BASE . "/admin/remove/{$uid}");
         $this->assertSame(200, $remove['status']);
         $this->assertTrue($remove['body']['success'] ?? false);
 
-        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $uid]);
+        $status = static::authorizedRequest($accessToken, 'GET', self::BASE . "/admin/status/{$uid}");
         $this->assertFalse($status['body']['enrolled'] ?? null);
 
         $login = static::loginWithPassword('kevin@example.test', 'Kevin-Pass-1!');
         $this->assertSame('failed', $login['body']['status'] ?? null);
     }
-
-    public function testAdminEndpointsRejectActorsWithoutPermission(): void
-    {
-        $targetUid = static::createUser('mallory-target@example.test', 'Mallory-Target-1!');
-        static::createUser('mallory@example.test', 'Mallory-Pass-1!');
-        $accessToken = static::loginWithPassword('mallory@example.test', 'Mallory-Pass-1!')['accessToken'];
-
-        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $targetUid]);
-        $this->assertSame(403, $status['status']);
-
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
-            'uid' => $targetUid,
-            'password' => 'Should-Not-Apply-1!',
-        ]);
-        $this->assertSame(403, $reset['status']);
-
-        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $targetUid]);
-        $this->assertSame(403, $remove['status']);
-
-        // None of the rejected calls should have taken effect
-        $login = static::loginWithPassword('mallory-target@example.test', 'Mallory-Target-1!');
-        $this->assertSame('success', $login['body']['status'] ?? null);
-    }
 }

tests/php/Unit/BaseTest.php

@@ -1,29 +0,0 @@
-<?php
-
-namespace KTXT\AuthenticationProviderPassword\Tests\Unit;
-
-use PHPUnit\Framework\TestCase;
-
-class BaseTest extends TestCase
-{
-    public function testBasicAssertion(): void
-    {
-        $this->assertTrue(true);
-    }
-
-    public function testArrayOperations(): void
-    {
-        $array = ['foo' => 'bar'];
-
-        $this->assertArrayHasKey('foo', $array);
-        $this->assertEquals('bar', $array['foo']);
-    }
-
-    public function testStringOperations(): void
-    {
-        $string = 'Hello, World!';
-
-        $this->assertStringContainsString('World', $string);
-        $this->assertEquals(13, strlen($string));
-    }
-}

tests/php/bootstrap.php

@@ -6,9 +6,9 @@ declare(strict_types=1);
 // server's own vendor/autoload.php (core + shared + framework deps) is a
 // fixed number of levels above this file. Every other test file resolves
 // the server root through this constant rather than repeating the math.
-define('SERVER_ROOT', dirname(__DIR__, 4));
+define('KTRIX_SERVER_ROOT', dirname(__DIR__, 4));
 
-require SERVER_ROOT . '/vendor/autoload.php';
+require KTRIX_SERVER_ROOT . '/vendor/autoload.php';
 require __DIR__ . '/Integration/IntegrationTestCase.php';
 
 if (isset($_SERVER['APP_DEBUG']) && $_SERVER['APP_DEBUG']) {

tests/php/phpunit.integration.xml

@@ -2,7 +2,7 @@
 
 <!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="../../vendor/phpunit/phpunit/phpunit.xsd"
+         xsi:noNamespaceSchemaLocation="../../../../vendor/phpunit/phpunit/phpunit.xsd"
          colors="true"
          failOnDeprecation="true"
          failOnNotice="true"
@@ -17,11 +17,8 @@
     </php>
 
     <testsuites>
-        <testsuite name="Unit Tests">
-            <directory>Unit</directory>
-        </testsuite>
         <testsuite name="Integration Tests">
-            <directory>Integration</directory>
+            <directory suffix="Test.php">Integration</directory>
         </testsuite>
     </testsuites>