feat(firewall): add tenant and system rule scopes

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-30 21:38:19 -04:00
parent b8afd75b77
commit 63d91ca7fa
5 changed files with 352 additions and 37 deletions
@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Models\Firewall;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+class FirewallRuleObjectTest extends TestCase
+{
+    #[TestDox('Persisted rules without an explicit scope are rejected')]
+    public function testMissingScope(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('explicit scope');
+
+        (new FirewallRuleObject())->jsonDeserialize([
+            'tenantId' => 'tenant-a',
+            'type' => FirewallRuleObject::TYPE_IP,
+            'action' => FirewallRuleObject::ACTION_BLOCK,
+            'value' => '203.0.113.10',
+        ]);
+    }
+
+    #[TestDox('Unknown rule scopes are rejected')]
+    public function testUnknownScope(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        (new FirewallRuleObject())->setScope('unknown');
+    }
+
+    #[TestDox('Tenant rules require a tenant ID')]
+    public function testTenantOwnership(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('require a tenant ID');
+
+        (new FirewallRuleObject())->assertValidScopeOwnership();
+    }
+
+    #[TestDox('System rules cannot have a tenant ID')]
+    public function testSystemOwnership(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('cannot have a tenant ID');
+
+        (new FirewallRuleObject())
+            ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
+            ->setTenantId('tenant-a')
+            ->assertValidScopeOwnership();
+    }
+}