chore(deps): update dependency dompurify to v3.4.12

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Console/Module/ModuleDisableCommand.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXC\Console;
+namespace KTXC\Console\Module;
 
 use KTXC\Module\ModuleManager;
 use Psr\Log\LoggerInterface;

core/lib/Console/Module/ModuleEnableCommand.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXC\Console;
+namespace KTXC\Console\Module;
 
 use KTXC\Module\ModuleManager;
 use Psr\Log\LoggerInterface;

core/lib/Console/Module/ModuleInstallCommand.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXC\Console;
+namespace KTXC\Console\Module;
 
 use KTXC\Module\ModuleManager;
 use Psr\Log\LoggerInterface;

core/lib/Console/Module/ModuleListCommand.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXC\Console;
+namespace KTXC\Console\Module;
 
 use KTXC\Module\ModuleManager;
 use Symfony\Component\Console\Attribute\AsCommand;

core/lib/Console/Module/ModuleUninstallCommand.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXC\Console;
+namespace KTXC\Console\Module;
 
 use KTXC\Module\ModuleManager;
 use Psr\Log\LoggerInterface;

core/lib/Console/Module/ModuleUpgradeCommand.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXC\Console;
+namespace KTXC\Console\Module;
 
 use KTXC\Module\ModuleManager;
 use Psr\Log\LoggerInterface;

core/lib/Console/Tenant/TenantCreateCommand.php

@@ -0,0 +1,120 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\Tenant;
+
+use KTXC\Models\Tenant\DomainCollection;
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\TenantService;
+use KTXF\Utile\UUID;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * Tenant Create Command
+ *
+ * Creates a new tenant.
+ */
+#[AsCommand(
+    name: 'tenant:create',
+    description: 'Create a new tenant',
+)]
+class TenantCreateCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('domain', InputArgument::REQUIRED | InputArgument::IS_ARRAY, 'Domain(s) served by this tenant')
+            ->addOption('label', 'l', InputOption::VALUE_REQUIRED, 'Display label for the tenant')
+            ->addOption('description', 'd', InputOption::VALUE_REQUIRED, 'Tenant description')
+            ->addOption('identifier', null, InputOption::VALUE_REQUIRED, 'Explicit tenant identifier (defaults to a generated UUID)')
+            ->addOption('disabled', null, InputOption::VALUE_NONE, 'Create the tenant in a disabled state')
+            ->setHelp('This command creates a new tenant with one or more domains. The tenant identifier is generated automatically unless --identifier is provided.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $identifier = $input->getOption('identifier') ?? UUID::v4();
+        $domains = array_values(array_unique(array_filter(array_map('trim', $input->getArgument('domain')))));
+
+        $io->title('Create Tenant');
+
+        try {
+            if (empty($domains)) {
+                $io->error('At least one non-empty domain is required.');
+                return Command::FAILURE;
+            }
+
+            // Ensure identifier is unique
+            if ($this->tenantService->fetchById($identifier)) {
+                $io->error("Tenant '{$identifier}' already exists.");
+                return Command::FAILURE;
+            }
+
+            // Ensure domains are not claimed by another tenant
+            foreach ($domains as $domain) {
+                $existing = $this->tenantService->fetchByDomain($domain);
+                if ($existing) {
+                    $io->error("Domain '{$domain}' is already assigned to tenant '{$existing->getIdentifier()}'.");
+                    return Command::FAILURE;
+                }
+            }
+
+            $tenant = new TenantObject();
+            $tenant->setIdentifier($identifier);
+            $tenant->setEnabled(!$input->getOption('disabled'));
+            $tenant->setLabel($input->getOption('label') ?? $domains[0]);
+            $tenant->setDescription($input->getOption('description') ?? '');
+            $tenant->setDomains(new DomainCollection($domains));
+            $tenant->setConfiguration(new TenantConfiguration());
+
+            $tenant = $this->tenantService->deposit($tenant);
+
+            if (!$tenant) {
+                $io->error('Failed to create tenant.');
+                return Command::FAILURE;
+            }
+
+            $this->logger->info('Tenant created via console', [
+                'identifier' => $identifier,
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("Tenant '{$identifier}' created successfully!");
+            $io->definitionList(
+                ['Id' => $tenant->getId()],
+                ['Identifier' => $tenant->getIdentifier()],
+                ['Label' => $tenant->getLabel()],
+                ['Enabled' => $tenant->getEnabled() ? 'yes' : 'no'],
+                ['Domains' => implode(', ', $domains)],
+            );
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to create tenant: ' . $e->getMessage());
+            $this->logger->error('Tenant create failed', [
+                'identifier' => $identifier,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}

core/lib/Console/Tenant/TenantDeleteCommand.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\Tenant;
+
+use KTXC\Service\TenantService;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * Tenant Delete Command
+ *
+ * Deletes an existing tenant.
+ */
+#[AsCommand(
+    name: 'tenant:delete',
+    description: 'Delete a tenant',
+)]
+class TenantDeleteCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('identifier', InputArgument::REQUIRED, 'Tenant identifier to delete')
+            ->addOption('force', 'f', InputOption::VALUE_NONE, 'Skip confirmation prompt')
+            ->setHelp('This command deletes a tenant. Deletion must be confirmed by typing the tenant\'s primary domain. User accounts and module data belonging to the tenant are not removed.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $identifier = $input->getArgument('identifier');
+        $force = $input->getOption('force');
+
+        $io->title('Delete Tenant');
+
+        try {
+            $tenant = $this->tenantService->fetchById($identifier);
+
+            if (!$tenant) {
+                $io->error("Tenant '{$identifier}' not found.");
+                return Command::FAILURE;
+            }
+
+            if (!$force) {
+                // Confirm by typing the tenant's primary domain (identifier for
+                // legacy tenants without domains)
+                $domains = $tenant->getDomains()?->getArrayCopy() ?? [];
+                $confirmation = $domains[0] ?? $identifier;
+
+                $io->definitionList(
+                    ['Identifier' => $tenant->getIdentifier()],
+                    ['Label' => $tenant->getLabel()],
+                    ['Domains' => implode(', ', $domains)],
+                );
+
+                $answer = $io->ask("Type '{$confirmation}' to confirm deletion");
+
+                if ($answer !== $confirmation) {
+                    $io->error('Confirmation did not match. Delete cancelled.');
+                    return Command::FAILURE;
+                }
+            }
+
+            $this->tenantService->destroy($tenant);
+
+            $this->logger->info('Tenant deleted via console', [
+                'identifier' => $identifier,
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("Tenant '{$identifier}' deleted successfully!");
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to delete tenant: ' . $e->getMessage());
+            $this->logger->error('Tenant delete failed', [
+                'identifier' => $identifier,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}

core/lib/Console/Tenant/TenantListCommand.php

@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\Tenant;
+
+use KTXC\Service\TenantService;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * Tenant List Command
+ *
+ * Lists all tenants.
+ */
+#[AsCommand(
+    name: 'tenant:list',
+    description: 'List all tenants',
+)]
+class TenantListCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this->setHelp('This command lists all tenants.');
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $io->title('Tenants');
+
+        try {
+            $tenants = $this->tenantService->list();
+
+            if (empty($tenants)) {
+                $io->text('No tenants found.');
+                return Command::SUCCESS;
+            }
+
+            $rows = [];
+            foreach ($tenants as $tenant) {
+                $domains = $tenant->getDomains();
+                $rows[] = [
+                    $tenant->getIdentifier(),
+                    $tenant->getLabel(),
+                    $tenant->getEnabled() ? 'yes' : 'no',
+                    $domains ? implode(', ', $domains->getArrayCopy()) : '',
+                ];
+            }
+
+            $io->table(['Identifier', 'Label', 'Enabled', 'Domains'], $rows);
+            $io->text(sprintf('Total: %d tenant(s)', count($rows)));
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to list tenants: ' . $e->getMessage());
+            return Command::FAILURE;
+        }
+    }
+}

core/lib/Console/User/UserCreateCommand.php

@@ -0,0 +1,128 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\User;
+
+use KTXC\Service\TenantService;
+use KTXC\Stores\UserAccountsStore;
+use KTXC\Stores\UserRolesStore;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * User Create Command
+ *
+ * Creates a new user account within a tenant.
+ */
+#[AsCommand(
+    name: 'user:create',
+    description: 'Create a new user account in a tenant',
+)]
+class UserCreateCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService,
+        private readonly UserAccountsStore $userStore,
+        private readonly UserRolesStore $rolesStore,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
+            ->addArgument('identity', InputArgument::REQUIRED, 'User identity (email/username)')
+            ->addOption('label', 'l', InputOption::VALUE_REQUIRED, 'Display label for the user')
+            ->addOption('role', 'r', InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY, 'Role id(s) to assign', [])
+            ->addOption('uid', null, InputOption::VALUE_REQUIRED, 'Explicit user id (defaults to a generated UUID)')
+            ->addOption('disabled', null, InputOption::VALUE_NONE, 'Create the account in a disabled state')
+            ->setHelp('This command creates a new user account in a tenant. Authentication credentials are managed separately by authentication provider modules.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $tenant = $input->getArgument('tenant');
+        $identity = $input->getArgument('identity');
+        $roles = $input->getOption('role');
+
+        $io->title('Create User');
+
+        try {
+            // Ensure the tenant exists
+            if (!$this->tenantService->fetchById($tenant)) {
+                $io->error("Tenant '{$tenant}' not found.");
+                return Command::FAILURE;
+            }
+
+            // Ensure identity is unique within the tenant
+            if ($this->userStore->fetchByIdentity($tenant, $identity)) {
+                $io->error("User '{$identity}' already exists in tenant '{$tenant}'.");
+                return Command::FAILURE;
+            }
+
+            // Ensure assigned roles exist
+            foreach ($roles as $role) {
+                if (!$this->rolesStore->fetchByRid($tenant, $role)) {
+                    $io->error("Role '{$role}' not found in tenant '{$tenant}'.");
+                    return Command::FAILURE;
+                }
+            }
+
+            $userData = [
+                'identity' => $identity,
+                'label' => $input->getOption('label') ?? $identity,
+                'enabled' => !$input->getOption('disabled'),
+                'roles' => $roles,
+                'profile' => [],
+                'settings' => [],
+                'provider' => null,
+                'provider_subject' => null,
+                'provider_managed_fields' => [],
+            ];
+
+            if ($input->getOption('uid')) {
+                $userData['uid'] = $input->getOption('uid');
+            }
+
+            $user = $this->userStore->createUser($tenant, $userData);
+
+            $this->logger->info('User created via console', [
+                'tenant' => $tenant,
+                'identity' => $identity,
+                'uid' => $user['uid'] ?? null,
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("User '{$identity}' created successfully!");
+            $io->definitionList(
+                ['Uid' => $user['uid'] ?? ''],
+                ['Identity' => $user['identity'] ?? ''],
+                ['Label' => $user['label'] ?? ''],
+                ['Enabled' => !empty($user['enabled']) ? 'yes' : 'no'],
+                ['Roles' => implode(', ', (array)($user['roles'] ?? []))],
+            );
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to create user: ' . $e->getMessage());
+            $this->logger->error('User create failed', [
+                'tenant' => $tenant,
+                'identity' => $identity,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}

core/lib/Console/User/UserDeleteCommand.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\User;
+
+use KTXC\Stores\UserAccountsStore;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * User Delete Command
+ *
+ * Deletes a user account from a tenant.
+ */
+#[AsCommand(
+    name: 'user:delete',
+    description: 'Delete a user account from a tenant',
+)]
+class UserDeleteCommand extends Command
+{
+    public function __construct(
+        private readonly UserAccountsStore $userStore,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
+            ->addArgument('identity', InputArgument::REQUIRED, 'User identity (email/username)')
+            ->addOption('force', 'f', InputOption::VALUE_NONE, 'Skip confirmation prompt')
+            ->setHelp('This command deletes a user account from a tenant. Credentials stored by authentication provider modules are not removed.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $tenant = $input->getArgument('tenant');
+        $identity = $input->getArgument('identity');
+        $force = $input->getOption('force');
+
+        $io->title('Delete User');
+
+        try {
+            $user = $this->userStore->fetchByIdentity($tenant, $identity);
+
+            if (!$user) {
+                $io->error("User '{$identity}' not found in tenant '{$tenant}'.");
+                return Command::FAILURE;
+            }
+
+            if (!$force && !$io->confirm("Are you sure you want to delete user '{$identity}' from tenant '{$tenant}'?", false)) {
+                $io->text('Delete cancelled.');
+                return Command::SUCCESS;
+            }
+
+            if (!$this->userStore->deleteUser($tenant, $user['uid'])) {
+                $io->error("Failed to delete user '{$identity}'.");
+                return Command::FAILURE;
+            }
+
+            $this->logger->info('User deleted via console', [
+                'tenant' => $tenant,
+                'identity' => $identity,
+                'uid' => $user['uid'],
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("User '{$identity}' deleted successfully!");
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to delete user: ' . $e->getMessage());
+            $this->logger->error('User delete failed', [
+                'tenant' => $tenant,
+                'identity' => $identity,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}

core/lib/Console/User/UserListCommand.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\User;
+
+use KTXC\Service\TenantService;
+use KTXC\Stores\UserAccountsStore;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * User List Command
+ *
+ * Lists all user accounts in a tenant.
+ */
+#[AsCommand(
+    name: 'user:list',
+    description: 'List user accounts in a tenant',
+)]
+class UserListCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService,
+        private readonly UserAccountsStore $userStore
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
+            ->setHelp('This command lists all user accounts in a tenant.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $tenant = $input->getArgument('tenant');
+
+        $io->title("Users in tenant '{$tenant}'");
+
+        try {
+            if (!$this->tenantService->fetchById($tenant)) {
+                $io->error("Tenant '{$tenant}' not found.");
+                return Command::FAILURE;
+            }
+
+            $users = $this->userStore->listUsers($tenant);
+
+            if (empty($users)) {
+                $io->text('No users found.');
+                return Command::SUCCESS;
+            }
+
+            $rows = [];
+            foreach ($users as $user) {
+                $rows[] = [
+                    $user['uid'] ?? '',
+                    $user['identity'] ?? '',
+                    $user['label'] ?? '',
+                    !empty($user['enabled']) ? 'yes' : 'no',
+                    implode(', ', (array)($user['roles'] ?? [])),
+                ];
+            }
+
+            $io->table(['Uid', 'Identity', 'Label', 'Enabled', 'Roles'], $rows);
+            $io->text(sprintf('Total: %d user(s)', count($rows)));
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to list users: ' . $e->getMessage());
+            return Command::FAILURE;
+        }
+    }
+}

core/lib/Models/Tenant/TenantObject.php

@@ -52,8 +52,8 @@ class TenantObject extends JsonSerializableObject
             'enabled' => $this->enabled,
             'label' => $this->label,
             'description' => $this->description,
-            'domains' => $this->domains,
-            'configuration' => $this->configuration,
+            'domains' => $this->domains?->getArrayCopy(),
+            'configuration' => $this->configuration?->jsonSerialize(),
         ];
     }
 

core/lib/Module/Module.php

@@ -99,12 +99,18 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
     public function registerCI(): array
     {
         return [
-            \KTXC\Console\ModuleListCommand::class,
-            \KTXC\Console\ModuleEnableCommand::class,
-            \KTXC\Console\ModuleDisableCommand::class,
-            \KTXC\Console\ModuleInstallCommand::class,
-            \KTXC\Console\ModuleUninstallCommand::class,
-            \KTXC\Console\ModuleUpgradeCommand::class,
+            \KTXC\Console\Module\ModuleListCommand::class,
+            \KTXC\Console\Module\ModuleEnableCommand::class,
+            \KTXC\Console\Module\ModuleDisableCommand::class,
+            \KTXC\Console\Module\ModuleInstallCommand::class,
+            \KTXC\Console\Module\ModuleUninstallCommand::class,
+            \KTXC\Console\Module\ModuleUpgradeCommand::class,
+            \KTXC\Console\Tenant\TenantCreateCommand::class,
+            \KTXC\Console\Tenant\TenantListCommand::class,
+            \KTXC\Console\Tenant\TenantDeleteCommand::class,
+            \KTXC\Console\User\UserCreateCommand::class,
+            \KTXC\Console\User\UserListCommand::class,
+            \KTXC\Console\User\UserDeleteCommand::class,
         ];
     }
 

core/lib/Service/TenantService.php

@@ -21,6 +21,31 @@ class TenantService
         return $this->store->fetch($identifier);
     }
 
+    /**
+     * List all tenants keyed by id
+     *
+     * @return array<string, TenantObject>
+     */
+    public function list(): array
+    {
+        return $this->store->list();
+    }
+
+    public function deposit(TenantObject $tenant): ?TenantObject
+    {
+        $domains = $tenant->getDomains();
+        if ($domains === null || count($domains) === 0) {
+            throw new \InvalidArgumentException('A tenant must have at least one domain.');
+        }
+
+        return $this->store->deposit($tenant);
+    }
+
+    public function destroy(TenantObject $tenant): void
+    {
+        $this->store->destroy($tenant);
+    }
+
     // =========================================================================
     // Settings
     // =========================================================================

core/lib/Stores/TenantStore.php

@@ -3,6 +3,7 @@
 namespace KTXC\Stores;
 
 use KTXC\Db\DataStore;
+use KTXC\Db\ObjectId;
 use KTXC\Models\Tenant\TenantObject;
 
 class TenantStore
@@ -52,7 +53,9 @@ class TenantStore
 
     private function create(TenantObject $entry): ?TenantObject
     {
-        $result = $this->dataStore->selectCollection(self::COLLECTION_NAME)->insertOne($entry->jsonSerialize());
+        $document = $entry->jsonSerialize();
+        unset($document['id']);
+        $result = $this->dataStore->selectCollection(self::COLLECTION_NAME)->insertOne($document);
         $entry->setId((string)$result->getInsertedId());
         return $entry;
     }
@@ -61,7 +64,9 @@ class TenantStore
     {
         $id = $entry->getId();
         if (!$id) { return null; }
-        $this->dataStore->selectCollection(self::COLLECTION_NAME)->updateOne(['_id' => $id], ['$set' => $entry->jsonSerialize()]);
+        $document = $entry->jsonSerialize();
+        unset($document['id']);
+        $this->dataStore->selectCollection(self::COLLECTION_NAME)->updateOne(['_id' => new ObjectId($id)], ['$set' => $document]);
         return $entry;
     }
 
@@ -69,7 +74,7 @@ class TenantStore
     {
         $id = $entry->getId();
         if (!$id) { return; }
-        $this->dataStore->selectCollection(self::COLLECTION_NAME)->deleteOne([ '_id' => $id]);
+        $this->dataStore->selectCollection(self::COLLECTION_NAME)->deleteOne(['_id' => new ObjectId($id)]);
     }
 
     // =========================================================================

package-lock.json

@@ -3006,9 +3006,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.4.11",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz",
-      "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==",
+      "version": "3.4.12",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
+      "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"

tests/php/unit/Console/Tenant/TenantCreateCommandTest.php

@@ -0,0 +1,175 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Console\Tenant;
+
+use KTXC\Console\Tenant\TenantCreateCommand;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\TenantService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Tester\CommandTester;
+
+class TenantCreateCommandTest extends TestCase
+{
+    private TenantService&MockObject $tenantService;
+    private CommandTester $tester;
+    private ?TenantObject $deposited = null;
+
+    protected function setUp(): void
+    {
+        $this->tenantService = $this->createMock(TenantService::class);
+        $this->tester = new CommandTester(
+            new TenantCreateCommand($this->tenantService, new NullLogger())
+        );
+    }
+
+    /**
+     * Configure the service mock to accept and capture the deposited tenant
+     */
+    private function expectDeposit(): void
+    {
+        $this->tenantService
+            ->method('deposit')
+            ->willReturnCallback(function (TenantObject $tenant): TenantObject {
+                $tenant->setId('6a5d84498ac04b41fa0c43a2');
+                $this->deposited = $tenant;
+                return $tenant;
+            });
+    }
+
+    public function testCreatesTenantWithGeneratedIdentifier(): void
+    {
+        $this->expectDeposit();
+
+        $status = $this->tester->execute(['domain' => ['acme.test']]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertNotNull($this->deposited);
+        $this->assertMatchesRegularExpression(
+            '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i',
+            $this->deposited->getIdentifier()
+        );
+        $this->assertTrue($this->deposited->getEnabled());
+        $this->assertSame(['acme.test'], $this->deposited->getDomains()->getArrayCopy());
+        $this->assertStringContainsString('created successfully', $this->tester->getDisplay());
+    }
+
+    public function testCreatesTenantWithExplicitIdentifier(): void
+    {
+        $this->expectDeposit();
+
+        $status = $this->tester->execute([
+            'domain' => ['acme.test'],
+            '--identifier' => 'acme',
+        ]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertSame('acme', $this->deposited->getIdentifier());
+    }
+
+    public function testLabelDefaultsToFirstDomain(): void
+    {
+        $this->expectDeposit();
+
+        $this->tester->execute(['domain' => ['acme.test', 'acme.example']]);
+
+        $this->assertSame('acme.test', $this->deposited->getLabel());
+    }
+
+    public function testAppliesOptions(): void
+    {
+        $this->expectDeposit();
+
+        $status = $this->tester->execute([
+            'domain' => ['acme.test'],
+            '--label' => 'Acme Inc',
+            '--description' => 'Test tenant',
+            '--disabled' => true,
+        ]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertSame('Acme Inc', $this->deposited->getLabel());
+        $this->assertSame('Test tenant', $this->deposited->getDescription());
+        $this->assertFalse($this->deposited->getEnabled());
+    }
+
+    public function testTrimsAndDeduplicatesDomains(): void
+    {
+        $this->expectDeposit();
+
+        $this->tester->execute(['domain' => [' acme.test ', 'acme.test', 'acme.example']]);
+
+        $this->assertSame(
+            ['acme.test', 'acme.example'],
+            $this->deposited->getDomains()->getArrayCopy()
+        );
+    }
+
+    public function testFailsWhenNoValidDomainProvided(): void
+    {
+        $this->tenantService->expects($this->never())->method('deposit');
+
+        $status = $this->tester->execute(['domain' => ['   ']]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('At least one non-empty domain is required', $this->tester->getDisplay());
+    }
+
+    public function testFailsWhenIdentifierAlreadyExists(): void
+    {
+        $this->tenantService
+            ->method('fetchById')
+            ->with('acme')
+            ->willReturn(new TenantObject());
+        $this->tenantService->expects($this->never())->method('deposit');
+
+        $status = $this->tester->execute([
+            'domain' => ['acme.test'],
+            '--identifier' => 'acme',
+        ]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('already exists', $this->tester->getDisplay());
+    }
+
+    public function testFailsWhenDomainAssignedToAnotherTenant(): void
+    {
+        $owner = (new TenantObject())->setIdentifier('other');
+        $this->tenantService
+            ->method('fetchByDomain')
+            ->with('acme.test')
+            ->willReturn($owner);
+        $this->tenantService->expects($this->never())->method('deposit');
+
+        $status = $this->tester->execute(['domain' => ['acme.test']]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString("already assigned to tenant 'other'", $this->tester->getDisplay());
+    }
+
+    public function testFailsWhenDepositReturnsNull(): void
+    {
+        $this->tenantService->method('deposit')->willReturn(null);
+
+        $status = $this->tester->execute(['domain' => ['acme.test']]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('Failed to create tenant', $this->tester->getDisplay());
+    }
+
+    public function testFailsWhenServiceThrows(): void
+    {
+        $this->tenantService
+            ->method('deposit')
+            ->willThrowException(new \RuntimeException('datastore unavailable'));
+
+        $status = $this->tester->execute(['domain' => ['acme.test']]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('datastore unavailable', $this->tester->getDisplay());
+    }
+}

tests/php/unit/Console/Tenant/TenantDeleteCommandTest.php

@@ -0,0 +1,128 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Console\Tenant;
+
+use KTXC\Console\Tenant\TenantDeleteCommand;
+use KTXC\Models\Tenant\DomainCollection;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\TenantService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Tester\CommandTester;
+
+class TenantDeleteCommandTest extends TestCase
+{
+    private TenantService&MockObject $tenantService;
+    private CommandTester $tester;
+
+    protected function setUp(): void
+    {
+        $this->tenantService = $this->createMock(TenantService::class);
+        $this->tester = new CommandTester(
+            new TenantDeleteCommand($this->tenantService, new NullLogger())
+        );
+    }
+
+    private function givenTenant(?array $domains = ['acme.test', 'acme.example']): TenantObject
+    {
+        $tenant = (new TenantObject())
+            ->setId('6a5d84498ac04b41fa0c43a2')
+            ->setIdentifier('acme')
+            ->setLabel('Acme Inc')
+            ->setEnabled(true);
+
+        if ($domains !== null) {
+            $tenant->setDomains(new DomainCollection($domains));
+        }
+
+        $this->tenantService->method('fetchById')->with('acme')->willReturn($tenant);
+
+        return $tenant;
+    }
+
+    public function testFailsWhenTenantNotFound(): void
+    {
+        $this->tenantService->method('fetchById')->willReturn(null);
+        $this->tenantService->expects($this->never())->method('destroy');
+
+        $status = $this->tester->execute(['identifier' => 'missing']);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('not found', $this->tester->getDisplay());
+    }
+
+    public function testForceDeletesWithoutPrompt(): void
+    {
+        $tenant = $this->givenTenant();
+        $this->tenantService->expects($this->once())->method('destroy')->with($tenant);
+
+        $status = $this->tester->execute(['identifier' => 'acme', '--force' => true]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertStringContainsString('deleted successfully', $this->tester->getDisplay());
+    }
+
+    public function testDeletesWhenConfirmationMatchesPrimaryDomain(): void
+    {
+        $tenant = $this->givenTenant();
+        $this->tenantService->expects($this->once())->method('destroy')->with($tenant);
+
+        $this->tester->setInputs(['acme.test']);
+        $status = $this->tester->execute(['identifier' => 'acme'], ['interactive' => true]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertStringContainsString("Type 'acme.test' to confirm deletion", $this->tester->getDisplay());
+        $this->assertStringContainsString('deleted successfully', $this->tester->getDisplay());
+    }
+
+    public function testCancelsWhenConfirmationDoesNotMatch(): void
+    {
+        $this->givenTenant();
+        $this->tenantService->expects($this->never())->method('destroy');
+
+        $this->tester->setInputs(['wrong.test']);
+        $status = $this->tester->execute(['identifier' => 'acme'], ['interactive' => true]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('Confirmation did not match', $this->tester->getDisplay());
+    }
+
+    public function testConfirmationFallsBackToIdentifierWhenTenantHasNoDomains(): void
+    {
+        $tenant = $this->givenTenant(null);
+        $this->tenantService->expects($this->once())->method('destroy')->with($tenant);
+
+        $this->tester->setInputs(['acme']);
+        $status = $this->tester->execute(['identifier' => 'acme'], ['interactive' => true]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertStringContainsString("Type 'acme' to confirm deletion", $this->tester->getDisplay());
+    }
+
+    public function testCancelsWhenRunNonInteractivelyWithoutForce(): void
+    {
+        $this->givenTenant();
+        $this->tenantService->expects($this->never())->method('destroy');
+
+        $status = $this->tester->execute(['identifier' => 'acme'], ['interactive' => false]);
+
+        $this->assertSame(Command::FAILURE, $status);
+    }
+
+    public function testFailsWhenDestroyThrows(): void
+    {
+        $this->givenTenant();
+        $this->tenantService
+            ->method('destroy')
+            ->willThrowException(new \RuntimeException('datastore unavailable'));
+
+        $status = $this->tester->execute(['identifier' => 'acme', '--force' => true]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('datastore unavailable', $this->tester->getDisplay());
+    }
+}

tests/php/unit/Console/Tenant/TenantListCommandTest.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Console\Tenant;
+
+use KTXC\Console\Tenant\TenantListCommand;
+use KTXC\Models\Tenant\DomainCollection;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\TenantService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Tester\CommandTester;
+
+class TenantListCommandTest extends TestCase
+{
+    private TenantService&MockObject $tenantService;
+    private CommandTester $tester;
+
+    protected function setUp(): void
+    {
+        $this->tenantService = $this->createMock(TenantService::class);
+        $this->tester = new CommandTester(
+            new TenantListCommand($this->tenantService)
+        );
+    }
+
+    public function testReportsWhenNoTenantsExist(): void
+    {
+        $this->tenantService->method('list')->willReturn([]);
+
+        $status = $this->tester->execute([]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertStringContainsString('No tenants found', $this->tester->getDisplay());
+    }
+
+    public function testListsTenantsWithDomains(): void
+    {
+        $acme = (new TenantObject())
+            ->setIdentifier('acme')
+            ->setLabel('Acme Inc')
+            ->setEnabled(true)
+            ->setDomains(new DomainCollection(['acme.test', 'acme.example']));
+
+        $wayne = (new TenantObject())
+            ->setIdentifier('wayne')
+            ->setLabel('Wayne Corp')
+            ->setEnabled(false)
+            ->setDomains(new DomainCollection(['wayne.test']));
+
+        $this->tenantService->method('list')->willReturn(['a' => $acme, 'b' => $wayne]);
+
+        $status = $this->tester->execute([]);
+        $display = $this->tester->getDisplay();
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertStringContainsString('acme', $display);
+        $this->assertStringContainsString('Acme Inc', $display);
+        $this->assertStringContainsString('acme.test, acme.example', $display);
+        $this->assertStringContainsString('Wayne Corp', $display);
+        $this->assertStringContainsString('wayne.test', $display);
+        $this->assertStringContainsString('Total: 2 tenant(s)', $display);
+    }
+
+    public function testHandlesTenantWithoutDomains(): void
+    {
+        $legacy = (new TenantObject())
+            ->setIdentifier('legacy')
+            ->setLabel('Legacy')
+            ->setEnabled(true);
+
+        $this->tenantService->method('list')->willReturn(['l' => $legacy]);
+
+        $status = $this->tester->execute([]);
+
+        $this->assertSame(Command::SUCCESS, $status);
+        $this->assertStringContainsString('legacy', $this->tester->getDisplay());
+    }
+
+    public function testFailsWhenServiceThrows(): void
+    {
+        $this->tenantService
+            ->method('list')
+            ->willThrowException(new \RuntimeException('datastore unavailable'));
+
+        $status = $this->tester->execute([]);
+
+        $this->assertSame(Command::FAILURE, $status);
+        $this->assertStringContainsString('datastore unavailable', $this->tester->getDisplay());
+    }
+}

tests/php/unit/Service/TenantServiceTest.php

@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Service;
+
+use KTXC\Models\Tenant\DomainCollection;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\TenantService;
+use KTXC\Stores\TenantStore;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class TenantServiceTest extends TestCase
+{
+    private TenantStore&MockObject $store;
+    private TenantService $service;
+
+    protected function setUp(): void
+    {
+        $this->store = $this->createMock(TenantStore::class);
+        $this->service = new TenantService($this->store);
+    }
+
+    public function testDepositRejectsTenantWithoutDomains(): void
+    {
+        $this->store->expects($this->never())->method('deposit');
+
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('at least one domain');
+
+        $this->service->deposit(new TenantObject());
+    }
+
+    public function testDepositRejectsTenantWithEmptyDomainCollection(): void
+    {
+        $tenant = (new TenantObject())->setDomains(new DomainCollection([]));
+        $this->store->expects($this->never())->method('deposit');
+
+        $this->expectException(\InvalidArgumentException::class);
+
+        $this->service->deposit($tenant);
+    }
+
+    public function testDepositPassesTenantWithDomainsToStore(): void
+    {
+        $tenant = (new TenantObject())
+            ->setIdentifier('acme')
+            ->setDomains(new DomainCollection(['acme.test']));
+
+        $this->store->expects($this->once())->method('deposit')->with($tenant)->willReturn($tenant);
+
+        $this->assertSame($tenant, $this->service->deposit($tenant));
+    }
+
+    public function testListDelegatesToStore(): void
+    {
+        $tenants = ['a' => new TenantObject()];
+        $this->store->expects($this->once())->method('list')->willReturn($tenants);
+
+        $this->assertSame($tenants, $this->service->list());
+    }
+
+    public function testDestroyDelegatesToStore(): void
+    {
+        $tenant = new TenantObject();
+        $this->store->expects($this->once())->method('destroy')->with($tenant);
+
+        $this->service->destroy($tenant);
+    }
+}