v1.6.55 Expand Core API backend test coverage baseline - #231
Open
roncodes wants to merge 377 commits into
Open
Conversation
roncodes
changed the title
- ReportQueryConverter: enforce registered join tables, validate every raw-interpolated join identifier and user select/group alias, and scope joined tenant tables to the active company inside the JOIN ON clause (closes execution-path identifier injection + cross-tenant join exposure). - SecurityBehavioralTest: real cross-tenant IDOR tests (Policy/Notification delete, File download, Company transfer/leave guards); drop matching source-text-grep tests from SecurityFindingsTest. - RequestValidationBehaviorTest: PublicWebhookUrl SSRF edge cases + request rule-set security invariants. - Backfill ParsePhone (extension, non-string) and DataPurger (disableForeignKeys off, deep-pass partial-failure rollback) edge cases; add getenv mail-from regression test. - Remove unreachable dead delete guards in HasApiModelBehavior (2 coverage ignores dropped). - Fix stale inviteUser comment (assignCompany already issues the invite). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rewrite the obfuscated `$userEnabled ? !$userEnabled : ...` (which always evaluated to false when 2FA was enabled) as the equivalent, explicit `$userEnabled ? false : ($systemEnforced || $companyEnforced)` with a comment. Behavior is unchanged: an already-enrolled user is not re-prompted to enroll, otherwise enrollment is enforced when the system or company mandates it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a behavioral test asserting that a valid personal access token whose owner's email/phone does not match the claimed `identity` is ignored (falls through to password auth, returns 401 invalid_credentials, issues no token) rather than being honored — the token-swap attack the login guard is meant to prevent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add behavioral tests for the SMS-2FA security contracts that run before the Auth::login guard path: - invalid code is rejected; - the SMS_AUTH_BYPASS_CODE is refused in production; - the bypass code is accepted only outside production (falls through to the user lookup); - a consumed OTP is deleted from Redis and cannot be replayed. Adds a get() accessor to the harness Redis fake. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a Codecov upload step to the backend CI using codecov-action@v5 with the organization CODECOV_TOKEN, and a coverage badge to the README. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
Add a minimal 'auth' guard fake so controller calls to the Auth facade work without a real auth manager, and use it to cover the previously-unreachable guarded paths: - authenticateSmsCode success: a valid OTP for a matching user logs in, consumes the OTP, and issues a Sanctum token. - ApiCredential::roll: unauthenticated requests are rejected, and rolling another company's credential is refused (cross-tenant IDOR) with the key left unchanged. Replaces the ApiCredential source-text grep in SecurityFindingsTest with the behavioral roll tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a behavioral test for the sign-up endpoint (reusing the auth-support fixture): a valid payload registers the owner + organization via Auth::register, assigns the owner to the company, and returns a Sanctum access token. Removes the @codeCoverageIgnore from signUp now that it is exercised end-to-end. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Str::domain() read $host[count($host) - 2], which throws "Undefined
array key -1" for single-label hosts such as "localhost" (e.g.
Str::domain(env('CONSOLE_HOST')) in Utils.php). This broke fleetbase:seed
on any localhost install.
Parse the host, drop empty labels, and return the host as-is when it has
fewer than two labels instead of indexing past the start of the array.
Add localhost coverage to the expansion contract test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add illuminate/validation (+ illuminate/translation) as dev dependencies so the real Laravel validator can be exercised instead of stubs: - RequestValidationBehaviorTest now runs each request's rules() through a real Validator and asserts valid input passes / invalid input is actually rejected (forgot-password, invite-user, update-password, webhook-endpoint), alongside the PublicWebhookUrl SSRF unit tests. - Fix stub-dependent tests now that the real Illuminate\Validation classes exist: give validator fakes a getTranslator() (ValidationException::summarize needs it), and update expected Rule::unique() strings to the engine's quoted format. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR completes the Core API backend full-coverage campaign on
dev-v1.6.55.Latest verified coverage baseline:
The generated Clover report includes
classes=393but omits thecoveredclassesmetric, so the coverage summary derives fully covered class coverage from per-class statement metrics and separately reports touched classes.Coverage Work
Class Coverage Fix
coveredclasses, which previously caused class coverage to appear as 0.00%.Validation
PATH=/Users/ron/.asdf/shims:$PATH /usr/local/bin/composer lintgit diff --checkgit diff --cached --checkXDEBUG_MODE=coverage /Users/ron/.asdf/shims/php /usr/local/bin/composer coverage:baseline/Users/ron/.asdf/shims/php scripts/coverage-summary.php coverage/clover.xmlFull coverage run result:
Raw Clover uncovered-statement scan result: