59 lines
2.2 KiB
PHP
59 lines
2.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Services\TenantConfiguration\ClaimGuard;
|
|
use App\Services\TenantConfiguration\ResourceTypeRegistry;
|
|
use App\Services\TenantConfiguration\SupportedScopeResolver;
|
|
use App\Support\TenantConfiguration\ClaimState;
|
|
use App\Support\TenantConfiguration\CoverageLevel;
|
|
|
|
it('Spec414 blocks unsafe customer-facing claims using persisted kernel definitions', function () {
|
|
$resolver = new SupportedScopeResolver;
|
|
$scope = $resolver->findActive('intune_tcm_core');
|
|
$roleScopeTag = (new ResourceTypeRegistry)->findActive('roleScopeTag');
|
|
$guard = new ClaimGuard;
|
|
|
|
expect($scope)->not->toBeNull()
|
|
->and($roleScopeTag)->not->toBeNull();
|
|
|
|
expect($guard->evaluate(
|
|
scopeKey: $scope?->scope_key,
|
|
requestedLevel: CoverageLevel::Certified,
|
|
actualLevel: CoverageLevel::Certified,
|
|
scopeComplete: true,
|
|
customerFacing: true,
|
|
sourceClass: $roleScopeTag?->source_class,
|
|
restoreTier: $roleScopeTag?->restore_tier,
|
|
allowsBetaClaims: (bool) $roleScopeTag?->allows_beta_claims,
|
|
allowsCertifiedClaims: (bool) $roleScopeTag?->allows_certified_claims,
|
|
))->toBe(ClaimState::ClaimBlocked);
|
|
|
|
expect($guard->evaluate(
|
|
scopeKey: $scope?->scope_key,
|
|
requestedLevel: CoverageLevel::ContentBacked,
|
|
actualLevel: CoverageLevel::ContentBacked,
|
|
scopeComplete: false,
|
|
customerFacing: true,
|
|
customerClaimsAllowed: (bool) $scope?->customer_claims_allowed,
|
|
))->toBe(ClaimState::ClaimBlocked);
|
|
});
|
|
|
|
it('Spec414 allows an exact persisted scope claim at the required level', function () {
|
|
$resolver = new SupportedScopeResolver;
|
|
$scope = $resolver->findActive('intune_tcm_core');
|
|
$guard = new ClaimGuard;
|
|
|
|
expect($scope)->not->toBeNull()
|
|
->and($resolver->meetsMinimum(CoverageLevel::ContentBacked, $scope))->toBeTrue();
|
|
|
|
expect($guard->evaluate(
|
|
scopeKey: $scope?->scope_key,
|
|
requestedLevel: $scope?->minimum_coverage_level,
|
|
actualLevel: CoverageLevel::Comparable,
|
|
scopeComplete: true,
|
|
customerFacing: true,
|
|
customerClaimsAllowed: (bool) $scope?->customer_claims_allowed,
|
|
))->toBe(ClaimState::ClaimAllowed);
|
|
});
|