TenantAtlas/apps/platform/tests/Architecture/Spec392DeprecatedCustomerOutputDownloadGuardTest.php
ahmido dd7139ebe3 Spec392 customer output gating (#463)
Implements Spec392 customer output gating for review pack downloads, rendered reports, management PDFs, and customer workspace CTAs.

Validation:
- php vendor/bin/pest --filter=Spec392: 12 passed / 58 assertions
- php vendor/bin/pest --filter='ReviewPack|CustomerReviewWorkspace|StoredReport': 283 passed / 1 skipped / 2053 assertions
- affected browser matrix: 12 passed / 420 assertions
- php vendor/bin/pint --dirty: pass
- git diff --check: pass

Notes:
- Deprecated limited-download semantics remain removed.
- Unsafe customer-facing output returns 403/no output.
- Internal preview/report access is operator-only.

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #463
2026-06-20 20:54:50 +00:00

58 lines
1.5 KiB
PHP

<?php
declare(strict_types=1);
it('keeps deprecated customer-output limited download vocabulary out of product surfaces', function (): void {
$forbiddenTerms = [
'download_review_pack_with_limitations',
'Download review pack with limitations',
'Download with limitations',
];
$roots = [
app_path(),
base_path('routes'),
resource_path(),
base_path('lang'),
base_path('tests'),
];
$self = realpath(__FILE__);
$violations = [];
foreach ($roots as $root) {
if (! is_dir($root)) {
continue;
}
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS),
);
foreach ($iterator as $file) {
if (! $file instanceof SplFileInfo || ! $file->isFile()) {
continue;
}
$path = $file->getRealPath();
if (! is_string($path) || $path === $self || ! preg_match('/\.(blade\.php|php|js|ts|vue|json)$/', $path)) {
continue;
}
$contents = file_get_contents($path);
if (! is_string($contents)) {
continue;
}
foreach ($forbiddenTerms as $term) {
if (str_contains($contents, $term)) {
$violations[] = str_replace(base_path().DIRECTORY_SEPARATOR, '', $path).': '.$term;
}
}
}
}
expect($violations)->toBeEmpty();
});