TenantAtlas/apps/platform/tests/Unit/Support/TenantConfiguration/Spec417CoverageIdentityStrategyRegistryTest.php
ahmido 9b58a5696d feat: add Exchange PowerShell adapter contract slice 1 (#497)
Spec 430: Exchange PowerShell adapter contract slice 1. Validation was not rerun during PR creation handoff; branch contains implementation report and tests.

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #497
2026-07-05 12:08:16 +00:00

45 lines
1.8 KiB
PHP

<?php
declare(strict_types=1);
use App\Services\TenantConfiguration\CoverageIdentityStrategyRegistry;
it('Spec417 defines canonical identity strategies for the initial Coverage v2 resource types', function (): void {
$strategies = app(CoverageIdentityStrategyRegistry::class)->strategies();
expect(array_keys($strategies))->toBe([
'deviceAndAppManagementAssignmentFilter',
'deviceEnrollmentLimitRestriction',
'deviceEnrollmentPlatformRestriction',
'deviceEnrollmentStatusPageWindows10',
'appProtectionPolicyAndroid',
'appProtectionPolicyiOS',
'conditionalAccessPolicy',
'securityDefaults',
'transportRule',
'remoteDomain',
'inboundConnector',
'acceptedDomain',
'appPermissionPolicy',
'meetingPolicy',
'notificationMessageTemplate',
'roleScopeTag',
]);
foreach ($strategies as $canonicalType => $strategy) {
expect($strategy['strategy_identifier'])->toBeString()->not->toBe('')
->and($strategy['preferred_identity_fields'])->toBeArray()->not->toBeEmpty()
->and($strategy['display_fields'])->toContain('displayName')
->and($strategy['requires_provider_connection_scope'])->toBeTrue()
->and($strategy['derived_claims_allowed'])->toBeFalse("{$canonicalType} must not certify derived identity by default");
}
});
it('Spec417 keeps beta identity experimental and claim-blocked by default', function (): void {
$strategy = app(CoverageIdentityStrategyRegistry::class)->strategies()['roleScopeTag'];
expect($strategy['allows_experimental_identity'])->toBeTrue()
->and($strategy['allows_derived_identity'])->toBeTrue()
->and($strategy['derived_claims_allowed'])->toBeFalse();
});