*/ private array $warnings = []; private function controller(array $configData = [], bool $withEvents = false): UsersController { $config = new Config(array_merge_recursive([ 'plugins' => ['api' => [ 'route' => '/api', 'version_prefix' => 'v1', 'pagination' => ['default_per_page' => 20, 'max_per_page' => 100], ]], ], $configData)); $services = [ 'config' => $config, 'permissions' => new Permissions(), ]; if ($withEvents) { $this->warnings = []; $services['log'] = new class ($this->warnings) { /** @var list */ private array $sink; /** @param list $sink */ public function __construct(array &$sink) { $this->sink = &$sink; } public function warning(string $message): void { $this->sink[] = $message; } }; } TestHelper::createMockGrav($services); return new UsersController(\Grav\Common\Grav::instance(), $config); } /** * @param array $contributed * @return array> */ private function assembleColumns(UsersController $c, array $contributed, UserInterface $user): array { $m = new ReflectionMethod($c, 'assembleColumns'); return $m->invoke($c, new Event(['columns' => $contributed]), $user, $this->unscopedRequest($user)); } /** * A credential with no API-key scopes attached, i.e. a session or JWT login. * The `authorize` filter runs the scope cap now (GHSA-p57v-xhv3-mf2w), and an * absent scope list means unscoped, so these cases exercise the ACL alone. */ private function unscopedRequest(UserInterface $user): ServerRequestInterface { $request = $this->createMock(ServerRequestInterface::class); $request->method('getAttribute')->willReturnCallback( static fn($name, $default = null) => $name === 'api_user' ? $user : $default, ); return $request; } /** * @param array $extra * @return array */ private function sanitize(UsersController $c, array $extra): array { $m = new ReflectionMethod($c, 'sanitizeColumnValues'); return $m->invoke($c, $extra); } /** * @param array> $data * @return array> */ private function applyColumnData(UsersController $c, array $data, UserInterface $user): array { $m = new ReflectionMethod($c, 'applyColumnData'); return $m->invoke($c, $data, $user); } #[Test] public function drops_malformed_columns(): void { $c = $this->controller(); $user = TestHelper::createMockUser('anyone', []); $columns = $this->assembleColumns($c, [ ['id' => '', 'field' => 'a'], // empty id — dropped ['field' => 'b'], // no id — dropped 'not-an-array', // not an array — dropped ['id' => 'no-field'], // no field — dropped ['id' => 'blank-field', 'field' => ' '], // field sanitizes to empty — dropped ['id' => 'real', 'field' => 'ok'], ], $user); $this->assertSame(['real'], array_column($columns, 'id')); } #[Test] public function whitelists_the_formatter_and_defaults_unknown_to_text(): void { $c = $this->controller(); $user = TestHelper::createMockUser('anyone', []); $columns = $this->assembleColumns($c, [ ['id' => 'a', 'field' => 'a', 'formatter' => 'datetime'], ['id' => 'b', 'field' => 'b', 'formatter' => 'script'], // not whitelisted ['id' => 'c', 'field' => 'c'], // missing ], $user); $byId = array_column($columns, 'formatter', 'id'); $this->assertSame('datetime', $byId['a']); $this->assertSame('text', $byId['b']); $this->assertSame('text', $byId['c']); } #[Test] public function sanitizes_the_field_key_charset(): void { $c = $this->controller(); $user = TestHelper::createMockUser('anyone', []); $columns = $this->assembleColumns($c, [ ['id' => 'ok', 'field' => 'sub.valid_till'], ['id' => 'dirty', 'field' => 'a/../b