portal/app/tests/Feature at 61e1cffb988ec527d33ca773f3ef1cc1cb92da27 - portal - Gitea: Git with a cup of tea

liderra/portal

Files

T

History

Дмитрий 1fd6f7f597 fix(security): harden impersonation/webhook/tenant — audit A2/A3/B3/C2

- A2: impersonation _dev_plain_code в ответе init только в local/testing
- A3: X-Tenant-Id принимается только в local/testing (anti-spoof тенанта)
- B3: WebhookReceiveController isHmacRequired() default false→true (fail-secure)
- C2: SupplierWebhookController per-IP rate-limit 600/min (DoS-guard)
- WebhookReceiveTest обновлён под B3 (отсутствие настройки → 401)

Tests: 70/70 passed (323 assertions) — Webhook/Impersonation/Tenant suites.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-15 19:16:13 +03:00

..

feat(admin): Plan 4 Task 10 — AdminSuppliersController + AdminSupplierPricesView (B1/B2/B3 cost editor)

2026-05-11 11:28:03 +03:00

test(projects-bulk): RLS cross-tenant isolation + empty-resolve edge case

2026-05-12 15:02:04 +03:00

phase2(notifications-stage3): NotificationsTab schema-aligned + prefs API

2026-05-09 11:41:35 +03:00

feat(billing): Plan 4 Task 11 — TenantChargesController + ChargesTab + CSV export

2026-05-11 11:51:13 +03:00

feat(commands): Plan 4 Task 5 — ResetMonthlyCountersCommand + Schedule monthlyOn(1, 00:00) МСК

2026-05-11 10:28:13 +03:00

fix(http): timestamp validation ±24h для partition guard (Plan 2.6 #iii)

2026-05-10 23:11:26 +03:00

feat(supplier): Plan 4 Task 4 — integrate LedgerService в RouteSupplierLeadJob + Task 3 carry-overs

2026-05-11 10:06:38 +03:00

feat(supplier): Plan 4 Task 4 — integrate LedgerService в RouteSupplierLeadJob + Task 3 carry-overs

2026-05-11 10:06:38 +03:00

fix(tests): RefreshDatabase on LookupsTest + ProjectExtensionsTest — close quirk #62

2026-05-14 05:29:34 +03:00

phase2(notifications-stage6): low_balance + zero_balance + topup + invoice email/inapp

2026-05-09 12:51:32 +03:00

fix(db): Plan 4 Task 1 code-review fixes (4 Important issues)

2026-05-11 08:51:18 +03:00

fix(projects): cyrillic ILIKE via PG ICU + clearable workaround

2026-05-12 19:25:25 +03:00

phase2(reports-stage3): retry/cancel/destroy + reports:cleanup-expired cron

2026-05-09 13:44:09 +03:00

feat(rules): add Signal validators (Domain, Phone, SmsSender) with comprehensive datasets

2026-05-10 17:05:19 +03:00

feat(supplier): Plan 4 Task 4 — integrate LedgerService в RouteSupplierLeadJob + Task 3 carry-overs

2026-05-11 10:06:38 +03:00

fix(tests): Bus::fake partial + session mock — close quirk #72

2026-05-14 05:35:06 +03:00

AdminBillingIndexTest.php

phase2(admin-billing): GET /api/admin/billing + AdminBillingView API (этап 3/5)

2026-05-09 09:28:49 +03:00

AdminIncidentsIndexTest.php

fix(backend): tenant middleware на auth-routes + HasPasswordRules trait + test password (audit P0-01 + O-refactor-03 + P2-01)

2026-05-09 18:22:30 +03:00

AdminSystemSettingsTest.php

phase2(7-features): bulk-actions / new-deal / tenant-card / system-edit / webhook / smart-filters / impersonation-list

2026-05-09 05:33:21 +03:00

AdminTenantShowTest.php

phase2(admin-tenant-detail-backend): GET /api/admin/tenants/{subdomain} с 4 секциями

2026-05-09 14:32:24 +03:00

AdminTenantsIndexTest.php

phase2(admin-tenants-mrr): mrr_rub в /api/admin/tenants (этап 7)

2026-05-09 10:08:12 +03:00

DealCreateTest.php

refactor(backend): Sprint 3 Phase A — DealController split + N+1 fix + export streaming

2026-05-09 20:08:20 +03:00

DealDestroyTest.php

phase2(soft-delete): schema v8.9 + DELETE /api/deals (этап 5/5 — авто-план закрыт)

2026-05-09 09:51:47 +03:00

DealIndexTest.php

feat(backend): Sprint 4 Phase A — keyset pagination в DealController::index (audit O-perf-04)

2026-05-10 04:29:54 +03:00

DealModelTest.php

phase1(webhook): Deal/WebhookDedupKey + ProcessWebhookJob (advisory lock) — CTO-17 addendum

2026-05-08 15:24:55 +03:00

DealRestoreTest.php

phase2(restore-flow): POST /api/deals/restore + undo-snackbar (этап 6 — completion of stage 5)

2026-05-09 10:01:35 +03:00

DealShowTest.php

phase2(deal-show): GET /api/deals/{id} + DealDetailDrawer на реальный ActivityLog

2026-05-09 08:21:50 +03:00

DealTransitionTest.php

phase2(bulk-transition+reload): POST /api/deals/transition + reload-btn

2026-05-09 07:46:19 +03:00

DealUpdateTest.php

phase2(deal-patch): PATCH /api/deals/{id} + comment-editor в DealDetailDrawer (этап 1/5)

2026-05-09 09:10:58 +03:00

ExampleTest.php

phase1(scaffold): Laravel 11 + predis + .env под PG 16 + Memurai

2026-05-08 09:37:16 +03:00

ImpersonationTest.php

phase2(7-features): bulk-actions / new-deal / tenant-card / system-edit / webhook / smart-filters / impersonation-list

2026-05-09 05:33:21 +03:00

LeadStatusesIndexTest.php

phase2(lead-statuses): GET /api/lead-statuses + Pinia-store с snapshot fallback

2026-05-09 08:59:17 +03:00

LookupsTest.php

fix(tests): RefreshDatabase on LookupsTest + ProjectExtensionsTest — close quirk #62

2026-05-14 05:29:34 +03:00

PartitionsCreateMonthsTest.php

phase2(2fa-setup): wizard init+confirm+disable+regenerate в SettingsView/SecurityTab

2026-05-09 04:03:02 +03:00

ProcessWebhookJobTest.php

phase1(webhook): failed() callback + FailedWebhookJob модель — упавшие jobs после 3 ретраев

2026-05-08 15:52:47 +03:00

ReminderControllerTest.php

phase2(reminders-backend): CRUD + cron-диспетчер + email/inapp (P0 этап 4)

2026-05-09 12:30:38 +03:00

RemindersDispatchDueTest.php

phase2(reminders-backend): CRUD + cron-диспетчер + email/inapp (P0 этап 4)

2026-05-09 12:30:38 +03:00

RlsSmokeTest.php

phase1(rls-smoke): CTO-13 — Pest 4 RLS smoke-test (4/4 passed, 662 ms)

2026-05-08 14:00:43 +03:00

SetTenantContextTest.php

phase1(eloquent): Tenant/User/Project models + SetTenantContext middleware

2026-05-08 14:29:50 +03:00

TenantModelsTest.php

phase1(eloquent): Tenant/User/Project models + SetTenantContext middleware

2026-05-08 14:29:50 +03:00

WebhookReceiveTest.php

fix(security): harden impersonation/webhook/tenant — audit A2/A3/B3/C2

2026-05-15 19:16:13 +03:00