Дмитрий
e71a02e498
Закрывает CV.11 audit WARN #4 (placeholder secret '__SET_ON_DEPLOY__' = silent 404 на production через verifySecret в SupplierWebhookController). Console command для deploy-script: SELECT system_settings.supplier_webhook_secret → exit 1 если placeholder OR len < 32 OR row отсутствует. Иначе exit 0. Использование: deploy-script вызывает `php artisan supplier:check-webhook-secret` перед запуском приложения; non-zero exit прерывает deploy fail-fast. TDD: 4 теста (placeholder rejected / short rejected / missing rejected / valid accepted). phpstan-baseline +1 entry: Pest TestCall::artisan() PhpDoc-quirk (как ResetDeliveredTodayCommandTest). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 lines
1.4 KiB
PHP
45 lines
1.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use Illuminate\Foundation\Testing\DatabaseTransactions;
|
|
use Illuminate\Support\Facades\DB;
|
|
|
|
uses(DatabaseTransactions::class);
|
|
|
|
test('rejects placeholder seed __SET_ON_DEPLOY__', function () {
|
|
DB::table('system_settings')
|
|
->updateOrInsert(
|
|
['key' => 'supplier_webhook_secret'],
|
|
['value' => '__SET_ON_DEPLOY__', 'type' => 'string', 'description' => 'test seed']
|
|
);
|
|
|
|
$this->artisan('supplier:check-webhook-secret')->assertExitCode(1);
|
|
});
|
|
|
|
test('rejects too-short secret (< 32 chars)', function () {
|
|
DB::table('system_settings')
|
|
->updateOrInsert(
|
|
['key' => 'supplier_webhook_secret'],
|
|
['value' => 'short-secret-only-20-chars', 'type' => 'string', 'description' => 'test']
|
|
);
|
|
|
|
$this->artisan('supplier:check-webhook-secret')->assertExitCode(1);
|
|
});
|
|
|
|
test('rejects missing seed row', function () {
|
|
DB::table('system_settings')->where('key', 'supplier_webhook_secret')->delete();
|
|
|
|
$this->artisan('supplier:check-webhook-secret')->assertExitCode(1);
|
|
});
|
|
|
|
test('accepts valid secret (>=32 chars and not placeholder)', function () {
|
|
DB::table('system_settings')
|
|
->updateOrInsert(
|
|
['key' => 'supplier_webhook_secret'],
|
|
['value' => str_repeat('a', 64), 'type' => 'string', 'description' => 'test seed']
|
|
);
|
|
|
|
$this->artisan('supplier:check-webhook-secret')->assertExitCode(0);
|
|
});
|