JobcardSystem/tests/SecurityRegressionTest.php

<?php
declare(strict_types=1);

require_once __DIR__ . '/../app/Domain/Attachment/AttachmentValidator.php';
require_once __DIR__ . '/../app/Domain/Credential/TechnicalInformation.php';
require_once __DIR__ . '/../app/Domain/Credential/CredentialVault.php';
require_once __DIR__ . '/../app/Domain/Reporting/TechnicianActivityReport.php';
require_once __DIR__ . '/../bin/healthcheck.php';

use App\Domain\Attachment\AttachmentValidator;
use App\Domain\Credential\CredentialVault;

function security_regression_assert(bool $condition, string $message): void
{
    if (!$condition) {
        throw new RuntimeException($message);
    }
}

function security_regression_assert_same(mixed $expected, mixed $actual, string $message): void
{
    if ($expected !== $actual) {
        throw new RuntimeException($message . "\nExpected: " . var_export($expected, true) . "\nActual: " . var_export($actual, true));
    }
}

$root = dirname(__DIR__);
$bootstrap = file_get_contents($root . '/config/bootstrap.php');
$frontController = file_get_contents($root . '/public/index.php');
$schema = file_get_contents($root . '/database/schema.sql');
$upgrade = file_get_contents($root . '/database/upgrade.sql');
security_regression_assert($bootstrap !== false && $frontController !== false && $schema !== false && $upgrade !== false, 'Security regression fixtures must be readable.');

$checks = 0;

// A technician access decision must bind the requested jobcard to the session user.
security_regression_assert(
    preg_match('/function can_access_jobcard\(int \$jobcardId\).*?SELECT 1 FROM jobcard_assignments.*?jobcard_id = :jobcard.*?user_id = :user/s', $bootstrap) === 1,
    'Jobcard access must scope by both jobcard ID and authenticated technician ID.'
);
security_regression_assert(
    preg_match('/if \(!can_access_jobcard\(\$jobcardId\)\).*?Jobcard not found/s', $frontController) === 1,
    'Direct technician jobcard IDs must be denied when the assignment is not theirs.'
);
security_regression_assert(
    preg_match('/SELECT DISTINCT c\.id, c\.name.*?jobcard_assignments.*?ja\.user_id = :user/s', $frontController) === 1,
    'Client lists must not become a cross-client oracle for technicians.'
);
$checks++;

// The technician report route must sum only the logged-in technician's entries,
// even when an assigned jobcard contains entries recorded by other technicians.
security_regression_assert(
    str_contains($frontController, 'array_unshift($hoursPredicates') && str_contains($frontController, 'te.technician_id = ?'),
    'Technician report SQL must isolate hours to the authenticated technician.'
);
$activity = (new TechnicianActivityReport())->build([
    ['technician_id' => 11, 'technician_name' => 'Own Tech', 'client_id' => 7, 'client_name' => 'Acme', 'hours' => 2.25, 'counts_toward_sla' => true],
    ['technician_id' => 12, 'technician_name' => 'Other Tech', 'client_id' => 7, 'client_name' => 'Acme', 'hours' => 9.50, 'counts_toward_sla' => true],
]);
security_regression_assert_same(2, count($activity), 'Activity aggregation must keep technicians distinct before route-level ownership filtering.');
security_regression_assert_same(2.25, $activity[1]['hours'], 'Own-technician report fixtures must preserve the own-technician total.');
security_regression_assert_same(9.5, $activity[0]['hours'], 'Cross-technician fixture must remain distinguishable for isolation assertions.');
$checks++;

// Credentials use the canonical ciphertext field and never persist/return plaintext.
$key = base64_encode(random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES));
$vault = new CredentialVault($key);
$secret = 'cross-client-secret-' . bin2hex(random_bytes(8));
$stored = $vault->encryptCredential(['id' => 4, 'category' => 'hosting', 'label' => 'Production', 'username' => 'deploy', 'notes' => 'private', 'secret' => $secret]);
security_regression_assert(!array_key_exists('secret', $stored), 'Stored credentials must not contain a plaintext secret field.');
security_regression_assert(isset($stored['secret_ciphertext']) && is_string($stored['secret_ciphertext']), 'Stored credentials must use secret_ciphertext as the canonical field.');
security_regression_assert(!str_contains(serialize($stored), $secret), 'Serialized stored credentials must not contain the plaintext secret.');
security_regression_assert_same($secret, $vault->decryptCredential($stored)['secret'], 'Canonical ciphertext must decrypt only with the owning vault key.');
security_regression_assert(!array_key_exists('secret', $vault->projectMetadata($stored)), 'Metadata projections must exclude plaintext secrets.');
$checks++;

// Upload metadata must reject traversal, executable double extensions, MIME mismatches,
// oversized files, and unapproved client-visible state.
$attachments = new AttachmentValidator(1_000);
$unsafe = [
    ['name' => '../outside.pdf', 'mime_type' => 'application/pdf', 'size_bytes' => 10],
    ['name' => 'invoice.php.jpg', 'mime_type' => 'image/jpeg', 'size_bytes' => 10],
    ['name' => 'photo.jpg', 'mime_type' => 'application/x-php', 'size_bytes' => 10],
    ['name' => 'photo.jpg', 'mime_type' => 'image/jpeg', 'size_bytes' => 1_001],
    ['name' => 'photo.jpg', 'mime_type' => 'image/jpeg', 'size_bytes' => 10, 'client_visible' => true, 'client_approved' => false],
];
foreach ($unsafe as $payload) {
    security_regression_assert($attachments->validate($payload)['valid'] === false, 'Unsafe attachment metadata must be rejected.');
}
$safe = $attachments->validate(['original_name' => ' evidence.PNG ', 'mime' => 'IMAGE/PNG', 'size' => '42']);
security_regression_assert_same(true, $safe['valid'], 'Safe attachment metadata should be accepted.');
security_regression_assert_same(['name' => 'evidence.PNG', 'extension' => 'png', 'mime_type' => 'image/png', 'size_bytes' => 42, 'client_visible' => false, 'client_approved' => false], array_intersect_key($safe, array_flip(['name', 'extension', 'mime_type', 'size_bytes', 'client_visible', 'client_approved'])), 'Attachment metadata must normalize to safe canonical fields.');
$checks++;

// Healthcheck schema coverage must include every table required by the current schema.
final class SecurityRegressionFakePdo extends PDO
{
    /** @var list<string> */
    public array $queries = [];
    public function __construct() {}
    public function query(string $query, ?int $fetchMode = null, mixed ...$fetchModeArgs): PDOStatement|false
    {
        $this->queries[] = $query;
        return false;
    }
}
$fakePdo = new SecurityRegressionFakePdo();
security_regression_assert(deployment_check_schema($fakePdo), 'Healthcheck schema probe should succeed for all required table probes.');
$probedTables = array_map(static fn(string $query): string => trim(str_replace(['SELECT 1 FROM', '`', 'LIMIT 1'], '', $query)), $fakePdo->queries);
preg_match_all('/CREATE TABLE IF NOT EXISTS ([a-z0-9_]+)/i', $schema, $schemaMatches);
$schemaTables = array_values(array_unique(array_map('strtolower', $schemaMatches[1])));
security_regression_assert_same($schemaTables, $probedTables, 'Healthcheck schema requirements must cover exactly the bootstrap schema tables.');
$checks++;

// Every state-changing route/form must retain the central CSRF guard assumption.
foreach (['logout', 'login', 'jobcard', 'client', 'clients', 'users'] as $route) {
    security_regression_assert(str_contains($frontController, "\$route === '{$route}'") || ($route === 'login' && str_contains($frontController, "\$route === 'login'")), "Expected explicit {$route} route in front controller.");
}
security_regression_assert(substr_count($frontController, 'verify_csrf();') >= 7, 'All supported POST route paths must call verify_csrf before mutation.');
security_regression_assert(str_contains($frontController, "if (\$route === 'logout')") && str_contains($frontController, "if ((\$_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST')"), 'Logout must remain POST-only and CSRF-protected.');
$checks++;

// Upgrade coverage is additive and must include each feature table introduced after
// the original foundation, plus the SLA uniqueness remediation guard.
foreach (['technical_information', 'credentials', 'jobcard_sequences', 'jobcard_status_history', 'attachments', 'notifications'] as $table) {
    security_regression_assert((bool)preg_match('/CREATE TABLE IF NOT EXISTS ' . preg_quote($table, '/') . '\\b/i', $upgrade), "Migration must cover {$table}.");
}
security_regression_assert(str_contains($upgrade, 'sla_client_unique') && str_contains($upgrade, 'sla_duplicate_count'), 'Migration must safely remediate duplicate SLA rows before adding the unique constraint.');
security_regression_assert(str_contains($upgrade, 'INSERT IGNORE INTO permissions') && str_contains($upgrade, 'attachments.view'), 'Migration must cover permissions for migrated feature modules.');
$checks++;

printf("Security regression tests: %d passed\n", $checks);