initial prototype based on nat-as-server

tests/Unit/RbacTest.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+final class RbacTest extends TestCase
+{
+    public function testAdminSeesAllClients(): void
+    {
+        [$clause, $params] = rbac_client_filter(['role' => 'admin', 'entityID' => 'a1'], 'cl');
+        $this->assertStringContainsString('1=1', $clause);
+        $this->assertStringContainsString('archived', $clause);
+        $this->assertSame([], $params);
+
+        [$allClause] = rbac_client_filter(['role' => 'admin', 'entityID' => 'a1'], 'cl', 'all');
+        $this->assertStringNotContainsString('archived', $allClause);
+    }
+
+    public function testSupervisorFilterBindsEntity(): void
+    {
+        [$clause, $params] = rbac_client_filter(
+            ['role' => 'supervisor', 'entityID' => 'sv-99'],
+            'cl'
+        );
+        $this->assertStringContainsString('supervisorID', $clause);
+        $this->assertSame([':rbac_eid' => 'sv-99'], $params);
+    }
+
+    public function testCoachFilterBindsCoach(): void
+    {
+        [$clause, $params] = rbac_client_filter(
+            ['role' => 'coach', 'entityID' => 'coach-1'],
+            'cl'
+        );
+        $this->assertStringContainsString('coachID', $clause);
+        $this->assertSame([':rbac_eid' => 'coach-1'], $params);
+    }
+
+    public function testWebRolesList(): void
+    {
+        $this->assertContains('admin', qdb_web_roles());
+        $this->assertContains('supervisor', qdb_web_roles());
+        $this->assertNotContains('coach', qdb_web_roles());
+    }
+}