tomh104/nat-as-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

securing translation endpoint
Some checks failed
PHPUnit / test (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Tom Hempel
2026-07-18 13:40:06 +02:00
parent 154535edc2
commit 06d53c564e
4 changed files with 133 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
tests/Integration/CatalogApiTest.php
View File

@ -85,9 +85,55 @@ final class CatalogApiTest extends QdbTestCase
$this->assertArrayHasKey('entries', $res['data']);
}
public function testAppTranslationsPublicNoAuth(): void
public function testAppTranslationsRequiresAuth(): void
{
$res = $this->api()->request('GET', 'app_questionnaires', null, [], ['translations' => '1']);
$this->assertApiError($res, 'UNAUTHORIZED', 401);
}
public function testAppLoginTranslationsPublicNoAuth(): void
{
$res = $this->api()->request('GET', 'app_questionnaires', null, [], ['loginTranslations' => '1']);
$this->assertApiOk($res);
$this->assertArrayHasKey('translations', $res['data']);
$map = $res['data']['translations'];
$this->assertIsArray($map);
// Must include auth / help_auth keys and must not dump unrelated catalog keys.
$foundAuth = false;
$foundHelp = false;
$forbidden = false;
foreach ($map as $lang => $strings) {
$this->assertIsArray($strings);
foreach ($strings as $key => $text) {
$this->assertTrue(
qdb_is_public_login_translation_key((string)$key),
"Unexpected public key: {$key}"
);
if (str_starts_with((string)$key, 'auth_')) {
$foundAuth = true;
}
if (str_starts_with((string)$key, 'help_auth_')) {
$foundHelp = true;
}
if ((string)$key === 'client_code' || (string)$key === 'client_picker_title') {
$forbidden = true;
}
}
}
$this->assertTrue($foundAuth);
$this->assertTrue($foundHelp);
$this->assertFalse($forbidden);
}
public function testAppTranslationsWithToken(): void
{
$login = $this->api()->loginMobileAndGetToken(
DatabaseSeeder::COACH_USERNAME,
DatabaseSeeder::PASSWORD
);
$res = $this->api()->withMobileToken($login['token'], 'GET', 'app_questionnaires', null, [
'translations' => '1',
]);
$this->assertApiOk($res);
$this->assertArrayHasKey('translations', $res['data']);
}