Upload via GUI (258 Dateien)

2026-10-16 19:12:24 +00:00
parent de06066052
commit 5a602de484
50 changed files with 8948 additions and 0 deletions
@@ -0,0 +1,61 @@
+<?php
+declare(strict_types=1);
+
+$previousDbPath = getenv('DESKHUB_SQLITE_PATH');
+putenv('DESKHUB_SQLITE_PATH=:memory:');
+
+require_once dirname(__DIR__) . '/includes/db.php';
+require_once dirname(__DIR__) . '/includes/functions.php';
+
+try {
+    $pdo = get_db();
+    $now = db_now();
+
+    $pdo->prepare('INSERT INTO users (name, email, password_hash, created_at) VALUES (?,?,?,?)')
+        ->execute(['Ticket Owner', 'ticket-owner@example.test', 'test-hash', $now]);
+    $ownerId = (int) $pdo->lastInsertId();
+    $pdo->prepare('INSERT INTO users (name, email, password_hash, created_at) VALUES (?,?,?,?)')
+        ->execute(['Other User', 'other@example.test', 'test-hash', $now]);
+    $otherId = (int) $pdo->lastInsertId();
+
+    $departmentId = (int) $pdo->query('SELECT id FROM departments LIMIT 1')->fetchColumn();
+    $priorityId = (int) $pdo->query('SELECT id FROM priorities LIMIT 1')->fetchColumn();
+    $pdo->prepare(
+        'INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id)
+         VALUES (?,?,?,?,?,?)'
+    )->execute(['TEST-ACCESS-1', 'Ticket access test', 'Ticket Owner', 'ticket-owner@example.test', $departmentId, $priorityId]);
+    $ticketId = (int) $pdo->lastInsertId();
+
+    $url = ticket_access_url(['id' => $ticketId, 'ticket_number' => 'TEST-ACCESS-1']);
+    parse_str((string) parse_url($url, PHP_URL_QUERY), $query);
+    $token = $query['token'] ?? '';
+    if (!preg_match('/^[a-f0-9]{96}$/', $token)) {
+        throw new RuntimeException('Der E-Mail-Link enthält kein korrektes Zugriffstoken.');
+    }
+    if (!verify_ticket_access_token($ticketId, $token)) {
+        throw new RuntimeException('Das generierte Zugriffstoken wird nicht akzeptiert.');
+    }
+    if (verify_ticket_access_token($ticketId, str_repeat('0', 96))) {
+        throw new RuntimeException('Ein falsches Zugriffstoken wurde akzeptiert.');
+    }
+    if (ticket_access_token($ticketId) !== $token) {
+        throw new RuntimeException('Das Ticket-Zugriffstoken ist nicht stabil.');
+    }
+
+    if (claim_ticket_for_customer($pdo, $ticketId, ['id' => $otherId, 'email' => 'other@example.test'])) {
+        throw new RuntimeException('Ein fremdes Kundenkonto konnte das Ticket beanspruchen.');
+    }
+    if (!claim_ticket_for_customer($pdo, $ticketId, ['id' => $ownerId, 'email' => 'TICKET-OWNER@example.test'])) {
+        throw new RuntimeException('Der berechtigte Kunde konnte das Ticket nicht beanspruchen.');
+    }
+
+    $ownerCheck = $pdo->prepare('SELECT user_id FROM tickets WHERE id = ?');
+    $ownerCheck->execute([$ticketId]);
+    if ((int) $ownerCheck->fetchColumn() !== $ownerId) {
+        throw new RuntimeException('Das Ticket wurde nicht dem richtigen Kundenkonto zugeordnet.');
+    }
+
+    echo "Ticket access integration checks passed.\n";
+} finally {
+    putenv($previousDbPath === false ? 'DESKHUB_SQLITE_PATH' : 'DESKHUB_SQLITE_PATH=' . $previousDbPath);
+}