M_Viper/deskhub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Upload via GUI (452 Dateien)

Browse Source
This commit is contained in:
M_Viper
2026-11-05 21:22:03 +00:00
parent a7577a234d
commit ded90af175
29 changed files with 2127 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DeskHub-Webseite/tests/ticket_done.php
+96
View File
@@ -0,0 +1,96 @@
<?php
declare(strict_types=1);
/**
* Gelöste und geschlossene Tickets gelten gleich als erledigt: Die SLA-Uhr läuft nicht weiter, es gibt kein „überfällig“, keine SLA-Meldung,
* keine Eskalation, keine Erinnerung und keine Wiedervorlage-Benachrichtigung mehr.
*/
putenv('DESKHUB_TESTING=1');
putenv('DESKHUB_SQLITE_PATH=:memory:');
require_once dirname(__DIR__) . '/includes/bootstrap.php';
if (!defined('DESKHUB_CRON_RUNNER')) define('DESKHUB_CRON_RUNNER', true);
require_once dirname(__DIR__) . '/cron/check_sla.php';
$failures = [];
$total = 0;
$check = function (bool $ok, string $what) use (&$failures, &$total): void {
$total++;
if (!$ok) $failures[] = $what;
};
$pdo = get_db();
$now = date('Y-m-d H:i:s');
$ago = fn(int $h) => date('Y-m-d H:i:s', time() - $h * 3600);
$dept = (int) $pdo->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
$prio = (int) $pdo->query('SELECT id FROM priorities ORDER BY id LIMIT 1')->fetchColumn();
$pdo->exec('DELETE FROM staff');
$pdo->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)')->execute(['Agent', 'agent@test.de', 'x', 'agent', $dept, $now]);
$agent = (int) $pdo->lastInsertId();
$mk = function (string $n, string $status, array $o = []) use ($pdo, $dept, $prio, $now, $agent): int {
$pdo->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, assigned_staff_id, resolution_due_at, first_response_due_at, is_overdue, snoozed_until, snoozed_by, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)')
->execute([$n, 'S ' . $n, 'K', 'k@example.org', $dept, $prio, $status, 'web', $agent, $o['due'] ?? null, $o['rdue'] ?? null, $o['overdue'] ?? 0, $o['snooze'] ?? null, $o['snooze'] ?? null ? $agent : null, $o['created'] ?? $now, $o['updated'] ?? $now]);
return (int) $pdo->lastInsertId();
};
$row = fn(int $id) => $pdo->query("SELECT * FROM tickets WHERE id = {$id}")->fetch(PDO::FETCH_ASSOC);
// 1. Erledigen löscht „überfällig“ und die Wiedervorlage, für gelöst und geschlossen gleich
foreach (['resolved', 'closed'] as $st) {
$t = $mk('D-' . $st, 'open', ['due' => $ago(5), 'overdue' => 1, 'snooze' => $ago(-5), 'created' => $ago(60)]);
$pdo->prepare('UPDATE tickets SET status = ? WHERE id = ?')->execute([$st, $t]);
ticket_sla_status_transition($pdo, $t, 'open', $st);
$r = $row($t);
$check((int) $r['is_overdue'] === 0 && $r['snoozed_until'] === null, "offen → {$st}: nicht mehr überfällig, Wiedervorlage entfällt");
}
// Ein offenes Ticket bleibt unberührt
$tOpen = $mk('D-open', 'open', ['due' => $ago(5), 'overdue' => 1, 'created' => $ago(60)]);
ticket_sla_status_transition($pdo, $tOpen, 'open', 'answered');
$check((int) $row($tOpen)['is_overdue'] === 1, 'offen → beantwortet: bleibt überfällig');
// gelöst → geschlossen: nichts Neues
$tc = $mk('D-rc', 'closed', ['due' => $ago(5), 'created' => $ago(60)]);
ticket_sla_status_transition($pdo, $tc, 'resolved', 'closed');
$check((int) $row($tc)['is_overdue'] === 0, 'gelöst → geschlossen: weiter nicht überfällig');
// 2. SLA-Prüfung fasst erledigte Tickets nicht an und meldet nichts
$a = $mk('S-closed', 'closed', ['due' => $ago(9), 'rdue' => $ago(20), 'created' => $ago(80)]);
$b = $mk('S-resolved', 'resolved', ['due' => $ago(9), 'rdue' => $ago(20), 'created' => $ago(80)]);
$c = $mk('S-flag', 'closed', ['due' => $ago(9), 'overdue' => 1, 'created' => $ago(80)]);
$res = run_check_sla($pdo);
$check($row($a)['is_overdue'] == 0 && $row($b)['is_overdue'] == 0, 'SLA-Prüfung: geschlossene und gelöste Tickets werden nicht überfällig');
$check((int) $row($c)['is_overdue'] === 0, 'SLA-Prüfung: ein übrig gebliebenes „überfällig“ bei einem erledigten Ticket wird entfernt');
$check($res['newlyOverdue'] === 0, 'SLA-Prüfung: keine neue Überschreitung gemeldet');
$hist = (int) $pdo->query("SELECT COUNT(*) FROM ticket_sla_history WHERE ticket_id IN ({$a},{$b}) AND event_type = 'overdue'")->fetchColumn();
$check($hist === 0, 'SLA-Verlauf: für erledigte Tickets entsteht kein „überschritten“');
// 3. Eskalationsregeln erfassen keine erledigten Tickets
require_once dirname(__DIR__) . '/cron/check_escalations.php';
$pdo->prepare("INSERT INTO escalation_rules (name,is_active,trigger_type,trigger_hours,action_notify_admin,action_notify_staff,sort_order,created_at) VALUES (?,?,?,?,?,?,?,?)")
->execute(['Alt', 1, 'overdue', 1, 1, 1, 1, $now]);
$eo = $mk('E-open', 'open', ['due' => $ago(5), 'overdue' => 1, 'created' => $ago(50)]);
$ec = $mk('E-closed', 'closed', ['due' => $ago(5), 'overdue' => 1, 'created' => $ago(50)]);
$r = run_check_escalations($pdo);
$check((int) $pdo->query("SELECT COUNT(*) FROM escalation_log WHERE ticket_id = {$eo}")->fetchColumn() === 1, 'Eskalation: die Regel greift bei einem offenen Ticket (Gegenprobe)');
$hit = (int) $pdo->query("SELECT COUNT(*) FROM escalation_log WHERE ticket_id IN ({$a},{$b},{$c},{$ec})")->fetchColumn();
$check($hit === 0, 'Eskalation: erledigte Tickets werden nicht eskaliert');
// 4. Wiedervorlage: bei erledigten Tickets still entfernt, bei offenen mit Benachrichtigung
$sc = $mk('W-closed', 'closed', ['snooze' => $ago(1)]);
$so = $mk('W-open', 'open', ['snooze' => $ago(1)]);
$woken = ticket_snooze_wake_due($pdo);
$check($woken === 1, "Wiedervorlage: nur das offene Ticket wird zurückgeholt (war {$woken})");
$check($row($sc)['snoozed_until'] === null && $row($so)['snoozed_until'] === null, 'Wiedervorlage: bei beiden aufgeräumt');
$act = fn(int $id) => (int) $pdo->query("SELECT COUNT(*) FROM activity_log WHERE ticket_id = {$id} AND action LIKE '%Wiedervorlage fällig%'")->fetchColumn();
$check($act($sc) === 0 && $act($so) === 1, 'Wiedervorlage: Hinweis „fällig“ nur beim offenen Ticket');
// 5. Erinnerung „Ticket wartet auf Antwort“ erfasst nur offene Tickets
set_setting('wait_reminder_enabled', '1');
set_setting('wait_reminder_hours', '1');
$wo = $mk('A-open', 'open', ['due' => $ago(-40), 'created' => $ago(100), 'updated' => $ago(100)]);
$wc = $mk('A-closed', 'closed', ['due' => $ago(-40), 'created' => $ago(100), 'updated' => $ago(100)]);
$wr = wait_reminders_run($pdo, $now);
$check((int) ($wr['sent'] ?? 0) === 1, 'Erinnerung: das offene Ticket wird erinnert (Gegenprobe)');
$check($row($wc)['wait_reminded_at'] === null && $row($wo)['wait_reminded_at'] !== null, 'Erinnerung: für das erledigte Ticket wird nichts gesendet');
echo $failures ? "FEHLGESCHLAGEN:\n - " . implode("\n - ", $failures) . "\n" : '';
echo "Ticket-erledigt-Test: " . ($total - count($failures)) . " von {$total} Prüfungen in Ordnung.\n";
exit($failures ? 1 : 0);
DeskHub-Webseite/tests/ticket_done_web.php
+157
View File
@@ -0,0 +1,157 @@
<?php
declare(strict_types=1);
/**
* Prüft über die echte Weboberfläche und die Mitarbeiter-API, dass gelöste und geschlossene Tickets als erledigt gelten:
* keine Fälligkeit und kein „überfällig“ in Liste, Ticketansicht und App-Schnittstelle; das Schließen räumt den Merker auf.
*/
if (!extension_loaded('pdo_sqlite') || !function_exists('curl_init')) { echo "Abmelde-Web-Test übersprungen: pdo_sqlite oder curl fehlt.\n"; exit(0); }
date_default_timezone_set('Europe/Berlin');
$root = dirname(__DIR__);
$work = sys_get_temp_dir() . '/deskhub-done-' . bin2hex(random_bytes(4));
$tmp = $work . '/inst';
mkdir($tmp, 0755, true);
$webPort = random_int(35500, 35999);
$skip = '#^(config/config\.php|database/[^/]+\.sqlite[^/]*|backups|uploads|tests|plugins/[^/]+|\.git)(/|$)#';
foreach (new RecursiveIteratorIterator(new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST) as $f) {
$rel = str_replace(chr(92), '/', substr($f->getPathname(), strlen($root) + 1));
if (preg_match($skip, $rel) && !preg_match('#^(backups|uploads|plugins)/(\.htaccess|README\.md)$#', $rel)) continue;
if ($f->isDir()) { @mkdir($tmp . '/' . $rel, 0755, true); continue; }
@mkdir(dirname($tmp . '/' . $rel), 0755, true);
copy($f->getPathname(), $tmp . '/' . $rel);
}
@mkdir($tmp . '/uploads');
@mkdir($tmp . '/config');
file_put_contents($tmp . '/config/config.php', '<?php return ' . var_export([
'app_key' => bin2hex(random_bytes(32)),
'db' => ['driver' => 'sqlite', 'sqlite_path' => $tmp . '/database/deskhub.sqlite'],
'site' => ['name' => 'Test', 'url' => 'http://127.0.0.1', 'admin_email' => 'a@test.de', 'timezone' => 'Europe/Berlin'],
'uploads' => ['max_size_bytes' => 10485760, 'allowed_extensions' => ['png'], 'path' => $tmp . '/uploads'],
], true) . ';');
putenv('DESKHUB_CONFIG_JSON');
putenv('DESKHUB_SQLITE_PATH');
putenv('DESKHUB_TESTING');
putenv('DESKHUB_API_ALLOW_INSECURE=1');
require_once $root . '/database/sqlite_schema.php';
require_once $root . '/database/migrate.php';
$db = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
$db->exec('PRAGMA foreign_keys = ON');
$db->exec(convert_schema_to_sqlite((string) file_get_contents($root . '/database/schema.sql')));
run_migrations($db, true);
$now = date('Y-m-d H:i:s');
$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
$db->exec('DELETE FROM staff');
$ins = $db->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)');
foreach ([['Chef', 'chef@test.de', 'admin'], ['Eva', 'eva@test.de', 'agent'], ['Max', 'max@test.de', 'agent']] as [$n, $e, $r]) {
$ins->execute([$n, $e, password_hash('Sehr-Sicher-1234', PASSWORD_DEFAULT), $r, $dept, $now]);
}
$evaId = (int) $db->query("SELECT id FROM staff WHERE email = 'eva@test.de'")->fetchColumn();
$db = null;
$failures = [];
$total = 0;
$check = function (bool $ok, string $what) use (&$failures, &$total): void { $total++; if (!$ok) $failures[] = $what; };
$webProc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$webPort", '-t', $tmp], [['pipe', 'r'], ['file', $work . '/web.out', 'w'], ['file', $work . '/web.out', 'a']], $wp, $tmp);
try {
for ($i = 0; $i < 50; $i++) { if (@fsockopen('127.0.0.1', $webPort)) break; usleep(100000); }
$pdo = function () use ($tmp): PDO {
$p = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
$p->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$p->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
return $p;
};
$call = function (string $method, string $path, array $form, string $jar, ?string $bearer = null, ?array $json = null) use ($webPort): array {
$ch = curl_init("http://127.0.0.1:$webPort$path");
$h = ['Sec-Fetch-Mode: navigate'];
if ($json !== null) $h[] = 'Content-Type: application/json';
if ($bearer) $h[] = 'Authorization: Bearer ' . $bearer;
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false, CURLOPT_TIMEOUT => 60, CURLOPT_HEADER => true, CURLOPT_HTTPHEADER => $h]);
if ($jar !== '') { curl_setopt($ch, CURLOPT_COOKIEJAR, $jar); curl_setopt($ch, CURLOPT_COOKIEFILE, $jar); }
if ($method === 'POST') { curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $json !== null ? json_encode($json) : http_build_query($form)); }
$raw = (string) curl_exec($ch);
$s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
$hs = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
curl_close($ch);
return [$s, substr($raw, $hs), substr($raw, 0, $hs)];
};
$login = function (string $email) use ($call): string {
$jar = tempnam(sys_get_temp_dir(), 'sow');
[, $lp] = $call('GET', '/staff/login.php', [], $jar);
preg_match('/name="csrf_token" value="([a-f0-9]+)"/', $lp, $m);
$call('POST', '/staff/login.php', ['csrf_token' => $m[1] ?? '', 'email' => $email, 'password' => 'Sehr-Sicher-1234'], $jar);
return $jar;
};
$csrf = function (string $path, string $jar) use ($call): string {
[, $p] = $call('GET', $path, [], $jar);
preg_match('/name="csrf_token" value="([a-f0-9]+)"/', $p, $mm);
return $mm[1] ?? '';
};
$loggedIn = function (string $jar) use ($call): bool {
[$s, $b] = $call('GET', '/staff/profile.php?tab=security', [], $jar);
return $s === 200 && str_contains($b, 'Von allen Geräten abmelden');
};
$apiToken = function (string $email) use ($call): string {
[, $b] = $call('POST', '/api/staff/v1/login.php', [], '', null, ['email' => $email, 'password' => 'Sehr-Sicher-1234', 'deviceName' => 'Test-Gerät']);
return (string) (json_decode($b, true)['token'] ?? '');
};
$apiOk = fn(string $tok) => $call('GET', '/api/staff/v1/me.php', [], '', $tok)[0];
$mk = function (string $n, string $status, array $o = []) use ($pdo, $now, $dept): int {
$p = $pdo();
$prio = (int) $p->query('SELECT id FROM priorities ORDER BY id LIMIT 1')->fetchColumn();
$p->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, resolution_due_at, first_response_due_at, is_overdue, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)')
->execute([$n, 'Betreff ' . $n, 'K', 'k@example.org', $dept, $prio, $status, 'web', date('Y-m-d H:i:s', time() - 9 * 3600), date('Y-m-d H:i:s', time() - 20 * 3600), $o['overdue'] ?? 0, date('Y-m-d H:i:s', time() - 80 * 3600), $now]);
return (int) $p->lastInsertId();
};
$mk('Z-OPEN', 'open', ['overdue' => 1]);
$mk('Z-CLOSED', 'closed', ['overdue' => 1]); // alter Zustand: überfällig-Merker noch gesetzt
$mk('Z-RESOLVED', 'resolved');
$jar = $login('chef@test.de');
$rowOf = function (string $html, string $num): string {
return preg_match('#<tr[^>]*>(?:(?!</tr>).)*' . preg_quote($num, '#') . '(?:(?!</tr>).)*</tr>#s', $html, $m) ? $m[0] : '';
};
[, $list] = $call('GET', '/staff/tickets.php?tab=all', [], $jar);
$open = $rowOf($list, 'Z-OPEN'); $closed = $rowOf($list, 'Z-CLOSED'); $resolved = $rowOf($list, 'Z-RESOLVED');
$check($open !== '' && $closed !== '' && $resolved !== '', 'Alle drei Tickets stehen in der Liste');
$check(str_contains($open, 'überfällig'), 'Liste: das offene Ticket zeigt „überfällig“');
$check(!str_contains($closed, 'überfällig') && !str_contains($closed, ' Std') && str_contains($closed, '–'), 'Liste: geschlossenes Ticket zeigt keine Fälligkeit und kein „überfällig“');
$check(!str_contains($resolved, 'überfällig') && !str_contains($resolved, ' Std') && str_contains($resolved, '–'), 'Liste: gelöstes Ticket genauso');
foreach (['Z-CLOSED' => 'geschlossen', 'Z-RESOLVED' => 'gelöst'] as $num => $label) {
[, $view] = $call('GET', '/staff/ticket_view.php?n=' . $num, [], $jar);
$check(!str_contains($view, 'überfällig') && str_contains($view, '✓ erledigt'), "Ticketansicht ($label): kein „überfällig“, die Lösung steht als erledigt");
}
[, $view] = $call('GET', '/staff/ticket_view.php?n=Z-OPEN', [], $jar);
$check(str_contains($view, 'überfällig'), 'Ticketansicht (offen): „überfällig“ bleibt');
$tok = $apiToken('chef@test.de');
[, $b] = $call('GET', '/api/staff/v1/tickets.php?status=open,closed,resolved&perPage=50', [], '', $tok);
$items = json_decode($b, true)['tickets'] ?? json_decode($b, true)['items'] ?? [];
$by = [];
foreach ($items as $it) $by[$it['number'] ?? $it['ticketNumber'] ?? ''] = $it;
$check(isset($by['Z-OPEN'], $by['Z-CLOSED'], $by['Z-RESOLVED']), 'App-Schnittstelle liefert alle drei Tickets');
$check(!empty($by['Z-OPEN']['isOverdue']) && str_contains((string) $by['Z-OPEN']['dueLabel'], 'überfällig'), 'App-Schnittstelle: offenes Ticket überfällig');
$check(empty($by['Z-CLOSED']['isOverdue']) && array_key_exists('dueLabel', $by['Z-CLOSED']) && $by['Z-CLOSED']['dueLabel'] === null, 'App-Schnittstelle: geschlossenes Ticket ohne Fälligkeit und ohne „überfällig“');
$check(empty($by['Z-RESOLVED']['isOverdue']) && array_key_exists('dueLabel', $by['Z-RESOLVED']) && $by['Z-RESOLVED']['dueLabel'] === null, 'App-Schnittstelle: gelöstes Ticket genauso');
// Echtes Schließen über die Weboberfläche räumt auf
$t = $csrf('/staff/ticket_view.php?n=Z-OPEN', $jar);
[, $v0] = $call('GET', '/staff/ticket_view.php?n=Z-OPEN', [], $jar);
$call('POST', '/staff/ticket_view.php?n=Z-OPEN', ['csrf_token' => $t, 'action' => 'update_props', 'status' => 'closed', 'resolution_code' => 'fixed', 'resolution_note' => 'ok', 'priority_id' => (string) $pdo()->query("SELECT priority_id FROM tickets WHERE ticket_number = 'Z-OPEN'")->fetchColumn(), 'department_id' => (string) $dept, 'assigned_staff_id' => ''], $jar);
$st = $pdo()->query("SELECT status, is_overdue FROM tickets WHERE ticket_number = 'Z-OPEN'")->fetch();
$check($st['status'] === 'closed' && (int) $st['is_overdue'] === 0, 'Nach dem Schließen in der Oberfläche ist das Ticket geschlossen und nicht mehr überfällig');
@unlink($jar);
} finally {
if (is_resource($webProc)) { proc_terminate($webProc); proc_close($webProc); }
$rm = function (string $d) use (&$rm): void { foreach (glob($d . '/{,.}*', GLOB_BRACE) ?: [] as $e) { $b = basename($e); if ($b === '.' || $b === '..') continue; is_dir($e) ? $rm($e) : @unlink($e); } @rmdir($d); };
$rm($work);
}
if ($failures) {
fwrite(STDERR, "Fehlgeschlagen:\n - " . implode("\n - ", $failures) . "\n");
exit(1);
}
echo "Ticket done web checks passed ({$total} Prüfungen).\n";
DeskHub-Webseite/tests/update_security.php
+45
View File
@@ -45,6 +45,10 @@ $z = new ZipArchive(); $z->open($zip, ZipArchive::CREATE); $z->addFromString('ve
$check($code === 0 && is_file($zip . '.sig'), 'Signier-Werkzeug erzeugt die .sig-Datei: ' . $out);
$sig = (string) @file_get_contents($zip . '.sig');
$check(update_verify_package('1.0.7', $zip, $sig) === null, 'Gültige Signatur wird akzeptiert');
foreach (['docs/DeskHub-Handbuch.pdf' => false, 'docs/video/demo.mp4' => true, 'docs/anderes.pdf' => true, 'plugins/x/plugin.php' => true, 'uploads/a.png' => true, 'backups/b.zip' => true,
'app_downloads/DeskHub.apk' => true, 'tools/x.php' => true, 'tests/x.php' => true, 'staff/help.php' => false, 'includes/mailer.php' => false, 'assets/js/passkey.js' => false, 'docs/DeskHub-Handbuch.pdf.bak' => true, 'config/config.php' => true, 'Config/Config.php' => true, 'config/config.example.php' => true, 'config/.htaccess' => true, './config/config.php' => true, '.env' => true, 'configure.php' => false, 'tools/fix-permissions.sh' => false, 'tools/release-sign.php' => true] as $path => $skipped) {
$check(update_path_is_skipped($path) === $skipped, 'Update-Pfad ' . $path . ($skipped ? ' wird übersprungen' : ' wird installiert'));
}
$check(update_verify_package('v1.0.7', $zip, $sig) === null, 'Version mit führendem "v" passt ebenfalls');
$check(update_verify_package('1.0.8', $zip, $sig) !== null, 'Signatur einer anderen Version wird abgelehnt (kein Herunterstufen/Umetikettieren)');
$check(update_verify_package('1.0.7', $zip, '') !== null, 'Fehlende Signatur wird abgelehnt');
@@ -100,6 +104,47 @@ $check(update_http_headers() === [] && update_token_info() === ['', ''], 'ohne T
putenv('DESKHUB_CATALOG_DEFAULTS=' . __DIR__ . '/fixtures/no-catalog.php');
$check(function_exists('plugin_publisher_key'), 'Hilfsfunktion vorhanden');
putenv('DESKHUB_CATALOG_DEFAULTS=' . $tmp . '/defaults.php'); // wieder mit offiziellem Katalog
// ── Updates von der Plugin-Webseite ──────────────────────────────────────────
$check(update_publisher_endpoint(['list' => 1]) === 'https://plugins.example.test/app-release.php?platform=server&list=1', 'Update-Adresse liegt neben dem Katalog: ' . update_publisher_endpoint(['list' => 1]));
$GLOBALS['deskhub_catalog_defaults'] = ['plugins_url' => '', 'themes_url' => '', 'publisher_key' => $pub];
$check(update_publisher_endpoint([]) === '' && update_publisher_releases() === [], 'Ohne offiziellen Katalog gibt es keine Update-Adresse');
unset($GLOBALS['deskhub_catalog_defaults']);
$pubZip = $tmp . '/pub.zip';
$z = new ZipArchive(); $z->open($pubZip, ZipArchive::CREATE); $z->addFromString('version.php', "<?php define('DESKHUB_VERSION', '1.0.9');"); $z->close();
$pubSha = hash_file('sha256', $pubZip);
openssl_sign(update_signature_message('1.0.9', $pubSha), $pubSigRaw, $k, OPENSSL_ALGO_SHA256);
$entry = ['platform' => 'server', 'version' => '1.0.9', 'sha256' => $pubSha, 'size' => filesize($pubZip), 'notes' => 'Neu', 'created_at' => '2026-11-05 10:00:00', 'signature' => base64_encode($pubSigRaw)];
$older = ['platform' => 'server', 'version' => '1.0.8', 'sha256' => str_repeat('a', 64), 'size' => 10, 'notes' => '', 'created_at' => '2026-10-01 10:00:00', 'signature' => 'x'];
$served = [$older, $entry];
$tamper = false;
$GLOBALS['deskhub_http_get'] = function (string $url, int $max, array $headers = []) use (&$served, &$tamper, $pubZip): array {
if (str_contains($url, 'list=1')) return [200, json_encode(['platform' => 'server', 'releases' => $served]), null];
if (str_contains($url, 'version=1.0.9') && str_contains($url, 'download=1')) return [200, ($tamper ? 'X' : '') . file_get_contents($pubZip), null];
return [404, null, 'HTTP 404'];
};
$rels = update_publisher_releases();
$check(count($rels) === 2 && $rels[0]['tag_name'] === '1.0.9' && $rels[0]['source'] === 'publisher' && $rels[0]['body'] === 'Neu', 'Plugin-Webseite: Versionen werden geladen, neueste zuerst');
$check(update_publisher_find('v1.0.9')['sha256'] === $pubSha && update_publisher_find('9.9.9') === null, 'Version wird mit oder ohne „v“ gefunden');
[$got, $err] = update_publisher_fetch($rels[0]);
$check($err === null && $got !== null && is_file($got), 'Gültiges Paket wird geladen und geprüft: ' . var_export($err, true));
if ($got) @unlink($got);
$bad = $rels[0]; $bad['signature'] = base64_encode('falsch');
[$got, $err] = update_publisher_fetch($bad);
$check($got === null && $err !== null, 'Falsche Signatur wird abgelehnt');
$bad = $rels[0]; $bad['signature'] = '';
[$got, $err] = update_publisher_fetch($bad);
$check($got === null && $err !== null, 'Fehlende Signatur wird abgelehnt (Seite ohne Signierschlüssel)');
$tamper = true;
[$got, $err] = update_publisher_fetch($rels[0]);
$check($got === null && str_contains((string) $err, 'Prüfsumme'), 'Verändertes Paket scheitert an der Prüfsumme');
$tamper = false;
$served = [['version' => '../../x', 'sha256' => $pubSha], ['version' => '2.0.0', 'sha256' => 'kurz'], 'kaputt'];
$check(update_publisher_releases() === [], 'Einträge mit ungültiger Version oder Prüfsumme werden ignoriert');
$GLOBALS['deskhub_http_get'] = fn(string $url, int $max, array $h = []): array => [500, null, 'HTTP 500'];
$check(update_publisher_releases() === [], 'Fällt die Plugin-Webseite aus, ist die Liste leer (dann greift Gitea)');
unset($GLOBALS['deskhub_http_get']);
// Aufräumen
foreach (glob($tmp . '/*') ?: [] as $f) @unlink($f);
@rmdir($tmp);
DeskHub-Webseite/tests/vacation_no_notifications.php
+1
View File
@@ -15,6 +15,7 @@ require_once dirname(__DIR__) . '/includes/push.php';
$failures = [];
$check = function (bool $ok, string $what) use (&$failures): void { if (!$ok) $failures[] = $what; };
$pdo = get_db();
set_setting('sla_notify_mode', 'assignee'); // diese Prüfungen betreffen den Modus „Bearbeiter bzw. Abteilung“ (Standard ist „nur Administratoren“)
$now = db_now();
$pdo->prepare('INSERT INTO departments (name, email) VALUES (?,?)')->execute(['Support', 'support@firma.example']);
$dept = (int) $pdo->lastInsertId();
DeskHub-Webseite/tests/web_handoff.php
+181 -181
View File
@@ -1,181 +1,181 @@
<?php
declare(strict_types=1);
/**
* Prüft die Übergabe aus den Apps an die Weboberfläche: wer welche Seiten sieht, einmalige und kurzlebige Anmelde-Adressen,
* abgelehnte Pfade und dass die Weboberfläche die Rechte weiterhin selbst prüft.
*/
date_default_timezone_set('Europe/Berlin'); // wie in der Test-Installation
$root = dirname(__DIR__);
$work = sys_get_temp_dir() . '/deskhub-handoff-' . bin2hex(random_bytes(4));
$tmp = $work . '/inst';
mkdir($tmp, 0755, true);
$webPort = random_int(36000, 36499);
$skip = '#^(config/config\.php|database/[^/]+\.sqlite[^/]*|backups|uploads|tests|plugins/[^/]+|\.git)(/|$)#';
foreach (new RecursiveIteratorIterator(new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST) as $f) {
$rel = str_replace(chr(92), '/', substr($f->getPathname(), strlen($root) + 1));
if (preg_match($skip, $rel) && !preg_match('#^(backups|uploads|plugins)/(\.htaccess|README\.md)$#', $rel)) continue;
if ($f->isDir()) { @mkdir($tmp . '/' . $rel, 0755, true); continue; }
@mkdir(dirname($tmp . '/' . $rel), 0755, true);
copy($f->getPathname(), $tmp . '/' . $rel);
}
@mkdir($tmp . '/uploads');
@mkdir($tmp . '/config');
file_put_contents($tmp . '/config/config.php', '<?php return ' . var_export([
'app_key' => bin2hex(random_bytes(32)),
'db' => ['driver' => 'sqlite', 'sqlite_path' => $tmp . '/database/deskhub.sqlite'],
'site' => ['name' => 'Test', 'url' => 'http://127.0.0.1', 'admin_email' => 'a@test.de', 'timezone' => 'Europe/Berlin'],
'uploads' => ['max_size_bytes' => 10485760, 'allowed_extensions' => ['png'], 'path' => $tmp . '/uploads'],
], true) . ';');
putenv('DESKHUB_CONFIG_JSON');
putenv('DESKHUB_SQLITE_PATH');
putenv('DESKHUB_TESTING');
putenv('DESKHUB_API_ALLOW_INSECURE=1');
require_once $root . '/database/sqlite_schema.php';
require_once $root . '/database/migrate.php';
$db = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
$db->exec('PRAGMA foreign_keys = ON');
$db->exec(convert_schema_to_sqlite((string) file_get_contents($root . '/database/schema.sql')));
$mig = run_migrations($db, true);
$now = date('Y-m-d H:i:s');
$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
$db->exec('DELETE FROM staff');
$ins = $db->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)');
$ids = [];
foreach ([['Chef', 'chef@test.de', 'admin'], ['Agent', 'agent@test.de', 'agent'], ['Pfleger', 'pfleger@test.de', 'agent']] as [$n, $e, $r]) {
$ins->execute([$n, $e, password_hash('Sehr-Sicher-1234', PASSWORD_DEFAULT), $r, $dept, $now]);
$ids[$n] = (int) $db->lastInsertId();
}
$db = null;
$failures = [];
$total = 0;
$check = function (bool $ok, string $what) use (&$failures, &$total): void { $total++; if (!$ok) $failures[] = $what; };
$webProc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$webPort", '-t', $tmp], [['pipe', 'r'], ['file', $work . '/web.out', 'w'], ['file', $work . '/web.out', 'a']], $wp, $tmp);
try {
for ($i = 0; $i < 50; $i++) { if (@fsockopen('127.0.0.1', $webPort)) break; usleep(100000); }
$pdo = function () use ($tmp): PDO {
$p = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
$p->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$p->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
return $p;
};
$api = function (string $method, string $path, ?array $json = null, ?string $bearer = null) use ($webPort): array {
$ch = curl_init("http://127.0.0.1:$webPort$path");
$h = ['Content-Type: application/json'];
if ($bearer) $h[] = 'Authorization: Bearer ' . $bearer;
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 60, CURLOPT_HTTPHEADER => $h, CURLOPT_CUSTOMREQUEST => $method]);
if ($json !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($json));
$b = (string) curl_exec($ch);
$s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);
return [$s, json_decode($b, true) ?? $b];
};
$web = function (string $path, string $jar) use ($webPort): array {
$ch = curl_init("http://127.0.0.1:$webPort$path");
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false, CURLOPT_HEADER => true, CURLOPT_TIMEOUT => 60, CURLOPT_COOKIEJAR => $jar, CURLOPT_COOKIEFILE => $jar, CURLOPT_HTTPHEADER => ['Sec-Fetch-Mode: navigate', 'Sec-Fetch-User: ?1']]);
$b = (string) curl_exec($ch);
$s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
$hs = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
curl_close($ch);
$head = substr($b, 0, $hs);
preg_match('/^Location: (.+)$/mi', $head, $m);
return [$s, trim($m[1] ?? ''), substr($b, $hs)];
};
$loginApi = function (string $email) use ($api): string {
[, $r] = $api('POST', '/api/staff/v1/login.php', ['email' => $email, 'password' => 'Sehr-Sicher-1234', 'deviceName' => 'Test']);
return (string) ($r['token'] ?? '');
};
$db = $pdo();
$db->prepare('INSERT INTO roles (name, permissions) VALUES (?,?)')->execute(['Assistent-Pfleger', json_encode(['reply_ticket' => true, 'manage_assistant' => true])]);
$roleId = (int) $db->lastInsertId();
$db->prepare('UPDATE staff SET role_id = ? WHERE email = ?')->execute([$roleId, 'pfleger@test.de']);
$now = date('Y-m-d H:i:s');
$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
$prio = (int) $db->query('SELECT id FROM priorities ORDER BY sort_order LIMIT 1')->fetchColumn();
$db->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?)')
->execute(['T7001', 'Testticket', 'Kunde', 'kunde@example.org', $dept, $prio, 'open', 'web', $now, $now]);
$chef = $loginApi('chef@test.de');
$agent = $loginApi('agent@test.de');
$pfleger = $loginApi('pfleger@test.de');
$check($chef !== '' && $agent !== '' && $pfleger !== '', 'Anmeldung der drei Mitarbeiter in der App-Schnittstelle');
// ── Welche Seiten sieht wer? ───────────────────────────────────────────
$keys = fn(string $t): array => array_column(($api('GET', '/api/staff/v1/web_pages.php', null, $t)[1]['pages'] ?? []), 'key');
$kc = $keys($chef); $ka = $keys($agent); $kp = $keys($pfleger);
$check(count($kc) === 20 && in_array('settings', $kc, true) && in_array('backup', $kc, true) && in_array('assistant', $kc, true), 'Administrator sieht alle 20 Seiten');
$check($ka === ['mentions', 'agent_directory', 'apps'], 'Mitarbeiter ohne Rechte sehen nur Erwähnungen, Verzeichnis und die Seite „Apps und Downloads“ ' . json_encode($ka));
$check(in_array('assistant', $kp, true) && !in_array('settings', $kp, true) && !in_array('backup', $kp, true) && !in_array('plugins', $kp, true), 'Mit dem Recht „Assistent“ kommt genau diese Seite dazu, aber keine Systemseiten ' . json_encode($kp));
// ── Übergabe ───────────────────────────────────────────────────────────
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/settings.php'], $agent);
$check($s === 403, 'Mitarbeiter ohne Recht bekommt keine Adresse für die Einstellungen (HTTP ' . $s . ')');
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/assistant.php'], $agent);
$check($s === 403, '… und auch nicht für den Assistenten');
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/staff_manage.php'], $chef);
$check($s === 403, 'Seiten, die nicht in der Liste stehen, werden auch Administratoren nicht übergeben');
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/ticket_view.php?n=T7001&x=<script>'], $chef);
$check($s === 403, 'Ticket-Adressen mit Zusätzen werden abgelehnt');
[$s] = $api('GET', '/api/staff/v1/web_pages.php');
$check($s === 401, 'Ohne Anmeldung gibt es nichts (HTTP ' . $s . ')');
[$s, $r] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/settings.php'], $chef);
$url = (string) ($r['url'] ?? '');
$check($s === 200 && preg_match('#/staff/app_login\.php\?t=[a-f0-9]{64}$#', $url) === 1, 'Administrator bekommt eine einmalige Adresse (HTTP ' . $s . ')');
$tokenPath = (string) parse_url($url, PHP_URL_PATH) . '?' . (string) parse_url($url, PHP_URL_QUERY);
$jar = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web('/staff/settings.php', $jar);
$check($s === 302, 'Vorher: ohne Anmeldung leitet die Einstellungsseite weg');
[$s, $loc] = $web($tokenPath, $jar);
$check($s === 302 && str_ends_with($loc, '/staff/settings.php'), 'Die Adresse meldet an und leitet auf die gewünschte Seite (HTTP ' . $s . ' ' . $loc . ')');
[$s, , $body] = $web('/staff/settings.php', $jar);
$check($s === 200 && str_contains($body, 'Einstellungen'), 'Danach ist man in der Weboberfläche angemeldet');
$jar2 = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web($tokenPath, $jar2);
$check($s === 302 && str_contains($loc, '/staff/login.php'), 'Die Adresse funktioniert nur einmal');
[$s, , $body] = $web('/staff/settings.php', $jar2);
$check($s === 302, 'Zweiter Versuch bleibt abgemeldet');
// abgelaufen
[, $r] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/backup.php'], $chef);
$pdo()->exec("UPDATE web_login_tokens SET expires_at = '2000-01-01 00:00:00' WHERE used_at IS NULL");
$tp = (string) parse_url((string) $r['url'], PHP_URL_PATH) . '?' . (string) parse_url((string) $r['url'], PHP_URL_QUERY);
$jar3 = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web($tp, $jar3);
$check(str_contains($loc, '/staff/login.php'), 'Abgelaufene Adressen werden abgelehnt');
[$s, $loc] = $web('/staff/app_login.php?t=' . str_repeat('a', 64), $jar3);
$check(str_contains($loc, '/staff/login.php'), 'Erfundene Adressen werden abgelehnt');
[$s, $loc] = $web('/staff/app_login.php?t=../../etc', $jar3);
$check(str_contains($loc, '/staff/login.php'), 'Ungültig aufgebaute Adressen werden abgelehnt');
// Wirkt das Recht auch in der Weboberfläche? Mitarbeiter ohne Recht bleibt auch nach Übergabe eines Tickets draußen bei Admin-Seiten
[, $r] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/ticket_view.php?n=T7001'], $agent);
$tp = (string) parse_url((string) ($r['url'] ?? ''), PHP_URL_PATH) . '?' . (string) parse_url((string) ($r['url'] ?? ''), PHP_URL_QUERY);
$jar4 = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web($tp, $jar4);
$check($s === 302 && str_contains($loc, 'ticket_view.php?n=T7001'), 'Ein Ticket lässt sich öffnen (zusammenführen, aufteilen, drucken)');
[$s, $loc] = $web('/staff/settings.php', $jar4);
$check($s === 302 && !str_contains($loc, 'settings'), 'Der übergebene Mitarbeiter kommt trotzdem nicht auf Admin-Seiten (Web prüft selbst)');
@unlink($jar); @unlink($jar2); @unlink($jar3); @unlink($jar4);
} finally {
if (isset($webProc) && is_resource($webProc)) { proc_terminate($webProc); proc_close($webProc); }
}
usleep(300000);
$rm = function (string $d) use (&$rm) {
foreach (scandir($d) ?: [] as $e) { if ($e === '.' || $e === '..') continue; is_dir("$d/$e") && !is_link("$d/$e") ? $rm("$d/$e") : @unlink("$d/$e"); }
@rmdir($d);
};
if (str_starts_with($work, sys_get_temp_dir() . '/deskhub-handoff-')) $rm($work);
if ($failures) {
fwrite(STDERR, "Fehlgeschlagen:\n - " . implode("\n - ", $failures) . "\n");
exit(1);
}
echo "Web handoff checks passed ({$total} Prüfungen).\n";
<?php
declare(strict_types=1);
/**
* Prüft die Übergabe aus den Apps an die Weboberfläche: wer welche Seiten sieht, einmalige und kurzlebige Anmelde-Adressen,
* abgelehnte Pfade und dass die Weboberfläche die Rechte weiterhin selbst prüft.
*/
date_default_timezone_set('Europe/Berlin'); // wie in der Test-Installation
$root = dirname(__DIR__);
$work = sys_get_temp_dir() . '/deskhub-handoff-' . bin2hex(random_bytes(4));
$tmp = $work . '/inst';
mkdir($tmp, 0755, true);
$webPort = random_int(36000, 36499);
$skip = '#^(config/config\.php|database/[^/]+\.sqlite[^/]*|backups|uploads|tests|plugins/[^/]+|\.git)(/|$)#';
foreach (new RecursiveIteratorIterator(new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST) as $f) {
$rel = str_replace(chr(92), '/', substr($f->getPathname(), strlen($root) + 1));
if (preg_match($skip, $rel) && !preg_match('#^(backups|uploads|plugins)/(\.htaccess|README\.md)$#', $rel)) continue;
if ($f->isDir()) { @mkdir($tmp . '/' . $rel, 0755, true); continue; }
@mkdir(dirname($tmp . '/' . $rel), 0755, true);
copy($f->getPathname(), $tmp . '/' . $rel);
}
@mkdir($tmp . '/uploads');
@mkdir($tmp . '/config');
file_put_contents($tmp . '/config/config.php', '<?php return ' . var_export([
'app_key' => bin2hex(random_bytes(32)),
'db' => ['driver' => 'sqlite', 'sqlite_path' => $tmp . '/database/deskhub.sqlite'],
'site' => ['name' => 'Test', 'url' => 'http://127.0.0.1', 'admin_email' => 'a@test.de', 'timezone' => 'Europe/Berlin'],
'uploads' => ['max_size_bytes' => 10485760, 'allowed_extensions' => ['png'], 'path' => $tmp . '/uploads'],
], true) . ';');
putenv('DESKHUB_CONFIG_JSON');
putenv('DESKHUB_SQLITE_PATH');
putenv('DESKHUB_TESTING');
putenv('DESKHUB_API_ALLOW_INSECURE=1');
require_once $root . '/database/sqlite_schema.php';
require_once $root . '/database/migrate.php';
$db = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
$db->exec('PRAGMA foreign_keys = ON');
$db->exec(convert_schema_to_sqlite((string) file_get_contents($root . '/database/schema.sql')));
$mig = run_migrations($db, true);
$now = date('Y-m-d H:i:s');
$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
$db->exec('DELETE FROM staff');
$ins = $db->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)');
$ids = [];
foreach ([['Chef', 'chef@test.de', 'admin'], ['Agent', 'agent@test.de', 'agent'], ['Pfleger', 'pfleger@test.de', 'agent']] as [$n, $e, $r]) {
$ins->execute([$n, $e, password_hash('Sehr-Sicher-1234', PASSWORD_DEFAULT), $r, $dept, $now]);
$ids[$n] = (int) $db->lastInsertId();
}
$db = null;
$failures = [];
$total = 0;
$check = function (bool $ok, string $what) use (&$failures, &$total): void { $total++; if (!$ok) $failures[] = $what; };
$webProc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$webPort", '-t', $tmp], [['pipe', 'r'], ['file', $work . '/web.out', 'w'], ['file', $work . '/web.out', 'a']], $wp, $tmp);
try {
for ($i = 0; $i < 50; $i++) { if (@fsockopen('127.0.0.1', $webPort)) break; usleep(100000); }
$pdo = function () use ($tmp): PDO {
$p = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
$p->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$p->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
return $p;
};
$api = function (string $method, string $path, ?array $json = null, ?string $bearer = null) use ($webPort): array {
$ch = curl_init("http://127.0.0.1:$webPort$path");
$h = ['Content-Type: application/json'];
if ($bearer) $h[] = 'Authorization: Bearer ' . $bearer;
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 60, CURLOPT_HTTPHEADER => $h, CURLOPT_CUSTOMREQUEST => $method]);
if ($json !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($json));
$b = (string) curl_exec($ch);
$s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);
return [$s, json_decode($b, true) ?? $b];
};
$web = function (string $path, string $jar) use ($webPort): array {
$ch = curl_init("http://127.0.0.1:$webPort$path");
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false, CURLOPT_HEADER => true, CURLOPT_TIMEOUT => 60, CURLOPT_COOKIEJAR => $jar, CURLOPT_COOKIEFILE => $jar, CURLOPT_HTTPHEADER => ['Sec-Fetch-Mode: navigate', 'Sec-Fetch-User: ?1']]);
$b = (string) curl_exec($ch);
$s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
$hs = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
curl_close($ch);
$head = substr($b, 0, $hs);
preg_match('/^Location: (.+)$/mi', $head, $m);
return [$s, trim($m[1] ?? ''), substr($b, $hs)];
};
$loginApi = function (string $email) use ($api): string {
[, $r] = $api('POST', '/api/staff/v1/login.php', ['email' => $email, 'password' => 'Sehr-Sicher-1234', 'deviceName' => 'Test']);
return (string) ($r['token'] ?? '');
};
$db = $pdo();
$db->prepare('INSERT INTO roles (name, permissions) VALUES (?,?)')->execute(['Assistent-Pfleger', json_encode(['reply_ticket' => true, 'manage_assistant' => true])]);
$roleId = (int) $db->lastInsertId();
$db->prepare('UPDATE staff SET role_id = ? WHERE email = ?')->execute([$roleId, 'pfleger@test.de']);
$now = date('Y-m-d H:i:s');
$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
$prio = (int) $db->query('SELECT id FROM priorities ORDER BY sort_order LIMIT 1')->fetchColumn();
$db->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?)')
->execute(['T7001', 'Testticket', 'Kunde', 'kunde@example.org', $dept, $prio, 'open', 'web', $now, $now]);
$chef = $loginApi('chef@test.de');
$agent = $loginApi('agent@test.de');
$pfleger = $loginApi('pfleger@test.de');
$check($chef !== '' && $agent !== '' && $pfleger !== '', 'Anmeldung der drei Mitarbeiter in der App-Schnittstelle');
// ── Welche Seiten sieht wer? ───────────────────────────────────────────
$keys = fn(string $t): array => array_column(($api('GET', '/api/staff/v1/web_pages.php', null, $t)[1]['pages'] ?? []), 'key');
$kc = $keys($chef); $ka = $keys($agent); $kp = $keys($pfleger);
$check(count($kc) === 27 && in_array('settings', $kc, true) && in_array('backup', $kc, true) && in_array('assistant', $kc, true), 'Administrator sieht alle 27 Seiten');
$check($ka === ['mentions', 'agent_directory', 'apps', 'banlist'], 'Mitarbeiter ohne Rechte sehen nur Erwähnungen, Verzeichnis, Apps und die Sperrliste (Standardrecht) ' . json_encode($ka));
$check(in_array('assistant', $kp, true) && !in_array('settings', $kp, true) && !in_array('backup', $kp, true) && !in_array('plugins', $kp, true), 'Mit dem Recht „Assistent“ kommt genau diese Seite dazu, aber keine Systemseiten ' . json_encode($kp));
// ── Übergabe ───────────────────────────────────────────────────────────
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/settings.php'], $agent);
$check($s === 403, 'Mitarbeiter ohne Recht bekommt keine Adresse für die Einstellungen (HTTP ' . $s . ')');
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/assistant.php'], $agent);
$check($s === 403, '… und auch nicht für den Assistenten');
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/staff_manage.php'], $chef);
$check($s === 403, 'Seiten, die nicht in der Liste stehen, werden auch Administratoren nicht übergeben');
[$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/ticket_view.php?n=T7001&x=<script>'], $chef);
$check($s === 403, 'Ticket-Adressen mit Zusätzen werden abgelehnt');
[$s] = $api('GET', '/api/staff/v1/web_pages.php');
$check($s === 401, 'Ohne Anmeldung gibt es nichts (HTTP ' . $s . ')');
[$s, $r] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/settings.php'], $chef);
$url = (string) ($r['url'] ?? '');
$check($s === 200 && preg_match('#/staff/app_login\.php\?t=[a-f0-9]{64}$#', $url) === 1, 'Administrator bekommt eine einmalige Adresse (HTTP ' . $s . ')');
$tokenPath = (string) parse_url($url, PHP_URL_PATH) . '?' . (string) parse_url($url, PHP_URL_QUERY);
$jar = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web('/staff/settings.php', $jar);
$check($s === 302, 'Vorher: ohne Anmeldung leitet die Einstellungsseite weg');
[$s, $loc] = $web($tokenPath, $jar);
$check($s === 302 && str_ends_with($loc, '/staff/settings.php'), 'Die Adresse meldet an und leitet auf die gewünschte Seite (HTTP ' . $s . ' ' . $loc . ')');
[$s, , $body] = $web('/staff/settings.php', $jar);
$check($s === 200 && str_contains($body, 'Einstellungen'), 'Danach ist man in der Weboberfläche angemeldet');
$jar2 = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web($tokenPath, $jar2);
$check($s === 302 && str_contains($loc, '/staff/login.php'), 'Die Adresse funktioniert nur einmal');
[$s, , $body] = $web('/staff/settings.php', $jar2);
$check($s === 302, 'Zweiter Versuch bleibt abgemeldet');
// abgelaufen
[, $r] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/backup.php'], $chef);
$pdo()->exec("UPDATE web_login_tokens SET expires_at = '2000-01-01 00:00:00' WHERE used_at IS NULL");
$tp = (string) parse_url((string) $r['url'], PHP_URL_PATH) . '?' . (string) parse_url((string) $r['url'], PHP_URL_QUERY);
$jar3 = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web($tp, $jar3);
$check(str_contains($loc, '/staff/login.php'), 'Abgelaufene Adressen werden abgelehnt');
[$s, $loc] = $web('/staff/app_login.php?t=' . str_repeat('a', 64), $jar3);
$check(str_contains($loc, '/staff/login.php'), 'Erfundene Adressen werden abgelehnt');
[$s, $loc] = $web('/staff/app_login.php?t=../../etc', $jar3);
$check(str_contains($loc, '/staff/login.php'), 'Ungültig aufgebaute Adressen werden abgelehnt');
// Wirkt das Recht auch in der Weboberfläche? Mitarbeiter ohne Recht bleibt auch nach Übergabe eines Tickets draußen bei Admin-Seiten
[, $r] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/ticket_view.php?n=T7001'], $agent);
$tp = (string) parse_url((string) ($r['url'] ?? ''), PHP_URL_PATH) . '?' . (string) parse_url((string) ($r['url'] ?? ''), PHP_URL_QUERY);
$jar4 = tempnam(sys_get_temp_dir(), 'hof');
[$s, $loc] = $web($tp, $jar4);
$check($s === 302 && str_contains($loc, 'ticket_view.php?n=T7001'), 'Ein Ticket lässt sich öffnen (zusammenführen, aufteilen, drucken)');
[$s, $loc] = $web('/staff/settings.php', $jar4);
$check($s === 302 && !str_contains($loc, 'settings'), 'Der übergebene Mitarbeiter kommt trotzdem nicht auf Admin-Seiten (Web prüft selbst)');
@unlink($jar); @unlink($jar2); @unlink($jar3); @unlink($jar4);
} finally {
if (isset($webProc) && is_resource($webProc)) { proc_terminate($webProc); proc_close($webProc); }
}
usleep(300000);
$rm = function (string $d) use (&$rm) {
foreach (scandir($d) ?: [] as $e) { if ($e === '.' || $e === '..') continue; is_dir("$d/$e") && !is_link("$d/$e") ? $rm("$d/$e") : @unlink("$d/$e"); }
@rmdir($d);
};
if (str_starts_with($work, sys_get_temp_dir() . '/deskhub-handoff-')) $rm($work);
if ($failures) {
fwrite(STDERR, "Fehlgeschlagen:\n - " . implode("\n - ", $failures) . "\n");
exit(1);
}
echo "Web handoff checks passed ({$total} Prüfungen).\n";