62 lines
2.9 KiB
PHP
62 lines
2.9 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
$previousDbPath = getenv('DESKHUB_SQLITE_PATH');
|
|
putenv('DESKHUB_SQLITE_PATH=:memory:');
|
|
|
|
require_once dirname(__DIR__) . '/includes/db.php';
|
|
require_once dirname(__DIR__) . '/includes/functions.php';
|
|
|
|
try {
|
|
$pdo = get_db();
|
|
$now = db_now();
|
|
|
|
$pdo->prepare('INSERT INTO users (name, email, password_hash, created_at) VALUES (?,?,?,?)')
|
|
->execute(['Ticket Owner', 'ticket-owner@example.test', 'test-hash', $now]);
|
|
$ownerId = (int) $pdo->lastInsertId();
|
|
$pdo->prepare('INSERT INTO users (name, email, password_hash, created_at) VALUES (?,?,?,?)')
|
|
->execute(['Other User', 'other@example.test', 'test-hash', $now]);
|
|
$otherId = (int) $pdo->lastInsertId();
|
|
|
|
$departmentId = (int) $pdo->query('SELECT id FROM departments LIMIT 1')->fetchColumn();
|
|
$priorityId = (int) $pdo->query('SELECT id FROM priorities LIMIT 1')->fetchColumn();
|
|
$pdo->prepare(
|
|
'INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id)
|
|
VALUES (?,?,?,?,?,?)'
|
|
)->execute(['TEST-ACCESS-1', 'Ticket access test', 'Ticket Owner', 'ticket-owner@example.test', $departmentId, $priorityId]);
|
|
$ticketId = (int) $pdo->lastInsertId();
|
|
|
|
$url = ticket_access_url(['id' => $ticketId, 'ticket_number' => 'TEST-ACCESS-1']);
|
|
parse_str((string) parse_url($url, PHP_URL_QUERY), $query);
|
|
$token = $query['token'] ?? '';
|
|
if (!preg_match('/^[a-f0-9]{96}$/', $token)) {
|
|
throw new RuntimeException('Der E-Mail-Link enthält kein korrektes Zugriffstoken.');
|
|
}
|
|
if (!verify_ticket_access_token($ticketId, $token)) {
|
|
throw new RuntimeException('Das generierte Zugriffstoken wird nicht akzeptiert.');
|
|
}
|
|
if (verify_ticket_access_token($ticketId, str_repeat('0', 96))) {
|
|
throw new RuntimeException('Ein falsches Zugriffstoken wurde akzeptiert.');
|
|
}
|
|
if (ticket_access_token($ticketId) !== $token) {
|
|
throw new RuntimeException('Das Ticket-Zugriffstoken ist nicht stabil.');
|
|
}
|
|
|
|
if (claim_ticket_for_customer($pdo, $ticketId, ['id' => $otherId, 'email' => 'other@example.test'])) {
|
|
throw new RuntimeException('Ein fremdes Kundenkonto konnte das Ticket beanspruchen.');
|
|
}
|
|
if (!claim_ticket_for_customer($pdo, $ticketId, ['id' => $ownerId, 'email' => 'TICKET-OWNER@example.test'])) {
|
|
throw new RuntimeException('Der berechtigte Kunde konnte das Ticket nicht beanspruchen.');
|
|
}
|
|
|
|
$ownerCheck = $pdo->prepare('SELECT user_id FROM tickets WHERE id = ?');
|
|
$ownerCheck->execute([$ticketId]);
|
|
if ((int) $ownerCheck->fetchColumn() !== $ownerId) {
|
|
throw new RuntimeException('Das Ticket wurde nicht dem richtigen Kundenkonto zugeordnet.');
|
|
}
|
|
|
|
echo "Ticket access integration checks passed.\n";
|
|
} finally {
|
|
putenv($previousDbPath === false ? 'DESKHUB_SQLITE_PATH' : 'DESKHUB_SQLITE_PATH=' . $previousDbPath);
|
|
}
|