286 lines
22 KiB
PHP
286 lines
22 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* Prüft die Rechte über die echte Weboberfläche und die App-Schnittstelle: Jede delegierbare Seite ist mit genau ihrem Recht erreichbar und ohne gesperrt,
|
|
* Bereiche nur für Administratoren bleiben auch mit allen Rechten zu, Menü, Sammelaktionen, Verknüpfen, Teilen, Rollen (keine Hochstufung), App-Schnittstelle.
|
|
*/
|
|
|
|
if (!extension_loaded('pdo_sqlite') || !function_exists('curl_init')) { echo "Abmelde-Web-Test übersprungen: pdo_sqlite oder curl fehlt.\n"; exit(0); }
|
|
|
|
date_default_timezone_set('Europe/Berlin');
|
|
$root = dirname(__DIR__);
|
|
$work = sys_get_temp_dir() . '/deskhub-perm-' . bin2hex(random_bytes(4));
|
|
$tmp = $work . '/inst';
|
|
mkdir($tmp, 0755, true);
|
|
$webPort = random_int(36500, 36999);
|
|
$skip = '#^(config/config\.php|database/[^/]+\.sqlite[^/]*|backups|uploads|tests|plugins/[^/]+|\.git)(/|$)#';
|
|
foreach (new RecursiveIteratorIterator(new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST) as $f) {
|
|
$rel = str_replace(chr(92), '/', substr($f->getPathname(), strlen($root) + 1));
|
|
if (preg_match($skip, $rel) && !preg_match('#^(backups|uploads|plugins)/(\.htaccess|README\.md)$#', $rel)) continue;
|
|
if ($f->isDir()) { @mkdir($tmp . '/' . $rel, 0755, true); continue; }
|
|
@mkdir(dirname($tmp . '/' . $rel), 0755, true);
|
|
copy($f->getPathname(), $tmp . '/' . $rel);
|
|
}
|
|
@mkdir($tmp . '/uploads');
|
|
@mkdir($tmp . '/config');
|
|
file_put_contents($tmp . '/config/config.php', '<?php return ' . var_export([
|
|
'app_key' => bin2hex(random_bytes(32)),
|
|
'db' => ['driver' => 'sqlite', 'sqlite_path' => $tmp . '/database/deskhub.sqlite'],
|
|
'site' => ['name' => 'Test', 'url' => 'http://127.0.0.1', 'admin_email' => 'a@test.de', 'timezone' => 'Europe/Berlin'],
|
|
'uploads' => ['max_size_bytes' => 10485760, 'allowed_extensions' => ['png'], 'path' => $tmp . '/uploads'],
|
|
], true) . ';');
|
|
|
|
putenv('DESKHUB_CONFIG_JSON');
|
|
putenv('DESKHUB_SQLITE_PATH');
|
|
putenv('DESKHUB_TESTING');
|
|
putenv('DESKHUB_API_ALLOW_INSECURE=1');
|
|
require_once $root . '/database/sqlite_schema.php';
|
|
require_once $root . '/database/migrate.php';
|
|
$db = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
|
|
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
|
|
$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
|
|
$db->exec('PRAGMA foreign_keys = ON');
|
|
$db->exec(convert_schema_to_sqlite((string) file_get_contents($root . '/database/schema.sql')));
|
|
run_migrations($db, true);
|
|
$now = date('Y-m-d H:i:s');
|
|
$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn();
|
|
$db->exec('DELETE FROM staff');
|
|
$ins = $db->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)');
|
|
foreach ([['Chef', 'chef@test.de', 'admin'], ['Eva', 'eva@test.de', 'agent'], ['Max', 'max@test.de', 'agent']] as [$n, $e, $r]) {
|
|
$ins->execute([$n, $e, password_hash('Sehr-Sicher-1234', PASSWORD_DEFAULT), $r, $dept, $now]);
|
|
}
|
|
$evaId = (int) $db->query("SELECT id FROM staff WHERE email = 'eva@test.de'")->fetchColumn();
|
|
$db = null;
|
|
|
|
$failures = [];
|
|
$total = 0;
|
|
$check = function (bool $ok, string $what) use (&$failures, &$total): void { $total++; if (!$ok) $failures[] = $what; };
|
|
$webProc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$webPort", '-t', $tmp], [['pipe', 'r'], ['file', $work . '/web.out', 'w'], ['file', $work . '/web.out', 'a']], $wp, $tmp);
|
|
|
|
try {
|
|
for ($i = 0; $i < 50; $i++) { if (@fsockopen('127.0.0.1', $webPort)) break; usleep(100000); }
|
|
$pdo = function () use ($tmp): PDO {
|
|
$p = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite');
|
|
$p->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
|
|
$p->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
|
|
return $p;
|
|
};
|
|
$call = function (string $method, string $path, array $form, string $jar, ?string $bearer = null, ?array $json = null) use ($webPort): array {
|
|
$ch = curl_init("http://127.0.0.1:$webPort$path");
|
|
$h = ['Sec-Fetch-Mode: navigate'];
|
|
if ($json !== null) $h[] = 'Content-Type: application/json';
|
|
if ($bearer) $h[] = 'Authorization: Bearer ' . $bearer;
|
|
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false, CURLOPT_TIMEOUT => 60, CURLOPT_HEADER => true, CURLOPT_HTTPHEADER => $h]);
|
|
if ($jar !== '') { curl_setopt($ch, CURLOPT_COOKIEJAR, $jar); curl_setopt($ch, CURLOPT_COOKIEFILE, $jar); }
|
|
if ($method === 'POST') { curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $json !== null ? json_encode($json) : http_build_query($form)); }
|
|
$raw = (string) curl_exec($ch);
|
|
$s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
|
|
$hs = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
|
|
curl_close($ch);
|
|
return [$s, substr($raw, $hs), substr($raw, 0, $hs)];
|
|
};
|
|
$login = function (string $email) use ($call): string {
|
|
$jar = tempnam(sys_get_temp_dir(), 'sow');
|
|
[, $lp] = $call('GET', '/staff/login.php', [], $jar);
|
|
preg_match('/name="csrf_token" value="([a-f0-9]+)"/', $lp, $m);
|
|
$call('POST', '/staff/login.php', ['csrf_token' => $m[1] ?? '', 'email' => $email, 'password' => 'Sehr-Sicher-1234'], $jar);
|
|
return $jar;
|
|
};
|
|
$csrf = function (string $path, string $jar) use ($call): string {
|
|
[, $p] = $call('GET', $path, [], $jar);
|
|
preg_match('/name="csrf_token" value="([a-f0-9]+)"/', $p, $mm);
|
|
return $mm[1] ?? '';
|
|
};
|
|
$loggedIn = function (string $jar) use ($call): bool {
|
|
[$s, $b] = $call('GET', '/staff/profile.php?tab=security', [], $jar);
|
|
return $s === 200 && str_contains($b, 'Von allen Geräten abmelden');
|
|
};
|
|
$apiToken = function (string $email) use ($call): string {
|
|
[, $b] = $call('POST', '/api/staff/v1/login.php', [], '', null, ['email' => $email, 'password' => 'Sehr-Sicher-1234', 'deviceName' => 'Test-Gerät']);
|
|
return (string) (json_decode($b, true)['token'] ?? '');
|
|
};
|
|
$apiOk = fn(string $tok) => $call('GET', '/api/staff/v1/me.php', [], '', $tok)[0];
|
|
|
|
require_once $root . '/includes/permissions.php';
|
|
$all = array_keys(permission_labels());
|
|
$maxId = (int) $pdo()->query("SELECT id FROM staff WHERE email = 'max@test.de'")->fetchColumn();
|
|
$evaId = (int) $pdo()->query("SELECT id FROM staff WHERE email = 'eva@test.de'")->fetchColumn();
|
|
$none = array_fill_keys($all, false);
|
|
// Max bekommt eine Rolle mit genau diesen Rechten (Rolle wird wiederverwendet)
|
|
$setRole = function (array $on, string $who = 'max@test.de') use ($pdo, $none): void {
|
|
$p = $pdo();
|
|
$perms = array_merge($none, array_fill_keys($on, true));
|
|
$rid = (int) $p->query("SELECT id FROM roles WHERE name = 'T-" . ($who === 'max@test.de' ? 'Max' : 'Eva') . "'")->fetchColumn();
|
|
if (!$rid) { $p->prepare("INSERT INTO roles (name, permissions, is_active, created_at, updated_at) VALUES (?,?,1,?,?)")->execute(['T-' . ($who === 'max@test.de' ? 'Max' : 'Eva'), '{}', date('Y-m-d H:i:s'), date('Y-m-d H:i:s')]); $rid = (int) $p->lastInsertId(); }
|
|
$p->prepare('UPDATE roles SET permissions = ? WHERE id = ?')->execute([json_encode($perms), $rid]);
|
|
$p->prepare('UPDATE staff SET role_id = ? WHERE email = ?')->execute([$rid, $who]);
|
|
};
|
|
$only = fn(string ...$k) => $k;
|
|
$allExcept = fn(string $k) => array_values(array_diff($all, [$k]));
|
|
$jarChef = $login('chef@test.de');
|
|
$jarMax = $login('max@test.de');
|
|
|
|
// ── Seiten: mit genau dem Recht ja, ohne dieses Recht (alle anderen an) nein ───────────────
|
|
$pages = [
|
|
['/staff/canned_responses.php', 'manage_canned'], ['/staff/custom_fields.php', 'manage_custom_fields'], ['/staff/custom_lists.php', 'manage_custom_fields'],
|
|
['/staff/ticket_templates.php', 'manage_ticket_templates'], ['/staff/ticket_rules.php', 'manage_automation'], ['/staff/recurring_tickets.php', 'manage_automation'],
|
|
['/staff/site_pages.php', 'manage_site_pages'], ['/staff/languages.php', 'manage_languages'], ['/staff/status_page.php', 'manage_status_page'],
|
|
['/staff/mail_queue.php', 'view_mail_queue'], ['/staff/login_log.php', 'view_login_guard'], ['/staff/problems.php', 'manage_problems'], ['/staff/help.php', 'view_help'],
|
|
['/staff/export.php?type=tickets', 'export_tickets'], ['/staff/customers.php', 'manage_customers'], ['/staff/banlist.php', 'manage_banlist'],
|
|
['/staff/departments.php', 'manage_departments'], ['/staff/staff_manage.php', 'manage_staff'], ['/staff/roles.php', 'manage_roles'], ['/staff/audit_log.php', 'view_audit_log'],
|
|
];
|
|
foreach ($pages as [$url, $perm]) {
|
|
$setRole($only($perm));
|
|
[$s] = $call('GET', $url, [], $jarMax);
|
|
$with = $s;
|
|
$setRole($allExcept($perm));
|
|
[$s2] = $call('GET', $url, [], $jarMax);
|
|
$check($with === 200 && $s2 === 302, "{$url}: mit „{$perm}“ erreichbar (HTTP {$with}), ohne dieses Recht gesperrt (HTTP {$s2})");
|
|
}
|
|
// Nur für echte Administratoren: auch mit allen Rechten gesperrt
|
|
$setRole($all);
|
|
foreach (['settings.php', 'backup.php', 'update.php', 'plugins.php', 'api_keys.php', 'webhooks.php', 'import_osticket.php', 'security_check.php'] as $f) {
|
|
[$s] = $call('GET', '/staff/' . $f, [], $jarMax);
|
|
$check($s === 302, "/staff/{$f}: bleibt echten Administratoren vorbehalten, auch mit allen Rechten (HTTP {$s})");
|
|
[$s] = $call('GET', '/staff/' . $f, [], $jarChef);
|
|
$check($s === 200, "/staff/{$f}: Administrator kommt hinein (HTTP {$s})");
|
|
}
|
|
|
|
// ── Menü ──────────────────────────────────────────────────────────────────────
|
|
$setRole($only('manage_custom_fields'));
|
|
[, $nav] = $call('GET', '/staff/profile.php', [], $jarMax);
|
|
$check(str_contains($nav, 'href="/staff/custom_fields.php"') && str_contains($nav, 'id="admin-block"') && !str_contains($nav, 'href="/staff/api_keys.php"') && !str_contains($nav, 'href="/staff/canned_responses.php"') && !str_contains($nav, 'href="/staff/help.php"') && !str_contains($nav, 'href="/staff/banlist.php"'), 'Menü zeigt nur, wofür das Recht da ist');
|
|
$setRole([]);
|
|
[, $nav] = $call('GET', '/staff/profile.php', [], $jarMax);
|
|
$check(!str_contains($nav, 'id="admin-block"'), 'Ohne Adminportal-Rechte gibt es das Adminportal im Menü nicht');
|
|
$setRole($all);
|
|
[, $nav] = $call('GET', '/staff/profile.php', [], $jarMax);
|
|
$check(!str_contains($nav, 'href="/staff/api_keys.php"') && !str_contains($nav, 'href="/staff/settings.php"') && str_contains($nav, 'href="/staff/help.php"'), 'Auch mit allen Rechten fehlen die Administrator-Bereiche im Menü');
|
|
|
|
// ── Aktionen ──────────────────────────────────────────────────────────────────
|
|
$p = $pdo();
|
|
$dept = (int) $p->query('SELECT department_id FROM staff WHERE id = ' . $maxId)->fetchColumn();
|
|
$prio = (int) $p->query('SELECT id FROM priorities ORDER BY id LIMIT 1')->fetchColumn();
|
|
$mk = function (string $n) use ($pdo, $dept, $prio): int {
|
|
$q = $pdo(); $now = date('Y-m-d H:i:s');
|
|
$q->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?)')->execute([$n, 'Betreff ' . $n, 'K', 'k@example.org', $dept, $prio, 'open', 'web', $now, $now]);
|
|
return (int) $q->lastInsertId();
|
|
};
|
|
$exists = fn(int $id) => (int) $pdo()->query("SELECT COUNT(*) FROM tickets WHERE id = {$id}")->fetchColumn() === 1;
|
|
// Sammelaktion „Löschen“
|
|
$t1 = $mk('P-1'); $t2 = $mk('P-2');
|
|
$setRole(array_values(array_diff($all, ['delete_ticket'])));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'bulk_action' => 'delete', 'ticket_ids' => [$t1]], $jarMax);
|
|
$check($exists($t1), 'Sammelaktion „Löschen“ ohne das Recht löscht nichts');
|
|
$setRole($only('delete_ticket'));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'bulk_action' => 'delete', 'ticket_ids' => [$t1]], $jarMax);
|
|
$check(!$exists($t1), 'Mit dem Recht „Tickets löschen“ wird gelöscht');
|
|
// Sammelaktion „Absender sperren“
|
|
$t3 = $mk('P-3');
|
|
$setRole($allExcept('manage_banlist'));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'bulk_action' => 'ban', 'ticket_ids' => [$t3]], $jarMax);
|
|
$check((int) $pdo()->query("SELECT COUNT(*) FROM banlist")->fetchColumn() === 0, 'Absender sperren ohne das Recht: nichts gesperrt');
|
|
$setRole($only('manage_banlist', 'close_ticket'));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'bulk_action' => 'ban', 'ticket_ids' => [$t3]], $jarMax);
|
|
$check((int) $pdo()->query("SELECT COUNT(*) FROM banlist")->fetchColumn() >= 1, 'Mit den Rechten wird gesperrt');
|
|
// Sammelaktion „Zuweisen“
|
|
$t4 = $mk('P-4');
|
|
$setRole($allExcept('assign_ticket'));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'bulk_action' => 'assign', 'ticket_ids' => [$t4], 'bulk_assigned_staff_id' => (string) $evaId], $jarMax);
|
|
$check($pdo()->query("SELECT assigned_staff_id FROM tickets WHERE id = {$t4}")->fetchColumn() === null, 'Zuweisen per Sammelaktion ohne das Recht: unverändert');
|
|
$setRole($only('assign_ticket'));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'bulk_action' => 'assign', 'ticket_ids' => [$t4], 'bulk_assigned_staff_id' => (string) $evaId], $jarMax);
|
|
$check((int) $pdo()->query("SELECT assigned_staff_id FROM tickets WHERE id = {$t4}")->fetchColumn() === $evaId, 'Mit dem Recht wird zugewiesen');
|
|
// Verknüpfen
|
|
$links = fn() => (int) $pdo()->query('SELECT COUNT(*) FROM ticket_links')->fetchColumn();
|
|
$setRole($allExcept('link_tickets'));
|
|
$tok = $csrf('/staff/ticket_view.php?n=P-2', $jarMax);
|
|
$call('POST', '/staff/ticket_view.php?n=P-2', ['csrf_token' => $tok, 'action' => 'link_add', 'link_number' => 'P-4', 'link_type' => 'related'], $jarMax);
|
|
$check($links() === 0, 'Verknüpfen ohne das Recht: keine Verknüpfung');
|
|
$setRole($only('link_tickets'));
|
|
$tok = $csrf('/staff/ticket_view.php?n=P-2', $jarMax);
|
|
$call('POST', '/staff/ticket_view.php?n=P-2', ['csrf_token' => $tok, 'action' => 'link_add', 'link_number' => 'P-4', 'link_type' => 'related'], $jarMax);
|
|
[, $lv] = $call('GET', '/staff/ticket_view.php?n=P-2', [], $jarMax);
|
|
$check($links() === 1, 'Mit dem Recht wird verknüpft (' . (preg_match('#class="flash [a-z]+"[^>]*>([^<]+)#', $lv, $mm) ? trim($mm[1]) : 'keine Meldung') . ')');
|
|
// Ansicht teilen
|
|
$setRole($allExcept('share_views'));
|
|
$tok = $csrf('/staff/tickets.php', $jarMax);
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'queue_action' => 'save', 'queue_name' => 'Nicht geteilt', 'queue_shared' => '1', 'return_query' => ''], $jarMax);
|
|
$setRole($only('share_views'));
|
|
$call('POST', '/staff/tickets.php', ['csrf_token' => $tok, 'queue_action' => 'save', 'queue_name' => 'Geteilt', 'queue_shared' => '1', 'return_query' => ''], $jarMax);
|
|
$sh = $pdo()->query("SELECT name, is_shared FROM saved_queues ORDER BY id")->fetchAll(PDO::FETCH_KEY_PAIR);
|
|
$check(($sh['Nicht geteilt'] ?? null) == 0 && ($sh['Geteilt'] ?? null) == 1, 'Ansichten teilen nur mit dem Recht ' . json_encode($sh));
|
|
// Anmelde-Wächter: Ansehen ja, Einstellungen nur Administrator
|
|
$setRole($only('view_login_guard'));
|
|
$tok = $csrf('/staff/login_log.php', $jarMax);
|
|
$call('POST', '/staff/login_log.php', ['csrf_token' => $tok, 'action' => 'save', 'login_guard' => '1', 'login_guard_max_attempts' => '9'], $jarMax);
|
|
$check((string) $pdo()->query("SELECT setting_value FROM settings WHERE setting_key = 'login_guard_max_attempts'")->fetchColumn() !== '9', 'Anmelde-Wächter: Einstellungen ändern bleibt Administratoren vorbehalten');
|
|
// Hochstufen über Rollen verhindern
|
|
$setRole($only('manage_roles'));
|
|
$tok = $csrf('/staff/roles.php', $jarMax);
|
|
$call('POST', '/staff/roles.php', ['csrf_token' => $tok, 'action' => 'create', 'name' => 'Hochstufung', 'status' => 'active', 'perm_manage_roles' => '1', 'perm_delete_ticket' => '1', 'perm_manage_staff' => '1'], $jarMax);
|
|
$r = json_decode((string) $pdo()->query("SELECT permissions FROM roles WHERE name = 'Hochstufung'")->fetchColumn(), true) ?: [];
|
|
$check(($r['manage_roles'] ?? false) === true && ($r['delete_ticket'] ?? true) === false && ($r['manage_staff'] ?? true) === false, 'Ein Co-Admin kann keine Rechte vergeben, die er selbst nicht hat');
|
|
$tok = $csrf('/staff/roles.php', $jarChef);
|
|
$call('POST', '/staff/roles.php', ['csrf_token' => $tok, 'action' => 'create', 'name' => 'Vom Admin', 'status' => 'active', 'perm_manage_staff' => '1', 'perm_delete_ticket' => '1'], $jarChef);
|
|
$r = json_decode((string) $pdo()->query("SELECT permissions FROM roles WHERE name = 'Vom Admin'")->fetchColumn(), true) ?: [];
|
|
$check(($r['manage_staff'] ?? false) === true && ($r['delete_ticket'] ?? false) === true && count($r) === count($all), 'Ein Administrator kann jedes Recht vergeben; alle Rechte werden gespeichert');
|
|
[, $rolesPage] = $call('GET', '/staff/roles.php', [], $jarChef);
|
|
$check(str_contains($rolesPage, 'Rechte-Übersicht') && str_contains($rolesPage, 'Vom Admin'), 'Rollen-Seite: Rechte-Übersicht mit den Rollen');
|
|
[, $form] = $call('GET', '/staff/roles.php?new=1', [], $jarChef);
|
|
$check(str_contains($form, 'Vorlage laden') && str_contains($form, 'data-preset="support_manager"') && str_contains($form, 'Tickets zusammenführen und teilen') && str_contains($form, 'name="perm_view_help"'), 'Rollen-Formular: Vorlagen, Gruppen und neue Rechte');
|
|
|
|
// Vordefinierte Rollen: Kennzeichnung, Knopf für fehlende, nur Administratoren legen an
|
|
[, $rp] = $call('GET', '/staff/roles.php', [], $jarChef);
|
|
$check(str_contains($rp, 'vordefiniert') && str_contains($rp, 'Co-Administrator') && str_contains($rp, 'IT / Technik') && !str_contains($rp, 'Fehlende Rollen anlegen'), 'Rollen-Seite: vordefinierte Rollen sind gekennzeichnet, nichts fehlt');
|
|
$pdo()->exec("DELETE FROM roles WHERE name = 'Aushilfe / Praktikant'");
|
|
[, $rp] = $call('GET', '/staff/roles.php', [], $jarChef);
|
|
$check(str_contains($rp, 'Fehlende Rollen anlegen') && str_contains($rp, 'Aushilfe / Praktikant'), 'Rollen-Seite: fehlende vordefinierte Rolle wird angeboten');
|
|
$setRole($only('manage_roles'));
|
|
$tok = $csrf('/staff/roles.php', $jarMax);
|
|
$call('POST', '/staff/roles.php', ['csrf_token' => $tok, 'action' => 'seed_defaults'], $jarMax);
|
|
$check((int) $pdo()->query("SELECT COUNT(*) FROM roles WHERE name = 'Aushilfe / Praktikant'")->fetchColumn() === 0, 'Ein Co-Admin kann vordefinierte Rollen nicht anlegen');
|
|
$tok = $csrf('/staff/roles.php', $jarChef);
|
|
$call('POST', '/staff/roles.php', ['csrf_token' => $tok, 'action' => 'seed_defaults'], $jarChef);
|
|
$check((int) $pdo()->query("SELECT COUNT(*) FROM roles WHERE name = 'Aushilfe / Praktikant'")->fetchColumn() === 1, 'Administrator legt die fehlende Rolle wieder an');
|
|
|
|
// ── App-Schnittstelle ─────────────────────────────────────────────────────────
|
|
$setRole($allExcept('fetch_mail'));
|
|
$tokMax = $apiToken('max@test.de');
|
|
[$s, $b] = $call('GET', '/api/staff/v1/me.php', [], '', $tokMax);
|
|
$perm = json_decode($b, true)['staff']['permissions'] ?? [];
|
|
$check($s === 200 && array_key_exists('merge_split_ticket', $perm) && $perm['fetch_mail'] === false && $perm['view_help'] === true && count($perm) === count($all), 'App-Schnittstelle liefert alle Rechte (' . count($perm) . ')');
|
|
[$s] = $call('POST', '/api/staff/v1/mail_fetch.php', [], '', $tokMax, []);
|
|
$check($s === 403, 'App: E-Mail-Abruf ohne das Recht: 403 (HTTP ' . $s . ')');
|
|
$setRole($only('manage_roles'));
|
|
[$s, $b] = $call('GET', '/api/staff/v1/roles.php', [], '', $tokMax);
|
|
$rj = json_decode($b, true) ?: [];
|
|
$check($s === 200 && count($rj['permissionKeys'] ?? []) === count($all) && isset($rj['permissionLabels']['view_help']) && count($rj['permissionGroups'] ?? []) === 7, 'App: Rollen-Schnittstelle liefert alle Rechte, Beschriftungen und Gruppen');
|
|
$firstRole = $rj['items'][0] ?? [];
|
|
$check(count($firstRole['effectivePermissions'] ?? []) === count($all) && array_key_exists('merge_split_ticket', $firstRole['effectivePermissions'] ?? []), 'App: jede Rolle liefert die wirksamen Rechte (fehlende mit Standardwert)');
|
|
// Eine ältere App schickt neue Rechte nicht mit: sie bleiben unverändert
|
|
$rid = (int) $pdo()->query("SELECT id FROM roles WHERE name = 'Vom Admin'")->fetchColumn();
|
|
$tokChef = $apiToken('chef@test.de');
|
|
$call('POST', '/api/staff/v1/roles.php', [], '', $tokChef, ['action' => 'save', 'id' => $rid, 'name' => 'Vom Admin', 'permissions' => ['reply_ticket' => false, 'manage_staff' => true]]);
|
|
$r = json_decode((string) $pdo()->query("SELECT permissions FROM roles WHERE id = {$rid}")->fetchColumn(), true) ?: [];
|
|
$check($r['reply_ticket'] === false && $r['manage_staff'] === true && $r['delete_ticket'] === true, 'Ältere App: nicht mitgeschickte Rechte bleiben unverändert');
|
|
foreach ([$jarChef, $jarMax] as $j) @unlink($j);
|
|
} finally {
|
|
if (is_resource($webProc)) { proc_terminate($webProc); proc_close($webProc); }
|
|
$rm = function (string $d) use (&$rm): void { foreach (glob($d . '/{,.}*', GLOB_BRACE) ?: [] as $e) { $b = basename($e); if ($b === '.' || $b === '..') continue; is_dir($e) ? $rm($e) : @unlink($e); } @rmdir($d); };
|
|
$rm($work);
|
|
}
|
|
|
|
if ($failures) {
|
|
fwrite(STDERR, "Fehlgeschlagen:\n - " . implode("\n - ", $failures) . "\n");
|
|
exit(1);
|
|
}
|
|
echo "Permission web checks passed ({$total} Prüfungen).\n";
|