280 lines
13 KiB
PHP
280 lines
13 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\SuiteCrm;
|
|
|
|
use App\Integrations\SuiteCrm\SuiteCrmClient;
|
|
use App\Integrations\SuiteCrm\SuiteCrmException;
|
|
use Carbon\CarbonInterval;
|
|
use Illuminate\Http\Client\Request;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Facades\Crypt;
|
|
use Illuminate\Support\Facades\Http;
|
|
use Illuminate\Support\Facades\Log;
|
|
use Illuminate\Support\Sleep;
|
|
use Tests\TestCase;
|
|
|
|
class SuiteCrmClientTest extends TestCase
|
|
{
|
|
private SuiteCrmClient $client;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
config(['suitecrm.enabled' => true, 'suitecrm.base_url' => 'https://crm.example.invalid/legacy',
|
|
'suitecrm.client_id' => 'test-client', 'suitecrm.client_secret' => 'secret-not-for-logs',
|
|
'suitecrm.cache_store' => 'array', 'suitecrm.retry_delay_ms' => 0]);
|
|
Cache::store('array')->flush();
|
|
Http::preventStrayRequests();
|
|
Log::spy();
|
|
Sleep::fake();
|
|
$this->client = new SuiteCrmClient;
|
|
}
|
|
|
|
private function tokenResponse(string $token = 'test-token'): array
|
|
{
|
|
return ['access_token' => $token, 'token_type' => 'Bearer', 'expires_in' => 3600];
|
|
}
|
|
|
|
private function tokenKey(): string
|
|
{
|
|
return 'suitecrm:'.hash('sha256', 'https://crm.example.invalid/legacy|test-client|secret-not-for-logs').':token';
|
|
}
|
|
|
|
public function test_disabled_client_and_insecure_configuration_never_send_requests(): void
|
|
{
|
|
Http::fake();
|
|
config(['suitecrm.enabled' => false]);
|
|
try {
|
|
$this->client->find('Contacts', 'contact-1');
|
|
$this->fail('Expected disabled client');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame('disabled', $e->reason);
|
|
}
|
|
config(['suitecrm.enabled' => true]);
|
|
foreach (['http://crm.example.invalid', 'https://user:pass@crm.example.invalid', 'https://crm.example.invalid?token=secret'] as $url) {
|
|
config(['suitecrm.base_url' => $url]);
|
|
try {
|
|
$this->client->find('Contacts', 'contact-1');
|
|
$this->fail('Expected URL rejection');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame('invalid_base_url', $e->reason);
|
|
}
|
|
}
|
|
Http::assertNothingSent();
|
|
}
|
|
|
|
public function test_authentication_contract_and_token_cache_are_encrypted(): void
|
|
{
|
|
Http::fake([
|
|
'*/Api/access_token' => Http::response($this->tokenResponse()),
|
|
'*/Api/V8/module/Contacts/contact-1' => Http::response(['data' => ['id' => 'contact-1', 'type' => 'Contacts']]),
|
|
]);
|
|
$this->client->find('Contacts', 'contact-1');
|
|
$this->client->find('Contacts', 'contact-1');
|
|
Http::assertSentCount(3);
|
|
Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/Api/access_token') && $r['grant_type'] === 'client_credentials'
|
|
&& $r['client_id'] === 'test-client' && $r['client_secret'] === 'secret-not-for-logs');
|
|
Http::assertSent(fn (Request $r) => str_contains($r->url(), '/Api/V8/') && $r->hasHeader('Authorization', 'Bearer test-token'));
|
|
$encrypted = Cache::store('array')->get($this->tokenKey());
|
|
$this->assertNotSame('test-token', $encrypted);
|
|
$this->assertSame('test-token', Crypt::decryptString($encrypted));
|
|
}
|
|
|
|
public function test_401_renews_once_and_replays_the_unauthorised_request(): void
|
|
{
|
|
Http::fake([
|
|
'*/Api/access_token' => Http::sequence()->push($this->tokenResponse('old'))->push($this->tokenResponse('new')),
|
|
'*/Api/V8/*' => Http::sequence()->push([], 401)->push(['data' => ['id' => 'contact-1']]),
|
|
]);
|
|
$result = $this->client->find('Contacts', 'contact-1');
|
|
$this->assertSame('contact-1', $result['data']['id']);
|
|
Http::assertSentCount(4);
|
|
Http::assertSent(fn (Request $r) => $r->hasHeader('Authorization', 'Bearer new'));
|
|
}
|
|
|
|
public function test_second_401_is_not_retried(): void
|
|
{
|
|
Http::fake([
|
|
'*/Api/access_token' => Http::response($this->tokenResponse()),
|
|
'*/Api/V8/*' => Http::response(['errors' => [['detail' => 'personal@example.invalid']]], 401),
|
|
]);
|
|
try {
|
|
$this->client->find('Contacts', 'contact-1');
|
|
$this->fail('Expected authentication failure');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame('unauthenticated', $e->reason);
|
|
$this->assertFalse($e->retryable);
|
|
$this->assertStringNotContainsString('personal@', $e->getMessage());
|
|
$this->assertNull($e->getPrevious());
|
|
}
|
|
Http::assertSentCount(4);
|
|
}
|
|
|
|
public function test_json_api_create_update_relationship_and_exact_search_contracts(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()), '*' => Http::response(['data' => ['id' => 'record-1']])]);
|
|
$this->client->create('Accounts', ['name' => 'Example']);
|
|
$this->client->update('Accounts', 'account-1', ['name' => 'Revised']);
|
|
$this->client->relate('Accounts', 'account-1', 'contacts', 'Contacts', 'contact-1');
|
|
$this->client->search('Contacts', ['email1' => 'person@example.invalid'], 2, 10);
|
|
Http::assertSent(fn (Request $r) => $r->method() === 'POST' && str_ends_with($r->url(), '/V8/module')
|
|
&& $r['data'] === ['type' => 'Accounts', 'attributes' => ['name' => 'Example']]);
|
|
Http::assertSent(fn (Request $r) => $r->method() === 'PATCH' && $r['data']['id'] === 'account-1');
|
|
Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/Accounts/account-1/relationships/contacts') && $r['data'] === ['type' => 'Contacts', 'id' => 'contact-1']);
|
|
Http::assertSent(fn (Request $r) => $r->method() === 'GET' && $r['filter']['email1']['eq'] === 'person@example.invalid' && $r['page']['number'] === 2);
|
|
}
|
|
|
|
public function test_read_retries_transient_failures_but_create_does_not(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()),
|
|
'*/Api/V8/*' => Http::sequence()->push([], 503)->push([], 503)->push(['data' => []])->push([], 503)]);
|
|
$this->assertSame(['data' => []], $this->client->search('Contacts', []));
|
|
try {
|
|
$this->client->create('Leads', ['last_name' => 'Example']);
|
|
$this->fail('Expected uncertain write');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertTrue($e->outcomeUnknown);
|
|
$this->assertSame(503, $e->httpStatus);
|
|
}
|
|
Http::assertSentCount(5);
|
|
}
|
|
|
|
public function test_write_timeout_is_not_replayed_and_transport_exception_is_not_retained(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()), '*/Api/V8/*' => Http::failedConnection('secret-not-for-logs')]);
|
|
try {
|
|
$this->client->create('Leads', ['last_name' => 'Private Name']);
|
|
$this->fail('Expected transport failure');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertTrue($e->outcomeUnknown);
|
|
$this->assertSame('transport_failure', $e->reason);
|
|
$this->assertNull($e->getPrevious());
|
|
$this->assertStringNotContainsString('secret-not-for-logs', $e->getMessage());
|
|
}
|
|
Log::shouldHaveReceived('info')->with('suitecrm.http', \Mockery::on(fn ($context) => array_keys($context) === ['operation', 'status', 'duration_ms']))->twice();
|
|
}
|
|
|
|
public function test_retry_after_is_returned_without_immediate_retry_for_long_delays(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()), '*/Api/V8/*' => Http::response([], 429, ['Retry-After' => '120'])]);
|
|
try {
|
|
$this->client->search('Contacts', []);
|
|
$this->fail('Expected rate limit');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame(120, $e->retryAfter);
|
|
$this->assertSame('rate_limited', $e->reason);
|
|
}
|
|
Http::assertSentCount(2);
|
|
}
|
|
|
|
public function test_circuit_opens_then_allows_recovery_after_cooldown(): void
|
|
{
|
|
config(['suitecrm.circuit_threshold' => 1, 'suitecrm.read_retries' => 0]);
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()),
|
|
'*/Api/V8/*' => Http::sequence()->push([], 503)->push(['data' => []])]);
|
|
foreach (['unavailable', 'circuit_open'] as $expected) {
|
|
try {
|
|
$this->client->search('Contacts', []);
|
|
$this->fail('Expected circuit failure');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame($expected, $e->reason);
|
|
}
|
|
}
|
|
Http::assertSentCount(2);
|
|
$this->travel(61)->seconds();
|
|
$this->assertSame(['data' => []], $this->client->search('Contacts', []));
|
|
Http::assertSentCount(3);
|
|
}
|
|
|
|
public function test_identifiers_modules_and_page_limits_are_rejected_before_network(): void
|
|
{
|
|
Http::fake();
|
|
foreach ([fn () => $this->client->find('Users', '1'), fn () => $this->client->find('Contacts', '../Accounts'),
|
|
fn () => $this->client->search('Contacts', [], 1, 1000)] as $operation) {
|
|
try {
|
|
$operation();
|
|
$this->fail('Expected rejection');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertContains($e->reason, ['module_not_allowed', 'invalid_identifier', 'invalid_pagination']);
|
|
}
|
|
}
|
|
Http::assertNothingSent();
|
|
}
|
|
|
|
public function test_invalid_token_response_and_redirect_are_rejected(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::sequence()->push(['access_token' => 'secret', 'expires_in' => 0])->push($this->tokenResponse()),
|
|
'*/Api/V8/*' => Http::response('', 302, ['Location' => 'https://untrusted.example.invalid'])]);
|
|
try {
|
|
$this->client->find('Contacts', 'contact-1');
|
|
$this->fail('Expected invalid token');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame('invalid_token_response', $e->reason);
|
|
}
|
|
try {
|
|
$this->client->find('Contacts', 'contact-1');
|
|
$this->fail('Expected redirect rejection');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame('unexpected_status', $e->reason);
|
|
$this->assertSame(302, $e->httpStatus);
|
|
}
|
|
}
|
|
|
|
public function test_token_expiration_and_credential_rotation_obtain_new_tokens(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::sequence()->push($this->tokenResponse('first'))
|
|
->push($this->tokenResponse('renewed'))->push($this->tokenResponse('rotated')),
|
|
'*/Api/V8/*' => Http::response(['data' => []])]);
|
|
$this->client->search('Contacts', []);
|
|
$this->travel(3601)->seconds();
|
|
$this->client->search('Contacts', []);
|
|
config(['suitecrm.client_secret' => 'rotated-secret']);
|
|
$this->client->search('Contacts', []);
|
|
Http::assertSentCount(6);
|
|
Http::assertSent(fn (Request $r) => $r->hasHeader('Authorization', 'Bearer rotated'));
|
|
}
|
|
|
|
public function test_forbidden_and_invalid_input_responses_are_permanent_and_sanitised(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()),
|
|
'*/Api/V8/*' => Http::sequence()->push(['errors' => [['detail' => 'private@example.invalid']]], 403)
|
|
->push(['errors' => [['detail' => 'Private Name']]], 422)]);
|
|
foreach (['forbidden', 'validation_failed'] as $reason) {
|
|
try {
|
|
$this->client->create('Contacts', ['last_name' => 'Private Name']);
|
|
$this->fail('Expected permanent failure');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame($reason, $e->reason);
|
|
$this->assertFalse($e->retryable);
|
|
$this->assertFalse($e->outcomeUnknown);
|
|
$this->assertNull($e->getPrevious());
|
|
}
|
|
}
|
|
Http::assertSentCount(3);
|
|
}
|
|
|
|
public function test_a_malformed_successful_write_is_treated_as_ambiguous(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()), '*/Api/V8/*' => Http::response('<html>Private data</html>', 200)]);
|
|
try {
|
|
$this->client->create('Contacts', ['last_name' => 'Private Name']);
|
|
$this->fail('Expected invalid response');
|
|
} catch (SuiteCrmException $e) {
|
|
$this->assertSame('invalid_response', $e->reason);
|
|
$this->assertTrue($e->outcomeUnknown);
|
|
}
|
|
Http::assertSentCount(2);
|
|
}
|
|
|
|
public function test_retry_after_short_delay_is_respected_and_logs_have_no_payload(): void
|
|
{
|
|
Http::fake(['*/Api/access_token' => Http::response($this->tokenResponse()),
|
|
'*/Api/V8/*' => Http::sequence()->push([], 429, ['Retry-After' => '2'])->push(['data' => []])]);
|
|
$this->client->search('Contacts', ['email1' => 'private@example.invalid']);
|
|
Sleep::assertSlept(function (CarbonInterval $duration) {
|
|
return $duration->totalMilliseconds >= 2000;
|
|
});
|
|
Log::shouldHaveReceived('info')->with('suitecrm.http', \Mockery::on(fn ($context) => array_keys($context) === ['operation', 'status', 'duration_ms']))->times(3);
|
|
}
|
|
}
|