core/php-tenant
8
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
16 commits 2 branches 0 tags 368 KiB
Commit graph

8 commits

Author SHA1 Message Date
Snider
7b5114dce6 test(api): add comprehensive integration tests for EntitlementApiController (P2-022) 
Add HTTP-level integration tests covering all API endpoints:

Cross-App Entitlement API:
- GET /api/v1/entitlements/check - authentication, validation, entitlement checks
- POST /api/v1/entitlements/usage - usage recording with metadata
- GET /api/v1/entitlements/summary - workspace summary

Blesta Provisioning API:
- POST /api/provisioning/entitlements (store) - user/workspace creation
- GET /api/provisioning/entitlements/{id} (show) - entitlement details
- POST suspend/unsuspend/cancel/renew - lifecycle operations

Also tests error responses, validation failures, and rate limit attribute.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 18:50:47 +00:00
Snider
adad6a1f47 perf(entitlements): optimise cache invalidation with tags (P2-023) 
Add O(1) cache invalidation using cache tags for Redis/Memcached,
replacing O(n) feature iteration. Key improvements:

- Cache tags for workspace/namespace scoping (entitlement:ws:{id})
- Granular invalidation: invalidateUsageCache(), invalidateLimitCache()
- Event-driven cache management via EntitlementCacheInvalidated event
- Fallback to O(n) for non-taggable stores (file, database)
- recordUsage() now invalidates only the affected feature's cache

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 18:44:50 +00:00
Snider
a067453a6a test(entitlements): add namespace-level entitlement tests (P2-021) 
Add comprehensive Pest tests for namespace-level entitlements including:
- canForNamespace() with user-owned and workspace-owned namespaces
- Entitlement cascade (namespace -> workspace -> user tier)
- provisionNamespacePackage() with replacement, expiry, metadata
- provisionNamespaceBoost() with stacking and unlimited overrides
- recordNamespaceUsage() with metadata and workspace context
- getNamespaceUsageSummary() with percentages and near-limit detection
- invalidateNamespaceCache() for limits and usage
- Multiple namespaces with separate usage tracking
- Boost stacking behaviour

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 18:41:24 +00:00
Snider
67b5b14b8e perf: add database indexes for common queries (P2-024) 
Add migration with performance indexes for frequently queried columns:
- users.tier for tier-based queries
- namespaces.slug for slug lookups
- workspaces.is_active, type, domain for common filters
- user_workspace.team_id foreign key
- entitlement_usage_records.user_id foreign key
- entitlement_logs.user_id foreign key

Resolves PERF-002 from TODO.md.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 16:17:06 +00:00
Snider
5197094bd6 docs: add comprehensive PHPDoc to EntitlementService (P2-020) 
- Document provisionNamespacePackage with examples
- Document provisionNamespaceBoost with boost/duration types
- Document invalidateNamespaceCache with auto-invalidation triggers
- Add cross-references to workspace-level equivalents

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 15:39:21 +00:00
Snider
501ea1897e chore: add strict types to core files (P2-019) 
- Add declare(strict_types=1) to Workspace.php
- Add declare(strict_types=1) to User.php
- Add declare(strict_types=1) to EntitlementService.php

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 15:16:10 +00:00
Snider
8a521d4f3e security: fix P1 items for rate limiting, auth, SSRF and workspace validation 
P1-010: Rate limiting (60 req/min) on EntitlementApiController
P1-011: API authentication documentation and middleware
P1-014: SSRF protection for webhook endpoints (PreventsSSRF trait)
P1-015: Workspace access validation in middleware (breaking change)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 13:19:27 +00:00
Snider
a35cbc9306 security: encrypt 2FA secrets and hash invitation tokens 
- Add encrypted cast to UserTwoFactorAuth secret and recovery_codes
- Hash invitation tokens on creation using Hash::make()
- Update token verification to use Hash::check()
- Add migration commands for existing data:
  - security:encrypt-2fa-secrets
  - security:hash-invitation-tokens
- Add tests for encryption and hashing

Fixes SEC-003, SEC-004 from security audit.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 12:20:53 +00:00