9a0ff1fc5e
The event list was hard-capped at the newest 100 with no way to reach
older events. Adds keyset pagination:
- EventRepository::page(limit, severity, beforeTs, beforeId) on both the
PDO and in-memory implementations, ordered (occurred_at DESC,
event_id DESC). The cursor is the last row's (occurred_at, event_id),
so pages stay stable as new events arrive at the head — no overlap, no
skips. occurred_at is bound as a string in SQL to keep DECIMAL
precision.
- EventListController reads `limit` (default 50, capped 200) and `cursor`
("occurred_at:event_id", malformed input ignored) and returns
`next_cursor` only on a full page. recent() is retained for existing
callers; the response gains next_cursor additively.
The live-tail dashboard keeps consuming page 1; a history-browse UI can
build on the same cursor. Test: testListPaginatesWithCursor.
phpunit: 89 passing (4 skipped: PDO-backed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW
77 lines
4.8 KiB
PHP
77 lines
4.8 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\Request;
|
|
use App\Auth\ArraySessionStore;
|
|
use App\Dashboard\{EventListController, EventDetailController, SnapshotProxy};
|
|
use App\Tests\Support\{InMemoryEventRepository, InMemorySnapshotRepository, InMemoryAuditRepository};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class DashboardTest extends TestCase
|
|
{
|
|
private function authed(string $role = 'operator'): ArraySessionStore {
|
|
$s = new ArraySessionStore(); $s->set('user_id', 1); $s->set('username', 'u'); $s->set('role', $role); $s->set('csrf', 'tok'); return $s;
|
|
}
|
|
public function testListRequiresAuth(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$c = new EventListController($repo, new ArraySessionStore());
|
|
$this->assertSame(401, $c->json(new Request('GET', '/api/events', [], '', [], []))->status());
|
|
}
|
|
public function testListReturnsRecent(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$repo->insert(['severity' => 'high', 'event_type' => 'fall']);
|
|
$c = new EventListController($repo, $this->authed());
|
|
$res = $c->json(new Request('GET', '/api/events', [], '', [], []));
|
|
$this->assertSame(200, $res->status());
|
|
$this->assertCount(1, json_decode($res->body(), true)['events']);
|
|
}
|
|
public function testListPaginatesWithCursor(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$repo->insert(['severity' => 'high', 'event_type' => 'fall', 'occurred_at' => 100.0]); // id 1
|
|
$repo->insert(['severity' => 'high', 'event_type' => 'fall', 'occurred_at' => 200.0]); // id 2
|
|
$repo->insert(['severity' => 'high', 'event_type' => 'fall', 'occurred_at' => 300.0]); // id 3
|
|
$c = new EventListController($repo, $this->authed());
|
|
// Page 1: the newest two (300, 200); a full page hands back a cursor at the oldest row.
|
|
$p1 = json_decode($c->json(new Request('GET', '/api/events', [], '', ['limit' => '2'], []))->body(), true);
|
|
$this->assertCount(2, $p1['events']);
|
|
$this->assertSame([3, 2], [$p1['events'][0]['event_id'], $p1['events'][1]['event_id']]);
|
|
$this->assertSame('200:2', $p1['next_cursor']);
|
|
// Page 2: following the cursor yields only the older remaining event; short page => no cursor.
|
|
$p2 = json_decode($c->json(new Request('GET', '/api/events', [], '', ['limit' => '2', 'cursor' => $p1['next_cursor']], []))->body(), true);
|
|
$this->assertCount(1, $p2['events']);
|
|
$this->assertSame(1, $p2['events'][0]['event_id']);
|
|
$this->assertNull($p2['next_cursor']);
|
|
}
|
|
public function testAcknowledgeRequiresPermissionAndSetsUser(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$id = $repo->insert(['severity' => 'critical', 'event_type' => 'no_motion']);
|
|
$req = new Request('POST', "/events/$id/ack", ['X-Csrf-Token' => 'tok'], '', [], []);
|
|
// viewer denied (RBAC check fires before CSRF)
|
|
$cv = new EventDetailController($repo, new InMemorySnapshotRepository(), new InMemoryAuditRepository(), $this->authed('viewer'));
|
|
$this->assertSame(403, $cv->acknowledge($req, ['id' => (string)$id])->status());
|
|
// operator allowed
|
|
$co = new EventDetailController($repo, new InMemorySnapshotRepository(), new InMemoryAuditRepository(), $this->authed('operator'));
|
|
$this->assertSame(200, $co->acknowledge($req, ['id' => (string)$id])->status());
|
|
$this->assertSame('u', $repo->find($id)['acknowledged_by']);
|
|
}
|
|
public function testAcknowledgeRejectsMissingOrWrongCsrfToken(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$id = $repo->insert(['severity' => 'critical', 'event_type' => 'no_motion']);
|
|
$c = new EventDetailController($repo, new InMemorySnapshotRepository(), new InMemoryAuditRepository(), $this->authed('operator'));
|
|
// missing header
|
|
$missing = new Request('POST', "/events/$id/ack", [], '', [], []);
|
|
$this->assertSame(403, $c->acknowledge($missing, ['id' => (string)$id])->status());
|
|
// wrong token
|
|
$wrong = new Request('POST', "/events/$id/ack", ['X-Csrf-Token' => 'nope'], '', [], []);
|
|
$this->assertSame(403, $c->acknowledge($wrong, ['id' => (string)$id])->status());
|
|
// acknowledge did not proceed
|
|
$this->assertNull($repo->find($id)['acknowledged_by']);
|
|
}
|
|
public function testSnapshotProxyAuthAnd404(): void {
|
|
$snaps = new InMemorySnapshotRepository();
|
|
$proxy = new SnapshotProxy($snaps, new ArraySessionStore()); // unauth
|
|
$this->assertSame(401, $proxy->serve(new Request('GET', '/snap/x', [], '', [], []), ['uuid' => 'x'])->status());
|
|
$proxy2 = new SnapshotProxy($snaps, $this->authed());
|
|
$this->assertSame(404, $proxy2->serve(new Request('GET', '/snap/missing', [], '', [], []), ['uuid' => 'missing'])->status());
|
|
}
|
|
}
|