2ea0420de7
Two independent adversarial reviews (codex CLI + a 6-dimension verification workflow) of the delivery-hardening branch surfaced ~40 findings; this closes the confirmed correctness/security/deploy blockers plus a codex re-review pass. edge: - geometry: track_displacement per-second threshold recalibrated (0.02->0.25, env-tunable via MOTION_THR, validated finite/positive); confidence-filter keypoints with a bbox-center fallback so hallucinated points don't fake motion - fall: low-confidence frames no longer cancel an active FALLING/FALLEN incident (freeze + reset recovery timer so recovery needs a fresh confident streak); baseline height only seeded from trusted frames - queue: PostClient.send() returns a tri-state SendResult; only definite 4xx count toward the poison drop cap, so a network outage (incl. 408/425/429/5xx) never deletes queued safety events; legacy rows persist their minted uuid - config: reject placeholder / http / short DEVICE_SECRET at startup - zones: warn+skip legacy pixel-space polygons that would silently match nothing cloud: - zone endpoints wired into P3-2b site-scope (cross-site read/write/delete closed) + role gate on list; catch narrowed so DB faults surface as 500 - snapshot purge keeps the DB row when unlink() fails (no untrackable PIPA orphan) - ingest dedup path re-stores missing snapshots (+ short-write guard); UNIQUE (event_id, content_hash) makes recovery idempotent under retry/race - event list cursor carries full-precision occurred_at (no float rounding at the page boundary); string keyset end-to-end - SiteScope '' fails closed (only NULL is global); dashboard fetches full page cap - runnable migration (site/event_uuid + backfill ordering + indexes); rate-limit reap fails open deploy: - offline bundle hashes EVERY file (fatal on missing/failed/injected; models in SBOM; arch in tarball name; REQUIRE_SIGNATURE option) - installer verifies before any mutation, Hailo arch preflight before install, atomic src swap, backend reconcile preserves a working operator choice - systemd DeviceAllow=char-dma_heap (the /dev/dma_heap/ dir form was inert) Verified: edge pytest 165 passed / 2 skipped; cloud phpunit 109 passed / 4 skipped; deploy scripts bash -n clean. Reviewed by codex twice (findings + fixes) with the second-pass findings folded in.
31 lines
1.1 KiB
PHP
31 lines
1.1 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Security\SiteScope;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class SiteScopeTest extends TestCase
|
|
{
|
|
public function testNullScopeIsGlobal(): void
|
|
{
|
|
$this->assertTrue(SiteScope::isGlobal(null));
|
|
$this->assertTrue(SiteScope::allows(null, 'factory-a')); // a global operator sees every site
|
|
$this->assertTrue(SiteScope::allows(null, null));
|
|
}
|
|
|
|
public function testEmptyStringScopeIsNotGlobal(): void
|
|
{
|
|
// A blank scope (an accidental '') must fail CLOSED — never be silently promoted to
|
|
// global access the way it was before this fix.
|
|
$this->assertFalse(SiteScope::isGlobal(''));
|
|
$this->assertFalse(SiteScope::allows('', 'factory-a'));
|
|
$this->assertFalse(SiteScope::allows('', null));
|
|
}
|
|
|
|
public function testScopedCallerSeesOnlyItsExactSite(): void
|
|
{
|
|
$this->assertTrue(SiteScope::allows('factory-a', 'factory-a'));
|
|
$this->assertFalse(SiteScope::allows('factory-a', 'factory-b'));
|
|
$this->assertFalse(SiteScope::allows('factory-a', null)); // an unscoped row is hidden from a scoped caller
|
|
}
|
|
}
|