65344f6ea6
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ne4rU4FToTLHcBUMUvUnT1
2127 lines
86 KiB
Markdown
2127 lines
86 KiB
Markdown
# P1-B 클라우드 수신·대시보드 (Cloud Ingest + Dashboard) Implementation Plan
|
|
|
|
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
|
|
|
**Goal:** Cafe24 웹호스팅(PHP+MySQL)에서 도는 관제 백엔드/대시보드 — 엣지(P1-A)가 보내는 서명된 이벤트+스냅샷을 안전하게 수신·저장하고, 인증된 안전관리자가 실시간 사고 목록·상세를 보고, 위험구역 폴리곤을 그려 Pi로 동기한다.
|
|
|
|
**Architecture:** 바닐라 PHP(프레임워크 없음) + PDO + PHPUnit. 프론트컨트롤러 라우터 → 컨트롤러 → **Repository 인터페이스**(PDO/MySQL 구현) 뒤에 DB. 보안 핵심 로직(HMAC+nonce 검증·입력검증·이미지 재인코딩·RBAC·세션)은 순수·mock repo로 PHPUnit 로컬 완결. DB 통합은 게이트(로컬 pdo_sqlite or Cafe24 MySQL). 스냅샷은 **웹루트 밖** 저장, 인증 PHP 프록시로만 서빙.
|
|
|
|
**Tech Stack:** PHP 8.5, Composer(dev: phpunit만), PDO(MySQL 타깃), gd(이미지 재인코딩), openssl/hash(HMAC), session/argon2id(인증). 런타임 외부 의존성 0(vendor는 phpunit 개발 전용).
|
|
|
|
## Global Constraints
|
|
|
|
- **PHP 8.5**, `declare(strict_types=1);` 모든 파일. PSR-4 오토로드(`App\` → `cloud/src/`).
|
|
- **폐쇄망/공유호스팅:** 런타임 composer 의존성 금지(대시보드는 vendor 없이 동작). phpunit은 개발 전용. Cafe24 `public_html`에 `cloud/public/`만 웹 노출.
|
|
- **HMAC 계약(P1-A와 정확히 일치):** 서명 = `hmac-sha256(nonce + timestamp + body, per_device_secret)` hex. P1-A `edge/alert.py::sign`과 바이트 동일하게 검증. 헤더 `X-Signature`, `X-Nonce`, `X-Timestamp`.
|
|
- **replay 방지:** nonce 1회성(저장·재사용 거부) + timestamp 윈도우(기본 300초).
|
|
- **스냅샷:** base64 JPEG를 **gd로 재인코딩**(페이로드 제거·강제 .jpg·랜덤 UUID 파일명), **웹루트 밖**(`cloud/storage/snapshots/`) 저장, 인증 프록시로만 서빙. 원본 바이트 절대 그대로 저장 금지.
|
|
- **SQL:** 전부 prepared statement(placeholder). event_type/severity/level 등은 **화이트리스트 enum** 검증.
|
|
- **인증:** 로그인 필수(argon2id), 세션 쿠키 HttpOnly+Secure+SameSite=Lax, CSRF 토큰, brute-force 잠금. RBAC: admin/operator/viewer.
|
|
- **심각도 색상 단독 금지(NF9):** 텍스트(위급/높음/경고)+아이콘+색, 색맹안전 팔레트.
|
|
- **시크릿:** per-device secret·DB 자격증명은 env/시크릿 파일(`cloud/config.php`는 `.gitignore`), 하드코딩 금지.
|
|
- **테스트:** 로직은 mock repository로 DB 없이 단위테스트. DB 통합은 마지막 게이트 태스크(로컬 pdo_sqlite or Cafe24).
|
|
- 파일 작고 단일책임. 컨트롤러는 얇게(검증·오케스트레이션), 로직은 서비스/헬퍼로.
|
|
|
|
## File Structure
|
|
|
|
```
|
|
cloud/
|
|
composer.json # PSR-4 autoload + phpunit(dev)
|
|
phpunit.xml
|
|
config.example.php # DB dsn, snapshot dir, nonce ttl 등 (실배포 config.php는 gitignore)
|
|
schema.sql # MySQL DDL (+ sqlite 호환 노트)
|
|
public/ # === Cafe24 웹루트 (이것만 노출) ===
|
|
index.php # 프론트컨트롤러
|
|
.htaccess # 라우팅 rewrite + storage/src 접근 차단
|
|
assets/{app.css, app.js, zone-draw.js}
|
|
src/
|
|
Config.php
|
|
Http/{Request.php, Response.php, Router.php}
|
|
Db/Database.php
|
|
Security/{Hmac.php, Csrf.php, Password.php}
|
|
Ingest/{EventValidator.php, ImageProcessor.php, IngestController.php}
|
|
Api/{HeartbeatController.php, ConfigController.php}
|
|
Auth/{Session.php, Rbac.php, AuthController.php}
|
|
Dashboard/{EventListController.php, EventDetailController.php, SnapshotProxy.php, ZoneConfigController.php}
|
|
Geometry/Polygon.php
|
|
Repository/ # 인터페이스
|
|
EventRepository.php, UserRepository.php, DeviceRepository.php,
|
|
ZoneRepository.php, ThresholdRepository.php, NonceRepository.php,
|
|
RateLimiterRepository.php, AuditRepository.php, SnapshotRepository.php
|
|
Repository/Pdo/ # PDO 구현 (DB 게이트 태스크)
|
|
Pdo*.php
|
|
View/ # 서버렌더 템플릿(php)
|
|
layout.php, login.php, events.php, event_detail.php, zones.php
|
|
storage/ # === 웹루트 밖 ===
|
|
snapshots/ # 재인코딩된 JPEG (UUID)
|
|
tests/ # PHPUnit + InMemory 테스트더블
|
|
Support/InMemoryRepositories.php
|
|
*Test.php
|
|
```
|
|
|
|
---
|
|
|
|
## Task 1: 스캐폴드 (composer, autoload, Config, PHPUnit)
|
|
|
|
**Files:**
|
|
- Create: `cloud/composer.json`, `cloud/phpunit.xml`, `cloud/src/Config.php`, `cloud/config.example.php`, `cloud/tests/ConfigTest.php`, `cloud/.gitignore`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces: `App\Config` with `Config::fromArray(array $a): Config` and typed getters `dbDsn(), dbUser(), dbPass(), snapshotDir(), nonceTtl(): int, timestampWindow(): int, rateLimitPerMin(): int`.
|
|
|
|
- [ ] **Step 1: composer.json + autoload**
|
|
|
|
```json
|
|
{
|
|
"name": "move-detect/cloud",
|
|
"type": "project",
|
|
"require": { "php": ">=8.2" },
|
|
"require-dev": { "phpunit/phpunit": "^11" },
|
|
"autoload": { "psr-4": { "App\\": "src/" } },
|
|
"autoload-dev": { "psr-4": { "App\\Tests\\": "tests/" } }
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: phpunit.xml**
|
|
|
|
```xml
|
|
<?xml version="1.0"?>
|
|
<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
bootstrap="vendor/autoload.php" colors="true">
|
|
<testsuites>
|
|
<testsuite name="unit"><directory>tests</directory></testsuite>
|
|
</testsuites>
|
|
</phpunit>
|
|
```
|
|
|
|
- [ ] **Step 3: `.gitignore`** (cloud/)
|
|
|
|
```
|
|
/vendor/
|
|
/config.php
|
|
/storage/snapshots/*
|
|
!/storage/snapshots/.gitkeep
|
|
```
|
|
|
|
- [ ] **Step 4: 실패 테스트** — `cloud/tests/ConfigTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Config;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class ConfigTest extends TestCase
|
|
{
|
|
public function testTypedGettersWithDefaults(): void
|
|
{
|
|
$c = Config::fromArray(['db_dsn' => 'sqlite::memory:']);
|
|
$this->assertSame('sqlite::memory:', $c->dbDsn());
|
|
$this->assertSame(300, $c->timestampWindow());
|
|
$this->assertSame(60, $c->rateLimitPerMin());
|
|
$this->assertSame(86400, $c->nonceTtl());
|
|
}
|
|
|
|
public function testOverrides(): void
|
|
{
|
|
$c = Config::fromArray(['db_dsn' => 'x', 'timestamp_window' => 120, 'rate_limit_per_min' => 30]);
|
|
$this->assertSame(120, $c->timestampWindow());
|
|
$this->assertSame(30, $c->rateLimitPerMin());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 5: 실패 확인**
|
|
|
|
Run: `cd cloud && composer install -q && ./vendor/bin/phpunit tests/ConfigTest.php`
|
|
Expected: FAIL — `Class "App\Config" not found`
|
|
|
|
- [ ] **Step 6: 구현** — `cloud/src/Config.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App;
|
|
|
|
final class Config
|
|
{
|
|
private function __construct(private array $a) {}
|
|
|
|
public static function fromArray(array $a): self { return new self($a); }
|
|
|
|
public function dbDsn(): string { return (string)($this->a['db_dsn'] ?? ''); }
|
|
public function dbUser(): string { return (string)($this->a['db_user'] ?? ''); }
|
|
public function dbPass(): string { return (string)($this->a['db_pass'] ?? ''); }
|
|
public function snapshotDir(): string { return (string)($this->a['snapshot_dir'] ?? __DIR__ . '/../storage/snapshots'); }
|
|
public function nonceTtl(): int { return (int)($this->a['nonce_ttl'] ?? 86400); }
|
|
public function timestampWindow(): int { return (int)($this->a['timestamp_window'] ?? 300); }
|
|
public function rateLimitPerMin(): int { return (int)($this->a['rate_limit_per_min'] ?? 60); }
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 7: config.example.php** (배포 참조)
|
|
|
|
```php
|
|
<?php
|
|
return [
|
|
'db_dsn' => 'mysql:host=localhost;dbname=move_detect;charset=utf8mb4',
|
|
'db_user' => 'CHANGEME',
|
|
'db_pass' => 'CHANGEME',
|
|
'snapshot_dir' => __DIR__ . '/storage/snapshots',
|
|
'timestamp_window' => 300,
|
|
'rate_limit_per_min' => 60,
|
|
];
|
|
```
|
|
|
|
- [ ] **Step 8: 통과 + 커밋**
|
|
|
|
Run: `./vendor/bin/phpunit tests/ConfigTest.php` → PASS
|
|
|
|
```bash
|
|
git add cloud/composer.json cloud/phpunit.xml cloud/.gitignore cloud/config.example.php cloud/src/Config.php cloud/tests/ConfigTest.php
|
|
git commit -m "feat(cloud): P1-B scaffold — composer autoload + Config"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 2: HMAC 검증 (Hmac::sign/verify) — P1-A 계약 일치
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Security/Hmac.php`, `cloud/tests/HmacTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces: `App\Security\Hmac::sign(string $secret, string $nonce, string $ts, string $body): string` (hex), `Hmac::verify(string $secret, string $nonce, string $ts, string $body, string $sig): bool` (hash_equals, 상수시간).
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/HmacTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Security\Hmac;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class HmacTest extends TestCase
|
|
{
|
|
public function testSignMatchesPythonEdgeContract(): void
|
|
{
|
|
// P1-A edge/alert.py::sign = HMAC-SHA256(nonce+ts+body, secret) hex
|
|
$sig = Hmac::sign('secret', 'n1', '1000.0', '{"a":1}');
|
|
$expected = hash_hmac('sha256', 'n1' . '1000.0' . '{"a":1}', 'secret');
|
|
$this->assertSame($expected, $sig);
|
|
$this->assertSame(64, strlen($sig));
|
|
}
|
|
|
|
public function testVerifyTrueOnMatchFalseOnTamper(): void
|
|
{
|
|
$sig = Hmac::sign('secret', 'n1', '1000.0', 'body');
|
|
$this->assertTrue(Hmac::verify('secret', 'n1', '1000.0', 'body', $sig));
|
|
$this->assertFalse(Hmac::verify('secret', 'n1', '1000.0', 'body-TAMPERED', $sig));
|
|
$this->assertFalse(Hmac::verify('wrong', 'n1', '1000.0', 'body', $sig));
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인**
|
|
|
|
Run: `./vendor/bin/phpunit tests/HmacTest.php` → FAIL (class not found)
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Security/Hmac.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Security;
|
|
|
|
final class Hmac
|
|
{
|
|
public static function sign(string $secret, string $nonce, string $ts, string $body): string
|
|
{
|
|
return hash_hmac('sha256', $nonce . $ts . $body, $secret);
|
|
}
|
|
|
|
public static function verify(string $secret, string $nonce, string $ts, string $body, string $sig): bool
|
|
{
|
|
$expected = self::sign($secret, $nonce, $ts, $body);
|
|
return hash_equals($expected, $sig);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
Run: `./vendor/bin/phpunit tests/HmacTest.php` → PASS
|
|
|
|
```bash
|
|
git add cloud/src/Security/Hmac.php cloud/tests/HmacTest.php
|
|
git commit -m "feat(cloud): HMAC sign/verify matching P1-A edge contract"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 3: Repository 인터페이스 + InMemory 테스트더블
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Repository/{EventRepository,UserRepository,DeviceRepository,ZoneRepository,ThresholdRepository,NonceRepository,RateLimiterRepository,AuditRepository,SnapshotRepository}.php`, `cloud/tests/Support/InMemoryRepositories.php`, `cloud/tests/RepositoryContractTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces (인터페이스 시그니처 — 이후 태스크가 의존):
|
|
- `DeviceRepository`: `secretFor(string $deviceId): ?string`, `touchHeartbeat(string $deviceId, array $meta): void`, `configVersion(string $deviceId): int`
|
|
- `NonceRepository`: `seen(string $nonce): bool`, `remember(string $nonce, int $expiresAt): void`
|
|
- `RateLimiterRepository`: `hit(string $key, int $windowStart): int` (해당 분 카운트 반환·증가)
|
|
- `EventRepository`: `insert(array $event): int` (event_id), `recent(int $limit, ?string $severity): array`, `find(int $id): ?array`, `acknowledge(int $id, string $user): bool`
|
|
- `SnapshotRepository`: `add(int $eventId, string $fileUuid, string $contentHash): void`, `forEvent(int $eventId): array`, `pathByUuid(string $uuid): ?string`
|
|
- `UserRepository`: `byUsername(string $u): ?array` (id, password_hash, role, site_scope, failed_attempts, locked_until), `recordFailure(int $userId, int $lockUntil): void`, `clearFailures(int $userId): void`
|
|
- `ZoneRepository`: `forDevice(string $deviceId): array`, `forCamera(string $cameraId): array`, `save(array $zone): string`, `delete(string $zoneId): bool`
|
|
- `ThresholdRepository`: `forDevice(string $deviceId): array`
|
|
- `AuditRepository`: `append(string $actor, string $action, string $target, array $before, array $after): void`
|
|
|
|
- [ ] **Step 1: 인터페이스들 작성** — 각 파일에 `interface` 정의.
|
|
|
|
`cloud/src/Repository/DeviceRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface DeviceRepository
|
|
{
|
|
public function secretFor(string $deviceId): ?string;
|
|
public function touchHeartbeat(string $deviceId, array $meta): void;
|
|
public function configVersion(string $deviceId): int;
|
|
}
|
|
```
|
|
|
|
`NonceRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface NonceRepository
|
|
{
|
|
public function seen(string $nonce): bool;
|
|
public function remember(string $nonce, int $expiresAt): void;
|
|
}
|
|
```
|
|
|
|
`RateLimiterRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface RateLimiterRepository
|
|
{
|
|
/** 해당 window(분)의 key 카운트를 1 증가시키고, 증가 후 카운트를 반환한다. */
|
|
public function hit(string $key, int $windowStart): int;
|
|
}
|
|
```
|
|
|
|
`EventRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface EventRepository
|
|
{
|
|
public function insert(array $event): int;
|
|
public function recent(int $limit, ?string $severity): array;
|
|
public function find(int $id): ?array;
|
|
public function acknowledge(int $id, string $user): bool;
|
|
}
|
|
```
|
|
|
|
`SnapshotRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface SnapshotRepository
|
|
{
|
|
public function add(int $eventId, string $fileUuid, string $contentHash): void;
|
|
public function forEvent(int $eventId): array;
|
|
public function pathByUuid(string $uuid): ?string;
|
|
}
|
|
```
|
|
|
|
`UserRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface UserRepository
|
|
{
|
|
public function byUsername(string $username): ?array;
|
|
public function recordFailure(int $userId, int $lockUntil): void;
|
|
public function clearFailures(int $userId): void;
|
|
}
|
|
```
|
|
|
|
`ZoneRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface ZoneRepository
|
|
{
|
|
public function forDevice(string $deviceId): array;
|
|
public function forCamera(string $cameraId): array;
|
|
public function save(array $zone): string;
|
|
public function delete(string $zoneId): bool;
|
|
}
|
|
```
|
|
|
|
`ThresholdRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface ThresholdRepository
|
|
{
|
|
public function forDevice(string $deviceId): array;
|
|
}
|
|
```
|
|
|
|
`AuditRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository;
|
|
|
|
interface AuditRepository
|
|
{
|
|
public function append(string $actor, string $action, string $target, array $before, array $after): void;
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: InMemory 더블 + 실패 테스트** — `cloud/tests/Support/InMemoryRepositories.php` (테스트 전용 구현)
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests\Support;
|
|
use App\Repository\{DeviceRepository, NonceRepository, RateLimiterRepository,
|
|
EventRepository, SnapshotRepository, UserRepository, ZoneRepository,
|
|
ThresholdRepository, AuditRepository};
|
|
|
|
final class InMemoryDeviceRepository implements DeviceRepository {
|
|
public array $heartbeats = [];
|
|
public function __construct(private array $secrets = [], private array $versions = []) {}
|
|
public function secretFor(string $d): ?string { return $this->secrets[$d] ?? null; }
|
|
public function touchHeartbeat(string $d, array $m): void { $this->heartbeats[$d] = $m; }
|
|
public function configVersion(string $d): int { return $this->versions[$d] ?? 1; }
|
|
}
|
|
final class InMemoryNonceRepository implements NonceRepository {
|
|
public array $store = [];
|
|
public function seen(string $n): bool { return isset($this->store[$n]); }
|
|
public function remember(string $n, int $exp): void { $this->store[$n] = $exp; }
|
|
}
|
|
final class InMemoryRateLimiter implements RateLimiterRepository {
|
|
public array $counts = [];
|
|
public function hit(string $k, int $w): int { $key = "$k:$w"; return $this->counts[$key] = ($this->counts[$key] ?? 0) + 1; }
|
|
}
|
|
final class InMemoryEventRepository implements EventRepository {
|
|
public array $rows = []; private int $seq = 0;
|
|
public function insert(array $e): int { $id = ++$this->seq; $this->rows[$id] = $e + ['event_id' => $id, 'acknowledged_by' => null]; return $id; }
|
|
public function recent(int $limit, ?string $sev): array {
|
|
$r = array_reverse($this->rows, true);
|
|
if ($sev !== null) $r = array_filter($r, fn($x) => $x['severity'] === $sev);
|
|
return array_slice(array_values($r), 0, $limit);
|
|
}
|
|
public function find(int $id): ?array { return $this->rows[$id] ?? null; }
|
|
public function acknowledge(int $id, string $u): bool { if (!isset($this->rows[$id])) return false; $this->rows[$id]['acknowledged_by'] = $u; return true; }
|
|
}
|
|
final class InMemorySnapshotRepository implements SnapshotRepository {
|
|
public array $rows = []; public array $paths = [];
|
|
public function add(int $e, string $uuid, string $hash): void { $this->rows[$e][] = ['file_uuid' => $uuid, 'content_hash' => $hash]; $this->paths[$uuid] = "/tmp/$uuid.jpg"; }
|
|
public function forEvent(int $e): array { return $this->rows[$e] ?? []; }
|
|
public function pathByUuid(string $u): ?string { return $this->paths[$u] ?? null; }
|
|
}
|
|
final class InMemoryUserRepository implements UserRepository {
|
|
public function __construct(public array $users = []) {}
|
|
public function byUsername(string $u): ?array { return $this->users[$u] ?? null; }
|
|
public function recordFailure(int $id, int $lock): void { foreach ($this->users as &$row) if ($row['id'] === $id) { $row['failed_attempts'] = ($row['failed_attempts'] ?? 0) + 1; $row['locked_until'] = $lock; } }
|
|
public function clearFailures(int $id): void { foreach ($this->users as &$row) if ($row['id'] === $id) { $row['failed_attempts'] = 0; $row['locked_until'] = 0; } }
|
|
}
|
|
final class InMemoryZoneRepository implements ZoneRepository {
|
|
public array $zones = []; private int $seq = 0;
|
|
public function forDevice(string $d): array { return array_values(array_filter($this->zones, fn($z) => ($z['device_id'] ?? '') === $d)); }
|
|
public function forCamera(string $c): array { return array_values(array_filter($this->zones, fn($z) => $z['camera_id'] === $c)); }
|
|
public function save(array $z): string { $id = $z['zone_id'] ?? ('z' . (++$this->seq)); $this->zones[$id] = $z + ['zone_id' => $id]; return $id; }
|
|
public function delete(string $id): bool { if (!isset($this->zones[$id])) return false; unset($this->zones[$id]); return true; }
|
|
}
|
|
final class InMemoryThresholdRepository implements ThresholdRepository {
|
|
public function __construct(private array $data = []) {}
|
|
public function forDevice(string $d): array { return $this->data[$d] ?? []; }
|
|
}
|
|
final class InMemoryAuditRepository implements AuditRepository {
|
|
public array $log = [];
|
|
public function append(string $a, string $act, string $t, array $b, array $af): void { $this->log[] = compact('a', 'act', 't', 'b', 'af'); }
|
|
}
|
|
```
|
|
|
|
그리고 `cloud/tests/RepositoryContractTest.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Tests\Support\{InMemoryNonceRepository, InMemoryEventRepository, InMemoryRateLimiter};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class RepositoryContractTest extends TestCase
|
|
{
|
|
public function testNonceRememberThenSeen(): void
|
|
{
|
|
$r = new InMemoryNonceRepository();
|
|
$this->assertFalse($r->seen('n1'));
|
|
$r->remember('n1', 999);
|
|
$this->assertTrue($r->seen('n1'));
|
|
}
|
|
public function testEventInsertAndRecent(): void
|
|
{
|
|
$r = new InMemoryEventRepository();
|
|
$id = $r->insert(['severity' => 'high', 'event_type' => 'fall']);
|
|
$this->assertSame(1, $id);
|
|
$this->assertCount(1, $r->recent(10, null));
|
|
$this->assertCount(0, $r->recent(10, 'critical'));
|
|
}
|
|
public function testRateLimiterIncrements(): void
|
|
{
|
|
$r = new InMemoryRateLimiter();
|
|
$this->assertSame(1, $r->hit('dev', 100));
|
|
$this->assertSame(2, $r->hit('dev', 100));
|
|
$this->assertSame(1, $r->hit('dev', 160));
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 3: 실패 → 통과**
|
|
|
|
Run: `./vendor/bin/phpunit tests/RepositoryContractTest.php`
|
|
Expected: FAIL (interfaces/doubles absent) → 작성 후 PASS.
|
|
|
|
- [ ] **Step 4: 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Repository/*.php cloud/tests/Support/InMemoryRepositories.php cloud/tests/RepositoryContractTest.php
|
|
git commit -m "feat(cloud): repository interfaces + in-memory test doubles"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 4: EventValidator (enum 화이트리스트 + 스키마 검증)
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Ingest/EventValidator.php`, `cloud/tests/EventValidatorTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces: `App\Ingest\EventValidator::validate(array $payload): array` — `['ok' => bool, 'errors' => string[], 'clean' => array]`. 화이트리스트: event_type ∈ {fall,no_motion,immobility,ghost,zone_warning,zone_restricted,pinch,monitoring_degraded,device_fault}; severity ∈ {critical,high,warning,info}. 필수: device_id, camera_id, event_type, severity, occurred_at. snapshots는 배열(≤3), 문자열 항목.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/EventValidatorTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Ingest\EventValidator;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class EventValidatorTest extends TestCase
|
|
{
|
|
private function valid(): array {
|
|
return ['device_id' => 'pi-1', 'camera_id' => 'cam-1', 'event_type' => 'fall',
|
|
'severity' => 'high', 'occurred_at' => 1000.0, 'snapshots' => ['aGk=']];
|
|
}
|
|
public function testAcceptsValid(): void {
|
|
$r = EventValidator::validate($this->valid());
|
|
$this->assertTrue($r['ok'], implode(',', $r['errors']));
|
|
$this->assertSame('fall', $r['clean']['event_type']);
|
|
}
|
|
public function testRejectsUnknownEventType(): void {
|
|
$p = $this->valid(); $p['event_type'] = 'explode';
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsUnknownSeverity(): void {
|
|
$p = $this->valid(); $p['severity'] = 'ULTRA';
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsMissingRequired(): void {
|
|
$p = $this->valid(); unset($p['device_id']);
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsTooManySnapshots(): void {
|
|
$p = $this->valid(); $p['snapshots'] = ['a', 'b', 'c', 'd'];
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Ingest/EventValidator.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Ingest;
|
|
|
|
final class EventValidator
|
|
{
|
|
private const TYPES = ['fall','no_motion','immobility','ghost','zone_warning',
|
|
'zone_restricted','pinch','monitoring_degraded','device_fault'];
|
|
private const SEVERITIES = ['critical','high','warning','info'];
|
|
private const REQUIRED = ['device_id','camera_id','event_type','severity','occurred_at'];
|
|
|
|
public static function validate(array $p): array
|
|
{
|
|
$errors = [];
|
|
foreach (self::REQUIRED as $k) {
|
|
if (!array_key_exists($k, $p) || $p[$k] === '' || $p[$k] === null) $errors[] = "missing:$k";
|
|
}
|
|
if (isset($p['event_type']) && !in_array($p['event_type'], self::TYPES, true)) $errors[] = 'bad:event_type';
|
|
if (isset($p['severity']) && !in_array($p['severity'], self::SEVERITIES, true)) $errors[] = 'bad:severity';
|
|
$snaps = $p['snapshots'] ?? [];
|
|
if (!is_array($snaps)) $errors[] = 'bad:snapshots';
|
|
elseif (count($snaps) > 3) $errors[] = 'too_many:snapshots';
|
|
else foreach ($snaps as $s) if (!is_string($s)) { $errors[] = 'bad:snapshot_item'; break; }
|
|
|
|
if ($errors) return ['ok' => false, 'errors' => $errors, 'clean' => []];
|
|
|
|
$clean = [
|
|
'device_id' => (string)$p['device_id'],
|
|
'camera_id' => (string)$p['camera_id'],
|
|
'event_type' => (string)$p['event_type'],
|
|
'severity' => (string)$p['severity'],
|
|
'track_id' => isset($p['track_id']) ? (int)$p['track_id'] : null,
|
|
'zone_id' => isset($p['zone_id']) ? (string)$p['zone_id'] : null,
|
|
'occurred_at' => (float)$p['occurred_at'],
|
|
'duration_s' => (float)($p['duration_s'] ?? 0.0),
|
|
'metrics' => is_array($p['metrics'] ?? null) ? $p['metrics'] : [],
|
|
];
|
|
return ['ok' => true, 'errors' => [], 'clean' => $clean];
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Ingest/EventValidator.php cloud/tests/EventValidatorTest.php
|
|
git commit -m "feat(cloud): event payload validator with enum whitelist"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 5: ImageProcessor (gd 재인코딩 + UUID)
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Ingest/ImageProcessor.php`, `cloud/tests/ImageProcessorTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces: `App\Ingest\ImageProcessor::reencode(string $base64, int $quality = 80): array` — `['ok'=>bool, 'bytes'=>string, 'uuid'=>string, 'hash'=>string]`. base64 디코드 → gd로 로드 → 순수 JPEG로 재출력(원본 메타/페이로드 제거). 실패 시 `['ok'=>false]`. uuid=랜덤 32hex, hash=sha256(재인코딩 바이트).
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/ImageProcessorTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Ingest\ImageProcessor;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class ImageProcessorTest extends TestCase
|
|
{
|
|
private function tinyJpegBase64(): string {
|
|
$im = imagecreatetruecolor(8, 8);
|
|
ob_start(); imagejpeg($im); $bytes = ob_get_clean(); imagedestroy($im);
|
|
return base64_encode($bytes);
|
|
}
|
|
public function testReencodeProducesJpeg(): void {
|
|
$r = ImageProcessor::reencode($this->tinyJpegBase64());
|
|
$this->assertTrue($r['ok']);
|
|
$this->assertSame("\xFF\xD8", substr($r['bytes'], 0, 2)); // JPEG magic
|
|
$this->assertSame(32, strlen($r['uuid']));
|
|
$this->assertSame(64, strlen($r['hash']));
|
|
}
|
|
public function testRejectsNonImage(): void {
|
|
$r = ImageProcessor::reencode(base64_encode("not an image <?php echo 1; ?>"));
|
|
$this->assertFalse($r['ok']);
|
|
}
|
|
public function testRejectsBadBase64(): void {
|
|
$this->assertFalse(ImageProcessor::reencode('%%%not-base64%%%')['ok']);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Ingest/ImageProcessor.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Ingest;
|
|
|
|
final class ImageProcessor
|
|
{
|
|
public static function reencode(string $base64, int $quality = 80): array
|
|
{
|
|
$raw = base64_decode($base64, true);
|
|
if ($raw === false || $raw === '') return ['ok' => false];
|
|
$im = @imagecreatefromstring($raw);
|
|
if ($im === false) return ['ok' => false];
|
|
ob_start();
|
|
$ok = imagejpeg($im, null, $quality);
|
|
$bytes = (string)ob_get_clean();
|
|
imagedestroy($im);
|
|
if (!$ok || $bytes === '') return ['ok' => false];
|
|
return [
|
|
'ok' => true,
|
|
'bytes' => $bytes,
|
|
'uuid' => bin2hex(random_bytes(16)),
|
|
'hash' => hash('sha256', $bytes),
|
|
];
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Ingest/ImageProcessor.php cloud/tests/ImageProcessorTest.php
|
|
git commit -m "feat(cloud): gd image re-encode (strip payload, uuid, hash)"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 6: Http Request/Response
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Http/Request.php`, `cloud/src/Http/Response.php`, `cloud/tests/HttpTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces:
|
|
- `App\Http\Request(string $method, string $path, array $headers, string $body, array $query, array $post)` with getters `method(), path(), header(string $name): ?string, body(), json(): array, query(string $k): ?string, post(string $k): ?string`, and static `fromGlobals(): self`.
|
|
- `App\Http\Response`: static `json(array $data, int $status=200): self`, `text(string $s, int $status=200): self`, `bytes(string $b, string $contentType, int $status=200): self`, `redirect(string $to): self`; getters `status(), headers(), body()`; `send(): void`.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/HttpTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\{Request, Response};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class HttpTest extends TestCase
|
|
{
|
|
public function testRequestJsonAndHeaderCaseInsensitive(): void {
|
|
$r = new Request('POST', '/api/events', ['X-Nonce' => 'n1'], '{"a":1}', [], []);
|
|
$this->assertSame('POST', $r->method());
|
|
$this->assertSame('n1', $r->header('x-nonce'));
|
|
$this->assertSame(['a' => 1], $r->json());
|
|
}
|
|
public function testResponseJson(): void {
|
|
$res = Response::json(['ok' => true], 201);
|
|
$this->assertSame(201, $res->status());
|
|
$this->assertStringContainsString('application/json', $res->headers()['Content-Type']);
|
|
$this->assertSame('{"ok":true}', $res->body());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Http/Request.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Http;
|
|
|
|
final class Request
|
|
{
|
|
private array $headers;
|
|
public function __construct(
|
|
private string $method, private string $path, array $headers,
|
|
private string $body, private array $query = [], private array $post = []
|
|
) {
|
|
$this->headers = [];
|
|
foreach ($headers as $k => $v) $this->headers[strtolower($k)] = $v;
|
|
}
|
|
public function method(): string { return $this->method; }
|
|
public function path(): string { return $this->path; }
|
|
public function header(string $name): ?string { return $this->headers[strtolower($name)] ?? null; }
|
|
public function body(): string { return $this->body; }
|
|
public function json(): array { $d = json_decode($this->body, true); return is_array($d) ? $d : []; }
|
|
public function query(string $k): ?string { return isset($this->query[$k]) ? (string)$this->query[$k] : null; }
|
|
public function post(string $k): ?string { return isset($this->post[$k]) ? (string)$this->post[$k] : null; }
|
|
|
|
public static function fromGlobals(): self
|
|
{
|
|
$headers = function_exists('getallheaders') ? (getallheaders() ?: []) : [];
|
|
return new self(
|
|
$_SERVER['REQUEST_METHOD'] ?? 'GET',
|
|
parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/',
|
|
$headers, file_get_contents('php://input') ?: '', $_GET, $_POST
|
|
);
|
|
}
|
|
}
|
|
```
|
|
|
|
`cloud/src/Http/Response.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Http;
|
|
|
|
final class Response
|
|
{
|
|
private function __construct(private int $status, private array $headers, private string $body) {}
|
|
|
|
public static function json(array $data, int $status = 200): self {
|
|
return new self($status, ['Content-Type' => 'application/json'], json_encode($data, JSON_UNESCAPED_UNICODE));
|
|
}
|
|
public static function text(string $s, int $status = 200): self {
|
|
return new self($status, ['Content-Type' => 'text/html; charset=utf-8'], $s);
|
|
}
|
|
public static function bytes(string $b, string $contentType, int $status = 200): self {
|
|
return new self($status, ['Content-Type' => $contentType], $b);
|
|
}
|
|
public static function redirect(string $to): self {
|
|
return new self(302, ['Location' => $to], '');
|
|
}
|
|
public function status(): int { return $this->status; }
|
|
public function headers(): array { return $this->headers; }
|
|
public function body(): string { return $this->body; }
|
|
public function send(): void {
|
|
http_response_code($this->status);
|
|
foreach ($this->headers as $k => $v) header("$k: $v");
|
|
echo $this->body;
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Http/Request.php cloud/src/Http/Response.php cloud/tests/HttpTest.php
|
|
git commit -m "feat(cloud): Http Request/Response primitives"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 7: IngestController (POST /api/events) — 보안 파이프라인 통합
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Ingest/IngestController.php`, `cloud/tests/IngestControllerTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: `Hmac` (T2), `EventValidator`/`ImageProcessor` (T4/T5), `Request`/`Response` (T6), `DeviceRepository`/`NonceRepository`/`RateLimiterRepository`/`EventRepository`/`SnapshotRepository` (T3), `Config` (T1)
|
|
- Produces: `App\Ingest\IngestController(Config, DeviceRepository, NonceRepository, RateLimiterRepository, EventRepository, SnapshotRepository)` with `handle(Request $req, int $now): Response`. 순서: rate limit → device secret 조회 → HMAC 검증 → timestamp 윈도우 → nonce replay → 검증 → 이미지 재인코딩·저장 → 이벤트+스냅샷 insert. 실패는 401/400/429, 성공 201 `{event_id}`.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/IngestControllerTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Config;
|
|
use App\Http\Request;
|
|
use App\Security\Hmac;
|
|
use App\Ingest\IngestController;
|
|
use App\Tests\Support\{InMemoryDeviceRepository, InMemoryNonceRepository,
|
|
InMemoryRateLimiter, InMemoryEventRepository, InMemorySnapshotRepository};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class IngestControllerTest extends TestCase
|
|
{
|
|
private string $dir;
|
|
protected function setUp(): void { $this->dir = sys_get_temp_dir() . '/snaps' . bin2hex(random_bytes(4)); mkdir($this->dir); }
|
|
|
|
private function make(array $secrets = ['pi-1' => 'sekret']): array {
|
|
$cfg = Config::fromArray(['snapshot_dir' => $this->dir, 'timestamp_window' => 300, 'rate_limit_per_min' => 60]);
|
|
$dev = new InMemoryDeviceRepository($secrets);
|
|
$nonce = new InMemoryNonceRepository();
|
|
$rl = new InMemoryRateLimiter();
|
|
$events = new InMemoryEventRepository();
|
|
$snaps = new InMemorySnapshotRepository();
|
|
$c = new IngestController($cfg, $dev, $nonce, $rl, $events, $snaps);
|
|
return [$c, $events, $snaps, $nonce];
|
|
}
|
|
private function jpegB64(): string { $im = imagecreatetruecolor(8, 8); ob_start(); imagejpeg($im); $b = ob_get_clean(); imagedestroy($im); return base64_encode($b); }
|
|
|
|
private function signedReq(string $secret, array $payload, string $nonce = 'n1', string $ts = '1000'): Request {
|
|
$body = json_encode($payload, JSON_UNESCAPED_UNICODE);
|
|
$sig = Hmac::sign($secret, $nonce, $ts, $body);
|
|
return new Request('POST', '/api/events',
|
|
['X-Nonce' => $nonce, 'X-Timestamp' => $ts, 'X-Signature' => $sig], $body, [], []);
|
|
}
|
|
private function payload(): array {
|
|
return ['device_id' => 'pi-1', 'camera_id' => 'cam-1', 'event_type' => 'fall',
|
|
'severity' => 'high', 'occurred_at' => 1000.0, 'snapshots' => [$this->jpegB64()]];
|
|
}
|
|
|
|
public function testAcceptsValidSignedEvent(): void {
|
|
[$c, $events, $snaps] = $this->make();
|
|
$res = $c->handle($this->signedReq('sekret', $this->payload()), now: 1000);
|
|
$this->assertSame(201, $res->status());
|
|
$this->assertCount(1, $events->rows);
|
|
$id = json_decode($res->body(), true)['event_id'];
|
|
$this->assertCount(1, $snaps->forEvent($id)); // snapshot re-encoded + stored
|
|
}
|
|
public function testRejectsBadSignature(): void {
|
|
[$c] = $this->make();
|
|
$req = $this->signedReq('WRONG', $this->payload());
|
|
$this->assertSame(401, $c->handle($req, now: 1000)->status());
|
|
}
|
|
public function testRejectsReplayedNonce(): void {
|
|
[$c] = $this->make();
|
|
$req = $this->signedReq('sekret', $this->payload());
|
|
$this->assertSame(201, $c->handle($req, now: 1000)->status());
|
|
$this->assertSame(401, $c->handle($req, now: 1000)->status()); // same nonce again
|
|
}
|
|
public function testRejectsStaleTimestamp(): void {
|
|
[$c] = $this->make();
|
|
$req = $this->signedReq('sekret', $this->payload(), ts: '1000');
|
|
$this->assertSame(401, $c->handle($req, now: 5000)->status()); // 4000s > 300 window
|
|
}
|
|
public function testRejectsUnknownDevice(): void {
|
|
[$c] = $this->make([]); // no secrets
|
|
$this->assertSame(401, $c->handle($this->signedReq('x', $this->payload()), now: 1000)->status());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Ingest/IngestController.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Ingest;
|
|
|
|
use App\Config;
|
|
use App\Http\{Request, Response};
|
|
use App\Security\Hmac;
|
|
use App\Repository\{DeviceRepository, NonceRepository, RateLimiterRepository,
|
|
EventRepository, SnapshotRepository};
|
|
|
|
final class IngestController
|
|
{
|
|
public function __construct(
|
|
private Config $cfg,
|
|
private DeviceRepository $devices,
|
|
private NonceRepository $nonces,
|
|
private RateLimiterRepository $rateLimiter,
|
|
private EventRepository $events,
|
|
private SnapshotRepository $snapshots,
|
|
) {}
|
|
|
|
public function handle(Request $req, int $now): Response
|
|
{
|
|
$payload = $req->json();
|
|
$deviceId = (string)($payload['device_id'] ?? '');
|
|
$window = intdiv($now, 60);
|
|
if ($deviceId !== '' && $this->rateLimiter->hit($deviceId, $window) > $this->cfg->rateLimitPerMin()) {
|
|
return Response::json(['error' => 'rate_limited'], 429);
|
|
}
|
|
|
|
$nonce = $req->header('X-Nonce') ?? '';
|
|
$ts = $req->header('X-Timestamp') ?? '';
|
|
$sig = $req->header('X-Signature') ?? '';
|
|
$secret = $deviceId !== '' ? $this->devices->secretFor($deviceId) : null;
|
|
if ($secret === null || $nonce === '' || $ts === '' || $sig === '') {
|
|
return Response::json(['error' => 'unauthorized'], 401);
|
|
}
|
|
if (!Hmac::verify($secret, $nonce, $ts, $req->body(), $sig)) {
|
|
return Response::json(['error' => 'bad_signature'], 401);
|
|
}
|
|
if (abs($now - (int)(float)$ts) > $this->cfg->timestampWindow()) {
|
|
return Response::json(['error' => 'stale_timestamp'], 401);
|
|
}
|
|
if ($this->nonces->seen($nonce)) {
|
|
return Response::json(['error' => 'replay'], 401);
|
|
}
|
|
$this->nonces->remember($nonce, $now + $this->cfg->nonceTtl());
|
|
|
|
$v = EventValidator::validate($payload);
|
|
if (!$v['ok']) return Response::json(['error' => 'invalid', 'details' => $v['errors']], 400);
|
|
|
|
$eventId = $this->events->insert($v['clean']);
|
|
foreach (($payload['snapshots'] ?? []) as $b64) {
|
|
$img = ImageProcessor::reencode((string)$b64);
|
|
if (!$img['ok']) continue;
|
|
$path = rtrim($this->cfg->snapshotDir(), '/\\') . '/' . $img['uuid'] . '.jpg';
|
|
file_put_contents($path, $img['bytes']);
|
|
$this->snapshots->add($eventId, $img['uuid'], $img['hash']);
|
|
}
|
|
return Response::json(['event_id' => $eventId], 201);
|
|
}
|
|
}
|
|
```
|
|
|
|
> **NOTE (implementer):** `InMemorySnapshotRepository::add` stores a `/tmp/...` path in the double; the controller also writes the real file to `snapshot_dir` (setUp creates the dir). Tests assert on `forEvent()` count only. Rate-limit is checked first so a flood is rejected before crypto work.
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Ingest/IngestController.php cloud/tests/IngestControllerTest.php
|
|
git commit -m "feat(cloud): ingest controller (HMAC+nonce+ratelimit+reencode+persist)"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 8: Password (argon2id) + Csrf
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Security/Password.php`, `cloud/src/Security/Csrf.php`, `cloud/tests/PasswordCsrfTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces:
|
|
- `App\Security\Password::hash(string $p): string` (PASSWORD_ARGON2ID), `Password::verify(string $p, string $hash): bool`.
|
|
- `App\Security\Csrf::issue(callable $randHex): string`, `Csrf::check(string $expected, string $given): bool` (hash_equals).
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/PasswordCsrfTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Security\{Password, Csrf};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class PasswordCsrfTest extends TestCase
|
|
{
|
|
public function testHashVerify(): void {
|
|
$h = Password::hash('s3cret!');
|
|
$this->assertNotSame('s3cret!', $h);
|
|
$this->assertTrue(Password::verify('s3cret!', $h));
|
|
$this->assertFalse(Password::verify('wrong', $h));
|
|
}
|
|
public function testCsrf(): void {
|
|
$t = Csrf::issue(fn() => 'abc123');
|
|
$this->assertSame('abc123', $t);
|
|
$this->assertTrue(Csrf::check($t, 'abc123'));
|
|
$this->assertFalse(Csrf::check($t, 'nope'));
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Security/Password.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Security;
|
|
|
|
final class Password
|
|
{
|
|
public static function hash(string $plain): string {
|
|
return password_hash($plain, PASSWORD_ARGON2ID);
|
|
}
|
|
public static function verify(string $plain, string $hash): bool {
|
|
return password_verify($plain, $hash);
|
|
}
|
|
}
|
|
```
|
|
|
|
`cloud/src/Security/Csrf.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Security;
|
|
|
|
final class Csrf
|
|
{
|
|
public static function issue(callable $randHex): string { return (string)$randHex(); }
|
|
public static function check(string $expected, string $given): bool {
|
|
return $expected !== '' && hash_equals($expected, $given);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Security/Password.php cloud/src/Security/Csrf.php cloud/tests/PasswordCsrfTest.php
|
|
git commit -m "feat(cloud): argon2id password + CSRF token helpers"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 9: Rbac (역할→권한)
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Auth/Rbac.php`, `cloud/tests/RbacTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: (없음)
|
|
- Produces: `App\Auth\Rbac::can(string $role, string $permission): bool`. 권한: `view_events`(all), `acknowledge`(admin,operator), `edit_zones`(admin,operator), `manage_thresholds`(admin), `manage_compliance`(admin).
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/RbacTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Auth\Rbac;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class RbacTest extends TestCase
|
|
{
|
|
public function testViewerCanOnlyView(): void {
|
|
$this->assertTrue(Rbac::can('viewer', 'view_events'));
|
|
$this->assertFalse(Rbac::can('viewer', 'acknowledge'));
|
|
$this->assertFalse(Rbac::can('viewer', 'edit_zones'));
|
|
}
|
|
public function testOperator(): void {
|
|
$this->assertTrue(Rbac::can('operator', 'acknowledge'));
|
|
$this->assertTrue(Rbac::can('operator', 'edit_zones'));
|
|
$this->assertFalse(Rbac::can('operator', 'manage_thresholds'));
|
|
}
|
|
public function testAdminAll(): void {
|
|
foreach (['view_events','acknowledge','edit_zones','manage_thresholds','manage_compliance'] as $p) {
|
|
$this->assertTrue(Rbac::can('admin', $p));
|
|
}
|
|
}
|
|
public function testUnknownDenied(): void {
|
|
$this->assertFalse(Rbac::can('ghost', 'view_events'));
|
|
$this->assertFalse(Rbac::can('admin', 'unknown_perm'));
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Auth/Rbac.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Auth;
|
|
|
|
final class Rbac
|
|
{
|
|
private const MATRIX = [
|
|
'admin' => ['view_events','acknowledge','edit_zones','manage_thresholds','manage_compliance'],
|
|
'operator' => ['view_events','acknowledge','edit_zones'],
|
|
'viewer' => ['view_events'],
|
|
];
|
|
public static function can(string $role, string $permission): bool {
|
|
return in_array($permission, self::MATRIX[$role] ?? [], true);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Auth/Rbac.php cloud/tests/RbacTest.php
|
|
git commit -m "feat(cloud): RBAC permission matrix"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 10: Session + AuthController (로그인/brute-force 잠금)
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Auth/Session.php`, `cloud/src/Auth/AuthController.php`, `cloud/tests/AuthControllerTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: `Password` (T8), `Request`/`Response` (T6), `UserRepository`/`AuditRepository` (T3)
|
|
- Produces:
|
|
- `interface App\Auth\SessionStore { get(string $k): mixed; set(string $k, mixed $v): void; clear(): void; }`, `ArraySessionStore` (test), `PhpSessionStore` (prod, secure cookie).
|
|
- `App\Auth\AuthController(UserRepository $users, AuditRepository $audit, int $maxAttempts=5, int $lockSeconds=900)` with `login(Request $req, SessionStore $sess, int $now): Response` and `logout(SessionStore $sess): Response`. Locks after maxAttempts; 200 on success (sets user in session), 401 on bad creds, 423 when locked.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/AuthControllerTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\Request;
|
|
use App\Security\Password;
|
|
use App\Auth\{AuthController, ArraySessionStore};
|
|
use App\Tests\Support\{InMemoryUserRepository, InMemoryAuditRepository};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class AuthControllerTest extends TestCase
|
|
{
|
|
private function users(): InMemoryUserRepository {
|
|
return new InMemoryUserRepository(['alice' => [
|
|
'id' => 1, 'username' => 'alice', 'password_hash' => Password::hash('pw'),
|
|
'role' => 'operator', 'site_scope' => null, 'failed_attempts' => 0, 'locked_until' => 0,
|
|
]]);
|
|
}
|
|
private function req(string $u, string $p): Request {
|
|
return new Request('POST', '/login', [], '', [], ['username' => $u, 'password' => $p]);
|
|
}
|
|
public function testLoginSuccessSetsSession(): void {
|
|
$c = new AuthController($this->users(), new InMemoryAuditRepository());
|
|
$sess = new ArraySessionStore();
|
|
$res = $c->login($this->req('alice', 'pw'), $sess, now: 1000);
|
|
$this->assertSame(200, $res->status());
|
|
$this->assertSame(1, $sess->get('user_id'));
|
|
$this->assertSame('operator', $sess->get('role'));
|
|
}
|
|
public function testBadPasswordIs401(): void {
|
|
$c = new AuthController($this->users(), new InMemoryAuditRepository());
|
|
$this->assertSame(401, $c->login($this->req('alice', 'nope'), new ArraySessionStore(), now: 1000)->status());
|
|
}
|
|
public function testLockoutAfterMaxAttempts(): void {
|
|
$repo = $this->users();
|
|
$c = new AuthController($repo, new InMemoryAuditRepository(), maxAttempts: 3, lockSeconds: 900);
|
|
for ($i = 0; $i < 3; $i++) $c->login($this->req('alice', 'bad'), new ArraySessionStore(), now: 1000);
|
|
// now locked, even correct password is 423
|
|
$this->assertSame(423, $c->login($this->req('alice', 'pw'), new ArraySessionStore(), now: 1000)->status());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Auth/Session.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Auth;
|
|
|
|
interface SessionStore {
|
|
public function get(string $key): mixed;
|
|
public function set(string $key, mixed $value): void;
|
|
public function clear(): void;
|
|
}
|
|
|
|
final class ArraySessionStore implements SessionStore {
|
|
private array $d = [];
|
|
public function get(string $k): mixed { return $this->d[$k] ?? null; }
|
|
public function set(string $k, mixed $v): void { $this->d[$k] = $v; }
|
|
public function clear(): void { $this->d = []; }
|
|
}
|
|
|
|
final class PhpSessionStore implements SessionStore {
|
|
public function __construct() { if (session_status() !== PHP_SESSION_ACTIVE) session_start([
|
|
'cookie_httponly' => true, 'cookie_secure' => true, 'cookie_samesite' => 'Lax',
|
|
]); }
|
|
public function get(string $k): mixed { return $_SESSION[$k] ?? null; }
|
|
public function set(string $k, mixed $v): void { $_SESSION[$k] = $v; }
|
|
public function clear(): void { $_SESSION = []; session_destroy(); }
|
|
}
|
|
```
|
|
|
|
`cloud/src/Auth/AuthController.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Auth;
|
|
|
|
use App\Http\{Request, Response};
|
|
use App\Security\Password;
|
|
use App\Repository\{UserRepository, AuditRepository};
|
|
|
|
final class AuthController
|
|
{
|
|
public function __construct(
|
|
private UserRepository $users,
|
|
private AuditRepository $audit,
|
|
private int $maxAttempts = 5,
|
|
private int $lockSeconds = 900,
|
|
) {}
|
|
|
|
public function login(Request $req, SessionStore $sess, int $now): Response
|
|
{
|
|
$username = (string)$req->post('username');
|
|
$password = (string)$req->post('password');
|
|
$u = $this->users->byUsername($username);
|
|
if ($u === null) return Response::json(['error' => 'invalid_credentials'], 401);
|
|
|
|
if ((int)($u['locked_until'] ?? 0) > $now) {
|
|
$this->audit->append($username, 'login_locked', 'auth', [], []);
|
|
return Response::json(['error' => 'locked'], 423);
|
|
}
|
|
if (!Password::verify($password, (string)$u['password_hash'])) {
|
|
$attempts = (int)($u['failed_attempts'] ?? 0) + 1;
|
|
$lock = $attempts >= $this->maxAttempts ? $now + $this->lockSeconds : 0;
|
|
$this->users->recordFailure((int)$u['id'], $lock);
|
|
$this->audit->append($username, 'login_failed', 'auth', [], ['attempts' => $attempts]);
|
|
return Response::json(['error' => 'invalid_credentials'], 401);
|
|
}
|
|
$this->users->clearFailures((int)$u['id']);
|
|
$sess->set('user_id', (int)$u['id']);
|
|
$sess->set('username', $u['username']);
|
|
$sess->set('role', $u['role']);
|
|
$sess->set('site_scope', $u['site_scope'] ?? null);
|
|
$this->audit->append($username, 'login_ok', 'auth', [], []);
|
|
return Response::json(['ok' => true], 200);
|
|
}
|
|
|
|
public function logout(SessionStore $sess): Response
|
|
{
|
|
$sess->clear();
|
|
return Response::json(['ok' => true], 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
> **NOTE (implementer):** the lockout test relies on `InMemoryUserRepository::recordFailure` mutating `failed_attempts`/`locked_until` on the stored row so the next `byUsername` reflects it (the double loops by reference — verify this persists across calls). `login` reads `locked_until` fresh on each call.
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Auth/Session.php cloud/src/Auth/AuthController.php cloud/tests/AuthControllerTest.php
|
|
git commit -m "feat(cloud): session store + auth controller with lockout"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 11: Router + 프론트컨트롤러 준비
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Http/Router.php`, `cloud/tests/RouterTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: `Request`/`Response` (T6)
|
|
- Produces: `App\Http\Router` with `add(string $method, string $path, callable $handler): void` and `dispatch(Request $req): Response` (404 if no match; path params `{id}` → passed to handler as second arg assoc array).
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/RouterTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\{Router, Request, Response};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class RouterTest extends TestCase
|
|
{
|
|
public function testMatchAndParams(): void {
|
|
$r = new Router();
|
|
$r->add('GET', '/events/{id}', fn(Request $req, array $p) => Response::json(['id' => $p['id']]));
|
|
$res = $r->dispatch(new Request('GET', '/events/42', [], '', [], []));
|
|
$this->assertSame(200, $res->status());
|
|
$this->assertSame(['id' => '42'], json_decode($res->body(), true));
|
|
}
|
|
public function testUnmatchedIs404(): void {
|
|
$r = new Router();
|
|
$this->assertSame(404, $r->dispatch(new Request('GET', '/nope', [], '', [], []))->status());
|
|
}
|
|
public function testMethodMismatchIs404(): void {
|
|
$r = new Router();
|
|
$r->add('POST', '/x', fn() => Response::text('ok'));
|
|
$this->assertSame(404, $r->dispatch(new Request('GET', '/x', [], '', [], []))->status());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Http/Router.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Http;
|
|
|
|
final class Router
|
|
{
|
|
private array $routes = [];
|
|
|
|
public function add(string $method, string $path, callable $handler): void {
|
|
$regex = '#^' . preg_replace('#\{(\w+)\}#', '(?P<$1>[^/]+)', $path) . '$#';
|
|
$this->routes[] = [strtoupper($method), $regex, $handler];
|
|
}
|
|
|
|
public function dispatch(Request $req): Response {
|
|
foreach ($this->routes as [$method, $regex, $handler]) {
|
|
if ($req->method() !== $method) continue;
|
|
if (preg_match($regex, $req->path(), $m)) {
|
|
$params = array_filter($m, 'is_string', ARRAY_FILTER_USE_KEY);
|
|
return $handler($req, $params);
|
|
}
|
|
}
|
|
return Response::json(['error' => 'not_found'], 404);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Http/Router.php cloud/tests/RouterTest.php
|
|
git commit -m "feat(cloud): path-param router + dispatch"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 12: 대시보드 컨트롤러 (목록·상세·확인) + 스냅샷 프록시
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Dashboard/EventListController.php`, `cloud/src/Dashboard/EventDetailController.php`, `cloud/src/Dashboard/SnapshotProxy.php`, `cloud/tests/DashboardTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: `Request`/`Response` (T6), `SessionStore`/`Rbac` (T9/T10), `EventRepository`/`SnapshotRepository`/`AuditRepository` (T3)
|
|
- Produces:
|
|
- `EventListController(EventRepository, SessionStore)::json(Request): Response` — 인증 필요, `?severity=` 필터, 최근 100개.
|
|
- `EventDetailController(EventRepository, SnapshotRepository, AuditRepository, SessionStore)::show(Request, array $params): Response`; `acknowledge(Request, array $params): Response` (RBAC `acknowledge`).
|
|
- `SnapshotProxy(SnapshotRepository, SessionStore)::serve(Request, array $params): Response` — 인증 필요, uuid→웹루트밖 파일 바이트 서빙(image/jpeg), 미인증 401, 없음 404.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/DashboardTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\Request;
|
|
use App\Auth\ArraySessionStore;
|
|
use App\Dashboard\{EventListController, EventDetailController, SnapshotProxy};
|
|
use App\Tests\Support\{InMemoryEventRepository, InMemorySnapshotRepository, InMemoryAuditRepository};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class DashboardTest extends TestCase
|
|
{
|
|
private function authed(string $role = 'operator'): ArraySessionStore {
|
|
$s = new ArraySessionStore(); $s->set('user_id', 1); $s->set('username', 'u'); $s->set('role', $role); return $s;
|
|
}
|
|
public function testListRequiresAuth(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$c = new EventListController($repo, new ArraySessionStore());
|
|
$this->assertSame(401, $c->json(new Request('GET', '/api/events', [], '', [], []))->status());
|
|
}
|
|
public function testListReturnsRecent(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$repo->insert(['severity' => 'high', 'event_type' => 'fall']);
|
|
$c = new EventListController($repo, $this->authed());
|
|
$res = $c->json(new Request('GET', '/api/events', [], '', [], []));
|
|
$this->assertSame(200, $res->status());
|
|
$this->assertCount(1, json_decode($res->body(), true)['events']);
|
|
}
|
|
public function testAcknowledgeRequiresPermissionAndSetsUser(): void {
|
|
$repo = new InMemoryEventRepository();
|
|
$id = $repo->insert(['severity' => 'critical', 'event_type' => 'no_motion']);
|
|
$req = new Request('POST', "/events/$id/ack", [], '', [], []);
|
|
// viewer denied
|
|
$cv = new EventDetailController($repo, new InMemorySnapshotRepository(), new InMemoryAuditRepository(), $this->authed('viewer'));
|
|
$this->assertSame(403, $cv->acknowledge($req, ['id' => (string)$id])->status());
|
|
// operator allowed
|
|
$co = new EventDetailController($repo, new InMemorySnapshotRepository(), new InMemoryAuditRepository(), $this->authed('operator'));
|
|
$this->assertSame(200, $co->acknowledge($req, ['id' => (string)$id])->status());
|
|
$this->assertSame('u', $repo->find($id)['acknowledged_by']);
|
|
}
|
|
public function testSnapshotProxyAuthAnd404(): void {
|
|
$snaps = new InMemorySnapshotRepository();
|
|
$proxy = new SnapshotProxy($snaps, new ArraySessionStore()); // unauth
|
|
$this->assertSame(401, $proxy->serve(new Request('GET', '/snap/x', [], '', [], []), ['uuid' => 'x'])->status());
|
|
$proxy2 = new SnapshotProxy($snaps, $this->authed());
|
|
$this->assertSame(404, $proxy2->serve(new Request('GET', '/snap/missing', [], '', [], []), ['uuid' => 'missing'])->status());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Dashboard/EventListController.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Dashboard;
|
|
|
|
use App\Http\{Request, Response};
|
|
use App\Auth\SessionStore;
|
|
use App\Repository\EventRepository;
|
|
|
|
final class EventListController
|
|
{
|
|
public function __construct(private EventRepository $events, private SessionStore $sess) {}
|
|
|
|
public function json(Request $req): Response
|
|
{
|
|
if ($this->sess->get('user_id') === null) return Response::json(['error' => 'unauthorized'], 401);
|
|
$severity = $req->query('severity');
|
|
$rows = $this->events->recent(100, $severity);
|
|
return Response::json(['events' => $rows], 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
`cloud/src/Dashboard/EventDetailController.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Dashboard;
|
|
|
|
use App\Http\{Request, Response};
|
|
use App\Auth\{SessionStore, Rbac};
|
|
use App\Repository\{EventRepository, SnapshotRepository, AuditRepository};
|
|
|
|
final class EventDetailController
|
|
{
|
|
public function __construct(
|
|
private EventRepository $events, private SnapshotRepository $snaps,
|
|
private AuditRepository $audit, private SessionStore $sess
|
|
) {}
|
|
|
|
public function show(Request $req, array $params): Response
|
|
{
|
|
if ($this->sess->get('user_id') === null) return Response::json(['error' => 'unauthorized'], 401);
|
|
$id = (int)($params['id'] ?? 0);
|
|
$event = $this->events->find($id);
|
|
if ($event === null) return Response::json(['error' => 'not_found'], 404);
|
|
return Response::json(['event' => $event, 'snapshots' => $this->snaps->forEvent($id)], 200);
|
|
}
|
|
|
|
public function acknowledge(Request $req, array $params): Response
|
|
{
|
|
if ($this->sess->get('user_id') === null) return Response::json(['error' => 'unauthorized'], 401);
|
|
if (!Rbac::can((string)$this->sess->get('role'), 'acknowledge')) return Response::json(['error' => 'forbidden'], 403);
|
|
$id = (int)($params['id'] ?? 0);
|
|
$user = (string)$this->sess->get('username');
|
|
if (!$this->events->acknowledge($id, $user)) return Response::json(['error' => 'not_found'], 404);
|
|
$this->audit->append($user, 'acknowledge', "event:$id", [], []);
|
|
return Response::json(['ok' => true], 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
`cloud/src/Dashboard/SnapshotProxy.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Dashboard;
|
|
|
|
use App\Http\{Request, Response};
|
|
use App\Auth\SessionStore;
|
|
use App\Repository\SnapshotRepository;
|
|
|
|
final class SnapshotProxy
|
|
{
|
|
public function __construct(private SnapshotRepository $snaps, private SessionStore $sess) {}
|
|
|
|
public function serve(Request $req, array $params): Response
|
|
{
|
|
if ($this->sess->get('user_id') === null) return Response::json(['error' => 'unauthorized'], 401);
|
|
$uuid = (string)($params['uuid'] ?? '');
|
|
$path = $this->snaps->pathByUuid($uuid);
|
|
if ($path === null || !is_file($path)) return Response::json(['error' => 'not_found'], 404);
|
|
return Response::bytes((string)file_get_contents($path), 'image/jpeg', 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Dashboard/EventListController.php cloud/src/Dashboard/EventDetailController.php cloud/src/Dashboard/SnapshotProxy.php cloud/tests/DashboardTest.php
|
|
git commit -m "feat(cloud): dashboard list/detail/ack + auth-gated snapshot proxy"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 13: Polygon 검증 + ZoneConfigController
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Geometry/Polygon.php`, `cloud/src/Dashboard/ZoneConfigController.php`, `cloud/tests/ZoneConfigTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: `Request`/`Response` (T6), `SessionStore`/`Rbac`, `ZoneRepository`/`AuditRepository` (T3)
|
|
- Produces:
|
|
- `App\Geometry\Polygon::validate(array $points): bool` — ≥3점, 각 점 `[x,y]` 숫자.
|
|
- `ZoneConfigController(ZoneRepository, AuditRepository, SessionStore)`: `list(Request, array): Response` (camera별), `save(Request): Response` (RBAC edit_zones; level ∈ {warning,restricted,pinch}; polygon 검증; zone_id 반환), `delete(Request, array): Response`.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/ZoneConfigTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\Request;
|
|
use App\Auth\ArraySessionStore;
|
|
use App\Geometry\Polygon;
|
|
use App\Dashboard\ZoneConfigController;
|
|
use App\Tests\Support\{InMemoryZoneRepository, InMemoryAuditRepository};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class ZoneConfigTest extends TestCase
|
|
{
|
|
private function authed(string $role = 'operator'): ArraySessionStore {
|
|
$s = new ArraySessionStore(); $s->set('user_id', 1); $s->set('username', 'u'); $s->set('role', $role); return $s;
|
|
}
|
|
public function testPolygonValidation(): void {
|
|
$this->assertTrue(Polygon::validate([[0,0],[10,0],[10,10]]));
|
|
$this->assertFalse(Polygon::validate([[0,0],[10,0]])); // <3
|
|
$this->assertFalse(Polygon::validate([[0,0],[10,0],['x',10]])); // non-numeric
|
|
}
|
|
private function saveReq(array $body): Request {
|
|
return new Request('POST', '/api/zones', [], json_encode($body), [], []);
|
|
}
|
|
public function testSaveRequiresPermission(): void {
|
|
$c = new ZoneConfigController(new InMemoryZoneRepository(), new InMemoryAuditRepository(), $this->authed('viewer'));
|
|
$res = $c->save($this->saveReq(['camera_id' => 'cam-1', 'level' => 'restricted', 'polygon' => [[0,0],[9,0],[9,9]]]));
|
|
$this->assertSame(403, $res->status());
|
|
}
|
|
public function testSaveValidZone(): void {
|
|
$repo = new InMemoryZoneRepository();
|
|
$c = new ZoneConfigController($repo, new InMemoryAuditRepository(), $this->authed('operator'));
|
|
$res = $c->save($this->saveReq(['device_id' => 'pi-1', 'camera_id' => 'cam-1', 'level' => 'restricted', 'polygon' => [[0,0],[9,0],[9,9]]]));
|
|
$this->assertSame(201, $res->status());
|
|
$this->assertCount(1, $repo->forCamera('cam-1'));
|
|
}
|
|
public function testSaveRejectsBadLevelOrPolygon(): void {
|
|
$c = new ZoneConfigController(new InMemoryZoneRepository(), new InMemoryAuditRepository(), $this->authed('operator'));
|
|
$this->assertSame(400, $c->save($this->saveReq(['camera_id' => 'cam-1', 'level' => 'BOOM', 'polygon' => [[0,0],[9,0],[9,9]]]))->status());
|
|
$this->assertSame(400, $c->save($this->saveReq(['camera_id' => 'cam-1', 'level' => 'warning', 'polygon' => [[0,0]]]))->status());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Geometry/Polygon.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Geometry;
|
|
|
|
final class Polygon
|
|
{
|
|
public static function validate(array $points): bool
|
|
{
|
|
if (count($points) < 3) return false;
|
|
foreach ($points as $pt) {
|
|
if (!is_array($pt) || count($pt) !== 2) return false;
|
|
if (!is_numeric($pt[0]) || !is_numeric($pt[1])) return false;
|
|
}
|
|
return true;
|
|
}
|
|
}
|
|
```
|
|
|
|
`cloud/src/Dashboard/ZoneConfigController.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Dashboard;
|
|
|
|
use App\Http\{Request, Response};
|
|
use App\Auth\{SessionStore, Rbac};
|
|
use App\Geometry\Polygon;
|
|
use App\Repository\{ZoneRepository, AuditRepository};
|
|
|
|
final class ZoneConfigController
|
|
{
|
|
private const LEVELS = ['warning','restricted','pinch'];
|
|
|
|
public function __construct(
|
|
private ZoneRepository $zones, private AuditRepository $audit, private SessionStore $sess
|
|
) {}
|
|
|
|
private function guard(string $perm): ?Response
|
|
{
|
|
if ($this->sess->get('user_id') === null) return Response::json(['error' => 'unauthorized'], 401);
|
|
if (!Rbac::can((string)$this->sess->get('role'), $perm)) return Response::json(['error' => 'forbidden'], 403);
|
|
return null;
|
|
}
|
|
|
|
public function list(Request $req, array $params): Response
|
|
{
|
|
if ($this->sess->get('user_id') === null) return Response::json(['error' => 'unauthorized'], 401);
|
|
return Response::json(['zones' => $this->zones->forCamera((string)($params['camera'] ?? ''))], 200);
|
|
}
|
|
|
|
public function save(Request $req): Response
|
|
{
|
|
if ($g = $this->guard('edit_zones')) return $g;
|
|
$b = $req->json();
|
|
$level = (string)($b['level'] ?? '');
|
|
$polygon = $b['polygon'] ?? [];
|
|
if (!in_array($level, self::LEVELS, true) || !is_array($polygon) || !Polygon::validate($polygon)) {
|
|
return Response::json(['error' => 'invalid_zone'], 400);
|
|
}
|
|
$zoneId = $this->zones->save([
|
|
'zone_id' => $b['zone_id'] ?? null,
|
|
'device_id' => (string)($b['device_id'] ?? ''),
|
|
'camera_id' => (string)($b['camera_id'] ?? ''),
|
|
'level' => $level,
|
|
'polygon_json' => json_encode($polygon),
|
|
]);
|
|
$this->audit->append((string)$this->sess->get('username'), 'zone_save', "zone:$zoneId", [], ['level' => $level]);
|
|
return Response::json(['zone_id' => $zoneId], 201);
|
|
}
|
|
|
|
public function delete(Request $req, array $params): Response
|
|
{
|
|
if ($g = $this->guard('edit_zones')) return $g;
|
|
$id = (string)($params['id'] ?? '');
|
|
if (!$this->zones->delete($id)) return Response::json(['error' => 'not_found'], 404);
|
|
$this->audit->append((string)$this->sess->get('username'), 'zone_delete', "zone:$id", [], []);
|
|
return Response::json(['ok' => true], 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Geometry/Polygon.php cloud/src/Dashboard/ZoneConfigController.php cloud/tests/ZoneConfigTest.php
|
|
git commit -m "feat(cloud): polygon validation + zone config controller (RBAC)"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 14: ConfigController + HeartbeatController (Pi 동기 API)
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Api/ConfigController.php`, `cloud/src/Api/HeartbeatController.php`, `cloud/tests/ApiSyncTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: `Request`/`Response` (T6), `Hmac` (T2), `DeviceRepository`/`ZoneRepository`/`ThresholdRepository` (T3), `Config` (T1)
|
|
- Produces:
|
|
- `App\Api\ConfigController(DeviceRepository, ZoneRepository, ThresholdRepository)::get(Request): Response` — `?device_id=`; device secret HMAC 검증(엣지 폴링). 반환 `{version, zones, thresholds}`.
|
|
- `App\Api\HeartbeatController(Config, DeviceRepository)::post(Request, int $now): Response` — HMAC 검증 후 `touchHeartbeat(device_id, {fps,temp,throttle,config_version,at})`. 200.
|
|
|
|
- [ ] **Step 1: 실패 테스트** — `cloud/tests/ApiSyncTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Config;
|
|
use App\Http\Request;
|
|
use App\Security\Hmac;
|
|
use App\Api\{ConfigController, HeartbeatController};
|
|
use App\Tests\Support\{InMemoryDeviceRepository, InMemoryZoneRepository, InMemoryThresholdRepository};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class ApiSyncTest extends TestCase
|
|
{
|
|
private function signed(string $method, string $path, string $secret, array $q = [], array $body = []): Request {
|
|
$raw = $body ? json_encode($body) : '';
|
|
$nonce = 'n1'; $ts = '1000';
|
|
$sig = Hmac::sign($secret, $nonce, $ts, $raw);
|
|
return new Request($method, $path, ['X-Nonce' => $nonce, 'X-Timestamp' => $ts, 'X-Signature' => $sig], $raw, $q, []);
|
|
}
|
|
public function testConfigReturnsZonesAndThresholds(): void {
|
|
$dev = new InMemoryDeviceRepository(['pi-1' => 'sek'], ['pi-1' => 7]);
|
|
$zones = new InMemoryZoneRepository(); $zones->save(['device_id' => 'pi-1', 'camera_id' => 'cam-1', 'level' => 'restricted', 'polygon_json' => '[[0,0],[9,0],[9,9]]']);
|
|
$thr = new InMemoryThresholdRepository(['pi-1' => ['fall_prone_s' => 3.0]]);
|
|
$c = new ConfigController($dev, $zones, $thr);
|
|
$res = $c->get($this->signed('GET', '/api/config', 'sek', ['device_id' => 'pi-1']));
|
|
$this->assertSame(200, $res->status());
|
|
$data = json_decode($res->body(), true);
|
|
$this->assertSame(7, $data['version']);
|
|
$this->assertCount(1, $data['zones']);
|
|
$this->assertSame(3.0, $data['thresholds']['fall_prone_s']);
|
|
}
|
|
public function testConfigRejectsBadSignature(): void {
|
|
$dev = new InMemoryDeviceRepository(['pi-1' => 'sek']);
|
|
$c = new ConfigController($dev, new InMemoryZoneRepository(), new InMemoryThresholdRepository());
|
|
$res = $c->get($this->signed('GET', '/api/config', 'WRONG', ['device_id' => 'pi-1']));
|
|
$this->assertSame(401, $res->status());
|
|
}
|
|
public function testHeartbeatStored(): void {
|
|
$cfg = Config::fromArray([]);
|
|
$dev = new InMemoryDeviceRepository(['pi-1' => 'sek']);
|
|
$c = new HeartbeatController($cfg, $dev);
|
|
$body = ['device_id' => 'pi-1', 'fps' => 12.0, 'temp' => 55.0, 'throttle' => false, 'config_version' => 7];
|
|
$res = $c->post($this->signed('POST', '/api/heartbeat', 'sek', [], $body), now: 1000);
|
|
$this->assertSame(200, $res->status());
|
|
$this->assertSame(12.0, $dev->heartbeats['pi-1']['fps']);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패 확인** → FAIL
|
|
|
|
- [ ] **Step 3: 구현** — `cloud/src/Api/ConfigController.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Api;
|
|
|
|
use App\Http\{Request, Response};
|
|
use App\Security\Hmac;
|
|
use App\Repository\{DeviceRepository, ZoneRepository, ThresholdRepository};
|
|
|
|
final class ConfigController
|
|
{
|
|
public function __construct(
|
|
private DeviceRepository $devices, private ZoneRepository $zones, private ThresholdRepository $thresholds
|
|
) {}
|
|
|
|
public function get(Request $req): Response
|
|
{
|
|
$deviceId = (string)$req->query('device_id');
|
|
$secret = $deviceId !== '' ? $this->devices->secretFor($deviceId) : null;
|
|
$nonce = $req->header('X-Nonce') ?? ''; $ts = $req->header('X-Timestamp') ?? ''; $sig = $req->header('X-Signature') ?? '';
|
|
if ($secret === null || !Hmac::verify($secret, $nonce, $ts, $req->body(), $sig)) {
|
|
return Response::json(['error' => 'unauthorized'], 401);
|
|
}
|
|
return Response::json([
|
|
'version' => $this->devices->configVersion($deviceId),
|
|
'zones' => $this->zones->forDevice($deviceId),
|
|
'thresholds' => $this->thresholds->forDevice($deviceId),
|
|
], 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
`cloud/src/Api/HeartbeatController.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Api;
|
|
|
|
use App\Config;
|
|
use App\Http\{Request, Response};
|
|
use App\Security\Hmac;
|
|
use App\Repository\DeviceRepository;
|
|
|
|
final class HeartbeatController
|
|
{
|
|
public function __construct(private Config $cfg, private DeviceRepository $devices) {}
|
|
|
|
public function post(Request $req, int $now): Response
|
|
{
|
|
$b = $req->json();
|
|
$deviceId = (string)($b['device_id'] ?? '');
|
|
$secret = $deviceId !== '' ? $this->devices->secretFor($deviceId) : null;
|
|
$nonce = $req->header('X-Nonce') ?? ''; $ts = $req->header('X-Timestamp') ?? ''; $sig = $req->header('X-Signature') ?? '';
|
|
if ($secret === null || !Hmac::verify($secret, $nonce, $ts, $req->body(), $sig)) {
|
|
return Response::json(['error' => 'unauthorized'], 401);
|
|
}
|
|
$this->devices->touchHeartbeat($deviceId, [
|
|
'fps' => (float)($b['fps'] ?? 0), 'temp' => (float)($b['temp'] ?? 0),
|
|
'throttle' => (bool)($b['throttle'] ?? false), 'config_version' => (int)($b['config_version'] ?? 0),
|
|
'at' => $now,
|
|
]);
|
|
return Response::json(['ok' => true], 200);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 4: 통과 + 커밋**
|
|
|
|
```bash
|
|
git add cloud/src/Api/ConfigController.php cloud/src/Api/HeartbeatController.php cloud/tests/ApiSyncTest.php
|
|
git commit -m "feat(cloud): device config + heartbeat sync API (HMAC)"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 15: 프론트컨트롤러 배선 + 뷰 + .htaccess (통합)
|
|
|
|
**Files:**
|
|
- Create: `cloud/public/index.php`, `cloud/public/.htaccess`, `cloud/public/assets/{app.css,app.js,zone-draw.js}`, `cloud/src/View/{layout.php,login.php,events.php,event_detail.php,zones.php}`, `cloud/tests/WiringSmokeTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: 전 태스크. `Router`, 모든 컨트롤러, `PhpSessionStore`, PDO repos (T16에서 실제 구현; 여기선 배선만).
|
|
- Produces: `cloud/public/index.php` — Config 로드 → PDO repos 생성 → Router에 모든 경로 등록 → dispatch → send. 뷰는 서버렌더 PHP. **테스트는 라우팅 표만 스모크 검증**(핸들러 스텁).
|
|
|
|
라우트 표:
|
|
| method | path | handler |
|
|
|---|---|---|
|
|
| POST | /api/events | IngestController::handle |
|
|
| POST | /api/heartbeat | HeartbeatController::post |
|
|
| GET | /api/config | ConfigController::get |
|
|
| POST | /login | AuthController::login |
|
|
| POST | /logout | AuthController::logout |
|
|
| GET | /api/events | EventListController::json |
|
|
| GET | /events/{id} | EventDetailController::show |
|
|
| POST | /events/{id}/ack | EventDetailController::acknowledge |
|
|
| GET | /api/zones/{camera} | ZoneConfigController::list |
|
|
| POST | /api/zones | ZoneConfigController::save |
|
|
| POST | /api/zones/{id}/delete | ZoneConfigController::delete |
|
|
| GET | /snap/{uuid} | SnapshotProxy::serve |
|
|
| GET | /, /zones, /login | View render |
|
|
|
|
- [ ] **Step 1: 라우터 스모크 테스트** — `cloud/tests/WiringSmokeTest.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Http\{Router, Request, Response};
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class WiringSmokeTest extends TestCase
|
|
{
|
|
public function testAllRoutesRegisteredAndDispatch(): void {
|
|
$r = new Router();
|
|
$paths = [
|
|
['POST', '/api/events'], ['POST', '/api/heartbeat'], ['GET', '/api/config'],
|
|
['POST', '/login'], ['POST', '/logout'], ['GET', '/api/events'],
|
|
['GET', '/events/{id}'], ['POST', '/events/{id}/ack'],
|
|
['GET', '/api/zones/{camera}'], ['POST', '/api/zones'],
|
|
['POST', '/api/zones/{id}/delete'], ['GET', '/snap/{uuid}'],
|
|
];
|
|
foreach ($paths as [$m, $p]) $r->add($m, $p, fn() => Response::json(['route' => $p]));
|
|
$this->assertSame(200, $r->dispatch(new Request('GET', '/events/9', [], '', [], []))->status());
|
|
$this->assertSame(200, $r->dispatch(new Request('GET', '/snap/abc', [], '', [], []))->status());
|
|
$this->assertSame(404, $r->dispatch(new Request('DELETE', '/api/events', [], '', [], []))->status());
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: 실패/통과 확인** → 라우터만 검증(회귀 방지). `./vendor/bin/phpunit tests/WiringSmokeTest.php` → PASS.
|
|
|
|
- [ ] **Step 3: 프론트컨트롤러** — `cloud/public/index.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
require __DIR__ . '/../vendor/autoload.php';
|
|
|
|
use App\Config;
|
|
use App\Http\{Request, Router, Response};
|
|
use App\Db\Database;
|
|
use App\Auth\PhpSessionStore;
|
|
use App\Repository\Pdo\{PdoDeviceRepository, PdoNonceRepository, PdoRateLimiterRepository,
|
|
PdoEventRepository, PdoSnapshotRepository, PdoUserRepository, PdoZoneRepository,
|
|
PdoThresholdRepository, PdoAuditRepository};
|
|
use App\Ingest\IngestController;
|
|
use App\Api\{ConfigController, HeartbeatController};
|
|
use App\Auth\AuthController;
|
|
use App\Dashboard\{EventListController, EventDetailController, SnapshotProxy, ZoneConfigController};
|
|
|
|
$cfg = Config::fromArray(require __DIR__ . '/../config.php');
|
|
$pdo = Database::connect($cfg);
|
|
$sess = new PhpSessionStore();
|
|
$now = time();
|
|
|
|
$devices = new PdoDeviceRepository($pdo);
|
|
$nonces = new PdoNonceRepository($pdo);
|
|
$rate = new PdoRateLimiterRepository($pdo);
|
|
$events = new PdoEventRepository($pdo);
|
|
$snaps = new PdoSnapshotRepository($pdo, $cfg->snapshotDir());
|
|
$users = new PdoUserRepository($pdo);
|
|
$zones = new PdoZoneRepository($pdo);
|
|
$thr = new PdoThresholdRepository($pdo);
|
|
$audit = new PdoAuditRepository($pdo);
|
|
|
|
$ingest = new IngestController($cfg, $devices, $nonces, $rate, $events, $snaps);
|
|
$config = new ConfigController($devices, $zones, $thr);
|
|
$heartbeat = new HeartbeatController($cfg, $devices);
|
|
$auth = new AuthController($users, $audit);
|
|
$list = new EventListController($events, $sess);
|
|
$detail = new EventDetailController($events, $snaps, $audit, $sess);
|
|
$proxy = new SnapshotProxy($snaps, $sess);
|
|
$zoneCtl = new ZoneConfigController($zones, $audit, $sess);
|
|
|
|
$render = function (string $view): Response {
|
|
ob_start(); require __DIR__ . '/../src/View/' . $view . '.php';
|
|
return Response::text((string)ob_get_clean());
|
|
};
|
|
|
|
$r = new Router();
|
|
$r->add('POST', '/api/events', fn(Request $q) => $ingest->handle($q, $now));
|
|
$r->add('POST', '/api/heartbeat', fn(Request $q) => $heartbeat->post($q, $now));
|
|
$r->add('GET', '/api/config', fn(Request $q) => $config->get($q));
|
|
$r->add('POST', '/login', fn(Request $q) => $auth->login($q, $sess, $now));
|
|
$r->add('POST', '/logout', fn(Request $q) => $auth->logout($sess));
|
|
$r->add('GET', '/api/events', fn(Request $q) => $list->json($q));
|
|
$r->add('GET', '/events/{id}', fn(Request $q, array $p) => $detail->show($q, $p));
|
|
$r->add('POST', '/events/{id}/ack', fn(Request $q, array $p) => $detail->acknowledge($q, $p));
|
|
$r->add('GET', '/api/zones/{camera}', fn(Request $q, array $p) => $zoneCtl->list($q, $p));
|
|
$r->add('POST', '/api/zones', fn(Request $q) => $zoneCtl->save($q));
|
|
$r->add('POST', '/api/zones/{id}/delete', fn(Request $q, array $p) => $zoneCtl->delete($q, $p));
|
|
$r->add('GET', '/snap/{uuid}', fn(Request $q, array $p) => $proxy->serve($q, $p));
|
|
$r->add('GET', '/', fn() => $render('events'));
|
|
$r->add('GET', '/login', fn() => $render('login'));
|
|
$r->add('GET', '/zones', fn() => $render('zones'));
|
|
|
|
$r->dispatch(Request::fromGlobals())->send();
|
|
```
|
|
|
|
- [ ] **Step 4: .htaccess** — `cloud/public/.htaccess`
|
|
|
|
```apache
|
|
RewriteEngine On
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteRule ^ index.php [QSA,L]
|
|
```
|
|
|
|
- [ ] **Step 5: 뷰 + 자산** — 서버렌더 PHP 뷰(로직 없음, 데이터는 JS가 API에서 로드):
|
|
- `src/View/layout.php`: 공통 헤더/네비.
|
|
- `src/View/login.php`: username/password 폼(POST /login), CSRF hidden.
|
|
- `src/View/events.php`: 실시간 목록 컨테이너 + `<script src="/assets/app.js">`.
|
|
- `src/View/event_detail.php`: 상세 컨테이너.
|
|
- `src/View/zones.php`: `<canvas>` + `<script src="/assets/zone-draw.js">`.
|
|
- `public/assets/app.css`: **색맹안전 심각도**(NF9) 클래스 — `.sev-critical`(빨강+아이콘 `⛔`+텍스트 "위급"), `.sev-high`(주황+`⚠`+"높음"), `.sev-warning`(노랑+`△`+"경고"), WCAG-AA 대비. 색 외 텍스트/아이콘 필수.
|
|
- `public/assets/app.js`: 5초 폴링 `GET /api/events`, 심각도별 텍스트+아이콘+색, 미확인 상단고정, 확인 버튼 → `POST /events/{id}/ack`.
|
|
- `public/assets/zone-draw.js`: canvas에 카메라 스냅샷 배경 + 클릭으로 폴리곤 점 추가, level(warning/restricted/pinch) 선택, 저장 → `POST /api/zones`; 기존 구역 `GET /api/zones/{camera}` 로드.
|
|
|
|
- [ ] **Step 6: 전체 스위트 + 커밋**
|
|
|
|
Run: `./vendor/bin/phpunit` (전체) — green.
|
|
|
|
```bash
|
|
git add cloud/public cloud/src/View cloud/tests/WiringSmokeTest.php
|
|
git commit -m "feat(cloud): front controller wiring + views + zone-draw UI"
|
|
```
|
|
|
|
---
|
|
|
|
## Task 16: PDO Repository 구현 + schema.sql + 배포 문서 (DB 게이트)
|
|
|
|
> ⚠️ **DB 통합 태스크.** 로컬에 PDO 드라이버 미로드 시 이 태스크의 DB 실행 테스트는 **게이트**(로컬에서 `pdo_sqlite` 활성 or Cafe24 MySQL). 단위 로직은 이미 T1~T15에서 mock repo로 검증됨. 이 태스크는 PDO 구현 + DDL + 배포 절차.
|
|
|
|
**Files:**
|
|
- Create: `cloud/src/Db/Database.php`, `cloud/src/Repository/Pdo/Pdo{Device,Nonce,RateLimiter,Event,Snapshot,User,Zone,Threshold,Audit}Repository.php` (9개), `cloud/schema.sql`, `cloud/docs/cloud-deploy.md`, `cloud/tests/PdoIntegrationTest.php`
|
|
|
|
**Interfaces:**
|
|
- Consumes: repository 인터페이스(T3), `Config`(T1)
|
|
- Produces: `App\Db\Database::connect(Config): PDO` (ERRMODE_EXCEPTION, prepared). 각 `Pdo*Repository`가 인터페이스 구현(전부 prepared statement).
|
|
|
|
- [ ] **Step 1: Database factory** — `cloud/src/Db/Database.php`
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Db;
|
|
use App\Config;
|
|
use PDO;
|
|
|
|
final class Database
|
|
{
|
|
public static function connect(Config $cfg): PDO
|
|
{
|
|
return new PDO($cfg->dbDsn(), $cfg->dbUser(), $cfg->dbPass(), [
|
|
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
|
|
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
|
|
PDO::ATTR_EMULATE_PREPARES => false,
|
|
]);
|
|
}
|
|
}
|
|
```
|
|
|
|
- [ ] **Step 2: schema.sql** — MySQL DDL (P1-B 서브셋: users, devices, cameras, zones, events, event_snapshots, thresholds, nonces, rate_limits, audit_log). §7.4 스펙 기준. `event_type`/`severity`/`level`은 애플리케이션 화이트리스트(+ 선택 CHECK). `nonces(nonce PK, expires_at INDEX)`, `rate_limits(rate_key, window)` 유니크. sqlite 호환 노트(AUTOINCREMENT 등) 주석. metrics/polygon_json은 TEXT/JSON.
|
|
|
|
- [ ] **Step 3: PDO repositories (9개)** — 각 인터페이스를 prepared statement로 구현. 예 `cloud/src/Repository/Pdo/PdoNonceRepository.php`:
|
|
|
|
```php
|
|
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Repository\Pdo;
|
|
use App\Repository\NonceRepository;
|
|
use PDO;
|
|
|
|
final class PdoNonceRepository implements NonceRepository
|
|
{
|
|
public function __construct(private PDO $pdo) {}
|
|
public function seen(string $nonce): bool {
|
|
$st = $this->pdo->prepare('SELECT 1 FROM nonces WHERE nonce = ? LIMIT 1');
|
|
$st->execute([$nonce]);
|
|
return (bool)$st->fetchColumn();
|
|
}
|
|
public function remember(string $nonce, int $expiresAt): void {
|
|
$st = $this->pdo->prepare('INSERT INTO nonces (nonce, expires_at) VALUES (?, ?)');
|
|
$st->execute([$nonce, $expiresAt]);
|
|
}
|
|
}
|
|
```
|
|
|
|
나머지 8개 동일 패턴(전부 prepared, 문자열 보간 금지):
|
|
- `PdoDeviceRepository`: secretFor(SELECT secret), touchHeartbeat(UPDATE/UPSERT), configVersion(SELECT).
|
|
- `PdoRateLimiterRepository`: `INSERT ... ON DUPLICATE KEY UPDATE count=count+1` (MySQL) 후 SELECT count. (sqlite는 UPSERT 구문 분기 or SELECT-then-INSERT/UPDATE.)
|
|
- `PdoEventRepository`: insert(INSERT, metrics=json_encode), recent(SELECT ORDER BY occurred_at DESC LIMIT, 선택 severity), find(SELECT), acknowledge(UPDATE acknowledged_by/at).
|
|
- `PdoSnapshotRepository`: add(INSERT), forEvent(SELECT), pathByUuid(=`snapshotDir/uuid.jpg`, 존재 시).
|
|
- `PdoUserRepository`: byUsername(SELECT), recordFailure(UPDATE), clearFailures(UPDATE).
|
|
- `PdoZoneRepository`: forDevice/forCamera(SELECT), save(UPSERT by zone_id or INSERT), delete(DELETE).
|
|
- `PdoThresholdRepository`: forDevice(SELECT key/value → assoc).
|
|
- `PdoAuditRepository`: append(INSERT, before/after=json_encode).
|
|
|
|
- [ ] **Step 4: (게이트) sqlite 통합 테스트** — `cloud/tests/PdoIntegrationTest.php`:
|
|
|
|
```php
|
|
protected function setUp(): void {
|
|
if (!in_array('sqlite', \PDO::getAvailableDrivers(), true)) {
|
|
$this->markTestSkipped('pdo_sqlite not available on this host');
|
|
}
|
|
// create sqlite :memory:, load sqlite-compatible DDL, then round-trip Pdo*Repository
|
|
}
|
|
```
|
|
|
|
로컬 PDO 미로드 환경에서도 `markTestSkipped`로 스위트 green 유지.
|
|
|
|
- [ ] **Step 5: 배포 문서** — `cloud/docs/cloud-deploy.md`: Cafe24 업로드 절차(`public/`만 웹루트; `storage/`·`src/`·`config.php`는 웹루트 밖 또는 상위 디렉토리), `config.php` 작성(config.example.php 복사), `schema.sql` phpMyAdmin import, per-device secret 발급(admin), 최초 admin 계정 생성 CLI 스니펫(`password_hash` argon2id), HTTPS/HSTS 강제, PHP 버전·gd·openssl 확인, `vendor/`는 배포 제외(런타임 의존성 0), storage/snapshots 쓰기권한.
|
|
|
|
- [ ] **Step 6: 전체 스위트 + 커밋**
|
|
|
|
Run: `./vendor/bin/phpunit` — green(통합은 sqlite 없으면 skip).
|
|
|
|
```bash
|
|
git add cloud/src/Db cloud/src/Repository/Pdo cloud/schema.sql cloud/docs/cloud-deploy.md cloud/tests/PdoIntegrationTest.php
|
|
git commit -m "feat(cloud): PDO repositories + schema + Cafe24 deploy doc"
|
|
```
|
|
|
|
---
|
|
|
|
## Self-Review
|
|
|
|
**1. Spec coverage (P1-B 범위):**
|
|
- Ingest HMAC+nonce+timestamp+ratelimit+재인코딩+웹루트밖 → T2·T5·T7 ✓ (NF5, §7.3)
|
|
- 인증/RBAC/세션/brute-force → T8·T9·T10 ✓ (NF7, §7.1)
|
|
- 최소 대시보드(목록·상세·확인)+스냅샷 프록시 → T12 ✓ (§7.2)
|
|
- 구역설정 UI(폴리곤 드로잉·저장) → T13·T15 ✓ (사용자 결정; **P1-A zone-loading 갭 해소** — Pi가 GET /api/config로 zones 폴링→ZoneIntrusionDetector 주입)
|
|
- config/heartbeat 동기 API → T14 ✓ (§7.3)
|
|
- DB schema+PDO+prepared → T3·T16 ✓ (§7.4, §9.2)
|
|
- audit 로그(확인·구역·로그인) → T10·T12·T13 ✓ (append; 해시체인 무결성은 P3)
|
|
- 색맹안전 심각도 → T15 뷰 ✓ (NF9)
|
|
- **P1-B 범위 밖(다른 단계):** 에스컬레이션·온콜·119(P3), 컴플라이언스 UI(사용자가 구역설정 선택 → 컴플라이언스는 P1-B-2/P2), 감도 다이얼·플릿·통계(P2/P3), legal-hold·해시체인 audit(P3), CSRF 토큰 실제 폼 강제(T8에 헬퍼 있음; 뷰/컨트롤러 강제는 T15 폼 + 후속).
|
|
|
|
**2. Placeholder scan:** 코드 스텝 모두 실제 PHP. T15 뷰/JS와 T16 PDO 8개·schema.sql은 인터페이스 시그니처(T3)·라우트표가 명확해 기계적 구현(각 지시에 SELECT/INSERT 매핑 명시). T16 DB 실행은 의도적 게이트.
|
|
|
|
**3. Type consistency:** 컨트롤러 소비 repo 시그니처가 T3 정의와 일치; `Request/Response`·`SessionStore`·`Hmac::verify`·`Rbac::can` 시그니처 태스크 간 일치. Ingest/Config/Heartbeat HMAC 검증이 P1-A `sign(nonce+ts+body)`와 동일(T2 테스트가 계약 고정).
|
|
|
|
**주의(구현자):** (a) InMemory `recordFailure`/`clearFailures`가 저장 배열 참조 갱신 → 다음 `byUsername` 반영(T10 잠금 테스트 전제). (b) Ingest 테스트 스냅샷 디렉토리 setUp 생성. (c) T15 스모크는 라우터 회귀만 검증(실제 컨트롤러 배선은 T16 PDO 완성 후 통합 구동).
|
|
|
|
---
|
|
|
|
## Execution Handoff
|
|
|
|
**Plan complete. 저장: `docs/superpowers/plans/2026-07-11-p1b-cloud-ingest-dashboard.md`.**
|
|
|
|
실행 옵션:
|
|
1. **Subagent-Driven (추천)** — 태스크마다 새 subagent + 리뷰. `superpowers:subagent-driven-development`.
|
|
2. **Inline Execution** — 이 세션 순차 실행. `superpowers:executing-plans`.
|
|
|
|
어느 방식으로?
|