930490d1b4
Two approved data-model changes. P1-9 — ingest idempotency. A POST can succeed server-side but time out client-side; the edge then re-queues and re-sends the same event, so the cloud stored duplicate alerts. The edge Event now carries a stable event_uuid (uuid4 hex) generated once at creation and preserved through the offline queue and every retry. Cloud: events.event_uuid CHAR(32) NULL UNIQUE; EventValidator accepts/validates it; IngestController returns the already-stored event (200, dedup:true) on a repeat uuid, race-safe against the UNIQUE key (catches the insert-race PDOException and returns the winner). P3-2b — site-scoped access control. site_scope was stored in the session but never enforced, so any authenticated user could read every site's worker snapshots (PIPA). Added devices.site; ingest denormalizes it onto events.site (server-derived from the authenticated device_id, never client-supplied). App\Security\SiteScope centralizes the rule (NULL scope = global operator). The event list filters in SQL (page(...,$site)); event detail + acknowledge and the snapshot proxy guard per-row and return 404 (not 403) cross-site so existence never leaks. Schema migration ALTERs and per-device/user provisioning UPDATEs are documented at the bottom of schema.sql. Tests: edge queue round-trip keeps the uuid; repeat-uuid dedups to one row; list scoped to caller site; detail cross-site 404; snapshot cross-site 404 / same-site 200; event_uuid validation. phpunit 97 passing (4 skipped: PDO), pytest 158 passing (2 skipped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW
83 lines
4 KiB
PHP
83 lines
4 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Ingest\EventValidator;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class EventValidatorTest extends TestCase
|
|
{
|
|
private function valid(): array {
|
|
return ['device_id' => 'pi-1', 'camera_id' => 'cam-1', 'event_type' => 'fall',
|
|
'severity' => 'high', 'occurred_at' => 1000.0, 'snapshots' => ['aGk=']];
|
|
}
|
|
public function testAcceptsValid(): void {
|
|
$r = EventValidator::validate($this->valid());
|
|
$this->assertTrue($r['ok'], implode(',', $r['errors']));
|
|
$this->assertSame('fall', $r['clean']['event_type']);
|
|
}
|
|
public function testRejectsOverlongIds(): void {
|
|
// An overlong id must be a 400 (invalid), not a MySQL 'Data too long' 500 that the edge
|
|
// then retries forever. Columns: device_id/camera_id VARCHAR(64), zone_id CHAR(32).
|
|
$long = $this->valid(); $long['device_id'] = str_repeat('x', 65);
|
|
$this->assertFalse(EventValidator::validate($long)['ok']);
|
|
$cam = $this->valid(); $cam['camera_id'] = str_repeat('y', 65);
|
|
$this->assertFalse(EventValidator::validate($cam)['ok']);
|
|
$zone = $this->valid(); $zone['zone_id'] = str_repeat('z', 33);
|
|
$this->assertFalse(EventValidator::validate($zone)['ok']);
|
|
// a normal-length id still passes
|
|
$ok = $this->valid(); $ok['device_id'] = str_repeat('x', 64);
|
|
$this->assertTrue(EventValidator::validate($ok)['ok']);
|
|
}
|
|
public function testAcceptsAndCleansEventUuid(): void {
|
|
$p = $this->valid(); $p['event_uuid'] = str_repeat('a', 32);
|
|
$r = EventValidator::validate($p);
|
|
$this->assertTrue($r['ok'], implode(',', $r['errors']));
|
|
$this->assertSame(str_repeat('a', 32), $r['clean']['event_uuid']);
|
|
// Optional: omitting it is valid and clean carries null (legacy edges send no uuid).
|
|
$none = EventValidator::validate($this->valid());
|
|
$this->assertTrue($none['ok']);
|
|
$this->assertNull($none['clean']['event_uuid']);
|
|
}
|
|
public function testRejectsMalformedEventUuid(): void {
|
|
foreach (['XYZ', str_repeat('a', 31), str_repeat('A', 32), 'g' . str_repeat('a', 31)] as $bad) {
|
|
$p = $this->valid(); $p['event_uuid'] = $bad;
|
|
$this->assertFalse(EventValidator::validate($p)['ok'], "uuid '$bad' must be rejected");
|
|
}
|
|
}
|
|
public function testRejectsUnknownEventType(): void {
|
|
$p = $this->valid(); $p['event_type'] = 'explode';
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsUnknownSeverity(): void {
|
|
$p = $this->valid(); $p['severity'] = 'ULTRA';
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsMissingRequired(): void {
|
|
$p = $this->valid(); unset($p['device_id']);
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsTooManySnapshots(): void {
|
|
$p = $this->valid(); $p['snapshots'] = ['a', 'b', 'c', 'd'];
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsNonNumericOccurredAt(): void {
|
|
$p = $this->valid(); $p['occurred_at'] = ['bad'];
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsNonStringDeviceId(): void {
|
|
$p = $this->valid(); $p['device_id'] = ['x'];
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsNonArraySnapshots(): void {
|
|
$p = $this->valid(); $p['snapshots'] = 'notarray';
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsNonStringSnapshotItem(): void {
|
|
$p = $this->valid(); $p['snapshots'] = [123];
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
public function testRejectsNonStringZoneId(): void {
|
|
$p = $this->valid(); $p['zone_id'] = ['z'];
|
|
$this->assertFalse(EventValidator::validate($p)['ok']);
|
|
}
|
|
}
|