Working state but no uploads

tests/Auth/PasswordResetControllerTest.php

@@ -7,6 +7,7 @@ use App\Auth\AuthServiceInterface;
 use App\Auth\PasswordResetController;
 use App\Auth\Exception\InvalidResetTokenException;
 use App\Auth\PasswordResetServiceInterface;
+use App\Shared\Http\ClientIpResolver;
 use App\Shared\Http\FlashServiceInterface;
 use App\User\Exception\WeakPasswordException;
 use App\User\User;
@@ -42,6 +43,7 @@ final class PasswordResetControllerTest extends ControllerTestCase
     /** @var FlashServiceInterface&MockObject */
     private FlashServiceInterface $flash;
 
+    private ClientIpResolver $clientIpResolver;
     private PasswordResetController $controller;
 
     private const BASE_URL = 'https://example.com';
@@ -52,6 +54,7 @@ final class PasswordResetControllerTest extends ControllerTestCase
         $this->passwordResetService = $this->createMock(PasswordResetServiceInterface::class);
         $this->authService          = $this->createMock(AuthServiceInterface::class);
         $this->flash                = $this->createMock(FlashServiceInterface::class);
+        $this->clientIpResolver     = new ClientIpResolver(['*']);
 
         // Par défaut : IP non verrouillée
         $this->authService->method('checkRateLimit')->willReturn(0);
@@ -61,6 +64,7 @@ final class PasswordResetControllerTest extends ControllerTestCase
             $this->passwordResetService,
             $this->authService,
             $this->flash,
+            $this->clientIpResolver,
             self::BASE_URL,
         );
     }
@@ -97,20 +101,27 @@ final class PasswordResetControllerTest extends ControllerTestCase
     public function testForgotRedirectsWhenRateLimited(): void
     {
         $authService = $this->createMock(AuthServiceInterface::class);
-        $authService->method('checkRateLimit')->willReturn(10);
+        $authService->expects($this->once())
+            ->method('checkRateLimit')
+            ->with('203.0.113.5')
+            ->willReturn(10);
 
         $controller = new PasswordResetController(
             $this->view,
             $this->passwordResetService,
             $authService,
             $this->flash,
+            $this->clientIpResolver,
             self::BASE_URL,
         );
 
         $this->flash->expects($this->once())->method('set')
             ->with('reset_error', $this->stringContains('Trop de demandes'));
 
-        $req = $this->makePost('/password/forgot', ['email' => 'alice@example.com']);
+        $req = $this->makePost('/password/forgot', ['email' => 'alice@example.com'], [
+            'REMOTE_ADDR' => '127.0.0.1',
+            'HTTP_X_FORWARDED_FOR' => '203.0.113.5, 198.51.100.12',
+        ]);
         $res = $controller->forgot($req, $this->makeResponse());
 
         $this->assertRedirectTo($res, '/password/forgot');
@@ -122,19 +133,26 @@ final class PasswordResetControllerTest extends ControllerTestCase
     public function testForgotDoesNotCallServiceWhenRateLimited(): void
     {
         $authService = $this->createMock(AuthServiceInterface::class);
-        $authService->method('checkRateLimit')->willReturn(5);
+        $authService->expects($this->once())
+            ->method('checkRateLimit')
+            ->with('203.0.113.5')
+            ->willReturn(5);
 
         $controller = new PasswordResetController(
             $this->view,
             $this->passwordResetService,
             $authService,
             $this->flash,
+            $this->clientIpResolver,
             self::BASE_URL,
         );
 
         $this->passwordResetService->expects($this->never())->method('requestReset');
 
-        $req = $this->makePost('/password/forgot', ['email' => 'alice@example.com']);
+        $req = $this->makePost('/password/forgot', ['email' => 'alice@example.com'], [
+            'REMOTE_ADDR' => '127.0.0.1',
+            'HTTP_X_FORWARDED_FOR' => '203.0.113.5, 198.51.100.12',
+        ]);
         $controller->forgot($req, $this->makeResponse());
     }
 
@@ -146,9 +164,14 @@ final class PasswordResetControllerTest extends ControllerTestCase
      */
     public function testForgotAlwaysRecordsFailure(): void
     {
-        $this->authService->expects($this->once())->method('recordFailure');
+        $this->authService->expects($this->once())
+            ->method('recordFailure')
+            ->with('203.0.113.5');
 
-        $req = $this->makePost('/password/forgot', ['email' => 'alice@example.com']);
+        $req = $this->makePost('/password/forgot', ['email' => 'alice@example.com'], [
+            'REMOTE_ADDR' => '127.0.0.1',
+            'HTTP_X_FORWARDED_FOR' => '203.0.113.5, 198.51.100.12',
+        ]);
         $this->controller->forgot($req, $this->makeResponse());
     }
 

tests/Shared/BootstrapTest.php

@@ -14,25 +14,6 @@ use Slim\App;
 
 final class BootstrapTest extends TestCase
 {
-    private array $envBackup = [];
-
-    protected function setUp(): void
-    {
-        $this->envBackup = [
-            'APP_AUTO_PROVISION' => $_ENV['APP_AUTO_PROVISION'] ?? null,
-        ];
-    }
-
-    protected function tearDown(): void
-    {
-        foreach ($this->envBackup as $key => $value) {
-            if ($value === null) {
-                unset($_ENV[$key]);
-            } else {
-                $_ENV[$key] = $value;
-            }
-        }
-    }
 
     public function testInitializeInfrastructureReturnsPreloadedContainer(): void
     {
@@ -55,10 +36,8 @@ final class BootstrapTest extends TestCase
         self::assertSame($app, $bootstrap->createHttpApp());
     }
 
-    public function testInitializeReturnsPreloadedAppWhenAutoProvisionIsDisabled(): void
+    public function testInitializeReturnsPreloadedApp(): void
     {
-        $_ENV['APP_AUTO_PROVISION'] = '0';
-
         $bootstrap = Bootstrap::create();
         $container = $this->createStub(ContainerInterface::class);
         $app = AppFactory::create();

tests/Shared/RequestContextTest.php

@@ -0,0 +1,55 @@
+<?php
+declare(strict_types=1);
+
+namespace Tests\Shared;
+
+use App\Shared\Http\RequestContext;
+use PHPUnit\Framework\TestCase;
+
+#[\PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations]
+final class RequestContextTest extends TestCase
+{
+    public function testIsHttpsReturnsTrueWhenNativeHttpsFlagIsEnabled(): void
+    {
+        self::assertTrue(RequestContext::isHttps([
+            'HTTPS' => 'on',
+        ]));
+    }
+
+    public function testIsHttpsReturnsTrueWhenTrustedProxyForwardsHttps(): void
+    {
+        self::assertTrue(RequestContext::isHttps([
+            'REMOTE_ADDR' => '127.0.0.1',
+            'HTTP_X_FORWARDED_PROTO' => 'https, http',
+        ], ['127.0.0.1']));
+    }
+
+    public function testIsHttpsIgnoresForwardedProtoWhenProxyIsNotTrusted(): void
+    {
+        self::assertFalse(RequestContext::isHttps([
+            'REMOTE_ADDR' => '10.0.0.5',
+            'HTTP_X_FORWARDED_PROTO' => 'https',
+        ], ['127.0.0.1']));
+    }
+
+    public function testTrustedProxiesFromEnvironmentTrimsValues(): void
+    {
+        self::assertSame(['127.0.0.1', '::1'], RequestContext::trustedProxiesFromEnvironment([
+            'TRUSTED_PROXIES' => ' 127.0.0.1 , ::1 ',
+        ]));
+    }
+
+    public function testTrustedProxiesFromEnvironmentFallsBackToProcessEnvWhenDotenvValueIsBlank(): void
+    {
+        putenv('TRUSTED_PROXIES=*');
+
+        try {
+            self::assertSame(['*'], RequestContext::trustedProxiesFromEnvironment([
+                'TRUSTED_PROXIES' => '',
+            ]));
+        } finally {
+            putenv('TRUSTED_PROXIES');
+        }
+    }
+}
+