' . htmlspecialchars( $e->getUserMessage() ) . '
';
+ exit;
+}
diff --git a/resources/views/admin/dashboard/index.php b/resources/views/admin/dashboard/index.php
index ea9aac9..bbde71b 100644
--- a/resources/views/admin/dashboard/index.php
+++ b/resources/views/admin/dashboard/index.php
@@ -4,15 +4,71 @@
@@ -88,6 +100,7 @@
+
+
+
diff --git a/resources/views/layouts/admin.php b/resources/views/layouts/admin.php
index 7a24717..8a7d686 100644
--- a/resources/views/layouts/admin.php
+++ b/resources/views/layouts/admin.php
@@ -29,6 +29,30 @@
Dashboard
+
+
+ Content
+
+
+
+
+
+ Users
+
+
+
View Site
diff --git a/resources/views/partials/media-picker-modal.php b/resources/views/partials/media-picker-modal.php
new file mode 100644
index 0000000..76322ca
--- /dev/null
+++ b/resources/views/partials/media-picker-modal.php
@@ -0,0 +1,378 @@
+
+
+
+
+
+
diff --git a/src/Cms/Auth/Filters/AuthenticationFilter.php b/src/Cms/Auth/Filters/AuthenticationFilter.php
index bac5bee..0c395d8 100644
--- a/src/Cms/Auth/Filters/AuthenticationFilter.php
+++ b/src/Cms/Auth/Filters/AuthenticationFilter.php
@@ -5,6 +5,7 @@
use Neuron\Routing\Filter;
use Neuron\Routing\RouteMap;
use Neuron\Cms\Services\Auth\Authentication;
+use Neuron\Cms\Exceptions\UnauthenticatedException;
use Neuron\Patterns\Registry;
/**
@@ -34,6 +35,8 @@ function( RouteMap $route ) { $this->checkAuthentication( $route ); },
/**
* Check if user is authenticated
+ *
+ * @throws UnauthenticatedException When user is not authenticated
*/
protected function checkAuthentication( RouteMap $route ): void
{
@@ -43,13 +46,16 @@ protected function checkAuthentication( RouteMap $route ): void
// Store intended URL for post-login redirect
$intendedUrl = $_SERVER['REQUEST_URI'] ?? $route->getPath();
- // Redirect to login page
+ // Build redirect URL to login page
$separator = ( strpos( $this->_loginUrl, '?' ) === false ) ? '?' : '&';
$query = http_build_query( [ $this->_redirectParam => $intendedUrl ] );
$redirectUrl = $this->_loginUrl . $separator . $query;
- header( 'Location: ' . $redirectUrl );
- exit;
+ throw new UnauthenticatedException(
+ $redirectUrl,
+ $intendedUrl,
+ 'User not authenticated, redirect required to: ' . $redirectUrl
+ );
}
Registry::getInstance()->set( 'Auth.User', $user );
diff --git a/src/Cms/Auth/Filters/CsrfFilter.php b/src/Cms/Auth/Filters/CsrfFilter.php
index c87c17b..9517ce7 100644
--- a/src/Cms/Auth/Filters/CsrfFilter.php
+++ b/src/Cms/Auth/Filters/CsrfFilter.php
@@ -5,6 +5,7 @@
use Neuron\Routing\Filter;
use Neuron\Routing\RouteMap;
use Neuron\Cms\Services\Auth\CsrfToken;
+use Neuron\Cms\Exceptions\CsrfValidationException;
use Neuron\Log\Log;
/**
@@ -32,6 +33,8 @@ function( RouteMap $route ) { $this->validateCsrfToken( $route ); },
/**
* Validate CSRF token
+ *
+ * @throws CsrfValidationException When token is missing or invalid
*/
protected function validateCsrfToken( RouteMap $route ): void
{
@@ -49,14 +52,20 @@ protected function validateCsrfToken( RouteMap $route ): void
if( !$token )
{
Log::warning( 'CSRF token missing from request' );
- $this->respondForbidden( 'CSRF token missing' );
+ throw new CsrfValidationException(
+ 'CSRF token missing from request',
+ 'CSRF token missing'
+ );
}
// Validate token
if( !$this->_csrfToken->validate( $token ) )
{
Log::warning( 'Invalid CSRF token' );
- $this->respondForbidden( 'Invalid CSRF token' );
+ throw new CsrfValidationException(
+ 'Invalid CSRF token provided',
+ 'Invalid CSRF token'
+ );
}
}
@@ -80,15 +89,4 @@ private function getTokenFromRequest(): ?string
return null;
}
-
- /**
- * Respond with 403 Forbidden
- */
- private function respondForbidden( string $message ): void
- {
- http_response_code( 403 );
- echo '
403 Forbidden
';
- echo '
' . htmlspecialchars( $message ) . '
';
- exit;
- }
}
diff --git a/src/Cms/Auth/Filters/MemberAuthenticationFilter.php b/src/Cms/Auth/Filters/MemberAuthenticationFilter.php
index 829391b..7e1b729 100644
--- a/src/Cms/Auth/Filters/MemberAuthenticationFilter.php
+++ b/src/Cms/Auth/Filters/MemberAuthenticationFilter.php
@@ -5,6 +5,8 @@
use Neuron\Routing\Filter;
use Neuron\Routing\RouteMap;
use Neuron\Cms\Services\Auth\Authentication;
+use Neuron\Cms\Exceptions\UnauthenticatedException;
+use Neuron\Cms\Exceptions\EmailVerificationRequiredException;
use Neuron\Patterns\Registry;
/**
@@ -42,6 +44,9 @@ function( RouteMap $route ) { $this->checkAuthentication( $route ); },
/**
* Check if user is authenticated and verified
+ *
+ * @throws UnauthenticatedException When user is not authenticated
+ * @throws EmailVerificationRequiredException When email verification is required but not completed
*/
protected function checkAuthentication( RouteMap $route ): void
{
@@ -53,21 +58,25 @@ protected function checkAuthentication( RouteMap $route ): void
// Store intended URL for post-login redirect
$intendedUrl = $_SERVER['REQUEST_URI'] ?? $route->getPath();
- // Redirect to login page
+ // Build redirect URL to login page
$separator = ( strpos( $this->_loginUrl, '?' ) === false ) ? '?' : '&';
$query = http_build_query( [ $this->_redirectParam => $intendedUrl ] );
$redirectUrl = $this->_loginUrl . $separator . $query;
- header( 'Location: ' . $redirectUrl );
- exit;
+ throw new UnauthenticatedException(
+ $redirectUrl,
+ $intendedUrl,
+ 'User not authenticated, redirect required to: ' . $redirectUrl
+ );
}
// Check if email verification is required
if( $this->_requireEmailVerification && !$user->isEmailVerified() )
{
- // Redirect to email verification required page
- header( 'Location: ' . $this->_verifyEmailUrl );
- exit;
+ throw new EmailVerificationRequiredException(
+ $this->_verifyEmailUrl,
+ 'Email verification required for user ID: ' . $user->getId()
+ );
}
// Set user in Registry for controllers to access
diff --git a/src/Cms/Cli/Commands/Install/InstallCommand.php b/src/Cms/Cli/Commands/Install/InstallCommand.php
index 4aab44e..02b8fb4 100644
--- a/src/Cms/Cli/Commands/Install/InstallCommand.php
+++ b/src/Cms/Cli/Commands/Install/InstallCommand.php
@@ -479,8 +479,11 @@ private function setupDatabase(): bool
// Optionally configure Cloudinary
$cloudinaryConfig = $this->configureCloudinary();
+ // Optionally configure Email
+ $emailConfig = $this->configureEmail();
+
// Merge and save complete configuration
- return $this->saveCompleteConfig( $config, $appConfig, $cloudinaryConfig );
+ return $this->saveCompleteConfig( $config, $appConfig, $cloudinaryConfig, $emailConfig );
}
/**
@@ -596,10 +599,161 @@ private function configureCloudinary(): array
];
}
+ /**
+ * Configure Email (optional)
+ */
+ private function configureEmail(): array
+ {
+ $this->output->writeln( "\n╔═══════════════════════════════════════╗" );
+ $this->output->writeln( "║ Email Configuration (Optional) ║" );
+ $this->output->writeln( "╚═══════════════════════════════════════╝\n" );
+
+ $this->output->writeln( "Email is used for:" );
+ $this->output->writeln( " • Email verification for new accounts" );
+ $this->output->writeln( " • Password reset requests" );
+ $this->output->writeln( " • User notifications and welcome emails" );
+ $this->output->writeln( "" );
+
+ if( !$this->input->confirm( "Would you like to configure email now?", false ) )
+ {
+ $this->output->info( "Skipping email configuration." );
+ $this->output->writeln( "Email will be in test mode (emails logged, not sent)" );
+ $this->output->writeln( "You can configure email later in config/neuron.yaml" );
+
+ return [
+ 'email' => [
+ 'driver' => 'mail',
+ 'test_mode' => true,
+ 'from_address' => 'noreply@example.com',
+ 'from_name' => 'Neuron CMS'
+ ]
+ ];
+ }
+
+ $this->output->writeln( "\n--- Email Driver ---\n" );
+
+ $driver = $this->input->choice(
+ "Select email driver:",
+ [
+ 'smtp' => 'SMTP - Recommended for production (Gmail, SendGrid, Mailgun, etc.)',
+ 'mail' => 'PHP mail() - Simple but less reliable (may go to spam)'
+ ],
+ 'smtp'
+ );
+
+ $config = [
+ 'driver' => $driver,
+ 'test_mode' => false
+ ];
+
+ // SMTP-specific configuration
+ if( $driver === 'smtp' )
+ {
+ $this->output->writeln( "\n--- SMTP Settings ---\n" );
+ $this->output->writeln( "Common SMTP providers:" );
+ $this->output->writeln( " • Gmail: smtp.gmail.com:587 (TLS)" );
+ $this->output->writeln( " • SendGrid: smtp.sendgrid.net:587 (TLS)" );
+ $this->output->writeln( " • Mailgun: smtp.mailgun.org:587 (TLS)" );
+ $this->output->writeln( " • Amazon SES: email-smtp.[region].amazonaws.com:587 (TLS)" );
+ $this->output->writeln( "" );
+
+ $host = $this->input->ask( "SMTP host (e.g., smtp.gmail.com)" );
+
+ if( !$host )
+ {
+ $this->output->warning( "SMTP host is required. Falling back to test mode." );
+ return [
+ 'email' => [
+ 'driver' => 'mail',
+ 'test_mode' => true,
+ 'from_address' => 'noreply@example.com',
+ 'from_name' => 'Neuron CMS'
+ ]
+ ];
+ }
+
+ $port = $this->input->ask( "SMTP port", "587" );
+ $encryption = $this->input->choice(
+ "Encryption type:",
+ [
+ 'tls' => 'TLS (recommended, port 587)',
+ 'ssl' => 'SSL (port 465)',
+ 'none' => 'None (not recommended)'
+ ],
+ 'tls'
+ );
+
+ $username = $this->input->ask( "SMTP username (usually your email address)" );
+
+ if( !$username )
+ {
+ $this->output->warning( "SMTP username is required. Falling back to test mode." );
+ return [
+ 'email' => [
+ 'driver' => 'mail',
+ 'test_mode' => true,
+ 'from_address' => 'noreply@example.com',
+ 'from_name' => 'Neuron CMS'
+ ]
+ ];
+ }
+
+ $password = $this->input->askSecret( "SMTP password (or app-specific password)" );
+
+ if( !$password )
+ {
+ $this->output->warning( "SMTP password is required. Falling back to test mode." );
+ return [
+ 'email' => [
+ 'driver' => 'mail',
+ 'test_mode' => true,
+ 'from_address' => 'noreply@example.com',
+ 'from_name' => 'Neuron CMS'
+ ]
+ ];
+ }
+
+ $config['host'] = $host;
+ $config['port'] = (int)$port;
+ $config['username'] = $username;
+ $config['password'] = $password;
+ $config['encryption'] = $encryption;
+
+ $this->_messages[] = "Email: SMTP ($host:$port)";
+ }
+ else
+ {
+ $this->_messages[] = "Email: PHP mail()";
+ }
+
+ // Common configuration
+ $this->output->writeln( "\n--- Sender Information ---\n" );
+
+ $fromAddress = $this->input->ask( "From email address", "noreply@example.com" );
+ $fromName = $this->input->ask( "From name", "Neuron CMS" );
+
+ $config['from_address'] = $fromAddress;
+ $config['from_name'] = $fromName;
+
+ // Test mode option
+ $this->output->writeln( "" );
+ $testMode = $this->input->confirm( "Enable test mode? (emails logged, not sent - useful for development)", false );
+
+ if( $testMode )
+ {
+ $config['test_mode'] = true;
+ $this->_messages[] = "Email test mode: ENABLED (emails will be logged, not sent)";
+ }
+
+ return [
+ 'email' => $config
+ ];
+ }
+
/**
* Save complete configuration with all required sections
*/
- private function saveCompleteConfig( array $databaseConfig, array $appConfig, array $cloudinaryConfig = [] ): bool
+ private function saveCompleteConfig( array $databaseConfig, array $appConfig, array $cloudinaryConfig = [], array $emailConfig = [] ): bool
{
// Build complete configuration
$config = [
@@ -639,6 +793,12 @@ private function saveCompleteConfig( array $databaseConfig, array $appConfig, ar
$config = array_merge( $config, $cloudinaryConfig );
}
+ // Merge Email configuration if provided
+ if( !empty( $emailConfig ) )
+ {
+ $config = array_merge( $config, $emailConfig );
+ }
+
// Save configuration
return $this->saveConfig( $config );
}
diff --git a/src/Cms/Controllers/Admin/Categories.php b/src/Cms/Controllers/Admin/Categories.php
index 746fcd8..5a066fc 100644
--- a/src/Cms/Controllers/Admin/Categories.php
+++ b/src/Cms/Controllers/Admin/Categories.php
@@ -28,20 +28,39 @@ class Categories extends Content
/**
* @param Application|null $app
+ * @param DatabaseCategoryRepository|null $categoryRepository
+ * @param Creator|null $categoryCreator
+ * @param Updater|null $categoryUpdater
+ * @param Deleter|null $categoryDeleter
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabaseCategoryRepository $categoryRepository = null,
+ ?Creator $categoryCreator = null,
+ ?Updater $categoryUpdater = null,
+ ?Deleter $categoryDeleter = null
+ )
{
parent::__construct( $app );
- // Get settings and initialize repository
- $settings = Registry::getInstance()->get( 'Settings' );
- $this->_categoryRepository = new DatabaseCategoryRepository( $settings );
+ // Use injected dependencies if provided (for testing), otherwise create them (for production)
+ if( $categoryRepository === null )
+ {
+ // Get settings and initialize repository
+ $settings = Registry::getInstance()->get( 'Settings' );
+ $categoryRepository = new DatabaseCategoryRepository( $settings );
+
+ // Initialize services
+ $categoryCreator = new Creator( $categoryRepository );
+ $categoryUpdater = new Updater( $categoryRepository );
+ $categoryDeleter = new Deleter( $categoryRepository );
+ }
- // Initialize services
- $this->_categoryCreator = new Creator( $this->_categoryRepository );
- $this->_categoryUpdater = new Updater( $this->_categoryRepository );
- $this->_categoryDeleter = new Deleter( $this->_categoryRepository );
+ $this->_categoryRepository = $categoryRepository;
+ $this->_categoryCreator = $categoryCreator;
+ $this->_categoryUpdater = $categoryUpdater;
+ $this->_categoryDeleter = $categoryDeleter;
}
/**
@@ -52,28 +71,15 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- $categoriesWithCount = $this->_categoryRepository->allWithPostCount();
-
- $viewData = [
- 'Title' => 'Categories | Admin | ' . $this->getName(),
- 'Description' => 'Manage blog categories',
- 'User' => $user,
- 'CategoriesWithCount' => $categoriesWithCount
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'categories'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Categories | Admin' )
+ ->description( 'Manage blog categories' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'CategoriesWithCount', $this->_categoryRepository->allWithPostCount() )
+ ->render( 'index', 'categories' );
}
/**
@@ -84,25 +90,14 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- $viewData = [
- 'Title' => 'Create Category | Admin | ' . $this->getName(),
- 'Description' => 'Create a new blog category',
- 'User' => $user
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'create',
- 'categories'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Create Category | Admin' )
+ ->description( 'Create a new blog category' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->render( 'create', 'categories' );
}
/**
@@ -136,13 +131,6 @@ public function store( Request $request ): never
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$categoryId = (int)$request->getRouteParameter( 'id' );
$category = $this->_categoryRepository->findById( $categoryId );
@@ -151,19 +139,15 @@ public function edit( Request $request ): string
throw new \RuntimeException( 'Category not found' );
}
- $viewData = [
- 'Title' => 'Edit Category | Admin | ' . $this->getName(),
- 'Description' => 'Edit blog category',
- 'User' => $user,
- 'Category' => $category
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'categories'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Edit Category | Admin' )
+ ->description( 'Edit blog category' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'Category', $category )
+ ->render( 'edit', 'categories' );
}
/**
diff --git a/src/Cms/Controllers/Admin/Dashboard.php b/src/Cms/Controllers/Admin/Dashboard.php
index 8ecbeb6..db752ab 100644
--- a/src/Cms/Controllers/Admin/Dashboard.php
+++ b/src/Cms/Controllers/Admin/Dashboard.php
@@ -3,13 +3,10 @@
namespace Neuron\Cms\Controllers\Admin;
use Neuron\Cms\Controllers\Content;
-use Neuron\Cms\Services\Auth\CsrfToken;
-use Neuron\Cms\Auth\SessionManager;
use Neuron\Core\Exceptions\NotFound;
use Neuron\Mvc\Application;
use Neuron\Mvc\Requests\Request;
use Neuron\Mvc\Responses\HttpResponseStatus;
-use Neuron\Patterns\Registry;
/**
* Admin dashboard controller.
@@ -37,31 +34,13 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- // Get authenticated user from Registry
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found in Registry' );
- }
-
- // Generate CSRF token and store in Registry for helper functions
- $sessionManager = new SessionManager();
- $sessionManager->start();
- $csrfToken = new CsrfToken( $sessionManager );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Dashboard | ' . $this->getName(),
- 'Description' => 'Admin Dashboard',
- 'User' => $user
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Dashboard' )
+ ->description( 'Admin Dashboard' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->render( 'index', 'admin' );
}
}
diff --git a/src/Cms/Controllers/Admin/EventCategories.php b/src/Cms/Controllers/Admin/EventCategories.php
index 53114a7..98e8e27 100644
--- a/src/Cms/Controllers/Admin/EventCategories.php
+++ b/src/Cms/Controllers/Admin/EventCategories.php
@@ -7,7 +7,6 @@
use Neuron\Cms\Services\EventCategory\Creator;
use Neuron\Cms\Services\EventCategory\Updater;
use Neuron\Cms\Services\EventCategory\Deleter;
-use Neuron\Cms\Services\Auth\CsrfToken;
use Neuron\Log\Log;
use Neuron\Mvc\Application;
use Neuron\Mvc\Requests\Request;
@@ -28,18 +27,37 @@ class EventCategories extends Content
/**
* @param Application|null $app
+ * @param DatabaseEventCategoryRepository|null $repository
+ * @param Creator|null $creator
+ * @param Updater|null $updater
+ * @param Deleter|null $deleter
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabaseEventCategoryRepository $repository = null,
+ ?Creator $creator = null,
+ ?Updater $updater = null,
+ ?Deleter $deleter = null
+ )
{
parent::__construct( $app );
- $settings = Registry::getInstance()->get( 'Settings' );
+ // Use injected dependencies if provided (for testing), otherwise create them (for production)
+ if( $repository === null )
+ {
+ $settings = Registry::getInstance()->get( 'Settings' );
+
+ $repository = new DatabaseEventCategoryRepository( $settings );
+ $creator = new Creator( $repository );
+ $updater = new Updater( $repository );
+ $deleter = new Deleter( $repository );
+ }
- $this->_repository = new DatabaseEventCategoryRepository( $settings );
- $this->_creator = new Creator( $this->_repository );
- $this->_updater = new Updater( $this->_repository );
- $this->_deleter = new Deleter( $this->_repository );
+ $this->_repository = $repository;
+ $this->_creator = $creator;
+ $this->_updater = $updater;
+ $this->_deleter = $deleter;
}
/**
@@ -47,34 +65,20 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
+ $this->initializeCsrfToken();
$sessionManager = $this->getSessionManager();
- $csrfToken = new CsrfToken( $sessionManager );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $categories = $this->_repository->all();
-
- $viewData = [
- 'Title' => 'Event Categories | ' . $this->getName(),
- 'Description' => 'Manage event categories',
- 'User' => $user,
- 'categories' => $categories,
- 'Success' => $sessionManager->getFlash( 'success' ),
- 'Error' => $sessionManager->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'admin'
- );
+ return $this->view()
+ ->title( 'Event Categories' )
+ ->description( 'Manage event categories' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'categories' => $this->_repository->all(),
+ 'Success' => $sessionManager->getFlash( 'success' ),
+ 'Error' => $sessionManager->getFlash( 'error' )
+ ])
+ ->render( 'index', 'admin' );
}
/**
@@ -82,31 +86,19 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
+ $this->initializeCsrfToken();
$sessionManager = $this->getSessionManager();
- $csrfToken = new CsrfToken( $sessionManager );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Create Event Category | ' . $this->getName(),
- 'Description' => 'Create a new event category',
- 'User' => $user,
- 'errors' => $sessionManager->getFlash( 'errors' ) ?: [],
- 'old' => $sessionManager->getFlash( 'old' ) ?: []
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'create',
- 'admin'
- );
+ return $this->view()
+ ->title( 'Create Event Category' )
+ ->description( 'Create a new event category' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'errors' => $sessionManager->getFlash( 'errors' ) ?: [],
+ 'old' => $sessionManager->getFlash( 'old' ) ?: []
+ ])
+ ->render( 'create', 'admin' );
}
/**
@@ -114,23 +106,6 @@ public function create( Request $request ): string
*/
public function store( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- // Validate CSRF token before any state changes
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for event category creation by user {$user->getId()}" );
- $this->redirect( 'admin_event_categories_create', [], ['error', 'Invalid security token. Please try again.'] );
- }
-
$name = $request->post( 'name', '' );
$slug = $request->post( 'slug', '' );
$color = $request->post( 'color', '#3b82f6' );
@@ -168,13 +143,6 @@ public function store( Request $request ): never
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$categoryId = (int)$request->getRouteParameter( 'id' );
$category = $this->_repository->findById( $categoryId );
@@ -183,22 +151,15 @@ public function edit( Request $request ): string
$this->redirect( 'admin_event_categories', [], ['error', 'Category not found'] );
}
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Edit Event Category | ' . $this->getName(),
- 'Description' => 'Edit event category',
- 'User' => $user,
- 'category' => $category
- ];
+ $this->initializeCsrfToken();
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'admin'
- );
+ return $this->view()
+ ->title( 'Edit Event Category' )
+ ->description( 'Edit event category' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'category', $category )
+ ->render( 'edit', 'admin' );
}
/**
@@ -206,13 +167,6 @@ public function edit( Request $request ): string
*/
public function update( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$categoryId = (int)$request->getRouteParameter( 'id' );
$category = $this->_repository->findById( $categoryId );
@@ -221,16 +175,6 @@ public function update( Request $request ): never
$this->redirect( 'admin_event_categories', [], ['error', 'Category not found'] );
}
- // Validate CSRF token before any state changes
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for event category update: Category {$categoryId}, user {$user->getId()}" );
- $this->redirect( 'admin_event_categories_edit', ['id' => $categoryId], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
$name = $request->post( 'name', '' );
@@ -259,13 +203,6 @@ public function update( Request $request ): never
*/
public function destroy( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$categoryId = (int)$request->getRouteParameter( 'id' );
$category = $this->_repository->findById( $categoryId );
@@ -274,16 +211,6 @@ public function destroy( Request $request ): never
$this->redirect( 'admin_event_categories', [], ['error', 'Category not found'] );
}
- // Validate CSRF token before any state changes
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for event category deletion: Category {$categoryId}, user {$user->getId()}" );
- $this->redirect( 'admin_event_categories', [], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
$this->_deleter->delete( $category );
diff --git a/src/Cms/Controllers/Admin/Events.php b/src/Cms/Controllers/Admin/Events.php
index c4932ae..22452a1 100644
--- a/src/Cms/Controllers/Admin/Events.php
+++ b/src/Cms/Controllers/Admin/Events.php
@@ -31,19 +31,41 @@ class Events extends Content
/**
* @param Application|null $app
+ * @param DatabaseEventRepository|null $eventRepository
+ * @param DatabaseEventCategoryRepository|null $categoryRepository
+ * @param Creator|null $creator
+ * @param Updater|null $updater
+ * @param Deleter|null $deleter
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabaseEventRepository $eventRepository = null,
+ ?DatabaseEventCategoryRepository $categoryRepository = null,
+ ?Creator $creator = null,
+ ?Updater $updater = null,
+ ?Deleter $deleter = null
+ )
{
parent::__construct( $app );
- $settings = Registry::getInstance()->get( 'Settings' );
+ // Use injected dependencies if provided (for testing), otherwise create them (for production)
+ if( $eventRepository === null )
+ {
+ $settings = Registry::getInstance()->get( 'Settings' );
+
+ $eventRepository = new DatabaseEventRepository( $settings );
+ $categoryRepository = new DatabaseEventCategoryRepository( $settings );
+ $creator = new Creator( $eventRepository, $categoryRepository );
+ $updater = new Updater( $eventRepository, $categoryRepository );
+ $deleter = new Deleter( $eventRepository );
+ }
- $this->_eventRepository = new DatabaseEventRepository( $settings );
- $this->_categoryRepository = new DatabaseEventCategoryRepository( $settings );
- $this->_creator = new Creator( $this->_eventRepository, $this->_categoryRepository );
- $this->_updater = new Updater( $this->_eventRepository, $this->_categoryRepository );
- $this->_deleter = new Deleter( $this->_eventRepository );
+ $this->_eventRepository = $eventRepository;
+ $this->_categoryRepository = $categoryRepository;
+ $this->_creator = $creator;
+ $this->_updater = $updater;
+ $this->_deleter = $deleter;
}
/**
@@ -51,42 +73,30 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- $sessionManager = $this->getSessionManager();
- $csrfToken = new CsrfToken( $sessionManager );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
+ $this->initializeCsrfToken();
// Get all events or filter by creator if not admin/editor
- if( $user->isAdmin() || $user->isEditor() )
+ if( is_admin() || is_editor() )
{
$events = $this->_eventRepository->all();
}
else
{
- $events = $this->_eventRepository->getByCreator( $user->getId() );
+ $events = $this->_eventRepository->getByCreator( user_id() );
}
- $viewData = [
- 'Title' => 'Events | ' . $this->getName(),
- 'Description' => 'Manage calendar events',
- 'User' => $user,
- 'events' => $events,
- 'Success' => $sessionManager->getFlash( 'success' ),
- 'Error' => $sessionManager->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'admin'
- );
+ $sessionManager = $this->getSessionManager();
+ return $this->view()
+ ->title( 'Events' )
+ ->description( 'Manage calendar events' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'events' => $events,
+ 'Success' => $sessionManager->getFlash( 'success' ),
+ 'Error' => $sessionManager->getFlash( 'error' )
+ ])
+ ->render( 'index', 'admin' );
}
/**
@@ -94,29 +104,15 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Create Event | ' . $this->getName(),
- 'Description' => 'Create a new calendar event',
- 'User' => $user,
- 'categories' => $this->_categoryRepository->all()
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'create',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Create Event' )
+ ->description( 'Create a new calendar event' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'categories', $this->_categoryRepository->all() )
+ ->render( 'create', 'admin' );
}
/**
@@ -124,23 +120,6 @@ public function create( Request $request ): string
*/
public function store( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- // Validate CSRF token before any state changes or processing
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for event creation by user {$user->getId()}" );
- $this->redirect( 'admin_events_create', [], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
$title = $request->post( 'title', '' );
@@ -161,7 +140,7 @@ public function store( Request $request ): never
$this->_creator->create(
$title,
new DateTimeImmutable( $startDate ),
- $user->getId(),
+ user_id(),
$status,
$slug ?: null,
$description ?: null,
@@ -189,13 +168,6 @@ public function store( Request $request ): never
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$eventId = (int)$request->getRouteParameter( 'id' );
$event = $this->_eventRepository->findById( $eventId );
@@ -205,28 +177,23 @@ public function edit( Request $request ): string
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $event->getCreatedBy() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $event->getCreatedBy() !== user_id() )
{
throw new \RuntimeException( 'Unauthorized to edit this event' );
}
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Edit Event | ' . $this->getName(),
- 'Description' => 'Edit calendar event',
- 'User' => $user,
- 'event' => $event,
- 'categories' => $this->_categoryRepository->all()
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Edit Event' )
+ ->description( 'Edit calendar event' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'event' => $event,
+ 'categories' => $this->_categoryRepository->all()
+ ])
+ ->render( 'edit', 'admin' );
}
/**
@@ -234,13 +201,6 @@ public function edit( Request $request ): string
*/
public function update( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$eventId = (int)$request->getRouteParameter( 'id' );
$event = $this->_eventRepository->findById( $eventId );
@@ -250,21 +210,11 @@ public function update( Request $request ): never
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $event->getCreatedBy() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $event->getCreatedBy() !== user_id() )
{
throw new \RuntimeException( 'Unauthorized to edit this event' );
}
- // Validate CSRF token before any state changes or processing
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for event update: Event {$eventId}, user {$user->getId()}" );
- $this->redirect( 'admin_events_edit', ['id' => $eventId], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
$title = $request->post( 'title', '' );
@@ -313,13 +263,6 @@ public function update( Request $request ): never
*/
public function destroy( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$eventId = (int)$request->getRouteParameter( 'id' );
$event = $this->_eventRepository->findById( $eventId );
@@ -329,21 +272,11 @@ public function destroy( Request $request ): never
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $event->getCreatedBy() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $event->getCreatedBy() !== user_id() )
{
$this->redirect( 'admin_events', [], ['error', 'Unauthorized to delete this event'] );
}
- // Validate CSRF token before any state changes
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for event deletion: Event {$eventId}, user {$user->getId()}" );
- $this->redirect( 'admin_events', [], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
$this->_deleter->delete( $event );
diff --git a/src/Cms/Controllers/Admin/Media.php b/src/Cms/Controllers/Admin/Media.php
index 00509d7..dcdf458 100644
--- a/src/Cms/Controllers/Admin/Media.php
+++ b/src/Cms/Controllers/Admin/Media.php
@@ -2,40 +2,161 @@
namespace Neuron\Cms\Controllers\Admin;
-use Neuron\Mvc\Controller;
+use Neuron\Cms\Controllers\Content;
use Neuron\Cms\Services\Media\CloudinaryUploader;
use Neuron\Cms\Services\Media\MediaValidator;
+use Neuron\Cms\Services\Auth\CsrfToken;
use Neuron\Data\Settings\SettingManager;
+use Neuron\Log\Log;
+use Neuron\Mvc\Application;
+use Neuron\Mvc\Requests\Request;
+use Neuron\Mvc\Responses\HttpResponseStatus;
use Neuron\Patterns\Registry;
/**
* Media upload controller.
*
- * Handles image uploads for the admin interface.
+ * Handles image uploads and media library management for the admin interface.
*
* @package Neuron\Cms\Controllers\Admin
*/
-class Media extends Controller
+class Media extends Content
{
private CloudinaryUploader $_uploader;
private MediaValidator $_validator;
/**
* Constructor
+ *
+ * @param Application|null $app
+ * @param CloudinaryUploader|null $uploader
+ * @param MediaValidator|null $validator
+ * @throws \Exception
*/
- public function __construct()
+ public function __construct(
+ ?Application $app = null,
+ ?CloudinaryUploader $uploader = null,
+ ?MediaValidator $validator = null
+ )
{
- parent::__construct();
+ parent::__construct( $app );
+
+ // Get settings once if we need to create any dependencies
+ $settings = null;
+ if( $uploader === null || $validator === null )
+ {
+ $settings = Registry::getInstance()->get( 'Settings' );
+
+ if( !$settings instanceof SettingManager )
+ {
+ throw new \Exception( 'Settings not found in Registry' );
+ }
+ }
+
+ // Create uploader if not provided
+ if( $uploader === null )
+ {
+ $uploader = new CloudinaryUploader( $settings );
+ }
+
+ // Create validator if not provided
+ if( $validator === null )
+ {
+ $validator = new MediaValidator( $settings );
+ }
+
+ $this->_uploader = $uploader;
+ $this->_validator = $validator;
+ }
- $settings = Registry::getInstance()->get( 'Settings' );
+ /**
+ * Display media library
+ *
+ * Shows all uploaded images from Cloudinary in a grid view.
+ * Supports pagination and search/filter.
+ *
+ * @param Request $request
+ * @return string Rendered view
+ * @throws \Exception
+ */
+ public function index( Request $request ): string
+ {
+ // Generate CSRF token
+ $sessionManager = $this->getSessionManager();
+ $csrfToken = new CsrfToken( $sessionManager );
+ Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
- if( !$settings instanceof SettingManager )
+ try
{
- throw new \Exception( 'Settings not found in Registry' );
+ // Get pagination cursor from query string
+ $rawCursor = $request->get( 'cursor' );
+
+ // Validate cursor - must be alphanumeric plus underscore/hyphen/equals (Cloudinary format)
+ // Fail closed by not passing invalid cursors to the API
+ $validatedCursor = null;
+ if( !empty( $rawCursor ) )
+ {
+ // Cloudinary cursors are typically base64-like strings with alphanumeric, _, -, and = characters
+ if( preg_match( '/^[a-zA-Z0-9_\-=]+$/', $rawCursor ) )
+ {
+ $validatedCursor = $rawCursor;
+ }
+ else
+ {
+ // Log invalid cursor attempt for security monitoring
+ Log::warning( 'Invalid pagination cursor rejected', [
+ 'cursor' => substr( $rawCursor, 0, 50 ), // Limit logged data
+ 'user_id' => user_id(),
+ 'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown'
+ ] );
+ }
+ }
+
+ // Build options array - only include next_cursor if validated
+ $options = ['max_results' => 30];
+ if( $validatedCursor !== null )
+ {
+ $options['next_cursor'] = $validatedCursor;
+ }
+
+ // List resources from Cloudinary with validated cursor
+ $result = $this->_uploader->listResources( $options );
+
+ return $this->view()
+ ->title( 'Media Library' )
+ ->description( 'Manage uploaded images' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'resources' => $result['resources'],
+ 'nextCursor' => $result['next_cursor'],
+ 'totalCount' => $result['total_count'],
+ 'success' => $sessionManager->getFlash( 'success' ),
+ 'error' => $sessionManager->getFlash( 'error' )
+ ])
+ ->render( 'index', 'admin' );
}
+ catch( \Exception $e )
+ {
+ Log::error( 'Error fetching media resources: ' . $e->getMessage(), [
+ 'exception' => $e,
+ 'user_id' => user_id()
+ ] );
- $this->_uploader = new CloudinaryUploader( $settings );
- $this->_validator = new MediaValidator( $settings );
+ return $this->view()
+ ->title( 'Media Library' )
+ ->description( 'Manage uploaded images' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'resources' => [],
+ 'nextCursor' => null,
+ 'totalCount' => 0,
+ 'success' => $sessionManager->getFlash( 'success' ),
+ 'error' => 'Failed to load media library. Please try again.'
+ ])
+ ->render( 'index', 'admin' );
+ }
}
/**
@@ -44,20 +165,23 @@ public function __construct()
* Handles POST /admin/upload/image
* Returns JSON in Editor.js format
*
- * @return void
+ * @param Request $request
+ * @return string JSON response
*/
- public function uploadImage(): void
+ public function uploadImage( Request $request ): string
{
- // Set JSON response header
- header( 'Content-Type: application/json' );
-
try
{
// Check if file was uploaded
if( !isset( $_FILES['image'] ) )
{
- $this->returnEditorJsError( 'No file was uploaded' );
- return;
+ return $this->renderJson(
+ HttpResponseStatus::BAD_REQUEST,
+ [
+ 'success' => 0,
+ 'message' => 'No file was uploaded'
+ ]
+ );
}
$file = $_FILES['image'];
@@ -65,19 +189,63 @@ public function uploadImage(): void
// Validate file
if( !$this->_validator->validate( $file ) )
{
- $this->returnEditorJsError( $this->_validator->getFirstError() );
- return;
+ Log::warning( 'Image upload validation failed', [
+ 'user_id' => user_id(),
+ 'filename' => $file['name'] ?? 'unknown',
+ 'error' => $this->_validator->getFirstError()
+ ] );
+
+ return $this->renderJson(
+ HttpResponseStatus::BAD_REQUEST,
+ [
+ 'success' => 0,
+ 'message' => $this->_validator->getFirstError()
+ ]
+ );
}
// Upload to Cloudinary
$result = $this->_uploader->upload( $file['tmp_name'] );
+ Log::info( 'Image uploaded successfully', [
+ 'user_id' => user_id(),
+ 'filename' => $file['name'],
+ 'public_id' => $result['public_id'],
+ 'url' => $result['url']
+ ] );
+
// Return success response in Editor.js format
- $this->returnEditorJsSuccess( $result );
+ return $this->renderJson(
+ HttpResponseStatus::OK,
+ [
+ 'success' => 1,
+ 'file' => [
+ 'url' => $result['url'],
+ 'width' => $result['width'],
+ 'height' => $result['height']
+ ]
+ ]
+ );
}
catch( \Exception $e )
{
- $this->returnEditorJsError( $e->getMessage() );
+ // Safely retrieve filename with explicit isset check to prevent undefined index
+ $filename = isset( $_FILES['image']['name'] ) ? $_FILES['image']['name'] : 'unknown';
+
+ Log::error( 'Image upload failed', [
+ 'user_id' => user_id(),
+ 'filename' => $filename,
+ 'exception' => $e,
+ 'message' => $e->getMessage()
+ ] );
+
+ return $this->renderJson(
+ HttpResponseStatus::INTERNAL_SERVER_ERROR,
+ [
+ 'success' => 0,
+ 'message' => 'Upload failed. Please try again.'
+ ]
+ );
}
}
@@ -87,20 +255,23 @@ public function uploadImage(): void
* Handles POST /admin/upload/featured-image
* Returns JSON with upload result
*
- * @return void
+ * @param Request $request
+ * @return string JSON response
*/
- public function uploadFeaturedImage(): void
+ public function uploadFeaturedImage( Request $request ): string
{
- // Set JSON response header
- header( 'Content-Type: application/json' );
-
try
{
// Check if file was uploaded
if( !isset( $_FILES['image'] ) )
{
- $this->returnError( 'No file was uploaded' );
- return;
+ return $this->renderJson(
+ HttpResponseStatus::BAD_REQUEST,
+ [
+ 'success' => false,
+ 'error' => 'No file was uploaded'
+ ]
+ );
}
$file = $_FILES['image'];
@@ -108,85 +279,59 @@ public function uploadFeaturedImage(): void
// Validate file
if( !$this->_validator->validate( $file ) )
{
- $this->returnError( $this->_validator->getFirstError() );
- return;
+ Log::warning( 'Featured image upload validation failed', [
+ 'user_id' => user_id(),
+ 'filename' => $file['name'] ?? 'unknown',
+ 'error' => $this->_validator->getFirstError()
+ ] );
+
+ return $this->renderJson(
+ HttpResponseStatus::BAD_REQUEST,
+ [
+ 'success' => false,
+ 'error' => $this->_validator->getFirstError()
+ ]
+ );
}
// Upload to Cloudinary
$result = $this->_uploader->upload( $file['tmp_name'] );
+ Log::info( 'Featured image uploaded successfully', [
+ 'user_id' => user_id(),
+ 'filename' => $file['name'],
+ 'public_id' => $result['public_id'],
+ 'url' => $result['url']
+ ] );
+
// Return success response
- $this->returnSuccess( $result );
+ return $this->renderJson(
+ HttpResponseStatus::OK,
+ [
+ 'success' => true,
+ 'data' => $result
+ ]
+ );
}
catch( \Exception $e )
{
- $this->returnError( $e->getMessage() );
- }
- }
-
- /**
- * Return Editor.js success response
- *
- * @param array $result Upload result
- * @return void
- */
- private function returnEditorJsSuccess( array $result ): void
- {
- echo json_encode( [
- 'success' => 1,
- 'file' => [
- 'url' => $result['url'],
- 'width' => $result['width'],
- 'height' => $result['height']
- ]
- ] );
- exit;
- }
+ // Safely retrieve filename with explicit isset check to prevent undefined index
+ $filename = isset( $_FILES['image']['name'] ) ? $_FILES['image']['name'] : 'unknown';
- /**
- * Return Editor.js error response
- *
- * @param string $message Error message
- * @return void
- */
- private function returnEditorJsError( string $message ): void
- {
- http_response_code( 400 );
- echo json_encode( [
- 'success' => 0,
- 'message' => $message
- ] );
- exit;
- }
-
- /**
- * Return standard success response
- *
- * @param array $result Upload result
- * @return void
- */
- private function returnSuccess( array $result ): void
- {
- echo json_encode( [
- 'success' => true,
- 'data' => $result
- ] );
- exit;
- }
+ Log::error( 'Featured image upload failed', [
+ 'user_id' => user_id(),
+ 'filename' => $filename,
+ 'exception' => $e,
+ 'message' => $e->getMessage()
+ ] );
- /**
- * Return standard error response
- *
- * @param string $message Error message
- * @return void
- */
- private function returnError( string $message ): void
- {
- http_response_code( 400 );
- echo json_encode( [
- 'success' => false,
- 'error' => $message
- ] );
- exit;
+ return $this->renderJson(
+ HttpResponseStatus::INTERNAL_SERVER_ERROR,
+ [
+ 'success' => false,
+ 'error' => 'Upload failed. Please try again.'
+ ]
+ );
+ }
}
}
diff --git a/src/Cms/Controllers/Admin/Pages.php b/src/Cms/Controllers/Admin/Pages.php
index 9341588..41609d5 100644
--- a/src/Cms/Controllers/Admin/Pages.php
+++ b/src/Cms/Controllers/Admin/Pages.php
@@ -29,22 +29,41 @@ class Pages extends Content
/**
* @param Application|null $app
+ * @param DatabasePageRepository|null $pageRepository
+ * @param Creator|null $pageCreator
+ * @param Updater|null $pageUpdater
+ * @param Deleter|null $pageDeleter
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabasePageRepository $pageRepository = null,
+ ?Creator $pageCreator = null,
+ ?Updater $pageUpdater = null,
+ ?Deleter $pageDeleter = null
+ )
{
parent::__construct( $app );
- // Get settings for repositories
- $settings = Registry::getInstance()->get( 'Settings' );
+ // Use injected dependencies if provided (for testing), otherwise create them (for production)
+ if( $pageRepository === null )
+ {
+ // Get settings for repositories
+ $settings = Registry::getInstance()->get( 'Settings' );
+
+ // Initialize repository
+ $pageRepository = new DatabasePageRepository( $settings );
- // Initialize repository
- $this->_pageRepository = new DatabasePageRepository( $settings );
+ // Initialize services
+ $pageCreator = new Creator( $pageRepository );
+ $pageUpdater = new Updater( $pageRepository );
+ $pageDeleter = new Deleter( $pageRepository );
+ }
- // Initialize services
- $this->_pageCreator = new Creator( $this->_pageRepository );
- $this->_pageUpdater = new Updater( $this->_pageRepository );
- $this->_pageDeleter = new Deleter( $this->_pageRepository );
+ $this->_pageRepository = $pageRepository;
+ $this->_pageCreator = $pageCreator;
+ $this->_pageUpdater = $pageUpdater;
+ $this->_pageDeleter = $pageDeleter;
}
/**
@@ -55,43 +74,32 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
// Generate CSRF token
$sessionManager = $this->getSessionManager();
$csrfToken = new CsrfToken( $sessionManager );
Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
// Get all pages or filter by author if not admin
- if( $user->isAdmin() || $user->isEditor() )
+ if( is_admin() || is_editor() )
{
$pages = $this->_pageRepository->all();
}
else
{
- $pages = $this->_pageRepository->getByAuthor( $user->getId() );
+ $pages = $this->_pageRepository->getByAuthor( user_id() );
}
- $viewData = [
- 'Title' => 'Pages | ' . $this->getName(),
- 'Description' => 'Manage pages',
- 'User' => $user,
- 'pages' => $pages,
- 'Success' => $sessionManager->getFlash( 'success' ),
- 'Error' => $sessionManager->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'pages/index',
- 'admin'
- );
+ return $this->view()
+ ->title( 'Pages' )
+ ->description( 'Manage pages' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'pages' => $pages,
+ 'Success' => $sessionManager->getFlash( 'success' ),
+ 'Error' => $sessionManager->getFlash( 'error' )
+ ])
+ ->render( 'pages/index', 'admin' );
}
/**
@@ -102,29 +110,14 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Create Page | ' . $this->getName(),
- 'Description' => 'Create a new page',
- 'User' => $user
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'pages/create',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Create Page' )
+ ->description( 'Create a new page' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->render( 'pages/create', 'admin' );
}
/**
@@ -135,23 +128,6 @@ public function create( Request $request ): string
*/
public function store( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- // Validate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for page creation by user {$user->getId()}" );
- $this->redirect( 'admin_pages_create', [], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
// Get form data
@@ -168,7 +144,7 @@ public function store( Request $request ): never
$page = $this->_pageCreator->create(
$title,
$content,
- $user->getId(),
+ user_id(),
$status,
$slug ?: null,
$template,
@@ -179,16 +155,16 @@ public function store( Request $request ): never
if( !$page )
{
- Log::error( "Page creation failed for user {$user->getId()}, title: {$title}" );
+ Log::error( "Page creation failed for user " . user_id() . ", title: {$title}" );
$this->redirect( 'admin_pages_create', [], ['error', 'Failed to create page. Please try again.'] );
}
- Log::info( "Page created successfully: ID {$page->getId()}, title: {$title}, by user {$user->getId()}" );
+ Log::info( "Page created successfully: ID {$page->getId()}, title: {$title}, by user " . user_id() );
$this->redirect( 'admin_pages', [], ['success', 'Page created successfully'] );
}
catch( \Exception $e )
{
- Log::error( "Exception during page creation by user {$user->getId()}: {$e->getMessage()}", [
+ Log::error( "Exception during page creation by user " . user_id() . ": {$e->getMessage()}", [
'exception' => $e,
'trace' => $e->getTraceAsString()
] );
@@ -204,13 +180,6 @@ public function store( Request $request ): never
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$pageId = (int)$request->getRouteParameter( 'id' );
$page = $this->_pageRepository->findById( $pageId );
@@ -220,29 +189,21 @@ public function edit( Request $request ): string
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $page->getAuthorId() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $page->getAuthorId() !== user_id() )
{
- Log::warning( "Unauthorized edit attempt by user {$user->getId()} on page {$pageId}" );
+ Log::warning( "Unauthorized edit attempt by user " . user_id() . " on page {$pageId}" );
$this->redirect( 'admin_pages', [], ['error', 'Unauthorized to edit this page'] );
}
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
+ $this->initializeCsrfToken();
- $viewData = [
- 'Title' => 'Edit Page | ' . $this->getName(),
- 'Description' => 'Edit page',
- 'User' => $user,
- 'page' => $page
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'pages/edit',
- 'admin'
- );
+ return $this->view()
+ ->title( 'Edit Page' )
+ ->description( 'Edit page' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'page', $page )
+ ->render( 'pages/edit', 'admin' );
}
/**
@@ -253,13 +214,6 @@ public function edit( Request $request ): string
*/
public function update( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$pageId = (int)$request->getRouteParameter( 'id' );
$page = $this->_pageRepository->findById( $pageId );
@@ -269,22 +223,12 @@ public function update( Request $request ): never
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $page->getAuthorId() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $page->getAuthorId() !== user_id() )
{
- Log::warning( "Unauthorized page update attempt: User {$user->getId()} tried to edit page {$pageId}" );
+ Log::warning( "Unauthorized page update attempt: User " . user_id() . " tried to edit page {$pageId}" );
$this->redirect( 'admin_pages', [], ['error', 'Unauthorized to edit this page'] );
}
- // Validate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for page update: Page {$pageId}, user {$user->getId()}" );
- $this->redirect( 'admin_pages_edit', ['id' => $pageId], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
// Get form data
@@ -312,16 +256,16 @@ public function update( Request $request ): never
if( !$success )
{
- Log::error( "Page update failed: Page {$pageId}, user {$user->getId()}, title: {$title}" );
+ Log::error( "Page update failed: Page {$pageId}, user " . user_id() . ", title: {$title}" );
$this->redirect( 'admin_pages_edit', ['id' => $pageId], ['error', 'Failed to update page. Please try again.'] );
}
- Log::info( "Page updated successfully: Page {$pageId}, title: {$title}, by user {$user->getId()}" );
+ Log::info( "Page updated successfully: Page {$pageId}, title: {$title}, by user " . user_id() );
$this->redirect( 'admin_pages', [], ['success', 'Page updated successfully'] );
}
catch( \Exception $e )
{
- Log::error( "Exception during page update: Page {$pageId}, user {$user->getId()}: {$e->getMessage()}", [
+ Log::error( "Exception during page update: Page {$pageId}, user " . user_id() . ": {$e->getMessage()}", [
'exception' => $e,
'trace' => $e->getTraceAsString()
] );
@@ -336,13 +280,6 @@ public function update( Request $request ): never
*/
public function destroy( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$pageId = (int)$request->getRouteParameter( 'id' );
$page = $this->_pageRepository->findById( $pageId );
@@ -352,22 +289,12 @@ public function destroy( Request $request ): never
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $page->getAuthorId() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $page->getAuthorId() !== user_id() )
{
- Log::warning( "Unauthorized page deletion attempt: User {$user->getId()} tried to delete page {$pageId}" );
+ Log::warning( "Unauthorized page deletion attempt: User " . user_id() . " tried to delete page {$pageId}" );
$this->redirect( 'admin_pages', [], ['error', 'Unauthorized to delete this page'] );
}
- // Validate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- $submittedToken = $request->post( 'csrf_token', '' );
-
- if( !$csrfToken->validate( $submittedToken ) )
- {
- Log::warning( "CSRF validation failed for page deletion: Page {$pageId}, user {$user->getId()}" );
- $this->redirect( 'admin_pages', [], ['error', 'Invalid security token. Please try again.'] );
- }
-
try
{
$pageTitle = $page->getTitle(); // Store for logging before deletion
@@ -376,16 +303,16 @@ public function destroy( Request $request ): never
if( !$success )
{
- Log::error( "Page deletion failed: Page {$pageId}, user {$user->getId()}" );
+ Log::error( "Page deletion failed: Page {$pageId}, user " . user_id() );
$this->redirect( 'admin_pages', [], ['error', 'Failed to delete page. Please try again.'] );
}
- Log::info( "Page deleted successfully: Page {$pageId}, title: {$pageTitle}, by user {$user->getId()}" );
+ Log::info( "Page deleted successfully: Page {$pageId}, title: {$pageTitle}, by user " . user_id() );
$this->redirect( 'admin_pages', [], ['success', 'Page deleted successfully'] );
}
catch( \Exception $e )
{
- Log::error( "Exception during page deletion: Page {$pageId}, user {$user->getId()}: {$e->getMessage()}", [
+ Log::error( "Exception during page deletion: Page {$pageId}, user " . user_id() . ": {$e->getMessage()}", [
'exception' => $e,
'trace' => $e->getTraceAsString()
] );
diff --git a/src/Cms/Controllers/Admin/Posts.php b/src/Cms/Controllers/Admin/Posts.php
index e260929..3f05b52 100644
--- a/src/Cms/Controllers/Admin/Posts.php
+++ b/src/Cms/Controllers/Admin/Posts.php
@@ -33,39 +33,86 @@ class Posts extends Content
/**
* @param Application|null $app
+ * @param DatabasePostRepository|null $postRepository
+ * @param DatabaseCategoryRepository|null $categoryRepository
+ * @param DatabaseTagRepository|null $tagRepository
+ * @param Creator|null $postCreator
+ * @param Updater|null $postUpdater
+ * @param Deleter|null $postDeleter
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabasePostRepository $postRepository = null,
+ ?DatabaseCategoryRepository $categoryRepository = null,
+ ?DatabaseTagRepository $tagRepository = null,
+ ?Creator $postCreator = null,
+ ?Updater $postUpdater = null,
+ ?Deleter $postDeleter = null
+ )
{
parent::__construct( $app );
- // Get settings for repositories
- $settings = Registry::getInstance()->get( 'Settings' );
+ // Get settings once if we need to create any repositories
+ $settings = null;
+ if( $postRepository === null || $categoryRepository === null || $tagRepository === null )
+ {
+ $settings = Registry::getInstance()->get( 'Settings' );
+ }
+
+ // Individually ensure each repository is initialized
+ if( $postRepository === null )
+ {
+ $postRepository = new DatabasePostRepository( $settings );
+ }
+
+ if( $categoryRepository === null )
+ {
+ $categoryRepository = new DatabaseCategoryRepository( $settings );
+ }
- // Initialize repositories
- $this->_postRepository = new DatabasePostRepository( $settings );
- $this->_categoryRepository = new DatabaseCategoryRepository( $settings );
- $this->_tagRepository = new DatabaseTagRepository( $settings );
+ if( $tagRepository === null )
+ {
+ $tagRepository = new DatabaseTagRepository( $settings );
+ }
- // Initialize services
+ // Build downstream services using guaranteed non-null repositories
+ // Create TagResolver if needed for Creator/Updater services
$tagResolver = new TagResolver(
- $this->_tagRepository,
- new \Neuron\Cms\Services\Tag\Creator( $this->_tagRepository )
+ $tagRepository,
+ new \Neuron\Cms\Services\Tag\Creator( $tagRepository )
);
- $this->_postCreator = new Creator(
- $this->_postRepository,
- $this->_categoryRepository,
- $tagResolver
- );
+ if( $postCreator === null )
+ {
+ $postCreator = new Creator(
+ $postRepository,
+ $categoryRepository,
+ $tagResolver
+ );
+ }
- $this->_postUpdater = new Updater(
- $this->_postRepository,
- $this->_categoryRepository,
- $tagResolver
- );
+ if( $postUpdater === null )
+ {
+ $postUpdater = new Updater(
+ $postRepository,
+ $categoryRepository,
+ $tagResolver
+ );
+ }
- $this->_postDeleter = new Deleter( $this->_postRepository );
+ if( $postDeleter === null )
+ {
+ $postDeleter = new Deleter( $postRepository );
+ }
+
+ // Assign to properties with defensive checks
+ $this->_postRepository = $postRepository;
+ $this->_categoryRepository = $categoryRepository;
+ $this->_tagRepository = $tagRepository;
+ $this->_postCreator = $postCreator;
+ $this->_postUpdater = $postUpdater;
+ $this->_postDeleter = $postDeleter;
}
/**
@@ -76,43 +123,30 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- // Generate CSRF token
- $sessionManager = $this->getSessionManager();
- $csrfToken = new CsrfToken( $sessionManager );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
+ $this->initializeCsrfToken();
// Get all posts or filter by author if not admin
- if( $user->isAdmin() || $user->isEditor() )
+ if( is_admin() || is_editor() )
{
$posts = $this->_postRepository->all();
}
else
{
- $posts = $this->_postRepository->getByAuthor( $user->getUsername() );
+ $posts = $this->_postRepository->getByAuthor( user_id() );
}
- $viewData = [
- 'Title' => 'Posts | ' . $this->getName(),
- 'Description' => 'Manage blog posts',
- 'User' => $user,
- 'posts' => $posts,
- 'Success' => $sessionManager->getFlash( 'success' ),
- 'Error' => $sessionManager->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'admin'
- );
+ $sessionManager = $this->getSessionManager();
+ return $this->view()
+ ->title( 'Posts' )
+ ->description( 'Manage blog posts' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'posts' => $posts,
+ 'Success' => $sessionManager->getFlash( 'success' ),
+ 'Error' => $sessionManager->getFlash( 'error' )
+ ])
+ ->render( 'index', 'admin' );
}
/**
@@ -123,30 +157,15 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Create Post | ' . $this->getName(),
- 'Description' => 'Create a new blog post',
- 'User' => $user,
- 'categories' => $this->_categoryRepository->all()
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'create',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Create Post' )
+ ->description( 'Create a new blog post' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'categories', $this->_categoryRepository->all() )
+ ->render( 'create', 'admin' );
}
/**
@@ -157,13 +176,6 @@ public function create( Request $request ): string
*/
public function store( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
try
{
// Get form data
@@ -180,7 +192,7 @@ public function store( Request $request ): never
$this->_postCreator->create(
$title,
$content,
- $user->getId(),
+ user_id(),
$status,
$slug ?: null,
$excerpt ?: null,
@@ -205,13 +217,6 @@ public function store( Request $request ): never
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$postId = (int)$request->getRouteParameter( 'id' );
$post = $this->_postRepository->findById( $postId );
@@ -221,29 +226,23 @@ public function edit( Request $request ): string
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $post->getAuthorId() !== user_id() )
{
throw new \RuntimeException( 'Unauthorized to edit this post' );
}
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Edit Post | ' . $this->getName(),
- 'Description' => 'Edit blog post',
- 'User' => $user,
- 'post' => $post,
- 'categories' => $this->_categoryRepository->all()
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Edit Post' )
+ ->description( 'Edit blog post' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'post' => $post,
+ 'categories' => $this->_categoryRepository->all()
+ ])
+ ->render( 'edit', 'admin' );
}
/**
@@ -254,12 +253,6 @@ public function edit( Request $request ): string
*/
public function update( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
$postId = (int)$request->getRouteParameter( 'id' );
$post = $this->_postRepository->findById( $postId );
@@ -270,7 +263,7 @@ public function update( Request $request ): never
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $post->getAuthorId() !== user_id() )
{
throw new \RuntimeException( 'Unauthorized to edit this post' );
}
@@ -315,12 +308,6 @@ public function update( Request $request ): never
*/
public function destroy( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
$postId = (int)$request->getRouteParameter( 'id' );
$post = $this->_postRepository->findById( $postId );
@@ -331,7 +318,7 @@ public function destroy( Request $request ): never
}
// Check permissions
- if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() )
+ if( !is_admin() && !is_editor() && $post->getAuthorId() !== user_id() )
{
$this->redirect( 'admin_posts', [], ['error', 'Unauthorized to delete this post'] );
}
diff --git a/src/Cms/Controllers/Admin/Profile.php b/src/Cms/Controllers/Admin/Profile.php
index 74ff398..99f6126 100644
--- a/src/Cms/Controllers/Admin/Profile.php
+++ b/src/Cms/Controllers/Admin/Profile.php
@@ -26,19 +26,42 @@ class Profile extends Content
/**
* @param Application|null $app
+ * @param DatabaseUserRepository|null $repository
+ * @param PasswordHasher|null $hasher
+ * @param Updater|null $userUpdater
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabaseUserRepository $repository = null,
+ ?PasswordHasher $hasher = null,
+ ?Updater $userUpdater = null
+ )
{
parent::__construct( $app );
- // Get settings and initialize repository
- $settings = Registry::getInstance()->get( 'Settings' );
- $this->_repository = new DatabaseUserRepository( $settings );
- $this->_hasher = new PasswordHasher();
+ // Get settings if we need to create repository
+ if( $repository === null )
+ {
+ $settings = Registry::getInstance()->get( 'Settings' );
+ $repository = new DatabaseUserRepository( $settings );
+ }
+
+ // Create hasher if not provided
+ if( $hasher === null )
+ {
+ $hasher = new PasswordHasher();
+ }
- // Initialize service
- $this->_userUpdater = new Updater( $this->_repository, $this->_hasher );
+ // Create updater if not provided
+ if( $userUpdater === null )
+ {
+ $userUpdater = new Updater( $repository, $hasher );
+ }
+
+ $this->_repository = $repository;
+ $this->_hasher = $hasher;
+ $this->_userUpdater = $userUpdater;
}
/**
@@ -49,36 +72,30 @@ public function __construct( ?Application $app = null )
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
+ $this->initializeCsrfToken();
+ // Get authenticated user once
+ $user = auth();
if( !$user )
{
throw new \RuntimeException( 'Authenticated user not found' );
}
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
// Get available timezones grouped by region with selection state
$timezones = \DateTimeZone::listIdentifiers();
$groupedTimezones = group_timezones_for_select( $timezones, $user->getTimezone() );
- $viewData = [
- 'Title' => 'Profile | ' . $this->getName(),
- 'Description' => 'Edit Your Profile',
- 'User' => $user,
- 'groupedTimezones' => $groupedTimezones,
- 'success' => $this->getSessionManager()->getFlash( 'success' ),
- 'error' => $this->getSessionManager()->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'admin'
- );
+ return $this->view()
+ ->title( 'Profile' )
+ ->description( 'Edit Your Profile' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'groupedTimezones' => $groupedTimezones,
+ 'success' => $this->getSessionManager()->getFlash( 'success' ),
+ 'error' => $this->getSessionManager()->getFlash( 'error' )
+ ])
+ ->render( 'edit', 'admin' );
}
/**
@@ -89,11 +106,11 @@ public function edit( Request $request ): string
*/
public function update( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
+ // Get authenticated user once and check for null
+ $user = auth();
if( !$user )
{
- throw new \RuntimeException( 'Authenticated user not found' );
+ $this->redirect( 'admin_profile', [], ['error', 'Authenticated user not found'] );
}
// Security: Only use email from POST if provided by Account Information form
diff --git a/src/Cms/Controllers/Admin/Tags.php b/src/Cms/Controllers/Admin/Tags.php
index c4503b9..cab9b02 100644
--- a/src/Cms/Controllers/Admin/Tags.php
+++ b/src/Cms/Controllers/Admin/Tags.php
@@ -21,17 +21,27 @@ class Tags extends Content
/**
* @param Application|null $app
+ * @param DatabaseTagRepository|null $tagRepository
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabaseTagRepository $tagRepository = null
+ )
{
parent::__construct( $app );
- // Get settings for repositories
- $settings = Registry::getInstance()->get( 'Settings' );
+ // Use injected dependencies if provided (for testing), otherwise create them (for production)
+ if( $tagRepository === null )
+ {
+ // Get settings for repositories
+ $settings = Registry::getInstance()->get( 'Settings' );
+
+ // Initialize repository
+ $tagRepository = new DatabaseTagRepository( $settings );
+ }
- // Initialize repository
- $this->_tagRepository = new DatabaseTagRepository( $settings );
+ $this->_tagRepository = $tagRepository;
}
/**
@@ -42,28 +52,15 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- $tagsWithCount = $this->_tagRepository->allWithPostCount();
-
- $viewData = [
- 'Title' => 'Tags | Admin | ' . $this->getName(),
- 'Description' => 'Manage blog tags',
- 'User' => $user,
- 'TagsWithCount' => $tagsWithCount
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'tags'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Tags | Admin' )
+ ->description( 'Manage blog tags' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'TagsWithCount', $this->_tagRepository->allWithPostCount() )
+ ->render( 'index', 'tags' );
}
/**
@@ -74,25 +71,14 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
- $viewData = [
- 'Title' => 'Create Tag | Admin | ' . $this->getName(),
- 'Description' => 'Create a new blog tag',
- 'User' => $user
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'create',
- 'tags'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Create Tag | Admin' )
+ ->description( 'Create a new blog tag' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->render( 'create', 'tags' );
}
/**
@@ -134,13 +120,6 @@ public function store( Request $request ): never
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found' );
- }
-
$tagId = (int)$request->getRouteParameter( 'id' );
$tag = $this->_tagRepository->findById( $tagId );
@@ -149,19 +128,15 @@ public function edit( Request $request ): string
throw new \RuntimeException( 'Tag not found' );
}
- $viewData = [
- 'Title' => 'Edit Tag | Admin | ' . $this->getName(),
- 'Description' => 'Edit blog tag',
- 'User' => $user,
- 'Tag' => $tag
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'tags'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Edit Tag | Admin' )
+ ->description( 'Edit blog tag' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'Tag', $tag )
+ ->render( 'edit', 'tags' );
}
/**
diff --git a/src/Cms/Controllers/Admin/Users.php b/src/Cms/Controllers/Admin/Users.php
index 5a9ab06..b116632 100644
--- a/src/Cms/Controllers/Admin/Users.php
+++ b/src/Cms/Controllers/Admin/Users.php
@@ -30,21 +30,40 @@ class Users extends Content
/**
* @param Application|null $app
+ * @param DatabaseUserRepository|null $repository
+ * @param Creator|null $userCreator
+ * @param Updater|null $userUpdater
+ * @param Deleter|null $userDeleter
* @throws \Exception
*/
- public function __construct( ?Application $app = null )
+ public function __construct(
+ ?Application $app = null,
+ ?DatabaseUserRepository $repository = null,
+ ?Creator $userCreator = null,
+ ?Updater $userUpdater = null,
+ ?Deleter $userDeleter = null
+ )
{
parent::__construct( $app );
- // Get settings and initialize repository
- $settings = Registry::getInstance()->get( 'Settings' );
- $this->_repository = new DatabaseUserRepository( $settings );
+ // Use injected dependencies if provided (for testing), otherwise create them (for production)
+ if( $repository === null )
+ {
+ // Get settings and initialize repository
+ $settings = Registry::getInstance()->get( 'Settings' );
+ $repository = new DatabaseUserRepository( $settings );
+
+ // Initialize services
+ $hasher = new PasswordHasher();
+ $userCreator = new Creator( $repository, $hasher );
+ $userUpdater = new Updater( $repository, $hasher );
+ $userDeleter = new Deleter( $repository );
+ }
- // Initialize services
- $hasher = new PasswordHasher();
- $this->_userCreator = new Creator( $this->_repository, $hasher );
- $this->_userUpdater = new Updater( $this->_repository, $hasher );
- $this->_userDeleter = new Deleter( $this->_repository );
+ $this->_repository = $repository;
+ $this->_userCreator = $userCreator;
+ $this->_userUpdater = $userUpdater;
+ $this->_userDeleter = $userDeleter;
}
/**
@@ -55,29 +74,21 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $users = $this->_repository->all();
-
- $viewData = [
- 'Title' => 'Users | ' . $this->getName(),
- 'Description' => 'User Management',
- 'User' => $user,
- 'users' => $users,
- 'Success' => $this->getSessionManager()->getFlash( 'success' ),
- 'Error' => $this->getSessionManager()->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ $sessionManager = $this->getSessionManager();
+
+ return $this->view()
+ ->title( 'Users' )
+ ->description( 'User Management' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'users' => $this->_repository->all(),
+ 'Success' => $sessionManager->getFlash( 'success' ),
+ 'Error' => $sessionManager->getFlash( 'error' )
+ ])
+ ->render( 'index', 'admin' );
}
/**
@@ -88,25 +99,15 @@ public function index( Request $request ): string
*/
public function create( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Create User | ' . $this->getName(),
- 'Description' => 'Create New User',
- 'User' => $user,
- 'roles' => [User::ROLE_ADMIN, User::ROLE_EDITOR, User::ROLE_AUTHOR, User::ROLE_SUBSCRIBER]
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'create',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Create User' )
+ ->description( 'Create New User' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'roles', [User::ROLE_ADMIN, User::ROLE_EDITOR, User::ROLE_AUTHOR, User::ROLE_SUBSCRIBER] )
+ ->render( 'create', 'admin' );
}
/**
@@ -149,7 +150,6 @@ public function store( Request $request ): never
public function edit( Request $request ): string
{
$id = (int)$request->getRouteParameter( 'id' );
- $currentUser = Registry::getInstance()->get( 'Auth.User' );
$user = $this->_repository->findById( $id );
if( !$user )
@@ -157,24 +157,18 @@ public function edit( Request $request ): string
$this->redirect( 'admin_users', [], ['error', 'User not found'] );
}
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Edit User | ' . $this->getName(),
- 'Description' => 'Edit User',
- 'User' => $currentUser,
- 'user' => $user,
- 'roles' => [User::ROLE_ADMIN, User::ROLE_EDITOR, User::ROLE_AUTHOR, User::ROLE_SUBSCRIBER]
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'admin'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Edit User' )
+ ->description( 'Edit User' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with([
+ 'user' => $user,
+ 'roles' => [User::ROLE_ADMIN, User::ROLE_EDITOR, User::ROLE_AUTHOR, User::ROLE_SUBSCRIBER]
+ ])
+ ->render( 'edit', 'admin' );
}
/**
@@ -229,10 +223,9 @@ public function update( Request $request ): never
public function destroy( Request $request ): never
{
$id = (int)$request->getRouteParameter( 'id' );
- $currentUser = Registry::getInstance()->get( 'Auth.User' );
// Prevent self-deletion
- if( $currentUser && $currentUser->getId() === $id )
+ if( user_id() === $id )
{
$this->redirect( 'admin_users', [], ['error', 'Cannot delete your own account'] );
}
diff --git a/src/Cms/Controllers/Auth/Login.php b/src/Cms/Controllers/Auth/Login.php
index 0d65b87..a33c764 100644
--- a/src/Cms/Controllers/Auth/Login.php
+++ b/src/Cms/Controllers/Auth/Login.php
@@ -70,20 +70,14 @@ public function showLoginForm( Request $request ): string
? $requestedRedirect
: $defaultRedirect;
- $viewData = [
- 'Title' => 'Login | ' . $this->getName(),
- 'Description' => 'Login to ' . $this->getName(),
- 'Error' => $this->getSessionManager()->getFlash( 'error' ),
- 'Success' => $this->getSessionManager()->getFlash( 'success' ),
- 'RedirectUrl' => $redirectUrl
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'login',
- 'auth'
- );
+ return $this->view()
+ ->title( 'Login' )
+ ->description( 'Login to ' . $this->getName() )
+ ->withCsrfToken()
+ ->with( 'Error', $this->getSessionManager()->getFlash( 'error' ) )
+ ->with( 'Success', $this->getSessionManager()->getFlash( 'success' ) )
+ ->with( 'RedirectUrl', $redirectUrl )
+ ->render( 'login', 'auth' );
}
/**
diff --git a/src/Cms/Controllers/Auth/PasswordReset.php b/src/Cms/Controllers/Auth/PasswordReset.php
index 9978301..3f0689b 100644
--- a/src/Cms/Controllers/Auth/PasswordReset.php
+++ b/src/Cms/Controllers/Auth/PasswordReset.php
@@ -58,20 +58,14 @@ public function showForgotPasswordForm( Request $request ): string
// Set CSRF token in Registry so csrf_field() helper works
Registry::getInstance()->set( 'Auth.CsrfToken', $this->_csrfToken->getToken() );
- $viewData = [
- 'Title' => 'Forgot Password | ' . $this->getName(),
- 'Description' => 'Reset your password',
- 'PageSubtitle' => 'Reset Password',
- 'Error' => $this->_sessionManager->getFlash( 'error' ),
- 'Success' => $this->_sessionManager->getFlash( 'success' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'forgot-password',
- 'auth'
- );
+ return $this->view()
+ ->title( 'Forgot Password' )
+ ->description( 'Reset your password' )
+ ->withCsrfToken()
+ ->with( 'PageSubtitle', 'Reset Password' )
+ ->with( 'Error', $this->_sessionManager->getFlash( 'error' ) )
+ ->with( 'Success', $this->_sessionManager->getFlash( 'success' ) )
+ ->render( 'forgot-password', 'auth' );
}
/**
@@ -157,22 +151,16 @@ public function showResetForm( Request $request ): string
// Set CSRF token in Registry so csrf_field() helper works
Registry::getInstance()->set( 'Auth.CsrfToken', $this->_csrfToken->getToken() );
- $viewData = [
- 'Title' => 'Reset Password | ' . $this->getName(),
- 'Description' => 'Enter your new password',
- 'PageSubtitle' => 'Create New Password',
- 'Error' => $this->_sessionManager->getFlash( 'error' ),
- 'Success' => $this->_sessionManager->getFlash( 'success' ),
- 'Token' => $token,
- 'Email' => $tokenObj->getEmail()
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'reset-password',
- 'auth'
- );
+ return $this->view()
+ ->title( 'Reset Password' )
+ ->description( 'Enter your new password' )
+ ->withCsrfToken()
+ ->with( 'PageSubtitle', 'Create New Password' )
+ ->with( 'Error', $this->_sessionManager->getFlash( 'error' ) )
+ ->with( 'Success', $this->_sessionManager->getFlash( 'success' ) )
+ ->with( 'Token', $token )
+ ->with( 'Email', $tokenObj->getEmail() )
+ ->render( 'reset-password', 'auth' );
}
/**
diff --git a/src/Cms/Controllers/Content.php b/src/Cms/Controllers/Content.php
index bd26a1a..314f003 100644
--- a/src/Cms/Controllers/Content.php
+++ b/src/Cms/Controllers/Content.php
@@ -299,4 +299,16 @@ protected function flash( string $type, string $message ): void
{
$this->getSessionManager()->flash( $type, $message );
}
+
+ /**
+ * Initialize CSRF token and store in Registry.
+ * Should be called by controllers that render forms requiring CSRF protection.
+ *
+ * @return void
+ */
+ protected function initializeCsrfToken(): void
+ {
+ $csrfToken = new \Neuron\Cms\Services\Auth\CsrfToken( $this->getSessionManager() );
+ Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
+ }
}
diff --git a/src/Cms/Controllers/Member/Dashboard.php b/src/Cms/Controllers/Member/Dashboard.php
index 7e3393d..24c074a 100644
--- a/src/Cms/Controllers/Member/Dashboard.php
+++ b/src/Cms/Controllers/Member/Dashboard.php
@@ -36,29 +36,13 @@ public function __construct( ?Application $app = null )
*/
public function index( Request $request ): string
{
- // Get authenticated user from Registry
- $user = Registry::getInstance()->get( 'Auth.User' );
-
- if( !$user )
- {
- throw new \RuntimeException( 'Authenticated user not found in Registry' );
- }
-
- // Generate CSRF token and store in Registry
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
- $viewData = [
- 'Title' => 'Member Dashboard | ' . $this->getName(),
- 'Description' => 'Member Dashboard',
- 'User' => $user
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'index',
- 'member'
- );
+ $this->initializeCsrfToken();
+
+ return $this->view()
+ ->title( 'Member Dashboard' )
+ ->description( 'Member Dashboard' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->render( 'index', 'member' );
}
}
diff --git a/src/Cms/Controllers/Member/Profile.php b/src/Cms/Controllers/Member/Profile.php
index 08ab355..3457d33 100644
--- a/src/Cms/Controllers/Member/Profile.php
+++ b/src/Cms/Controllers/Member/Profile.php
@@ -49,36 +49,28 @@ public function __construct( ?Application $app = null )
*/
public function edit( Request $request ): string
{
- $user = Registry::getInstance()->get( 'Auth.User' );
+ $this->initializeCsrfToken();
+ // Get authenticated user once
+ $user = auth();
if( !$user )
{
throw new \RuntimeException( 'Authenticated user not found' );
}
- // Generate CSRF token
- $csrfToken = new CsrfToken( $this->getSessionManager() );
- Registry::getInstance()->set( 'Auth.CsrfToken', $csrfToken->getToken() );
-
// Get available timezones grouped by region with selection state
$timezones = \DateTimeZone::listIdentifiers();
$groupedTimezones = group_timezones_for_select( $timezones, $user->getTimezone() );
- $viewData = [
- 'Title' => 'Profile | ' . $this->getName(),
- 'Description' => 'Edit Your Profile',
- 'User' => $user,
- 'groupedTimezones' => $groupedTimezones,
- 'success' => $this->getSessionManager()->getFlash( 'success' ),
- 'error' => $this->getSessionManager()->getFlash( 'error' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'edit',
- 'member'
- );
+ return $this->view()
+ ->title( 'Profile' )
+ ->description( 'Edit Your Profile' )
+ ->withCurrentUser()
+ ->withCsrfToken()
+ ->with( 'groupedTimezones', $groupedTimezones )
+ ->with( 'success', $this->getSessionManager()->getFlash( 'success' ) )
+ ->with( 'error', $this->getSessionManager()->getFlash( 'error' ) )
+ ->render( 'edit', 'member' );
}
/**
@@ -90,11 +82,11 @@ public function edit( Request $request ): string
*/
public function update( Request $request ): never
{
- $user = Registry::getInstance()->get( 'Auth.User' );
-
+ // Get authenticated user once and check for null
+ $user = auth();
if( !$user )
{
- throw new \RuntimeException( 'Authenticated user not found' );
+ $this->redirect( 'member_profile', [], ['error', 'Authenticated user not found'] );
}
// Security: Only use email from POST if provided by Account Information form
diff --git a/src/Cms/Controllers/Member/Registration.php b/src/Cms/Controllers/Member/Registration.php
index 4febd7e..2cb034c 100644
--- a/src/Cms/Controllers/Member/Registration.php
+++ b/src/Cms/Controllers/Member/Registration.php
@@ -71,35 +71,22 @@ public function showRegistrationForm( Request $request ): string
// Check if registration is enabled
if( !$this->_registrationService->isRegistrationEnabled() )
{
- $viewData = [
- 'Title' => 'Registration Disabled | ' . $this->getName(),
- 'Description' => 'User registration is currently disabled'
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'registration-disabled',
- 'member'
- );
+ return $this->view()
+ ->title( 'Registration Disabled' )
+ ->description( 'User registration is currently disabled' )
+ ->render( 'registration-disabled', 'member' );
}
// Set CSRF token in Registry
Registry::getInstance()->set( 'Auth.CsrfToken', $this->_csrfToken->getToken() );
- $viewData = [
- 'Title' => 'Register | ' . $this->getName(),
- 'Description' => 'Create your account',
- 'Error' => $this->getSessionManager()->getFlash( 'error' ),
- 'Success' => $this->getSessionManager()->getFlash( 'success' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'register',
- 'member'
- );
+ return $this->view()
+ ->title( 'Register' )
+ ->description( 'Create your account' )
+ ->withCsrfToken()
+ ->with( 'Error', $this->getSessionManager()->getFlash( 'error' ) )
+ ->with( 'Success', $this->getSessionManager()->getFlash( 'success' ) )
+ ->render( 'register', 'member' );
}
/**
@@ -165,18 +152,11 @@ public function processRegistration( Request $request ): never
*/
public function showVerificationSent( Request $request ): string
{
- $viewData = [
- 'Title' => 'Verify Your Email | ' . $this->getName(),
- 'Description' => 'Please check your email',
- 'Success' => $this->getSessionManager()->getFlash( 'success' )
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'verify-email-sent',
- 'member'
- );
+ return $this->view()
+ ->title( 'Verify Your Email' )
+ ->description( 'Please check your email' )
+ ->with( 'Success', $this->getSessionManager()->getFlash( 'success' ) )
+ ->render( 'verify-email-sent', 'member' );
}
/**
@@ -193,19 +173,12 @@ public function verify( Request $request ): string
if( empty( $token ) )
{
- $viewData = [
- 'Title' => 'Email Verification | ' . $this->getName(),
- 'Description' => 'Email verification',
- 'Success' => false,
- 'Message' => 'Invalid or missing verification token.'
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::BAD_REQUEST,
- $viewData,
- 'email-verified',
- 'member'
- );
+ return $this->view()
+ ->title( 'Email Verification' )
+ ->description( 'Email verification' )
+ ->with( 'Success', false )
+ ->with( 'Message', 'Invalid or missing verification token.' )
+ ->render( 'email-verified', 'member', HttpResponseStatus::BAD_REQUEST );
}
try
@@ -215,52 +188,31 @@ public function verify( Request $request ): string
if( $success )
{
- $viewData = [
- 'Title' => 'Email Verified | ' . $this->getName(),
- 'Description' => 'Your email has been verified',
- 'Success' => true,
- 'Message' => 'Your email has been verified successfully! You can now log in.'
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::OK,
- $viewData,
- 'email-verified',
- 'member'
- );
+ return $this->view()
+ ->title( 'Email Verified' )
+ ->description( 'Your email has been verified' )
+ ->with( 'Success', true )
+ ->with( 'Message', 'Your email has been verified successfully! You can now log in.' )
+ ->render( 'email-verified', 'member' );
}
else
{
- $viewData = [
- 'Title' => 'Email Verification | ' . $this->getName(),
- 'Description' => 'Email verification failed',
- 'Success' => false,
- 'Message' => 'This verification link is invalid or has expired.'
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::BAD_REQUEST,
- $viewData,
- 'email-verified',
- 'member'
- );
+ return $this->view()
+ ->title( 'Email Verification' )
+ ->description( 'Email verification failed' )
+ ->with( 'Success', false )
+ ->with( 'Message', 'This verification link is invalid or has expired.' )
+ ->render( 'email-verified', 'member', HttpResponseStatus::BAD_REQUEST );
}
}
catch( Exception $e )
{
- $viewData = [
- 'Title' => 'Email Verification | ' . $this->getName(),
- 'Description' => 'Email verification error',
- 'Success' => false,
- 'Message' => 'An error occurred during email verification. Please try again later.'
- ];
-
- return $this->renderHtml(
- HttpResponseStatus::INTERNAL_SERVER_ERROR,
- $viewData,
- 'email-verified',
- 'member'
- );
+ return $this->view()
+ ->title( 'Email Verification' )
+ ->description( 'Email verification error' )
+ ->with( 'Success', false )
+ ->with( 'Message', 'An error occurred during email verification. Please try again later.' )
+ ->render( 'email-verified', 'member', HttpResponseStatus::INTERNAL_SERVER_ERROR );
}
}
diff --git a/src/Cms/Exceptions/CsrfValidationException.php b/src/Cms/Exceptions/CsrfValidationException.php
new file mode 100644
index 0000000..022e62a
--- /dev/null
+++ b/src/Cms/Exceptions/CsrfValidationException.php
@@ -0,0 +1,36 @@
+_userMessage = $userMessage;
+ }
+
+ /**
+ * Get user-friendly message suitable for display
+ */
+ public function getUserMessage(): string
+ {
+ return $this->_userMessage;
+ }
+}
diff --git a/src/Cms/Exceptions/EmailVerificationRequiredException.php b/src/Cms/Exceptions/EmailVerificationRequiredException.php
new file mode 100644
index 0000000..3a11129
--- /dev/null
+++ b/src/Cms/Exceptions/EmailVerificationRequiredException.php
@@ -0,0 +1,36 @@
+_verificationUrl = $verificationUrl;
+ }
+
+ /**
+ * Get URL to redirect to (verification page)
+ */
+ public function getVerificationUrl(): string
+ {
+ return $this->_verificationUrl;
+ }
+}
diff --git a/src/Cms/Exceptions/UnauthenticatedException.php b/src/Cms/Exceptions/UnauthenticatedException.php
new file mode 100644
index 0000000..d52168a
--- /dev/null
+++ b/src/Cms/Exceptions/UnauthenticatedException.php
@@ -0,0 +1,47 @@
+_redirectUrl = $redirectUrl;
+ $this->_intendedUrl = $intendedUrl;
+ }
+
+ /**
+ * Get URL to redirect to (login page)
+ */
+ public function getRedirectUrl(): string
+ {
+ return $this->_redirectUrl;
+ }
+
+ /**
+ * Get original URL user was trying to access
+ */
+ public function getIntendedUrl(): string
+ {
+ return $this->_intendedUrl;
+ }
+}
diff --git a/src/Cms/Services/Content/EditorJsRenderer.php b/src/Cms/Services/Content/EditorJsRenderer.php
index 42ea044..aabb959 100644
--- a/src/Cms/Services/Content/EditorJsRenderer.php
+++ b/src/Cms/Services/Content/EditorJsRenderer.php
@@ -57,6 +57,7 @@ private function renderBlock( array $block ): string
'code' => $this->renderCode( $data ),
'delimiter' => $this->renderDelimiter( $data ),
'raw' => $this->renderRaw( $data ),
+ 'embed' => $this->renderEmbed( $data ),
default => $this->renderUnknown( $type )
};
}
@@ -246,6 +247,87 @@ private function renderRaw( array $data ): string
return $this->sanitizeHtml( $html ) . "\n";
}
+ /**
+ * Render embed block
+ */
+ private function renderEmbed( array $data ): string
+ {
+ $service = $data['service'] ?? '';
+ $source = $data['source'] ?? '';
+ $embed = $data['embed'] ?? '';
+ $width = $data['width'] ?? 580;
+ $height = $data['height'] ?? 320;
+ $caption = htmlspecialchars( $data['caption'] ?? '' );
+
+ // If no embed URL, return comment
+ if( empty( $embed ) )
+ {
+ return "\n";
+ }
+
+ // Sanitize embed URL - only allow trusted domains
+ $allowedDomains = [
+ 'youtube.com',
+ 'youtube-nocookie.com',
+ 'youtu.be',
+ 'vimeo.com',
+ 'player.vimeo.com',
+ 'twitter.com',
+ 'platform.twitter.com',
+ 'instagram.com',
+ 'facebook.com',
+ 'codepen.io',
+ 'github.com',
+ 'gist.github.com',
+ 'coub.com',
+ 'imgur.com',
+ 'gfycat.com',
+ 'giphy.com',
+ 'reddit.com',
+ 'open.spotify.com',
+ 'soundcloud.com',
+ 'twitch.tv',
+ 'player.twitch.tv',
+ 'miro.com',
+ 'figma.com'
+ ];
+
+ $embedUrl = htmlspecialchars( $embed );
+ $parsedUrl = parse_url( $embed );
+ $host = $parsedUrl['host'] ?? '';
+
+ // Check if domain is allowed
+ $isAllowed = false;
+ foreach( $allowedDomains as $domain )
+ {
+ if( $host === $domain || str_ends_with( $host, '.' . $domain ) )
+ {
+ $isAllowed = true;
+ break;
+ }
+ }
+
+ if( !$isAllowed )
+ {
+ return "\n";
+ }
+
+ // Create responsive embed container
+ $html = "
\n";
+ $html .= " \n";
+ $html .= " \n";
+ $html .= "
\n";
+
+ if( $caption )
+ {
+ $html .= " {$caption}\n";
+ }
+
+ $html .= "\n";
+
+ return $html;
+ }
+
/**
* Render unknown block type
*/
diff --git a/src/Cms/Services/Media/CloudinaryUploader.php b/src/Cms/Services/Media/CloudinaryUploader.php
index fc72a12..a09dcfe 100644
--- a/src/Cms/Services/Media/CloudinaryUploader.php
+++ b/src/Cms/Services/Media/CloudinaryUploader.php
@@ -4,6 +4,7 @@
use Cloudinary\Cloudinary;
use Cloudinary\Api\Upload\UploadApi;
+use Cloudinary\Api\Admin\AdminApi;
use Neuron\Data\Settings\SettingManager;
/**
@@ -138,6 +139,50 @@ public function delete( string $publicId ): bool
}
}
+ /**
+ * List resources from Cloudinary
+ *
+ * @param array $options Options for listing (max_results, next_cursor, prefix, etc.)
+ * @return array Resources list with pagination info
+ * @throws \Exception If listing fails
+ */
+ public function listResources( array $options = [] ): array
+ {
+ try
+ {
+ $adminApi = $this->_cloudinary->adminApi();
+
+ // Get folder prefix from settings or options
+ $folder = $options['folder'] ?? $this->_settings->get( 'cloudinary', 'folder' ) ?? 'neuron-cms/images';
+
+ $listOptions = [
+ 'type' => 'upload',
+ 'prefix' => $folder,
+ 'max_results' => $options['max_results'] ?? 30,
+ 'resource_type' => 'image'
+ ];
+
+ // Add pagination cursor if provided
+ if( isset( $options['next_cursor'] ) )
+ {
+ $listOptions['next_cursor'] = $options['next_cursor'];
+ }
+
+ $result = $adminApi->assets( $listOptions );
+
+ // Format the result
+ return [
+ 'resources' => array_map( [ $this, 'formatResult' ], $result['resources'] ?? [] ),
+ 'next_cursor' => $result['next_cursor'] ?? null,
+ 'total_count' => $result['total_count'] ?? 0
+ ];
+ }
+ catch( \Exception $e )
+ {
+ throw new \Exception( "Cloudinary list resources failed: " . $e->getMessage(), 0, $e );
+ }
+ }
+
/**
* Validate URL against SSRF (Server-Side Request Forgery) attacks
*
diff --git a/tests/Unit/Cms/Auth/AuthenticationFilterTest.php b/tests/Unit/Cms/Auth/AuthenticationFilterTest.php
new file mode 100644
index 0000000..66c3ebe
--- /dev/null
+++ b/tests/Unit/Cms/Auth/AuthenticationFilterTest.php
@@ -0,0 +1,243 @@
+_authentication = $this->createMock( Authentication::class );
+
+ // Create filter
+ $this->_filter = new AuthenticationFilter( $this->_authentication, '/login' );
+
+ // Create mock route
+ $this->_route = $this->createMock( RouteMap::class );
+ $this->_route->method( 'getPath' )->willReturn( '/admin/users' );
+
+ // Clear Registry
+ Registry::getInstance()->reset();
+ }
+
+ protected function tearDown(): void
+ {
+ parent::tearDown();
+ Registry::getInstance()->reset();
+ }
+
+ public function testConstructor(): void
+ {
+ $this->assertInstanceOf( AuthenticationFilter::class, $this->_filter );
+ }
+
+ public function testSetLoginUrl(): void
+ {
+ $result = $this->_filter->setLoginUrl( '/custom-login' );
+ $this->assertInstanceOf( AuthenticationFilter::class, $result );
+ }
+
+ public function testSetsUserInRegistryForAuthenticatedUser(): void
+ {
+ // Create authenticated user
+ $user = new User();
+ $user->setId( 1 );
+ $user->setUsername( 'admin' );
+ $user->setRole( User::ROLE_ADMIN );
+
+ // Auth manager returns user
+ $this->_authentication
+ ->method( 'user' )
+ ->willReturn( $user );
+
+ // Execute filter
+ $this->_filter->pre( $this->_route );
+
+ // Verify user was set in Registry
+ $this->assertEquals( $user, Registry::getInstance()->get( 'Auth.User' ) );
+ $this->assertEquals( 1, Registry::getInstance()->get( 'Auth.UserId' ) );
+ $this->assertEquals( User::ROLE_ADMIN, Registry::getInstance()->get( 'Auth.UserRole' ) );
+ }
+
+ public function testSetsUserIdCorrectly(): void
+ {
+ $user = new User();
+ $user->setId( 42 );
+ $user->setUsername( 'testuser' );
+ $user->setRole( User::ROLE_EDITOR );
+
+ $this->_authentication
+ ->method( 'user' )
+ ->willReturn( $user );
+
+ $this->_filter->pre( $this->_route );
+
+ $this->assertEquals( 42, Registry::getInstance()->get( 'Auth.UserId' ) );
+ }
+
+ public function testSetsUserRoleCorrectly(): void
+ {
+ $user = new User();
+ $user->setId( 1 );
+ $user->setUsername( 'author' );
+ $user->setRole( User::ROLE_AUTHOR );
+
+ $this->_authentication
+ ->method( 'user' )
+ ->willReturn( $user );
+
+ $this->_filter->pre( $this->_route );
+
+ $this->assertEquals( User::ROLE_AUTHOR, Registry::getInstance()->get( 'Auth.UserRole' ) );
+ }
+
+ /**
+ * Test that filter throws exception for unauthenticated user.
+ *
+ * When user is null (not authenticated), the filter should throw
+ * UnauthenticatedException with redirect URL to login page.
+ */
+ public function testThrowsExceptionForUnauthenticatedUser(): void
+ {
+ // Mock authentication to return null (unauthenticated)
+ $this->_authentication
+ ->method( 'user' )
+ ->willReturn( null );
+
+ // Expect UnauthenticatedException when user is not authenticated
+ $this->expectException( \Neuron\Cms\Exceptions\UnauthenticatedException::class );
+ $this->expectExceptionCode( 401 );
+
+ // Execute filter - should throw exception
+ $this->_filter->pre( $this->_route );
+ }
+
+ /**
+ * Test that UnauthenticatedException includes redirect information.
+ *
+ * The exception should include the redirect URL (login page) and
+ * the intended URL (original page user was trying to access).
+ */
+ public function testExceptionIncludesRedirectInformation(): void
+ {
+ // Mock authentication to return null
+ $this->_authentication
+ ->method( 'user' )
+ ->willReturn( null );
+
+ try
+ {
+ $this->_filter->pre( $this->_route );
+ $this->fail( 'Expected UnauthenticatedException was not thrown' );
+ }
+ catch( \Neuron\Cms\Exceptions\UnauthenticatedException $e )
+ {
+ // Verify exception includes redirect URL (login page with query param)
+ $redirectUrl = $e->getRedirectUrl();
+ $this->assertStringContainsString( '/login', $redirectUrl );
+ $this->assertStringContainsString( 'redirect=', $redirectUrl );
+
+ // Verify exception includes intended URL (original route path)
+ $this->assertEquals( '/admin/users', $e->getIntendedUrl() );
+
+ // Verify exception code
+ $this->assertEquals( 401, $e->getCode() );
+ }
+ }
+
+ /**
+ * Test that filter does not populate Registry for unauthenticated user.
+ *
+ * When authentication fails, Registry should remain unpopulated.
+ */
+ public function testDoesNotPopulateRegistryForNullUser(): void
+ {
+ // Mock authentication to return null (unauthenticated)
+ $this->_authentication
+ ->method( 'user' )
+ ->willReturn( null );
+
+ // Verify Registry is not populated before filter runs
+ $this->assertNull( Registry::getInstance()->get( 'Auth.User' ) );
+ $this->assertNull( Registry::getInstance()->get( 'Auth.UserId' ) );
+ $this->assertNull( Registry::getInstance()->get( 'Auth.UserRole' ) );
+
+ try
+ {
+ $this->_filter->pre( $this->_route );
+ }
+ catch( \Neuron\Cms\Exceptions\UnauthenticatedException $e )
+ {
+ // Expected exception - verify Registry still not populated
+ $this->assertNull(
+ Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.User should not be set when authentication fails'
+ );
+ $this->assertNull(
+ Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.UserId should not be set when authentication fails'
+ );
+ $this->assertNull(
+ Registry::getInstance()->get( 'Auth.UserRole' ),
+ 'Auth.UserRole should not be set when authentication fails'
+ );
+ }
+ }
+
+ public function testHandlesDifferentUserRoles(): void
+ {
+ $roles = [
+ User::ROLE_ADMIN,
+ User::ROLE_EDITOR,
+ User::ROLE_AUTHOR,
+ User::ROLE_SUBSCRIBER
+ ];
+
+ foreach( $roles as $role )
+ {
+ // Clear registry for each iteration
+ Registry::getInstance()->reset();
+
+ $user = new User();
+ $user->setId( 1 );
+ $user->setUsername( 'testuser' );
+ $user->setRole( $role );
+
+ $this->_authentication = $this->createMock( Authentication::class );
+ $this->_authentication->method( 'user' )->willReturn( $user );
+
+ $filter = new AuthenticationFilter( $this->_authentication );
+ $filter->pre( $this->_route );
+
+ $this->assertEquals( $role, Registry::getInstance()->get( 'Auth.UserRole' ), "Failed for role: $role" );
+ }
+ }
+
+ public function testCustomLoginUrl(): void
+ {
+ $customFilter = new AuthenticationFilter( $this->_authentication, '/custom-auth' );
+ $this->assertInstanceOf( AuthenticationFilter::class, $customFilter );
+
+ $customFilter->setLoginUrl( '/another-login' );
+ $this->assertInstanceOf( AuthenticationFilter::class, $customFilter );
+ }
+}
diff --git a/tests/Unit/Cms/Auth/CsrfFilterTest.php b/tests/Unit/Cms/Auth/CsrfFilterTest.php
new file mode 100644
index 0000000..c7e6e7c
--- /dev/null
+++ b/tests/Unit/Cms/Auth/CsrfFilterTest.php
@@ -0,0 +1,343 @@
+_csrfToken = $this->createMock( CsrfToken::class );
+
+ // Create filter
+ $this->_filter = new CsrfFilter( $this->_csrfToken );
+
+ // Create mock route
+ $this->_route = $this->createMock( RouteMap::class );
+ $this->_route->method( 'getPath' )->willReturn( '/admin/users' );
+ }
+
+ public function testConstructor(): void
+ {
+ $this->assertInstanceOf( CsrfFilter::class, $this->_filter );
+ }
+
+ public function testSkipsValidationForGetRequests(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'GET';
+
+ // CSRF token should never be called for GET requests
+ $this->_csrfToken
+ ->expects( $this->never() )
+ ->method( 'validate' );
+
+ $this->_filter->pre( $this->_route );
+
+ // If we get here without exit(), validation was skipped
+ $this->assertTrue( true, 'GET request bypassed CSRF validation' );
+ }
+
+ public function testSkipsValidationForHeadRequests(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'HEAD';
+
+ // CSRF token should never be called for HEAD requests
+ $this->_csrfToken
+ ->expects( $this->never() )
+ ->method( 'validate' );
+
+ $this->_filter->pre( $this->_route );
+
+ $this->assertTrue( true, 'HEAD request bypassed CSRF validation' );
+ }
+
+ public function testSkipsValidationForOptionsRequests(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'OPTIONS';
+
+ // CSRF token should never be called for OPTIONS requests
+ $this->_csrfToken
+ ->expects( $this->never() )
+ ->method( 'validate' );
+
+ $this->_filter->pre( $this->_route );
+
+ $this->assertTrue( true, 'OPTIONS request bypassed CSRF validation' );
+ }
+
+ /**
+ * Test that CSRF service correctly validates a valid POST token.
+ *
+ * Note: Cannot invoke filter->pre() in unit tests because the filter uses
+ * filter_input(INPUT_POST) which reads from PHP's input buffer, not $_POST.
+ * Manually set $_POST values in tests are not visible to filter_input().
+ * Full filter behavior should be verified in integration tests.
+ */
+ public function testCsrfServiceValidatesPostToken(): void
+ {
+ // Mock CSRF service to validate token
+ $this->_csrfToken
+ ->method( 'validate' )
+ ->with( 'test-token-123' )
+ ->willReturn( true );
+
+ // Verify the CSRF service correctly validates the token
+ $this->assertTrue(
+ $this->_csrfToken->validate( 'test-token-123' ),
+ 'CSRF service correctly validates valid token'
+ );
+ }
+
+ /**
+ * Test that PUT requests without CSRF token throw validation exception.
+ *
+ * PUT is not in the exempt methods list, so it requires CSRF validation.
+ * When no token is provided, the filter should throw CsrfValidationException.
+ */
+ public function testPutRequestsRequireCsrfValidation(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'PUT';
+ unset( $_POST['csrf_token'] );
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+
+ // Expect CsrfValidationException when token is missing
+ $this->expectException( \Neuron\Cms\Exceptions\CsrfValidationException::class );
+ $this->expectExceptionMessage( 'CSRF token missing from request' );
+ $this->expectExceptionCode( 403 );
+
+ // Execute filter - should throw exception
+ $this->_filter->pre( $this->_route );
+ }
+
+ /**
+ * Test that DELETE requests without CSRF token throw validation exception.
+ *
+ * DELETE is not in the exempt methods list, so it requires CSRF validation.
+ * When no token is provided, the filter should throw CsrfValidationException.
+ */
+ public function testDeleteRequestsRequireCsrfValidation(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'DELETE';
+ unset( $_POST['csrf_token'] );
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+
+ // Expect CsrfValidationException when token is missing
+ $this->expectException( \Neuron\Cms\Exceptions\CsrfValidationException::class );
+ $this->expectExceptionMessage( 'CSRF token missing from request' );
+ $this->expectExceptionCode( 403 );
+
+ // Execute filter - should throw exception
+ $this->_filter->pre( $this->_route );
+ }
+
+ /**
+ * Test that CSRF token can be provided via HTTP_X_CSRF_TOKEN header.
+ *
+ * Note: Cannot invoke filter->pre() in unit tests because the filter uses
+ * filter_input(INPUT_POST) which doesn't work with manually set $_POST.
+ * This test verifies the header fallback logic exists.
+ */
+ public function testAcceptsTokenViaHeader(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'POST';
+ $_SERVER['HTTP_X_CSRF_TOKEN'] = 'header-token-123';
+ unset( $_POST['csrf_token'] );
+
+ // Verify HTTP_X_CSRF_TOKEN header is set
+ $this->assertEquals(
+ 'header-token-123',
+ $_SERVER['HTTP_X_CSRF_TOKEN'],
+ 'CSRF token should be available in HTTP_X_CSRF_TOKEN header'
+ );
+ }
+
+ /**
+ * Test that invalid token throws validation exception.
+ *
+ * When an invalid token is provided, the filter should throw
+ * CsrfValidationException with appropriate message.
+ */
+ public function testDetectsInvalidToken(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'POST';
+ $_SERVER['HTTP_X_CSRF_TOKEN'] = 'invalid-token';
+
+ // Mock CSRF service to reject the token
+ $this->_csrfToken
+ ->expects( $this->once() )
+ ->method( 'validate' )
+ ->with( 'invalid-token' )
+ ->willReturn( false );
+
+ // Expect CsrfValidationException when token is invalid
+ $this->expectException( \Neuron\Cms\Exceptions\CsrfValidationException::class );
+ $this->expectExceptionMessage( 'Invalid CSRF token provided' );
+ $this->expectExceptionCode( 403 );
+
+ // Execute filter - should throw exception
+ $this->_filter->pre( $this->_route );
+ }
+
+ /**
+ * Test that missing token throws validation exception.
+ *
+ * When no token is provided (neither POST nor header), the filter
+ * should throw CsrfValidationException.
+ */
+ public function testDetectsMissingToken(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'POST';
+ unset( $_POST['csrf_token'] );
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+
+ // Expect CsrfValidationException when no token is present
+ $this->expectException( \Neuron\Cms\Exceptions\CsrfValidationException::class );
+ $this->expectExceptionMessage( 'CSRF token missing from request' );
+ $this->expectExceptionCode( 403 );
+
+ // Execute filter - should throw exception
+ $this->_filter->pre( $this->_route );
+ }
+
+ /**
+ * Test that CsrfValidationException includes user-friendly message.
+ *
+ * The exception should provide a getUserMessage() method that returns
+ * a message suitable for displaying to users.
+ */
+ public function testExceptionIncludesUserMessage(): void
+ {
+ $_SERVER['REQUEST_METHOD'] = 'POST';
+ unset( $_POST['csrf_token'] );
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+
+ try
+ {
+ $this->_filter->pre( $this->_route );
+ $this->fail( 'Expected CsrfValidationException was not thrown' );
+ }
+ catch( \Neuron\Cms\Exceptions\CsrfValidationException $e )
+ {
+ // Verify exception has user message
+ $this->assertEquals( 'CSRF token missing', $e->getUserMessage() );
+ $this->assertEquals( 'CSRF token missing from request', $e->getMessage() );
+ $this->assertEquals( 403, $e->getCode() );
+ }
+ }
+
+ /**
+ * Test that demonstrates the token extraction limitation in unit tests.
+ *
+ * This test documents that POST token extraction cannot be unit tested
+ * because getTokenFromRequest() uses filter_input(INPUT_POST), which reads
+ * from PHP's input buffer rather than $_POST. Setting $_POST in tests
+ * does not affect filter_input() behavior.
+ *
+ * In practice, when both POST and header tokens are present, POST takes
+ * precedence. However, in unit tests, filter_input() returns null, causing
+ * fallback to the header token. This is a testing limitation, not a bug.
+ */
+ public function testPostTokenExtractionLimitation(): void
+ {
+ // Setup: Set both POST and header (simulating real request)
+ $_POST['csrf_token'] = 'post-token';
+ $_SERVER['HTTP_X_CSRF_TOKEN'] = 'header-token';
+
+ // Use reflection to call getTokenFromRequest()
+ $reflection = new \ReflectionClass( $this->_filter );
+ $method = $reflection->getMethod( 'getTokenFromRequest' );
+ $method->setAccessible( true );
+ $token = $method->invoke( $this->_filter );
+
+ // In unit tests, filter_input(INPUT_POST) returns null because
+ // it reads from PHP's input buffer, not $_POST. Therefore, the
+ // method falls back to the header token even though we set POST.
+ $this->assertEquals(
+ 'header-token',
+ $token,
+ 'Unit tests fall back to header because filter_input(INPUT_POST) cannot read $_POST'
+ );
+
+ // Verify our test setup was correct (POST was set)
+ $this->assertEquals( 'post-token', $_POST['csrf_token'] );
+
+ // In real requests (integration/E2E tests), POST would take precedence
+ // and the token would be 'post-token', not 'header-token'
+
+ // Cleanup
+ unset( $_POST['csrf_token'] );
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+ }
+
+ /**
+ * Test that header token is used as fallback when POST token is not present.
+ *
+ * Uses reflection to test the private getTokenFromRequest() method
+ * to verify header token is returned when POST data doesn't contain a token.
+ */
+ public function testFallsBackToHeaderTokenWhenPostNotSet(): void
+ {
+ // Setup: Only set header token, ensure POST token is not set
+ unset( $_POST['csrf_token'] );
+ $_SERVER['HTTP_X_CSRF_TOKEN'] = 'header-token';
+
+ // Use reflection to access private getTokenFromRequest() method
+ $reflection = new \ReflectionClass( $this->_filter );
+ $method = $reflection->getMethod( 'getTokenFromRequest' );
+ $method->setAccessible( true );
+
+ // Execute: Get token from request
+ $token = $method->invoke( $this->_filter );
+
+ // Assert: Header token should be returned when POST token absent
+ $this->assertEquals(
+ 'header-token',
+ $token,
+ 'Header token should be returned when POST token is not set'
+ );
+
+ // Cleanup
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+ }
+
+ /**
+ * Test that null is returned when no token is present in either location.
+ *
+ * Uses reflection to test the private getTokenFromRequest() method
+ * to verify null is returned when neither POST nor header contain a token.
+ */
+ public function testReturnsNullWhenNoTokenPresent(): void
+ {
+ // Setup: Ensure both POST and header tokens are not set
+ unset( $_POST['csrf_token'] );
+ unset( $_SERVER['HTTP_X_CSRF_TOKEN'] );
+
+ // Use reflection to access private getTokenFromRequest() method
+ $reflection = new \ReflectionClass( $this->_filter );
+ $method = $reflection->getMethod( 'getTokenFromRequest' );
+ $method->setAccessible( true );
+
+ // Execute: Get token from request
+ $token = $method->invoke( $this->_filter );
+
+ // Assert: Null should be returned when no token present
+ $this->assertNull(
+ $token,
+ 'Null should be returned when no token is present in POST or header'
+ );
+ }
+}
diff --git a/tests/Unit/Cms/Auth/MemberAuthenticationFilterTest.php b/tests/Unit/Cms/Auth/MemberAuthenticationFilterTest.php
index 215924e..2ee9b76 100644
--- a/tests/Unit/Cms/Auth/MemberAuthenticationFilterTest.php
+++ b/tests/Unit/Cms/Auth/MemberAuthenticationFilterTest.php
@@ -88,8 +88,7 @@ public function testBeforeWithAuthenticatedAndVerifiedUser(): void
}
/**
- * Testing redirects with exit() is problematic in PHPUnit.
- * This test verifies the conditions that would trigger a redirect.
+ * Test that filter throws exception for unauthenticated user.
*/
public function testBeforeWithUnauthenticatedUser(): void
{
@@ -98,21 +97,16 @@ public function testBeforeWithUnauthenticatedUser(): void
->method( 'user' )
->willReturn( null );
- // We can't test the actual redirect/exit behavior in a unit test
- // because exit() terminates the test process. Instead, we verify
- // the condition that triggers the redirect is correctly detected.
- // In production, this would redirect to login and exit.
- $this->assertNull( $this->_authentication->user() );
+ // Expect UnauthenticatedException when user is not authenticated
+ $this->expectException( \Neuron\Cms\Exceptions\UnauthenticatedException::class );
+ $this->expectExceptionCode( 401 );
- // This verifies that the authentication check correctly identifies
- // when a user is not authenticated, which is the core business logic.
- // The redirect behavior itself is tested in integration/E2E tests.
- $this->assertTrue( true, 'Authentication correctly identifies unauthenticated user' );
+ // Execute filter - should throw exception
+ $this->_filter->pre( $this->_route );
}
/**
- * Testing redirects with exit() is problematic in PHPUnit.
- * This test verifies the conditions that would trigger a redirect.
+ * Test that filter throws exception for unverified user.
*/
public function testBeforeWithUnverifiedUser(): void
{
@@ -130,16 +124,12 @@ public function testBeforeWithUnverifiedUser(): void
// Filter requires verification
$filter = new MemberAuthenticationFilter( $this->_authentication, '/login', true );
- // We can't test the actual redirect/exit behavior in a unit test
- // because exit() terminates the test process. Instead, we verify
- // the conditions that trigger the redirect are correctly detected.
- // In production, this would redirect to the verification page and exit.
- $this->assertFalse( $user->isEmailVerified() );
+ // Expect EmailVerificationRequiredException when user is not verified
+ $this->expectException( \Neuron\Cms\Exceptions\EmailVerificationRequiredException::class );
+ $this->expectExceptionCode( 403 );
- // This verifies that the filter correctly identifies when a user
- // is authenticated but not verified, which is the core business logic.
- // The redirect behavior itself is tested in integration/E2E tests.
- $this->assertTrue( true, 'Filter correctly identifies unverified user when verification is required' );
+ // Execute filter - should throw exception
+ $filter->pre( $this->_route );
}
public function testBeforeWithUnverifiedUserButVerificationNotRequired(): void
diff --git a/tests/Unit/Cms/Controllers/CategoriesControllerTest.php b/tests/Unit/Cms/Controllers/CategoriesControllerTest.php
new file mode 100644
index 0000000..0d3fbf3
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/CategoriesControllerTest.php
@@ -0,0 +1,204 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllCategories(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Mock repository
+ $repository = $this->createMock( DatabaseCategoryRepository::class );
+ $categories = [
+ ['id' => 1, 'name' => 'Technology', 'post_count' => 5],
+ ['id' => 2, 'name' => 'Business', 'post_count' => 3]
+ ];
+ $repository->expects( $this->once() )
+ ->method( 'allWithPostCount' )
+ ->willReturn( $categories );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Categories::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Categories Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Categories::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Categories Index', $result );
+ }
+
+ public function testCreateReturnsForm(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $repository = $this->createMock( DatabaseCategoryRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Categories::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create Category Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Categories::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create Category Form', $result );
+ }
+
+ public function testEditThrowsExceptionWhenCategoryNotFound(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $repository = $this->createMock( DatabaseCategoryRepository::class );
+ $repository->method( 'findById' )->with( 999 )->willReturn( null );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = new Categories(
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'getRouteParameter' )->with( 'id' )->willReturn( '999' );
+
+ $this->expectException( \RuntimeException::class );
+ $this->expectExceptionMessage( 'Category not found' );
+
+ $controller->edit( $request );
+ }
+
+}
diff --git a/tests/Unit/Cms/Controllers/EventCategoriesControllerTest.php b/tests/Unit/Cms/Controllers/EventCategoriesControllerTest.php
new file mode 100644
index 0000000..244d45a
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/EventCategoriesControllerTest.php
@@ -0,0 +1,175 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllCategories(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Mock repository to return categories
+ $repository = $this->createMock( DatabaseEventCategoryRepository::class );
+ $categories = [
+ $this->createMock( EventCategory::class ),
+ $this->createMock( EventCategory::class )
+ ];
+ $repository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( $categories );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( EventCategories::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Event Categories Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( EventCategories::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Event Categories Index', $result );
+ }
+
+ public function testCreateReturnsForm(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $repository = $this->createMock( DatabaseEventCategoryRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( EventCategories::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create Event Category Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( EventCategories::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create Event Category Form', $result );
+ }
+}
diff --git a/tests/Unit/Cms/Controllers/EventsControllerTest.php b/tests/Unit/Cms/Controllers/EventsControllerTest.php
new file mode 100644
index 0000000..7ed1fa3
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/EventsControllerTest.php
@@ -0,0 +1,250 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllEventsForAdmin(): void
+ {
+ // Set up admin user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ $user->method( 'isAdmin' )->willReturn( true );
+ $user->method( 'isEditor' )->willReturn( false );
+ Registry::getInstance()->set( 'Auth.User', $user );
+ Registry::getInstance()->set( 'Auth.UserId', 1 );
+
+ // Mock repository to return events
+ $eventRepository = $this->createMock( DatabaseEventRepository::class );
+ $events = [
+ $this->createMock( Event::class ),
+ $this->createMock( Event::class )
+ ];
+ $eventRepository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( $events );
+
+ $categoryRepository = $this->createMock( DatabaseEventCategoryRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Events::class )
+ ->setConstructorArgs([
+ null,
+ $eventRepository,
+ $categoryRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Events Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Events::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Events Index', $result );
+ }
+
+ public function testIndexFiltersEventsForNonAdmin(): void
+ {
+ // Set up regular user (not admin, not editor)
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 2 );
+ $user->method( 'isAdmin' )->willReturn( false );
+ $user->method( 'isEditor' )->willReturn( false );
+ Registry::getInstance()->set( 'Auth.User', $user );
+ Registry::getInstance()->set( 'Auth.UserId', 2 );
+
+ // Mock repository to return creator's events
+ $eventRepository = $this->createMock( DatabaseEventRepository::class );
+ $events = [
+ $this->createMock( Event::class )
+ ];
+ $eventRepository->expects( $this->once() )
+ ->method( 'getByCreator' )
+ ->with( 2 )
+ ->willReturn( $events );
+
+ $categoryRepository = $this->createMock( DatabaseEventCategoryRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Events::class )
+ ->setConstructorArgs([
+ null,
+ $eventRepository,
+ $categoryRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Events Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Events::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ }
+
+ public function testCreateReturnsFormForAuthenticatedUser(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $eventRepository = $this->createMock( DatabaseEventRepository::class );
+ $categoryRepository = $this->createMock( DatabaseEventCategoryRepository::class );
+ $categoryRepository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( [] );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Events::class )
+ ->setConstructorArgs([
+ null,
+ $eventRepository,
+ $categoryRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create Event Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Events::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create Event Form', $result );
+ }
+}
diff --git a/tests/Unit/Cms/Controllers/MediaIndexTest.php b/tests/Unit/Cms/Controllers/MediaIndexTest.php
new file mode 100644
index 0000000..f6ea0ce
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/MediaIndexTest.php
@@ -0,0 +1,214 @@
+_originalRegistry = [
+ 'Settings' => Registry::getInstance()->get( 'Settings' ),
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' )
+ ];
+
+ // Set up Settings
+ $memory = new Memory();
+ $memory->set( 'cloudinary', 'cloud_name', 'test-cloud' );
+ $memory->set( 'cloudinary', 'api_key', 'test-key' );
+ $memory->set( 'cloudinary', 'api_secret', 'test-secret' );
+ $memory->set( 'cloudinary', 'folder', 'test-folder' );
+ $memory->set( 'cloudinary', 'max_file_size', 5242880 );
+ $memory->set( 'cloudinary', 'allowed_formats', ['jpg', 'png', 'gif', 'webp'] );
+ $memory->set( 'site', 'name', 'Test Site' );
+
+ $this->_settings = new SettingManager( $memory );
+ Registry::getInstance()->set( 'Settings', $this->_settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsSuccessWithResources(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Create a partial mock that mocks renderHtml but allows view() to work
+ $media = $this->getMockBuilder( Media::class )
+ ->onlyMethods( ['renderHtml'] )
+ ->getMock();
+
+ $media->method( 'renderHtml' )->willReturn( 'test' );
+
+ // Create a mock session manager
+ $sessionManagerMock = $this->createMock( SessionManager::class );
+ $sessionManagerMock->method( 'getFlash' )->willReturn( null );
+
+ // Inject mock session manager via reflection
+ $reflection = new \ReflectionClass( get_parent_class( Media::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+ $sessionProperty->setValue( $media, $sessionManagerMock );
+
+ // Create a mock uploader that returns resources
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->method( 'listResources' )->willReturn( [
+ 'resources' => [
+ [
+ 'public_id' => 'test-folder/image1',
+ 'url' => 'https://res.cloudinary.com/test/image/upload/v1/image1.jpg',
+ 'width' => 800,
+ 'height' => 600
+ ],
+ [
+ 'public_id' => 'test-folder/image2',
+ 'url' => 'https://res.cloudinary.com/test/image/upload/v1/image2.jpg',
+ 'width' => 1024,
+ 'height' => 768
+ ]
+ ],
+ 'next_cursor' => 'abc123',
+ 'total_count' => 50
+ ] );
+
+ // Inject mock uploader via reflection
+ $reflection = new \ReflectionClass( Media::class );
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'get' )->with( 'cursor' )->willReturn( null );
+
+ $result = $media->index( $request );
+
+ // Should return HTML response
+ $this->assertIsString( $result );
+ }
+
+ public function testIndexHandlesCursorParameter(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Create a partial mock that mocks renderHtml but allows view() to work
+ $media = $this->getMockBuilder( Media::class )
+ ->onlyMethods( ['renderHtml'] )
+ ->getMock();
+
+ $media->method( 'renderHtml' )->willReturn( 'test' );
+
+ // Create a mock session manager
+ $sessionManagerMock = $this->createMock( SessionManager::class );
+ $sessionManagerMock->method( 'getFlash' )->willReturn( null );
+
+ // Inject mock session manager via reflection
+ $reflection = new \ReflectionClass( get_parent_class( Media::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+ $sessionProperty->setValue( $media, $sessionManagerMock );
+
+ // Create a mock uploader that expects cursor parameter
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->expects( $this->once() )
+ ->method( 'listResources' )
+ ->with( $this->callback( function( $options ) {
+ return $options['next_cursor'] === 'xyz789'
+ && $options['max_results'] === 30;
+ } ) )
+ ->willReturn( [
+ 'resources' => [],
+ 'next_cursor' => null,
+ 'total_count' => 0
+ ] );
+
+ // Inject mock uploader via reflection
+ $reflection = new \ReflectionClass( Media::class );
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'get' )->with( 'cursor' )->willReturn( 'xyz789' );
+
+ $result = $media->index( $request );
+
+ $this->assertIsString( $result );
+ }
+
+ public function testIndexHandlesListResourcesException(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Create a partial mock that mocks renderHtml but allows view() to work
+ $media = $this->getMockBuilder( Media::class )
+ ->onlyMethods( ['renderHtml'] )
+ ->getMock();
+
+ $media->method( 'renderHtml' )->willReturn( 'test' );
+
+ // Create a mock session manager
+ $sessionManagerMock = $this->createMock( SessionManager::class );
+ $sessionManagerMock->method( 'getFlash' )->willReturn( null );
+
+ // Inject mock session manager via reflection
+ $reflection = new \ReflectionClass( get_parent_class( Media::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+ $sessionProperty->setValue( $media, $sessionManagerMock );
+
+ // Create a mock uploader that throws exception
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->method( 'listResources' )
+ ->willThrowException( new \Exception( 'Cloudinary API error' ) );
+
+ // Inject mock uploader via reflection
+ $reflection = new \ReflectionClass( Media::class );
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'get' )->with( 'cursor' )->willReturn( null );
+
+ $result = $media->index( $request );
+
+ // Should return HTML response with error message (not throw exception)
+ $this->assertIsString( $result );
+ }
+}
diff --git a/tests/Unit/Cms/Controllers/MediaUploadTest.php b/tests/Unit/Cms/Controllers/MediaUploadTest.php
new file mode 100644
index 0000000..e3401b6
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/MediaUploadTest.php
@@ -0,0 +1,395 @@
+_originalRegistry = [
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Set up Settings
+ $memory = new Memory();
+ $memory->set( 'cloudinary', 'cloud_name', 'test-cloud' );
+ $memory->set( 'cloudinary', 'api_key', 'test-key' );
+ $memory->set( 'cloudinary', 'api_secret', 'test-secret' );
+ $memory->set( 'cloudinary', 'folder', 'test-folder' );
+ $memory->set( 'cloudinary', 'max_file_size', 5242880 );
+ $memory->set( 'cloudinary', 'allowed_formats', ['jpg', 'png', 'gif', 'webp'] );
+
+ $this->_settings = new SettingManager( $memory );
+ Registry::getInstance()->set( 'Settings', $this->_settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ // Clean up $_FILES if set
+ $_FILES = [];
+
+ parent::tearDown();
+ }
+
+ public function testUploadImageReturnsErrorWhenNoFileUploaded(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Ensure $_FILES is empty
+ $_FILES = [];
+
+ $media = new Media();
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadImage( $request );
+
+ // Should return JSON error
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'success', $result );
+ $this->assertStringContainsString( 'No file was uploaded', $result );
+
+ $json = json_decode( $result, true );
+ $this->assertEquals( 0, $json['success'] );
+ }
+
+ public function testUploadImageReturnsErrorWhenValidationFails(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Set up invalid file in $_FILES
+ $_FILES['image'] = [
+ 'name' => 'test.txt',
+ 'type' => 'text/plain',
+ 'tmp_name' => '/tmp/phptest',
+ 'error' => UPLOAD_ERR_OK,
+ 'size' => 1000
+ ];
+
+ // Create Media controller
+ $media = new Media();
+
+ // Create a mock validator that fails
+ $validatorMock = $this->createMock( MediaValidator::class );
+ $validatorMock->method( 'validate' )->willReturn( false );
+ $validatorMock->method( 'getFirstError' )->willReturn( 'Invalid file type' );
+
+ // Inject mock validator via reflection
+ $reflection = new \ReflectionClass( $media );
+ $validatorProperty = $reflection->getProperty( '_validator' );
+ $validatorProperty->setAccessible( true );
+ $validatorProperty->setValue( $media, $validatorMock );
+
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadImage( $request );
+
+ // Should return JSON error
+ $this->assertIsString( $result );
+ $json = json_decode( $result, true );
+ $this->assertEquals( 0, $json['success'] );
+ $this->assertEquals( 'Invalid file type', $json['message'] );
+ }
+
+ public function testUploadFeaturedImageReturnsErrorWhenNoFileUploaded(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Ensure $_FILES is empty
+ $_FILES = [];
+
+ $media = new Media();
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadFeaturedImage( $request );
+
+ // Should return JSON error
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'success', $result );
+ $this->assertStringContainsString( 'No file was uploaded', $result );
+
+ $json = json_decode( $result, true );
+ $this->assertFalse( $json['success'] );
+ }
+
+ public function testUploadFeaturedImageReturnsErrorWhenValidationFails(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Set up invalid file in $_FILES
+ $_FILES['image'] = [
+ 'name' => 'test.exe',
+ 'type' => 'application/x-executable',
+ 'tmp_name' => '/tmp/phptest',
+ 'error' => UPLOAD_ERR_OK,
+ 'size' => 1000
+ ];
+
+ // Create Media controller
+ $media = new Media();
+
+ // Create a mock validator that fails
+ $validatorMock = $this->createMock( MediaValidator::class );
+ $validatorMock->method( 'validate' )->willReturn( false );
+ $validatorMock->method( 'getFirstError' )->willReturn( 'File type not allowed' );
+
+ // Inject mock validator via reflection
+ $reflection = new \ReflectionClass( $media );
+ $validatorProperty = $reflection->getProperty( '_validator' );
+ $validatorProperty->setAccessible( true );
+ $validatorProperty->setValue( $media, $validatorMock );
+
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadFeaturedImage( $request );
+
+ // Should return JSON error
+ $this->assertIsString( $result );
+ $json = json_decode( $result, true );
+ $this->assertFalse( $json['success'] );
+ $this->assertEquals( 'File type not allowed', $json['error'] );
+ }
+
+ public function testUploadImageSuccessfulUpload(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Set up valid file in $_FILES
+ $_FILES['image'] = [
+ 'name' => 'test.jpg',
+ 'type' => 'image/jpeg',
+ 'tmp_name' => '/tmp/phptest.jpg',
+ 'error' => UPLOAD_ERR_OK,
+ 'size' => 1000
+ ];
+
+ // Create Media controller
+ $media = new Media();
+
+ // Create a mock validator that passes
+ $validatorMock = $this->createMock( MediaValidator::class );
+ $validatorMock->method( 'validate' )->willReturn( true );
+
+ // Create a mock uploader
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->method( 'upload' )->willReturn( [
+ 'url' => 'https://res.cloudinary.com/test/image/upload/v1/test.jpg',
+ 'public_id' => 'test-folder/test',
+ 'width' => 800,
+ 'height' => 600,
+ 'format' => 'jpg',
+ 'bytes' => 50000
+ ] );
+
+ // Inject mocks via reflection
+ $reflection = new \ReflectionClass( $media );
+
+ $validatorProperty = $reflection->getProperty( '_validator' );
+ $validatorProperty->setAccessible( true );
+ $validatorProperty->setValue( $media, $validatorMock );
+
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadImage( $request );
+
+ // Should return JSON success in Editor.js format
+ $this->assertIsString( $result );
+ $json = json_decode( $result, true );
+ $this->assertEquals( 1, $json['success'] );
+ $this->assertArrayHasKey( 'file', $json );
+ $this->assertEquals( 'https://res.cloudinary.com/test/image/upload/v1/test.jpg', $json['file']['url'] );
+ $this->assertEquals( 800, $json['file']['width'] );
+ $this->assertEquals( 600, $json['file']['height'] );
+ }
+
+ public function testUploadFeaturedImageSuccessfulUpload(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Set up valid file in $_FILES
+ $_FILES['image'] = [
+ 'name' => 'featured.png',
+ 'type' => 'image/png',
+ 'tmp_name' => '/tmp/phptest.png',
+ 'error' => UPLOAD_ERR_OK,
+ 'size' => 2000
+ ];
+
+ // Create Media controller
+ $media = new Media();
+
+ // Create a mock validator that passes
+ $validatorMock = $this->createMock( MediaValidator::class );
+ $validatorMock->method( 'validate' )->willReturn( true );
+
+ // Create a mock uploader
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->method( 'upload' )->willReturn( [
+ 'url' => 'https://res.cloudinary.com/test/image/upload/v1/featured.png',
+ 'public_id' => 'test-folder/featured',
+ 'width' => 1920,
+ 'height' => 1080,
+ 'format' => 'png',
+ 'bytes' => 150000,
+ 'resource_type' => 'image',
+ 'created_at' => '2024-01-01T00:00:00Z'
+ ] );
+
+ // Inject mocks via reflection
+ $reflection = new \ReflectionClass( $media );
+
+ $validatorProperty = $reflection->getProperty( '_validator' );
+ $validatorProperty->setAccessible( true );
+ $validatorProperty->setValue( $media, $validatorMock );
+
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadFeaturedImage( $request );
+
+ // Should return JSON success
+ $this->assertIsString( $result );
+ $json = json_decode( $result, true );
+ $this->assertTrue( $json['success'] );
+ $this->assertArrayHasKey( 'data', $json );
+ $this->assertEquals( 'https://res.cloudinary.com/test/image/upload/v1/featured.png', $json['data']['url'] );
+ }
+
+ public function testUploadImageHandlesUploadException(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Set up valid file in $_FILES
+ $_FILES['image'] = [
+ 'name' => 'test.jpg',
+ 'type' => 'image/jpeg',
+ 'tmp_name' => '/tmp/phptest.jpg',
+ 'error' => UPLOAD_ERR_OK,
+ 'size' => 1000
+ ];
+
+ // Create Media controller
+ $media = new Media();
+
+ // Create a mock validator that passes
+ $validatorMock = $this->createMock( MediaValidator::class );
+ $validatorMock->method( 'validate' )->willReturn( true );
+
+ // Create a mock uploader that throws exception
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->method( 'upload' )->willThrowException( new \Exception( 'Upload failed' ) );
+
+ // Inject mocks via reflection
+ $reflection = new \ReflectionClass( $media );
+
+ $validatorProperty = $reflection->getProperty( '_validator' );
+ $validatorProperty->setAccessible( true );
+ $validatorProperty->setValue( $media, $validatorMock );
+
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadImage( $request );
+
+ // Should return JSON error with user-friendly message
+ $this->assertIsString( $result );
+ $json = json_decode( $result, true );
+ $this->assertEquals( 0, $json['success'] );
+ $this->assertEquals( 'Upload failed. Please try again.', $json['message'] );
+ }
+
+ public function testUploadFeaturedImageHandlesUploadException(): void
+ {
+ // Set up user in registry
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Set up valid file in $_FILES
+ $_FILES['image'] = [
+ 'name' => 'test.jpg',
+ 'type' => 'image/jpeg',
+ 'tmp_name' => '/tmp/phptest.jpg',
+ 'error' => UPLOAD_ERR_OK,
+ 'size' => 1000
+ ];
+
+ // Create Media controller
+ $media = new Media();
+
+ // Create a mock validator that passes
+ $validatorMock = $this->createMock( MediaValidator::class );
+ $validatorMock->method( 'validate' )->willReturn( true );
+
+ // Create a mock uploader that throws exception
+ $uploaderMock = $this->createMock( CloudinaryUploader::class );
+ $uploaderMock->method( 'upload' )->willThrowException( new \Exception( 'Cloudinary error' ) );
+
+ // Inject mocks via reflection
+ $reflection = new \ReflectionClass( $media );
+
+ $validatorProperty = $reflection->getProperty( '_validator' );
+ $validatorProperty->setAccessible( true );
+ $validatorProperty->setValue( $media, $validatorMock );
+
+ $uploaderProperty = $reflection->getProperty( '_uploader' );
+ $uploaderProperty->setAccessible( true );
+ $uploaderProperty->setValue( $media, $uploaderMock );
+
+ $request = $this->createMock( Request::class );
+ $result = $media->uploadFeaturedImage( $request );
+
+ // Should return JSON error with user-friendly message
+ $this->assertIsString( $result );
+ $json = json_decode( $result, true );
+ $this->assertFalse( $json['success'] );
+ $this->assertEquals( 'Upload failed. Please try again.', $json['error'] );
+ }
+
+}
diff --git a/tests/Unit/Cms/Controllers/PagesControllerTest.php b/tests/Unit/Cms/Controllers/PagesControllerTest.php
new file mode 100644
index 0000000..33c0616
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/PagesControllerTest.php
@@ -0,0 +1,241 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllPagesForAdmin(): void
+ {
+ // Set up admin user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ $user->method( 'isAdmin' )->willReturn( true );
+ $user->method( 'isEditor' )->willReturn( false );
+ Registry::getInstance()->set( 'Auth.User', $user );
+ Registry::getInstance()->set( 'Auth.UserId', 1 );
+
+ // Mock repository to return pages
+ $pageRepository = $this->createMock( DatabasePageRepository::class );
+ $pages = [
+ $this->createMock( Page::class ),
+ $this->createMock( Page::class )
+ ];
+ $pageRepository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( $pages );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ // Create controller with mocked dependencies and mocked view method
+ $controller = $this->getMockBuilder( Pages::class )
+ ->setConstructorArgs([
+ null,
+ $pageRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Pages Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager via reflection
+ $reflection = new \ReflectionClass( get_parent_class( Pages::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Pages Index', $result );
+ }
+
+ public function testIndexFiltersPagesForNonAdmin(): void
+ {
+ // Set up regular user (not admin, not editor)
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 2 );
+ $user->method( 'isAdmin' )->willReturn( false );
+ $user->method( 'isEditor' )->willReturn( false );
+ Registry::getInstance()->set( 'Auth.User', $user );
+ Registry::getInstance()->set( 'Auth.UserId', 2 );
+
+ // Mock repository to return author's pages
+ $pageRepository = $this->createMock( DatabasePageRepository::class );
+ $pages = [
+ $this->createMock( Page::class )
+ ];
+ $pageRepository->expects( $this->once() )
+ ->method( 'getByAuthor' )
+ ->with( 2 )
+ ->willReturn( $pages );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ // Create controller with mocked dependencies
+ $controller = $this->getMockBuilder( Pages::class )
+ ->setConstructorArgs([
+ null,
+ $pageRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Pages Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Pages::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ }
+
+ public function testCreateReturnsFormForAuthenticatedUser(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $pageRepository = $this->createMock( DatabasePageRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Pages::class )
+ ->setConstructorArgs([
+ null,
+ $pageRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create Page Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Pages::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create Page Form', $result );
+ }
+
+}
diff --git a/tests/Unit/Cms/Controllers/PostsControllerTest.php b/tests/Unit/Cms/Controllers/PostsControllerTest.php
new file mode 100644
index 0000000..9e7748c
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/PostsControllerTest.php
@@ -0,0 +1,299 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllPostsForAdmin(): void
+ {
+ // Set up admin user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ $user->method( 'getUsername' )->willReturn( 'admin' );
+ $user->method( 'isAdmin' )->willReturn( true );
+ $user->method( 'isEditor' )->willReturn( false );
+ Registry::getInstance()->set( 'Auth.User', $user );
+ Registry::getInstance()->set( 'Auth.UserId', 1 );
+
+ // Mock repository to return posts
+ $postRepository = $this->createMock( DatabasePostRepository::class );
+ $posts = [
+ $this->createMock( Post::class ),
+ $this->createMock( Post::class )
+ ];
+ $postRepository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( $posts );
+
+ $categoryRepository = $this->createMock( DatabaseCategoryRepository::class );
+ $tagRepository = $this->createMock( DatabaseTagRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ // Create controller with mocked dependencies and mocked view method
+ $controller = $this->getMockBuilder( Posts::class )
+ ->setConstructorArgs([
+ null,
+ $postRepository,
+ $categoryRepository,
+ $tagRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Posts Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager via reflection
+ $reflection = new \ReflectionClass( get_parent_class( Posts::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Posts Index', $result );
+ }
+
+ public function testIndexFiltersPostsByAuthorForNonAdmin(): void
+ {
+ // Set up regular user (not admin, not editor)
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 2 );
+ $user->method( 'isAdmin' )->willReturn( false );
+ $user->method( 'isEditor' )->willReturn( false );
+ Registry::getInstance()->set( 'Auth.User', $user );
+ Registry::getInstance()->set( 'Auth.UserId', 2 );
+
+ // Mock repository to return author's posts
+ $postRepository = $this->createMock( DatabasePostRepository::class );
+ $posts = [
+ $this->createMock( Post::class )
+ ];
+ $postRepository->expects( $this->once() )
+ ->method( 'getByAuthor' )
+ ->with( 2 )
+ ->willReturn( $posts );
+
+ $categoryRepository = $this->createMock( DatabaseCategoryRepository::class );
+ $tagRepository = $this->createMock( DatabaseTagRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ // Create controller with mocked dependencies
+ $controller = $this->getMockBuilder( Posts::class )
+ ->setConstructorArgs([
+ null,
+ $postRepository,
+ $categoryRepository,
+ $tagRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Posts Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Posts::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ }
+
+ public function testCreateReturnsFormForAuthenticatedUser(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $postRepository = $this->createMock( DatabasePostRepository::class );
+ $categoryRepository = $this->createMock( DatabaseCategoryRepository::class );
+ $categoryRepository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( [] );
+
+ $tagRepository = $this->createMock( DatabaseTagRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Posts::class )
+ ->setConstructorArgs([
+ null,
+ $postRepository,
+ $categoryRepository,
+ $tagRepository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create Post Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Posts::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create Post Form', $result );
+ }
+
+ public function testEditThrowsExceptionWhenUserUnauthorized(): void
+ {
+ // Set up regular user (not admin, not editor)
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 2 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Mock post owned by different user
+ $post = $this->createMock( Post::class );
+ $post->method( 'getAuthorId' )->willReturn( 999 ); // Different author
+
+ $postRepository = $this->createMock( DatabasePostRepository::class );
+ $postRepository->method( 'findById' )->with( 1 )->willReturn( $post );
+
+ $categoryRepository = $this->createMock( DatabaseCategoryRepository::class );
+ $tagRepository = $this->createMock( DatabaseTagRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = new Posts(
+ null,
+ $postRepository,
+ $categoryRepository,
+ $tagRepository,
+ $creator,
+ $updater,
+ $deleter
+ );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'getRouteParameter' )->with( 'id' )->willReturn( '1' );
+
+ $this->expectException( \RuntimeException::class );
+ $this->expectExceptionMessage( 'Unauthorized to edit this post' );
+
+ $controller->edit( $request );
+ }
+}
diff --git a/tests/Unit/Cms/Controllers/TagsControllerTest.php b/tests/Unit/Cms/Controllers/TagsControllerTest.php
new file mode 100644
index 0000000..8c8bcf7
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/TagsControllerTest.php
@@ -0,0 +1,181 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllTags(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Mock repository
+ $repository = $this->createMock( DatabaseTagRepository::class );
+ $tags = [
+ ['id' => 1, 'name' => 'PHP', 'post_count' => 10],
+ ['id' => 2, 'name' => 'JavaScript', 'post_count' => 5]
+ ];
+ $repository->expects( $this->once() )
+ ->method( 'allWithPostCount' )
+ ->willReturn( $tags );
+
+ $controller = $this->getMockBuilder( Tags::class )
+ ->setConstructorArgs([
+ null,
+ $repository
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Tags Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Tags::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Tags Index', $result );
+ }
+
+ public function testCreateReturnsForm(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $repository = $this->createMock( DatabaseTagRepository::class );
+
+ $controller = $this->getMockBuilder( Tags::class )
+ ->setConstructorArgs([
+ null,
+ $repository
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create Tag Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Tags::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create Tag Form', $result );
+ }
+
+ public function testEditThrowsExceptionWhenTagNotFound(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $repository = $this->createMock( DatabaseTagRepository::class );
+ $repository->method( 'findById' )->with( 999 )->willReturn( null );
+
+ $controller = new Tags(
+ null,
+ $repository
+ );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'getRouteParameter' )->with( 'id' )->willReturn( '999' );
+
+ $this->expectException( \RuntimeException::class );
+ $this->expectExceptionMessage( 'Tag not found' );
+
+ $controller->edit( $request );
+ }
+
+}
diff --git a/tests/Unit/Cms/Controllers/UsersControllerTest.php b/tests/Unit/Cms/Controllers/UsersControllerTest.php
new file mode 100644
index 0000000..7dacf09
--- /dev/null
+++ b/tests/Unit/Cms/Controllers/UsersControllerTest.php
@@ -0,0 +1,232 @@
+_originalRegistry = [
+ 'Auth.User' => Registry::getInstance()->get( 'Auth.User' ),
+ 'Auth.UserId' => Registry::getInstance()->get( 'Auth.UserId' ),
+ 'Auth.CsrfToken' => Registry::getInstance()->get( 'Auth.CsrfToken' ),
+ 'Settings' => Registry::getInstance()->get( 'Settings' )
+ ];
+
+ // Mock Settings for Content controller parent class
+ $settings = $this->createMock( SettingManager::class );
+ $settings->method( 'get' )->willReturnCallback( function( $section, $key ) {
+ $defaults = [
+ 'site' => [
+ 'name' => 'Test Site',
+ 'title' => 'Test Site Title',
+ 'description' => 'Test Description',
+ 'url' => 'https://test.example.com'
+ ]
+ ];
+ return $defaults[$section][$key] ?? null;
+ });
+ Registry::getInstance()->set( 'Settings', $settings );
+ }
+
+ protected function tearDown(): void
+ {
+ // Restore original registry values
+ foreach( $this->_originalRegistry as $key => $value )
+ {
+ Registry::getInstance()->set( $key, $value );
+ }
+
+ parent::tearDown();
+ }
+
+ public function testIndexReturnsAllUsers(): void
+ {
+ // Set up admin user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Mock repository to return users
+ $repository = $this->createMock( DatabaseUserRepository::class );
+ $users = [
+ $this->createMock( User::class ),
+ $this->createMock( User::class )
+ ];
+ $repository->expects( $this->once() )
+ ->method( 'all' )
+ ->willReturn( $users );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ // Create controller with mocked dependencies
+ $controller = $this->getMockBuilder( Users::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Users Index' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Users::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionManager->method( 'getFlash' )->willReturn( null );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->index( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Users Index', $result );
+ }
+
+ public function testCreateReturnsForm(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ $repository = $this->createMock( DatabaseUserRepository::class );
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Users::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Create User Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Users::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+
+ $result = $controller->create( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Create User Form', $result );
+ }
+
+ public function testEditReturnsFormForValidUser(): void
+ {
+ // Set up authenticated user
+ $user = $this->createMock( User::class );
+ $user->method( 'getId' )->willReturn( 1 );
+ Registry::getInstance()->set( 'Auth.User', $user );
+
+ // Mock user to edit
+ $userToEdit = $this->createMock( User::class );
+ $userToEdit->method( 'getId' )->willReturn( 2 );
+
+ $repository = $this->createMock( DatabaseUserRepository::class );
+ $repository->method( 'findById' )->with( 2 )->willReturn( $userToEdit );
+
+ $creator = $this->createMock( Creator::class );
+ $updater = $this->createMock( Updater::class );
+ $deleter = $this->createMock( Deleter::class );
+
+ $controller = $this->getMockBuilder( Users::class )
+ ->setConstructorArgs([
+ null,
+ $repository,
+ $creator,
+ $updater,
+ $deleter
+ ])
+ ->onlyMethods( ['view'] )
+ ->getMock();
+
+ // Mock the view builder chain
+ $viewBuilder = $this->createMock( ViewContext::class );
+ $viewBuilder->method( 'title' )->willReturnSelf();
+ $viewBuilder->method( 'description' )->willReturnSelf();
+ $viewBuilder->method( 'withCurrentUser' )->willReturnSelf();
+ $viewBuilder->method( 'withCsrfToken' )->willReturnSelf();
+ $viewBuilder->method( 'with' )->willReturnSelf();
+ $viewBuilder->method( 'render' )->willReturn( 'Edit User Form' );
+
+ $controller->method( 'view' )->willReturn( $viewBuilder );
+
+ // Mock session manager
+ $reflection = new \ReflectionClass( get_parent_class( Users::class ) );
+ $sessionProperty = $reflection->getProperty( '_sessionManager' );
+ $sessionProperty->setAccessible( true );
+
+ $sessionManager = $this->createMock( SessionManager::class );
+ $sessionProperty->setValue( $controller, $sessionManager );
+
+ $request = $this->createMock( Request::class );
+ $request->method( 'getRouteParameter' )->with( 'id' )->willReturn( '2' );
+
+ $result = $controller->edit( $request );
+
+ $this->assertIsString( $result );
+ $this->assertStringContainsString( 'Edit User Form', $result );
+ }
+
+}
diff --git a/tests/Unit/Cms/Services/Content/EditorJsRendererTest.php b/tests/Unit/Cms/Services/Content/EditorJsRendererTest.php
index 70a6ce1..f6ed374 100644
--- a/tests/Unit/Cms/Services/Content/EditorJsRendererTest.php
+++ b/tests/Unit/Cms/Services/Content/EditorJsRendererTest.php
@@ -558,4 +558,368 @@ public function testRenderNestedListPreservesLegacyFormat(): void
$ulCount = substr_count( $result, '
assertEquals( 1, $ulCount );
}
+
+ public function testRenderEmbedBlockYouTube(): void
+ {
+ $data = [
+ 'blocks' => [
+ [
+ 'type' => 'embed',
+ 'data' => [
+ 'service' => 'youtube',
+ 'source' => 'https://www.youtube.com/watch?v=dQw4w9WgXcQ',
+ 'embed' => 'https://www.youtube.com/embed/dQw4w9WgXcQ',
+ 'width' => 580,
+ 'height' => 320,
+ 'caption' => 'Sample Video'
+ ]
+ ]
+ ]
+ ];
+
+ $result = $this->renderer->render( $data );
+
+ $this->assertStringContainsString( 'assertStringContainsString( 'assertStringContainsString( 'youtube.com/embed', $result );
+ $this->assertStringContainsString( 'Sample Video', $result );
+ $this->assertStringContainsString( 'sandbox=', $result );
+ $this->assertStringContainsString( '', $result );
+ }
+
+ public function testRenderEmbedBlockVimeo(): void
+ {
+ $data = [
+ 'blocks' => [
+ [
+ 'type' => 'embed',
+ 'data' => [
+ 'service' => 'vimeo',
+ 'source' => 'https://vimeo.com/123456789',
+ 'embed' => 'https://player.vimeo.com/video/123456789',
+ 'width' => 580,
+ 'height' => 320
+ ]
+ ]
+ ]
+ ];
+
+ $result = $this->renderer->render( $data );
+
+ $this->assertStringContainsString( 'assertStringContainsString( 'player.vimeo.com', $result );
+ $this->assertStringNotContainsString( ' [
+ [
+ 'type' => 'embed',
+ 'data' => [
+ 'service' => 'codepen',
+ 'embed' => 'https://codepen.io/embed/abc123',
+ 'caption' => 'Cool CodePen Demo'
+ ]
+ ]
+ ]
+ ];
+
+ $result = $this->renderer->render( $data );
+
+ $this->assertStringContainsString( 'assertStringContainsString( 'Cool CodePen Demo', $result );
+ }
+
+ public function testRenderEmbedBlockMissingUrl(): void
+ {
+ $data = [
+ 'blocks' => [
+ [
+ 'type' => 'embed',
+ 'data' => [
+ 'service' => 'youtube'
+ // Missing 'embed' URL
+ ]
+ ]
+ ]
+ ];
+
+ $result = $this->renderer->render( $data );
+
+ $this->assertStringContainsString( '', $result );
+ }
+
+ public function testRenderEmbedBlockUntrustedDomain(): void
+ {
+ $data = [
+ 'blocks' => [
+ [
+ 'type' => 'embed',
+ 'data' => [
+ 'service' => 'unknown',
+ 'embed' => 'https://evil.com/malicious.html'
+ ]
+ ]
+ ]
+ ];
+
+ $result = $this->renderer->render( $data );
+
+ $this->assertStringContainsString( '', $result );
+ }
}
diff --git a/tests/Unit/Cms/Services/Media/CloudinaryUploaderMockTest.php b/tests/Unit/Cms/Services/Media/CloudinaryUploaderMockTest.php
new file mode 100644
index 0000000..d762819
--- /dev/null
+++ b/tests/Unit/Cms/Services/Media/CloudinaryUploaderMockTest.php
@@ -0,0 +1,539 @@
+set( 'cloudinary', 'cloud_name', 'test-cloud' );
+ $memory->set( 'cloudinary', 'api_key', 'test-key' );
+ $memory->set( 'cloudinary', 'api_secret', 'test-secret' );
+ $memory->set( 'cloudinary', 'folder', 'test-folder' );
+
+ $this->_settings = new SettingManager( $memory );
+ }
+
+ public function testListResourcesCallsAdminApiWithCorrectParameters(): void
+ {
+ // Create a mock AdminApi
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ // Expect assets() to be called with correct parameters
+ $adminApiMock->expects( $this->once() )
+ ->method( 'assets' )
+ ->with( [
+ 'type' => 'upload',
+ 'prefix' => 'test-folder',
+ 'max_results' => 30,
+ 'resource_type' => 'image'
+ ] )
+ ->willReturn( [
+ 'resources' => [
+ [
+ 'url' => 'https://res.cloudinary.com/test/image/upload/v1/test.jpg',
+ 'secure_url' => 'https://res.cloudinary.com/test/image/upload/v1/test.jpg',
+ 'public_id' => 'test-folder/test',
+ 'width' => 800,
+ 'height' => 600,
+ 'format' => 'jpg',
+ 'bytes' => 50000,
+ 'resource_type' => 'image',
+ 'created_at' => '2024-01-01T00:00:00Z'
+ ]
+ ],
+ 'next_cursor' => 'abc123',
+ 'total_count' => 10
+ ] );
+
+ // Create a mock Cloudinary instance
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )
+ ->willReturn( $adminApiMock );
+
+ // Create uploader and inject mock via reflection
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ // Call listResources
+ $result = $uploader->listResources();
+
+ // Verify structure
+ $this->assertIsArray( $result );
+ $this->assertArrayHasKey( 'resources', $result );
+ $this->assertArrayHasKey( 'next_cursor', $result );
+ $this->assertArrayHasKey( 'total_count', $result );
+ $this->assertEquals( 'abc123', $result['next_cursor'] );
+ $this->assertEquals( 10, $result['total_count'] );
+ $this->assertCount( 1, $result['resources'] );
+ }
+
+ public function testListResourcesWithCustomMaxResults(): void
+ {
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ $adminApiMock->expects( $this->once() )
+ ->method( 'assets' )
+ ->with( $this->callback( function( $options ) {
+ return $options['max_results'] === 10;
+ } ) )
+ ->willReturn( [
+ 'resources' => [],
+ 'next_cursor' => null,
+ 'total_count' => 0
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )->willReturn( $adminApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->listResources( [ 'max_results' => 10 ] );
+
+ $this->assertIsArray( $result );
+ }
+
+ public function testListResourcesWithNextCursor(): void
+ {
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ $adminApiMock->expects( $this->once() )
+ ->method( 'assets' )
+ ->with( $this->callback( function( $options ) {
+ return isset( $options['next_cursor'] ) && $options['next_cursor'] === 'cursor123';
+ } ) )
+ ->willReturn( [
+ 'resources' => [],
+ 'next_cursor' => null,
+ 'total_count' => 0
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )->willReturn( $adminApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->listResources( [ 'next_cursor' => 'cursor123' ] );
+
+ $this->assertIsArray( $result );
+ }
+
+ public function testListResourcesWithCustomFolder(): void
+ {
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ $adminApiMock->expects( $this->once() )
+ ->method( 'assets' )
+ ->with( $this->callback( function( $options ) {
+ return $options['prefix'] === 'custom-folder';
+ } ) )
+ ->willReturn( [
+ 'resources' => [],
+ 'next_cursor' => null,
+ 'total_count' => 0
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )->willReturn( $adminApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->listResources( [ 'folder' => 'custom-folder' ] );
+
+ $this->assertIsArray( $result );
+ }
+
+ public function testListResourcesFormatsResultsCorrectly(): void
+ {
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ $adminApiMock->method( 'assets' )
+ ->willReturn( [
+ 'resources' => [
+ [
+ 'url' => 'http://example.com/image.jpg',
+ 'secure_url' => 'https://example.com/image.jpg',
+ 'public_id' => 'test/image',
+ 'width' => 1024,
+ 'height' => 768,
+ 'format' => 'png',
+ 'bytes' => 100000,
+ 'resource_type' => 'image',
+ 'created_at' => '2024-01-15T10:00:00Z'
+ ]
+ ],
+ 'next_cursor' => null,
+ 'total_count' => 1
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )->willReturn( $adminApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->listResources();
+
+ $this->assertCount( 1, $result['resources'] );
+ $resource = $result['resources'][0];
+
+ // Verify formatted result structure
+ $this->assertEquals( 'https://example.com/image.jpg', $resource['url'] );
+ $this->assertEquals( 'test/image', $resource['public_id'] );
+ $this->assertEquals( 1024, $resource['width'] );
+ $this->assertEquals( 768, $resource['height'] );
+ $this->assertEquals( 'png', $resource['format'] );
+ $this->assertEquals( 100000, $resource['bytes'] );
+ $this->assertEquals( 'image', $resource['resource_type'] );
+ $this->assertEquals( '2024-01-15T10:00:00Z', $resource['created_at'] );
+ }
+
+ public function testListResourcesHandlesEmptyResults(): void
+ {
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ $adminApiMock->method( 'assets' )
+ ->willReturn( [
+ 'resources' => [],
+ 'total_count' => 0
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )->willReturn( $adminApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->listResources();
+
+ $this->assertIsArray( $result );
+ $this->assertEmpty( $result['resources'] );
+ $this->assertNull( $result['next_cursor'] );
+ $this->assertEquals( 0, $result['total_count'] );
+ }
+
+ public function testListResourcesThrowsExceptionOnApiFailure(): void
+ {
+ $adminApiMock = $this->createMock( AdminApi::class );
+
+ $adminApiMock->method( 'assets' )
+ ->willThrowException( new \Exception( 'API Error' ) );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'adminApi' )->willReturn( $adminApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Cloudinary list resources failed' );
+
+ $uploader->listResources();
+ }
+
+ public function testDeleteCallsUploadApiWithPublicId(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ $uploadApiMock->expects( $this->once() )
+ ->method( 'destroy' )
+ ->with( 'test-folder/test-image' )
+ ->willReturn( [ 'result' => 'ok' ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->delete( 'test-folder/test-image' );
+
+ $this->assertTrue( $result );
+ }
+
+ public function testDeleteReturnsFalseOnFailure(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ $uploadApiMock->method( 'destroy' )
+ ->willReturn( [ 'result' => 'not found' ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->delete( 'test-folder/nonexistent' );
+
+ $this->assertFalse( $result );
+ }
+
+ public function testDeleteThrowsExceptionOnApiError(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ $uploadApiMock->method( 'destroy' )
+ ->willThrowException( new \Exception( 'API Error' ) );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Cloudinary deletion failed' );
+
+ $uploader->delete( 'test-folder/test-image' );
+ }
+
+ public function testUploadCallsUploadApiWithCorrectOptions(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ // Create a real temporary file
+ $tmpFile = tmpfile();
+ $tmpFilePath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, 'fake image content' );
+
+ $uploadApiMock->expects( $this->once() )
+ ->method( 'upload' )
+ ->with(
+ $tmpFilePath,
+ $this->callback( function( $options ) {
+ return $options['folder'] === 'test-folder'
+ && $options['resource_type'] === 'image';
+ } )
+ )
+ ->willReturn( [
+ 'secure_url' => 'https://example.com/test.jpg',
+ 'public_id' => 'test-folder/test',
+ 'width' => 800,
+ 'height' => 600,
+ 'format' => 'jpg',
+ 'bytes' => 50000
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->upload( $tmpFilePath );
+
+ $this->assertArrayHasKey( 'url', $result );
+ $this->assertEquals( 'https://example.com/test.jpg', $result['url'] );
+
+ // Clean up
+ fclose( $tmpFile );
+ }
+
+ public function testUploadThrowsExceptionForNonexistentFile(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'File not found' );
+
+ $uploader->upload( '/nonexistent/file.jpg' );
+ }
+
+ public function testUploadThrowsExceptionOnApiError(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ // Create a real temporary file
+ $tmpFile = tmpfile();
+ $tmpFilePath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, 'fake image content' );
+
+ $uploadApiMock->method( 'upload' )
+ ->willThrowException( new \Exception( 'Upload failed' ) );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Cloudinary upload failed' );
+
+ $uploader->upload( $tmpFilePath );
+
+ // Clean up
+ fclose( $tmpFile );
+ }
+
+ public function testUploadWithCustomOptions(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ // Create a real temporary file
+ $tmpFile = tmpfile();
+ $tmpFilePath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, 'fake image content' );
+
+ $uploadApiMock->expects( $this->once() )
+ ->method( 'upload' )
+ ->with(
+ $tmpFilePath,
+ $this->callback( function( $options ) {
+ return $options['folder'] === 'custom-folder'
+ && $options['public_id'] === 'my-image'
+ && isset( $options['tags'] )
+ && in_array( 'test', $options['tags'] );
+ } )
+ )
+ ->willReturn( [
+ 'secure_url' => 'https://example.com/custom.jpg',
+ 'public_id' => 'custom-folder/my-image',
+ 'width' => 1024,
+ 'height' => 768,
+ 'format' => 'jpg',
+ 'bytes' => 100000
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->upload( $tmpFilePath, [
+ 'folder' => 'custom-folder',
+ 'public_id' => 'my-image',
+ 'tags' => ['test', 'upload']
+ ] );
+
+ $this->assertEquals( 'https://example.com/custom.jpg', $result['url'] );
+ $this->assertEquals( 'custom-folder/my-image', $result['public_id'] );
+
+ // Clean up
+ fclose( $tmpFile );
+ }
+
+ public function testUploadWithTransformation(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ // Create a real temporary file
+ $tmpFile = tmpfile();
+ $tmpFilePath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, 'fake image content' );
+
+ $uploadApiMock->expects( $this->once() )
+ ->method( 'upload' )
+ ->with(
+ $tmpFilePath,
+ $this->callback( function( $options ) {
+ return isset( $options['transformation'] )
+ && is_array( $options['transformation'] );
+ } )
+ )
+ ->willReturn( [
+ 'secure_url' => 'https://example.com/transformed.jpg',
+ 'public_id' => 'test-folder/transformed',
+ 'width' => 800,
+ 'height' => 600,
+ 'format' => 'jpg',
+ 'bytes' => 50000
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->upload( $tmpFilePath, [
+ 'transformation' => [
+ 'width' => 800,
+ 'height' => 600,
+ 'crop' => 'fill'
+ ]
+ ] );
+
+ $this->assertArrayHasKey( 'url', $result );
+
+ // Clean up
+ fclose( $tmpFile );
+ }
+}
diff --git a/tests/Unit/Cms/Services/Media/CloudinaryUploaderTest.php b/tests/Unit/Cms/Services/Media/CloudinaryUploaderTest.php
index ad9157d..534b0e6 100644
--- a/tests/Unit/Cms/Services/Media/CloudinaryUploaderTest.php
+++ b/tests/Unit/Cms/Services/Media/CloudinaryUploaderTest.php
@@ -282,4 +282,118 @@ public function testDeleteWithValidPublicId(): void
$this->assertIsBool( $result );
}
+
+ public function testListResourcesReturnsExpectedStructure(): void
+ {
+ // Skip if using test credentials (not real Cloudinary account)
+ $cloudName = $this->_settings->get( 'cloudinary', 'cloud_name' );
+ $isTestCredentials = ($cloudName === 'test-cloud');
+ $hasRealCredentials = getenv( 'CLOUDINARY_URL' ) || (!$isTestCredentials && $cloudName);
+
+ if( !$hasRealCredentials )
+ {
+ $this->markTestSkipped(
+ 'Cloudinary credentials not configured. Set CLOUDINARY_URL environment variable or configure real cloudinary settings to run this integration test.'
+ );
+ }
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+ $result = $uploader->listResources();
+
+ // Verify structure
+ $this->assertIsArray( $result );
+ $this->assertArrayHasKey( 'resources', $result );
+ $this->assertArrayHasKey( 'next_cursor', $result );
+ $this->assertArrayHasKey( 'total_count', $result );
+
+ // Verify resources is an array
+ $this->assertIsArray( $result['resources'] );
+
+ // If there are resources, verify their structure
+ if( !empty( $result['resources'] ) )
+ {
+ $resource = $result['resources'][0];
+ $this->assertArrayHasKey( 'url', $resource );
+ $this->assertArrayHasKey( 'public_id', $resource );
+ $this->assertArrayHasKey( 'width', $resource );
+ $this->assertArrayHasKey( 'height', $resource );
+ $this->assertArrayHasKey( 'format', $resource );
+ $this->assertArrayHasKey( 'bytes', $resource );
+ }
+ }
+
+ public function testListResourcesWithCustomOptions(): void
+ {
+ // Skip if using test credentials (not real Cloudinary account)
+ $cloudName = $this->_settings->get( 'cloudinary', 'cloud_name' );
+ $isTestCredentials = ($cloudName === 'test-cloud');
+ $hasRealCredentials = getenv( 'CLOUDINARY_URL' ) || (!$isTestCredentials && $cloudName);
+
+ if( !$hasRealCredentials )
+ {
+ $this->markTestSkipped(
+ 'Cloudinary credentials not configured. Set CLOUDINARY_URL environment variable or configure real cloudinary settings to run this integration test.'
+ );
+ }
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+ $result = $uploader->listResources( [
+ 'max_results' => 5
+ ] );
+
+ $this->assertIsArray( $result );
+ $this->assertArrayHasKey( 'resources', $result );
+
+ // If there are resources, should not exceed max_results
+ if( !empty( $result['resources'] ) )
+ {
+ $this->assertLessThanOrEqual( 5, count( $result['resources'] ) );
+ }
+ }
+
+ public function testListResourcesWithPagination(): void
+ {
+ // Skip if using test credentials (not real Cloudinary account)
+ $cloudName = $this->_settings->get( 'cloudinary', 'cloud_name' );
+ $isTestCredentials = ($cloudName === 'test-cloud');
+ $hasRealCredentials = getenv( 'CLOUDINARY_URL' ) || (!$isTestCredentials && $cloudName);
+
+ if( !$hasRealCredentials )
+ {
+ $this->markTestSkipped(
+ 'Cloudinary credentials not configured. Set CLOUDINARY_URL environment variable or configure real cloudinary settings to run this integration test.'
+ );
+ }
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ // Get first page
+ $firstPage = $uploader->listResources( [ 'max_results' => 2 ] );
+
+ // If we have a next_cursor, test pagination
+ if( $firstPage['next_cursor'] )
+ {
+ $secondPage = $uploader->listResources( [
+ 'max_results' => 2,
+ 'next_cursor' => $firstPage['next_cursor']
+ ] );
+
+ $this->assertIsArray( $secondPage );
+ $this->assertArrayHasKey( 'resources', $secondPage );
+
+ // Resources should be different
+ if( !empty( $firstPage['resources'] ) && !empty( $secondPage['resources'] ) )
+ {
+ $this->assertNotEquals(
+ $firstPage['resources'][0]['public_id'],
+ $secondPage['resources'][0]['public_id']
+ );
+ }
+ }
+ else
+ {
+ // If no next_cursor, we just verify structure is correct
+ $this->assertNull( $firstPage['next_cursor'] );
+ }
+ }
}
diff --git a/tests/Unit/Cms/Services/Media/CloudinaryUploaderUrlTest.php b/tests/Unit/Cms/Services/Media/CloudinaryUploaderUrlTest.php
new file mode 100644
index 0000000..ff02864
--- /dev/null
+++ b/tests/Unit/Cms/Services/Media/CloudinaryUploaderUrlTest.php
@@ -0,0 +1,213 @@
+set( 'cloudinary', 'cloud_name', 'test-cloud' );
+ $memory->set( 'cloudinary', 'api_key', 'test-key' );
+ $memory->set( 'cloudinary', 'api_secret', 'test-secret' );
+ $memory->set( 'cloudinary', 'folder', 'test-folder' );
+
+ $this->_settings = new SettingManager( $memory );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForInvalidUrl(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Invalid URL' );
+
+ $uploader->uploadFromUrl( 'not-a-url' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForHttpUrl(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Only HTTPS URLs are allowed' );
+
+ $uploader->uploadFromUrl( 'http://example.com/image.jpg' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForFtpUrl(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Only HTTPS URLs are allowed' );
+
+ $uploader->uploadFromUrl( 'ftp://example.com/image.jpg' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForLoopbackIp(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'private or reserved IP address' );
+
+ $uploader->uploadFromUrl( 'https://127.0.0.1/image.jpg' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForPrivateIp10(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'private or reserved IP address' );
+
+ $uploader->uploadFromUrl( 'https://10.0.0.1/image.jpg' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForPrivateIp192(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'private or reserved IP address' );
+
+ $uploader->uploadFromUrl( 'https://192.168.1.1/image.jpg' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForPrivateIp172(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'private or reserved IP address' );
+
+ $uploader->uploadFromUrl( 'https://172.16.0.1/image.jpg' );
+ }
+
+ public function testUploadFromUrlThrowsExceptionForLinkLocalIp(): void
+ {
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'private or reserved IP address' );
+
+ // 169.254.169.254 is cloud metadata service IP
+ $uploader->uploadFromUrl( 'https://169.254.169.254/latest/meta-data/' );
+ }
+
+ public function testUploadFromUrlCallsUploadApiWithValidUrl(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ $uploadApiMock->expects( $this->once() )
+ ->method( 'upload' )
+ ->with(
+ 'https://example.com/test.jpg',
+ $this->callback( function( $options ) {
+ return $options['folder'] === 'test-folder'
+ && $options['resource_type'] === 'image';
+ } )
+ )
+ ->willReturn( [
+ 'secure_url' => 'https://res.cloudinary.com/test/image/upload/v1/test.jpg',
+ 'public_id' => 'test-folder/test',
+ 'width' => 800,
+ 'height' => 600,
+ 'format' => 'jpg',
+ 'bytes' => 50000
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->uploadFromUrl( 'https://example.com/test.jpg' );
+
+ $this->assertArrayHasKey( 'url', $result );
+ $this->assertEquals( 'https://res.cloudinary.com/test/image/upload/v1/test.jpg', $result['url'] );
+ }
+
+ public function testUploadFromUrlWithCustomOptions(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ $uploadApiMock->expects( $this->once() )
+ ->method( 'upload' )
+ ->with(
+ 'https://example.com/test.jpg',
+ $this->callback( function( $options ) {
+ return $options['folder'] === 'custom'
+ && isset( $options['public_id'] );
+ } )
+ )
+ ->willReturn( [
+ 'secure_url' => 'https://res.cloudinary.com/test/image/upload/v1/custom.jpg',
+ 'public_id' => 'custom/my-image',
+ 'width' => 1024,
+ 'height' => 768,
+ 'format' => 'jpg',
+ 'bytes' => 100000
+ ] );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $result = $uploader->uploadFromUrl( 'https://example.com/test.jpg', [
+ 'folder' => 'custom',
+ 'public_id' => 'my-image'
+ ] );
+
+ $this->assertArrayHasKey( 'url', $result );
+ }
+
+ public function testUploadFromUrlThrowsExceptionOnApiError(): void
+ {
+ $uploadApiMock = $this->createMock( UploadApi::class );
+
+ $uploadApiMock->method( 'upload' )
+ ->willThrowException( new \Exception( 'Upload failed' ) );
+
+ $cloudinaryMock = $this->createMock( Cloudinary::class );
+ $cloudinaryMock->method( 'uploadApi' )->willReturn( $uploadApiMock );
+
+ $uploader = new CloudinaryUploader( $this->_settings );
+
+ $reflection = new \ReflectionClass( $uploader );
+ $cloudinaryProperty = $reflection->getProperty( '_cloudinary' );
+ $cloudinaryProperty->setAccessible( true );
+ $cloudinaryProperty->setValue( $uploader, $cloudinaryMock );
+
+ $this->expectException( \Exception::class );
+ $this->expectExceptionMessage( 'Cloudinary upload from URL failed' );
+
+ $uploader->uploadFromUrl( 'https://example.com/test.jpg' );
+ }
+}
diff --git a/tests/Unit/Cms/Services/Media/MediaValidatorTest.php b/tests/Unit/Cms/Services/Media/MediaValidatorTest.php
index 244a438..e53e5ed 100644
--- a/tests/Unit/Cms/Services/Media/MediaValidatorTest.php
+++ b/tests/Unit/Cms/Services/Media/MediaValidatorTest.php
@@ -57,6 +57,97 @@ public function testValidateReturnsFalseForUploadError(): void
$this->assertStringContainsString( 'No file was uploaded', $this->_validator->getFirstError() );
}
+ public function testValidateReturnsFalseForIniSizeError(): void
+ {
+ $file = [
+ 'error' => UPLOAD_ERR_INI_SIZE,
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'upload_max_filesize', $this->_validator->getFirstError() );
+ }
+
+ public function testValidateReturnsFalseForFormSizeError(): void
+ {
+ $file = [
+ 'error' => UPLOAD_ERR_FORM_SIZE,
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'MAX_FILE_SIZE', $this->_validator->getFirstError() );
+ }
+
+ public function testValidateReturnsFalseForPartialUploadError(): void
+ {
+ $file = [
+ 'error' => UPLOAD_ERR_PARTIAL,
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'partially uploaded', $this->_validator->getFirstError() );
+ }
+
+ public function testValidateReturnsFalseForNoTmpDirError(): void
+ {
+ $file = [
+ 'error' => UPLOAD_ERR_NO_TMP_DIR,
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'temporary folder', $this->_validator->getFirstError() );
+ }
+
+ public function testValidateReturnsFalseForCantWriteError(): void
+ {
+ $file = [
+ 'error' => UPLOAD_ERR_CANT_WRITE,
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'write file to disk', $this->_validator->getFirstError() );
+ }
+
+ public function testValidateReturnsFalseForExtensionError(): void
+ {
+ $file = [
+ 'error' => UPLOAD_ERR_EXTENSION,
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'extension stopped', $this->_validator->getFirstError() );
+ }
+
+ public function testValidateReturnsFalseForUnknownError(): void
+ {
+ $file = [
+ 'error' => 999, // Unknown error code
+ 'tmp_name' => ''
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'Unknown', $this->_validator->getFirstError() );
+ }
+
public function testValidateReturnsFalseForNonExistentFile(): void
{
$file = [
@@ -160,9 +251,130 @@ public function testGetFirstErrorReturnsNullWhenNoErrors(): void
$this->assertNull( $firstError );
}
- /**
- * Note: Full validation with real image files would require creating
- * actual image data, which is complex in unit tests. These tests cover
- * the basic validation logic.
- */
+ public function testValidatePassesForValidJpegFile(): void
+ {
+ // Create a minimal valid JPEG file
+ $jpegData = base64_decode(
+ '/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a' .
+ 'HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy' .
+ 'MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAABAAEDASIA' .
+ 'AhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAv/xAAUEAEAAAAAAAAAAAAAAAAAAAAA/8QAFQEB' .
+ 'AQAAAAAAAAAAAAAAAAAAAAX/xAAUEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIRAxEAPwCwAA=='
+ );
+
+ $tmpFile = tmpfile();
+ $tmpPath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, $jpegData );
+
+ $file = [
+ 'error' => UPLOAD_ERR_OK,
+ 'tmp_name' => $tmpPath,
+ 'name' => 'test.jpg',
+ 'size' => strlen( $jpegData )
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertTrue( $result );
+ $this->assertEmpty( $this->_validator->getErrors() );
+
+ fclose( $tmpFile );
+ }
+
+ public function testValidatePassesForValidPngFile(): void
+ {
+ // Create a minimal valid PNG file (1x1 transparent pixel)
+ $pngData = base64_decode(
+ 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg=='
+ );
+
+ $tmpFile = tmpfile();
+ $tmpPath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, $pngData );
+
+ $file = [
+ 'error' => UPLOAD_ERR_OK,
+ 'tmp_name' => $tmpPath,
+ 'name' => 'test.png',
+ 'size' => strlen( $pngData )
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertTrue( $result );
+ $this->assertEmpty( $this->_validator->getErrors() );
+
+ fclose( $tmpFile );
+ }
+
+ public function testValidateFailsForInvalidMimeType(): void
+ {
+ // Create a text file with .jpg extension (MIME type mismatch)
+ $tmpFile = tmpfile();
+ $tmpPath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, 'This is not an image' );
+
+ $file = [
+ 'error' => UPLOAD_ERR_OK,
+ 'tmp_name' => $tmpPath,
+ 'name' => 'fake.jpg',
+ 'size' => 20
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertFalse( $result );
+ $this->assertStringContainsString( 'Invalid file type', $this->_validator->getFirstError() );
+
+ fclose( $tmpFile );
+ }
+
+ public function testValidateFailsForNonImageFile(): void
+ {
+ // Create a file that has correct MIME but isn't a valid image
+ $tmpFile = tmpfile();
+ $tmpPath = stream_get_meta_data( $tmpFile )['uri'];
+ // Write some binary data that might pass MIME check but fail getimagesize
+ fwrite( $tmpFile, "\xFF\xD8\xFF" . str_repeat( 'X', 100 ) ); // Fake JPEG header
+
+ $file = [
+ 'error' => UPLOAD_ERR_OK,
+ 'tmp_name' => $tmpPath,
+ 'name' => 'corrupt.jpg',
+ 'size' => 103
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ // Should fail either on MIME or getimagesize check
+ $this->assertFalse( $result );
+
+ fclose( $tmpFile );
+ }
+
+ public function testValidatePassesForValidGifFile(): void
+ {
+ // Create a minimal valid GIF file (1x1 transparent pixel)
+ $gifData = base64_decode(
+ 'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'
+ );
+
+ $tmpFile = tmpfile();
+ $tmpPath = stream_get_meta_data( $tmpFile )['uri'];
+ fwrite( $tmpFile, $gifData );
+
+ $file = [
+ 'error' => UPLOAD_ERR_OK,
+ 'tmp_name' => $tmpPath,
+ 'name' => 'test.gif',
+ 'size' => strlen( $gifData )
+ ];
+
+ $result = $this->_validator->validate( $file );
+
+ $this->assertTrue( $result );
+ $this->assertEmpty( $this->_validator->getErrors() );
+
+ fclose( $tmpFile );
+ }
}
diff --git a/versionlog.md b/versionlog.md
index ff519c6..b591632 100644
--- a/versionlog.md
+++ b/versionlog.md
@@ -12,16 +12,11 @@
## 0.8.9 2025-12-19
* **Slug generation now uses system abstractions** - All content service classes refactored to use `IRandom` interface
* Refactored 6 service classes: Post/Creator, Post/Updater, Category/Creator, Category/Updater, Page/Creator, Tag/Creator
-* Slug generation fallback now uses `IRandom->uniqueId()` instead of direct `uniqid()` calls
* Services support dependency injection with optional `IRandom` parameter for testability
* Maintains full backward compatibility - existing code works without changes
-* All 195 tests passing (slug generation now fully deterministic in tests)
* **Security services now use system abstractions** - PasswordResetter and EmailVerifier refactored to use `IRandom` interface
* Secure token generation now uses abstraction instead of direct random_bytes() calls
* Services support dependency injection with optional `IRandom` parameter for testability
-* Maintains cryptographic security with RealRandom default (using random_bytes())
-* Maintains full backward compatibility - existing code works without changes
-* All tests passing (24 tests total for both services)
## 0.8.8 2025-11-16