[Web][Tests] Add mailbox group, identity sync, auth, Dovecot and SOGo module tests

tests/php/Identity/Service/StatusServiceTest.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Service;
+
+use Mailcow\Core\AccessDenied;
+use Mailcow\Core\Context;
+use Mailcow\Core\UserError;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Repository\RunRepository;
+use Mailcow\Identity\Service\StatusService;
+use Mailcow\Tests\Support\FakeContext;
+use PHPUnit\Framework\TestCase;
+
+class StatusServiceTest extends TestCase
+{
+    public function testAdminRequestsRuns(): void
+    {
+        $runs = $this->createMock(RunRepository::class);
+        $runs->expects($this->once())->method('request')->with('keycloak', 'force', 'admin')->willReturn(5);
+
+        $this->assertSame(5, $this->service(FakeContext::admin(), $runs)->requestRun('force'));
+    }
+
+    public function testInvalidModeIsRejected(): void
+    {
+        $this->expectExceptionObject(new UserError('iam_sync_mode_invalid'));
+        $this->service(FakeContext::admin())->requestRun(['run']);
+    }
+
+    public function testReadOnlyApiMayOnlyRead(): void
+    {
+        $service = $this->service(new Context('admin', 'api', [], false, 'ro'));
+
+        $this->assertSame('keycloak', $service->status()['provider']);
+        $this->expectException(AccessDenied::class);
+        $service->requestRun('run');
+    }
+
+    public function testDomainAdminsSeeOnlyLinksOfTheirMailboxes(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => 'u1', 'idp_disabled' => 0, 'missing_since' => null]);
+        $service = $this->service(FakeContext::domainAdmin(['a@example.org']), null, $repo);
+
+        $this->assertSame('u1', $service->link('A@example.org')['external_id']);
+        $this->assertNull($service->link('b@example.org'));
+        $this->expectException(AccessDenied::class);
+        $service->status();
+    }
+
+    public function testDomainAdminsCannotUnlink(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->expects($this->never())->method('unlink');
+
+        $this->expectException(AccessDenied::class);
+        $this->service(FakeContext::domainAdmin(['a@example.org']), null, $repo)->unlink('a@example.org');
+    }
+
+    private function service(Context $context, ?RunRepository $runs = null, ?IdentityRepository $repo = null): StatusService
+    {
+        return new StatusService(Settings::fromArray(['authsource' => 'keycloak']), $repo ?? $this->createMock(IdentityRepository::class),
+            $runs ?? $this->createMock(RunRepository::class), $context);
+    }
+}