OpenNIT

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

<?php

declare(strict_types=1);

use OpenNIT\Notifications\ChannelDispatcher;

/**
 * Deckt die (DB-freie) Payload-Formatierung je Kanaltyp ab. Die private
 * format()-Methode wird per Reflection geprüft.
 */
return static function (): void {

    $ref  = new ReflectionClass(ChannelDispatcher::class);
    $disp = $ref->newInstanceWithoutConstructor();
    $fmt  = $ref->getMethod('format');
    $fmt->setAccessible(true);

    $call = static function (string $type, string $secret = '') use ($fmt, $disp): array {
        return $fmt->invoke($disp, $type, 'Titel', 'Nachricht', 'https://example.test/x', $secret);
    };

    test('slack: einfacher text-Payload', function () use ($call) {
        [$body, $headers] = $call('slack');
        $data = json_decode($body, true);
        assertTrue(is_array($data) && isset($data['text']), 'text-Feld fehlt');
        assertTrue(str_contains($data['text'], 'Titel') && str_contains($data['text'], 'Nachricht'));
        assertTrue(str_contains($data['text'], 'https://example.test/x'));
    });

    test('teams: MessageCard mit Titel und Link', function () use ($call) {
        [$body] = $call('teams');
        $data = json_decode($body, true);
        assertSame('MessageCard', $data['@type']);
        assertSame('Titel', $data['title']);
        assertTrue(str_contains($data['text'], 'example.test'));
    });

    test('ntfy: Nachricht im Body, Metadaten in Headern', function () use ($call) {
        [$body, $headers] = $call('ntfy', 'geheim');
        assertSame('Nachricht', $body);
        assertSame('Titel', $headers['Title'] ?? null);
        assertSame('https://example.test/x', $headers['Click'] ?? null);
        assertTrue(str_starts_with($headers['Content-Type'] ?? '', 'text/plain'));
        assertSame('Bearer geheim', $headers['Authorization'] ?? null);
    });

    test('webhook: JSON-Payload, HMAC-Signatur nur mit Secret', function () use ($call) {
        [$body, $headers] = $call('webhook');
        $data = json_decode($body, true);
        assertSame('Titel', $data['title']);
        assertSame('Nachricht', $data['message']);
        assertFalse(isset($headers['X-OpenNIT-Signature']), 'Ohne Secret keine Signatur');

        [$body2, $headers2] = $call('webhook', 'sec');
        assertSame(hash_hmac('sha256', $body2, 'sec'), $headers2['X-OpenNIT-Signature'] ?? null);
    });

    test('EVENTS-Katalog enthält security', function () {
        assertTrue(array_key_exists('security', ChannelDispatcher::EVENTS));
    });
};