Add GitHub Actions CI and expand unit test coverage by daedeloth · Pull Request #2 · CatLabInteractive/OpenID-Connect-Client

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth · 2026-08-27T12:24:01Z

Workflow

.github/workflows/tests.yml runs on push to master and on every pull request:

actions/checkout@v4
shivammathur/setup-php@v2 on a PHP 8.1 / 8.2 / 8.3 / 8.4 / 8.5 matrix (fail-fast: false), extensions: gettext, mbstring, curl (gettext is a hard requirement of catlabinteractive/neuron), no coverage
composer install --prefer-dist --no-progress --no-interaction
vendor/bin/phpunit

composer.lock is git-ignored, so every job resolves fresh; all dependencies (neuron >=7.4, guzzle ^7, phpunit ^9.6) accept the full range, so no version was dropped from the matrix. Locally the suite is green on PHP 8.5.4 with error_reporting=E_ALL and display_errors=1 (no notices/deprecations) against a fresh composer install (neuron v3.1.6).

Tests added (9 → 39 tests)

All run without a database or network; HTTP goes through Guzzle's MockHandler, following the existing BasicFlowTest style. Each new test was checked against a deliberate breakage of the behaviour it pins (removing the state unset, the is_string guard, the updateLastPing call, the post-login-redirect clear, letting mergeFromInput copy the email) and fails as expected.

tests/BasicFlowTest.php (extended)

array scope / response_type are space-joined
every authorization request gets a fresh 32-hex-char state; only the latest is accepted
state is single-use: a replayed callback is rejected and the session key is gone
callback with no pending request, missing state, or a non-string (array) state is rejected with OpenIDConnectException (no TypeError from hash_equals)
getAuthorizationCode() falls back to $_GET
error_description ends up in the exception message
token response without access_token → exception; error wins even when access_token is present
non-object bodies (HTML, empty, null, string, number) are rejected as invalid JSON (userinfo)
userinfo HTTP 401 → OpenIDConnectException
transport failures (ConnectException) become OpenIDConnectException with the Guzzle exception as getPrevious()
the client secret travels only in the POST body (no Authorization header, not in the URL)

tests/UserModelTest.php (new, uses tests/Fakes/RecordingUserMapper.php)

mergeFromInput() only takes username; email/sub from the claims payload are ignored; display name kept when username absent
shouldPing(): true when never pinged / when older than pingInterval (and stamps lastPing, calls updateLastPing), false within the interval (nothing persisted), pingInterval is per-instance
anonymize() nulls email + display name, keeps id/sub, persists via update()
Guest never exposes an id or personal data even if setters are called

tests/ModuleTest.php (new)

login() stores catlab-user-id + catlab-openid-access-token in the session, fires user:login, returns a 302
post-login-redirect is honoured once and then cleared (with cancel-login-redirect); fallback is the app root
logout() clears both session keys, fires user:logout, redirects to /

The fake mapper is registered once in Neuron's MapperFactory (a process-wide singleton without a reset), which is why it lives in tests/Fakes/ and is shared.

Deliberately not covered

Mappers\UserMapper (all methods build Neuron\DB\Query objects and execute them) and Module::setRequestUser() / setUserMapper() — need MySQL or a real mapper in the singleton.
Controllers\LoginController (login, next, cookieGate, processLogin, touchUser) — depends on Neuron\Config, the DB-backed mapper, setcookie() and Application::getInstance(); would need an integration harness.
Helpers\LoginForm — needs a running Neuron\Application router and template paths.
User::ping() / activity() / createAuthenticatedRequest() — owned by 4.1: ping/activity send the access token in the Authorization header #1 (fix/bearer-header-tokens, tests/UserTokenTransportTest.php); nothing here touches those methods or that file, so the two PRs merge cleanly.
The client_secret form param when authentication_info is absent is sent as an empty value; existing behaviour, left as is rather than pinned.

No changes to src/. .phpunit.result.cache is now git-ignored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

CI: .github/workflows/tests.yml runs vendor/bin/phpunit on push to master and on pull requests, on a PHP 8.1-8.5 matrix (composer.lock is not tracked, so each job resolves fresh; every dependency accepts the whole range). gettext is enabled explicitly because catlabinteractive/neuron requires ext-gettext. Tests (no database, no network; HTTP goes through Guzzle's MockHandler): - BasicFlowTest: array scope/response_type joining, fresh state per request, state is single-use, callback without pending request, missing/non-string state (no TypeError), $_GET fallback, error description in the message, token response without access_token, error wins over access_token, non-object JSON bodies rejected (userinfo), userinfo HTTP error, Guzzle transport exception kept as previous, client secret only in the POST body. - UserModelTest: mergeFromInput only takes the username, shouldPing first/stale/recent/custom-interval behaviour and its updateLastPing persistence, anonymize strips email+display name and persists, Guest never exposes an id or personal data. Uses Tests\Fakes\ RecordingUserMapper registered once in Neuron's MapperFactory. - ModuleTest: login stores user id + access token in the session and fires user:login, post-login-redirect is honoured once and cleared, fallback to app root, logout clears the session and fires user:logout. .phpunit.result.cache is now ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qz9QvEe8uJ65wx8aVKwk7o

daedeloth merged commit d9815b5 into masterAug 27, 2026
5 checks passed

Uh oh!

Conversation

daedeloth commented Aug 27, 2026

Workflow

Tests added (9 → 39 tests)

Deliberately not covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

daedeloth commented Aug 27, 2026

Workflow

Tests added (9 → 39 tests)

Deliberately not covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

daedeloth commented Aug 27, 2026

Workflow

Tests added (9 → 39 tests)

Deliberately not covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

daedeloth commented Aug 27, 2026

Workflow

Tests added (9 → 39 tests)

Deliberately not covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

daedeloth commented Aug 27, 2026

Workflow

Tests added (9 → 39 tests)

Deliberately not covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant