PHPUnit Test Suite
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The PHPUnit Test Suite in the IT Management System is a comprehensive framework designed to validate system functionality, prevent regressions, and ensure the integrity of the multi-tenant architecture. The suite prioritizes critical CRUD (Create, Read, Update, Delete) paths, security measures, and database integration across all project modules. It is built to run in a CLI context, allowing for automated testing of the core PHP logic and MySQL database interactions.
The suite is organized into subdirectories within tests/Unit/, covering specific domains such as Security, CRUD, and MultiTenancy. By utilizing a standardized bootstrap process and automated test generation, the system maintains a high coverage goal (minimum 80%) for both standard and bespoke modules.
Sources: tests/PREFERENCES.md:4-10, tests/AGENT_NOTES.md:4-12, scripts/scripts.php:220-225
Architecture and Components
The testing architecture relies on PHPUnit 9.6 and a structured environment initialization process. The suite is designed to be "MySQL independent" via environment flags, though it primarily focuses on integration tests that interact with the database.
Core Testing Components
| Component | Description | File Path |
|---|---|---|
| Configuration | Defines the test suites, directory locations, and bootstrap file. | phpunit.xml |
| Bootstrap | Initializes constants, loads the main config, and sets the CLI context. | tests/bootstrap.php |
| Test Runner | A utility script to execute the suite via phpunit.phar. | scripts/run_tests.php |
| Test Generator | Automatically creates CRUD integration tests based on module metadata. | scripts/generate_tests.php |
| Unit Directory | Contains the actual test classes (ending in *unittest.php or Test.php). | tests/Unit/ |
Sources: phpunit.xml:1-12, tests/bootstrap.php:1-20, tests/AGENT_NOTES.md:14-22, tests/PREFERENCES.md:23-28
Test Execution Flow
The following diagram illustrates how the system prepares and executes the test suite:
The system uses the ITM_CLI_SCRIPT constant to bypass web-only authentication and logic during test execution.
Sources: tests/bootstrap.php:1-35, tests/PREFERENCES.md:13-20, phpunit.xml:8-11
Automated Test Generation
The system includes a specialized script, generate_tests.php, which automates the creation of integration tests for standard CRUD modules. This script reads scripts/modules_metadata.json to identify modules and dynamically generates PHP code that performs full CRUD lifecycle testing.
Generation Logic
- Metadata Identification: Scans for modules marked as
is_standard. - Schema Inspection: Uses
DESCRIBEandINFORMATION_SCHEMAto identify table columns and Foreign Key (FK) relationships. - Dependency Resolution: Generates setup code to find valid parent records for foreign keys (e.g., finding an existing
company_idoremployee_id). - Template Injection: Injects the discovered schema into a PHPUnit class template that tests Create, Read, Update, and Delete operations.
Sources: scripts/generate_tests.php:6-60
Sources: scripts/generate_tests.php:10-50
Multi-Tenancy and Data Isolation
A critical focus of the suite is validating data isolation across the 5 seeded companies. Tests ensure that users can only interact with records belonging to their assigned company_id.
- Fixtures: Initial data is pulled from
database.sql. - Isolation: Tests utilize transaction rollbacks or temporary table approaches to ensure the environment remains clean for subsequent runs.
- Audit Logging: The suite verifies that all mutations (INSERT, UPDATE, DELETE) are correctly recorded in the
audit_logstable with the appropriatecompany_id.
Sources: tests/PREFERENCES.md:13-20, scripts/scripts.php:385-395
Security Testing Focus
The test suite includes dedicated security-focused tests to prevent regressions in common vulnerability areas:
- SQL Injection (SQLi): Tests check for direct queries near user input without binding or sanitization.
- CSRF Validation: Ensures POST handlers that mutate data are protected by the system's CSRF guards.
- XSS Sanitization: Validates that user-supplied data is properly escaped before being re-displayed.
- FK Regression: Includes specific tests for the "Protection Zone" to ensure delete cascades do not bypass business rules.
Sources: tests/PREFERENCES.md:13-21, scripts/scripts.php:240-260
Conclusion
The PHPUnit Test Suite serves as the primary automated quality gate for the IT Management System. By combining manual unit tests with automated integration test generation, the project ensures that both standard CRUD operations and complex multi-tenant logic remain functional. The suite's integration with the CLI and its focus on security audits make it an essential tool for developers maintaining the system's 80% coverage goal.