snipe-it/tests/Unit/DatabaseSslConfigurationTest.php

<?php

namespace Tests\Unit;

use PDO;
use Tests\TestCase;

class DatabaseSslConfigurationTest extends TestCase
{
    public function test_mysql_ssl_configuration_with_paas_mode(): void
    {
        config([
            'database.connections.mysql.options' => null,
        ]);

        // Test PAAS mode SSL configuration
        config([
            'database.connections.mysql.options' => $this->getSslOptions(true, false, true), // isPaas=true, verifyServer=false, sslEnabled=true
        ]);

        $options = config('database.connections.mysql.options');

        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_CA, $options);
        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT, $options);

        // PAAS mode should not include client certificate attributes
        $this->assertArrayNotHasKey(PDO::MYSQL_ATTR_SSL_KEY, $options);
        $this->assertArrayNotHasKey(PDO::MYSQL_ATTR_SSL_CERT, $options);
        $this->assertArrayNotHasKey(PDO::MYSQL_ATTR_SSL_CIPHER, $options);
    }

    public function test_mysql_ssl_configuration_with_non_paas_mode(): void
    {
        config([
            'database.connections.mysql.options' => null,
        ]);

        // Test non-PAAS mode SSL configuration
        config([
            'database.connections.mysql.options' => $this->getSslOptions(false, false, true), // isPaas=false, verifyServer=false, sslEnabled=true
        ]);

        $options = config('database.connections.mysql.options');

        // Non-PAAS mode should include all SSL attributes
        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_CA, $options);
        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT, $options);
        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_KEY, $options);
        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_CERT, $options);
        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_CIPHER, $options);
    }

    public function test_mysql_ssl_configuration_without_ssl(): void
    {
        config([
            'database.connections.mysql.options' => null,
        ]);

        // Test SSL disabled configuration
        config([
            'database.connections.mysql.options' => $this->getSslOptions(true, false, false), // isPaas=true, verifyServer=false, sslEnabled=false
        ]);

        $options = config('database.connections.mysql.options');

        // When SSL is disabled, options should be empty
        $this->assertEmpty($options);
    }

    public function test_ssl_verify_server_defaults_to_false(): void
    {
        // Test that SSL_VERIFY_SERVER defaults to false when not explicitly set
        $options = $this->getSslOptions(true, null, true); // isPaas=true, verifyServer=null, sslEnabled=true

        $this->assertArrayHasKey(PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT, $options);
        $this->assertFalse($options[PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT]);
    }

    private function getSslOptions(bool $isPaas, ?bool $verifyServer = false, bool $sslEnabled = true): array
    {
        // simulates the SSL options logic from database.php
        if (! $sslEnabled) {
            return [];
        }

        if ($isPaas) {
            return [
                PDO::MYSQL_ATTR_SSL_CA => '/path/to/ca.pem',
                PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => $verifyServer ?? false,
            ];
        }

        return [
            PDO::MYSQL_ATTR_SSL_KEY => '/path/to/key.pem',
            PDO::MYSQL_ATTR_SSL_CERT => '/path/to/cert.pem',
            PDO::MYSQL_ATTR_SSL_CA => '/path/to/ca.pem',
            PDO::MYSQL_ATTR_SSL_CIPHER => null,
            PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => $verifyServer ?? false,
        ];
    }
}