Repository navigation
Isolate the test login route and refuse unsafe production modes - #32
Merged
Merged
Conversation
The test-only login controller lived in controllers/ and relied on a single YII_ENV_TEST check. Move it under tests/_support, mount it only from the test config, and also require APP_ENV=testing/test before it answers. Production now refuses to start unless YII_ENV=prod and YII_DEBUG=false, matching what the configuration guide already promised. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
APP_ENV uses production/testing/development while YII_ENV only accepts prod/dev/test. Say so in .env.example and in the startup error, and cover YII_ENV=production in the runtime mode test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
執行規劃 PR-3（S4／P10）。
測試專用登入
TestController原本放在正式程式的controllers/，只靠YII_ENV_TEST一道檢查。另外，docs/CONFIGURATION.md寫明正式環境「強制關閉」YII_DEBUG，但程式並未強制。修改：
controllers/TestController.php移至tests/_support/TestLoginController.php，只由config/test.php的controllerMap掛載，路由維持/index-test.php/test/login，現有 acceptance 與 E2E 不需修改。APP_ENV=testing／test（沿用測試入口的test-entry-policy.php），否則回 404。ConfigValidator::validateProductionRuntimeMode()：APP_ENV=production時要求YII_ENV=prod（或未設定）且YII_DEBUG=false。正式環境原本即以 strict 模式驗證，不符時拒絕啟動並列出原因。tests/與測試入口）、TEST_PLAN、E2E README 同步更新。升級注意：正式機
.env若設定YII_ENV=dev／test或YII_DEBUG=true，升級後網站會拒絕啟動，請在部署前檢查。開發與測試環境不受影響。驗證（dev6，PHP 8.2.35，HEAD
2030d9f）：ProductionRuntimeModeTest：模式檢查、正式驗證只在 production 套用、controllers/與config/web.php不含測試登入、非測試APP_ENV一律拒絕。tests/unit/config/22 tests／43 assertions 通過。APP_ENV=testing測試伺服器上/index-test.php/test/login回 200。🤖 Generated with Claude Code