phpunit.xml

<?xml version="1.0" encoding="UTF-8"?>
<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
         bootstrap="vendor/autoload.php"
         colors="true"
         processIsolation="false"
>
    <testsuites>
        <testsuite name="Unit">
            <directory>tests/Unit</directory>
        </testsuite>
        <testsuite name="Feature">
            <directory>tests/Feature</directory>
        </testsuite>
        <testsuite name="Arch">
            <directory>tests/Arch</directory>
        </testsuite>
        <testsuite name="Contract">
            <directory>tests/Contract</directory>
        </testsuite>
    </testsuites>
    <source>
        <include>
            <directory>app</directory>
        </include>
        <exclude>
            <!-- Exclude ONLY the Laravel skeleton User model from coverage gate (D9).
                 C2-authored models (Organization, TenantModel, Models/Concerns/TenantScoped)
                 are security-critical and MUST be included in the coverage gate. -->
            <file>app/Models/User.php</file>
        </exclude>
    </source>
    <coverage>
        <report>
            <text outputFile="php://stdout"/>
        </report>
    </coverage>
    <php>
        <!-- The suite does not fit PHP's 128M default: the coverage collector
             holds the whole `app/` line map, and parallel mode gives every
             worker its own copy, so a full run died with "Allowed memory size
             of 134217728 bytes exhausted" long before any assertion failed.
             A cap, not a reservation: PHP still allocates only what it uses,
             and 4G leaves room for the coverage report merge, which outgrew 2G
             on the CI runner on 2026-10-10. Set here rather than in php.ini so artisan test,
             its parallel workers and a bare vendor/bin/pest all get it. Passing the limit on the command line
             does NOT reach the child process artisan test spawns. -->
        <ini name="memory_limit" value="4G"/>
        <env name="APP_ENV" value="testing"/>
        <env name="APP_KEY" value="base64:YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE="/>
        <env name="JWT_SECRET" value="testing-secret-key-for-phpunit-only-not-for-production-use"/>
        <!-- public-api step 5: a DEDICATED session-token secret, distinct
             from JWT_SECRET above (SPEC.md §3.5) — required in every
             non-testing environment; fixed here so the suite never depends
             on a real secret being configured. -->
        <env name="PUBLIC_API_SESSION_SECRET" value="testing-session-secret-key-for-phpunit-only-not-for-production-use"/>
        <env name="APP_MAINTENANCE_DRIVER" value="file"/>
        <!-- object-storage-fix: pinned so a developer with FILESYSTEM_DISK=s3 in
             their own .env cannot leak a real cloud disk into the suite the
             moment a test resolves the disk without faking it (D3). -->
        <env name="FILESYSTEM_DISK" value="local"/>
        <env name="BCRYPT_ROUNDS" value="4"/>
        <env name="BROADCAST_CONNECTION" value="null"/>
        <env name="CACHE_STORE" value="array"/>
        <env name="DB_CONNECTION" value="pgsql"/>
        <env name="DB_HOST" value="127.0.0.1"/>
        <env name="DB_PORT" value="5432"/>
        <env name="DB_DATABASE" value="beai_test"/>
        <env name="DB_USERNAME" value="postgres"/>
        <env name="DB_PASSWORD" value="postgres"/>
        <env name="DB_URL" value=""/>
        <env name="MAIL_MAILER" value="array"/>
        <env name="QUEUE_CONNECTION" value="sync"/>
        <env name="SESSION_DRIVER" value="array"/>
        <env name="PULSE_ENABLED" value="false"/>
        <env name="TELESCOPE_ENABLED" value="false"/>
        <env name="NIGHTWATCH_ENABLED" value="false"/>
        <env name="XDEBUG_MODE" value="off"/>
        <!-- config/scoring.php reads `scoring.audit.api_key` from TYPESAFE_API_KEY.
             Pinned empty so a developer's real key (shell or .env)
             can never leak into the suite or reach the paid TypeSafe API;
             AuditConfigTest pins that the SHIPPED default is empty.
             The <server> line is the one that bites: a shell variable is also
             in the PHP server superglobal, which Laravel's env() reads BEFORE
             the putenv/environment value <env> sets, so <env> alone does not
             override the shell. -->
        <env name="TYPESAFE_API_KEY" value="" force="true"/>
        <server name="TYPESAFE_API_KEY" value="" force="true"/>
        <!-- backoffice-session-refresh-hardening D1: deterministic allowlist for
             CORS preflight/config tests — both Nuxt dev origins, never a wildcard. -->
        <env name="CORS_ALLOWED_ORIGINS" value="http://localhost:3001,http://localhost:3000"/>
    </php>
</phpunit>