test: integrate ttt for PHPUnit test sandboxing

.gitleaksignore

@@ -0,0 +1,8 @@
+# Test fixtures, not real secrets: TYPO3 SYS.encryptionKey values used only in unit tests.
+# Migrating ConfigurationTest to ttt's #[WithTypo3ConfVars] turned the previous
+# $GLOBALS[...]['encryptionKey'] = '...' assignment into an array-arrow literal, which trips
+# gitleaks' generic-api-key rule where the bracket assignment did not. The literals are the
+# obviously-fake string "test-encryption-key-12345"; the HEAD occurrences also carry an inline
+# `gitleaks:allow`, these fingerprints cover the same lines in the historical integration commit.
+f9381041121ecaefabe744efa9b3014d2446277b:Tests/Unit/ConfigurationTest.php:generic-api-key:56
+f9381041121ecaefabe744efa9b3014d2446277b:Tests/Unit/ConfigurationTest.php:generic-api-key:70

Tests/Unit/Configuration/DetectorConfigurationBuilderTest.php

@@ -14,6 +14,7 @@
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Configuration;
 
 use Exception;
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Configuration;
 use MoveElevator\Typo3LoginWarning\Configuration\DetectorConfigurationBuilder;
 use MoveElevator\Typo3LoginWarning\Detector\{LongTimeNoSeeDetector, NewIpDetector, OutOfOfficeDetector};
@@ -29,6 +30,7 @@
  * @author Konrad Michalik <km@move-elevator.de>
  * @license GPL-2.0-or-later
  */
+#[WithTypo3ConfVars(['EXTENSIONS' => [Configuration::EXT_KEY => []]])]
 final class DetectorConfigurationBuilderTest extends TestCase
 {
     private ExtensionConfiguration&MockObject $extensionConfiguration;
@@ -44,12 +46,6 @@ protected function setUp(): void
 
         $this->extensionConfiguration = $this->createMock(ExtensionConfiguration::class);
         $this->subject = new DetectorConfigurationBuilder($this->extensionConfiguration);
-        $GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS'][Configuration::EXT_KEY] = [];
-    }
-
-    protected function tearDown(): void
-    {
-        unset($GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS'][Configuration::EXT_KEY]);
     }
 
     public function testIsActiveReturnsTrueWhenDetectorIsActive(): void
@@ -186,15 +182,14 @@ public function testBuildLongTimeNoSeeConfigWithCustomValues(): void
         ], $result);
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['phpTimeZone' => 'Europe/Berlin']])]
     public function testBuildOutOfOfficeConfigWithDefaults(): void
     {
         $this->extensionConfiguration
             ->method('get')
             ->with(Configuration::EXT_KEY)
             ->willReturn(['outOfOffice' => ['active' => true]]);
 
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['phpTimeZone'] = 'Europe/Berlin';
-
         $result = $this->subject->build(OutOfOfficeDetector::class);
 
         self::assertSame('Europe/Berlin', $result['timezone']);
@@ -253,15 +248,14 @@ public function testBuildOutOfOfficeConfigWithBlockedPeriods(): void
         ], $result['blockedPeriods']);
     }
 
+    #[WithTypo3ConfVars(['BE' => ['warning_email_addr' => 'admin@example.com']])]
     public function testBuildNotificationConfigWithDefaults(): void
     {
         $this->extensionConfiguration
             ->method('get')
             ->with(Configuration::EXT_KEY)
             ->willReturn([]);
 
-        $GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = 'admin@example.com';
-
         $result = $this->subject->buildNotificationConfig();
 
         self::assertSame('admin@example.com', $result['recipient']);

Tests/Unit/ConfigurationTest.php

@@ -13,6 +13,7 @@
 
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit;
 
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Configuration;
 use PHPUnit\Framework\TestCase;
 
@@ -22,15 +23,9 @@
  * @author Konrad Michalik <km@move-elevator.de>
  * @license GPL-2.0-or-later
  */
+#[WithTypo3ConfVars([])]
 final class ConfigurationTest extends TestCase
 {
-    protected function tearDown(): void
-    {
-        // Clean up global state
-        unset($GLOBALS['TYPO3_CONF_VARS']['MAIL']['templateRootPaths'][500]);
-        unset($GLOBALS['TYPO3_CONF_VARS']['EXTCONF'][Configuration::EXT_KEY]);
-    }
-
     public function testExtKeyConstant(): void
     {
         self::assertSame('typo3_login_warning', Configuration::EXT_KEY);
@@ -58,9 +53,9 @@ public function testRegisterMailTemplateAddsTemplateRootPath(): void
         );
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['encryptionKey' => 'test-encryption-key-12345']])] // gitleaks:allow
     public function testRegisterHmacKeyUsesEncryptionKeyWhenNotSet(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] = 'test-encryption-key-12345';
         unset($GLOBALS['TYPO3_CONF_VARS']['EXTCONF'][Configuration::EXT_KEY]['hmacKey']);
 
         Configuration::registerHmacKey();
@@ -71,11 +66,12 @@ public function testRegisterHmacKeyUsesEncryptionKeyWhenNotSet(): void
         );
     }
 
+    #[WithTypo3ConfVars([
+        'SYS' => ['encryptionKey' => 'test-encryption-key-12345'], // gitleaks:allow
+        'EXTCONF' => [Configuration::EXT_KEY => ['hmacKey' => 'existing-hmac-key']],
+    ])]
     public function testRegisterHmacKeyDoesNotOverwriteExistingKey(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['EXTCONF'][Configuration::EXT_KEY]['hmacKey'] = 'existing-hmac-key';
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] = 'test-encryption-key-12345';
-
         Configuration::registerHmacKey();
 
         self::assertSame(

Tests/Unit/Detector/AbstractDetectorTest.php

@@ -13,6 +13,7 @@
 
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Detector;
 
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Detector\AbstractDetector;
 use PHPUnit\Framework\TestCase;
 
@@ -52,17 +53,17 @@ public function testShouldDetectForUserReturnsFalseForNonAdminWhenAffectedUsersI
         self::assertFalse($this->subject->exposeShouldDetectForUser($userArray, ['affectedUsers' => 'admins']));
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['systemMaintainers' => [1, 2]]])]
     public function testShouldDetectForUserReturnsTrueForSystemMaintainerWhenAffectedUsersIsMaintainers(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] = [1, 2];
         $userArray = $this->createUserArray(uid: 1);
 
         self::assertTrue($this->subject->exposeShouldDetectForUser($userArray, ['affectedUsers' => 'maintainers']));
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['systemMaintainers' => [2, 3]]])]
     public function testShouldDetectForUserReturnsFalseForNonSystemMaintainerWhenAffectedUsersIsMaintainers(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] = [2, 3];
         $userArray = $this->createUserArray(uid: 1);
 
         self::assertFalse($this->subject->exposeShouldDetectForUser($userArray, ['affectedUsers' => 'maintainers']));

Tests/Unit/Detector/LongTimeNoSeeDetectorTest.php

@@ -14,6 +14,7 @@
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Detector;
 
 use DateTime;
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Configuration;
 use MoveElevator\Typo3LoginWarning\Detector\{DetectorInterface, LongTimeNoSeeDetector};
 use PHPUnit\Framework\TestCase;
@@ -384,10 +385,9 @@ public function testShouldDetectForUserReturnsTrueForAdmin(): void
         self::assertTrue($result);
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['systemMaintainers' => [2, 3]]])]
     public function testShouldDetectForUserReturnsFalseForNonMaintainer(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] = [2, 3];
-
         $user = $this->createMockUser(['uid' => 123]);
         $configuration = ['affectedUsers' => 'maintainers'];
 
@@ -396,14 +396,11 @@ public function testShouldDetectForUserReturnsFalseForNonMaintainer(): void
         $result = $subject->shouldDetectForUser($user, $configuration);
 
         self::assertFalse($result);
-
-        unset($GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers']);
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['systemMaintainers' => [123, 456]]])]
     public function testShouldDetectForUserReturnsTrueForMaintainer(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] = [123, 456];
-
         $user = $this->createMockUser(['uid' => 123]);
         $configuration = ['affectedUsers' => 'maintainers'];
 
@@ -412,8 +409,6 @@ public function testShouldDetectForUserReturnsTrueForMaintainer(): void
         $result = $subject->shouldDetectForUser($user, $configuration);
 
         self::assertTrue($result);
-
-        unset($GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers']);
     }
 
     /**

Tests/Unit/Detector/NewIpDetectorTest.php

@@ -13,6 +13,7 @@
 
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Detector;
 
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Detector\{DetectorInterface, NewIpDetector};
 use MoveElevator\Typo3LoginWarning\Domain\Repository\IpLogRepository;
 use MoveElevator\Typo3LoginWarning\Service\GeolocationServiceInterface;
@@ -26,20 +27,18 @@
  * @author Konrad Michalik <km@move-elevator.de>
  * @license GPL-2.0-or-later
  */
+#[WithTypo3ConfVars(['SYS' => ['encryptionKey' => 'test-encryption-key-for-phpunit']])]
 final class NewIpDetectorTest extends TestCase
 {
     protected function setUp(): void
     {
         // Clean slate for each test - set default to avoid issues
         $GLOBALS['_SERVER']['REMOTE_ADDR'] = '127.0.0.1';
-        // Set HMAC key for tests
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] = 'test-encryption-key-for-phpunit';
     }
 
     protected function tearDown(): void
     {
         unset($GLOBALS['_SERVER']['REMOTE_ADDR']);
-        unset($GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey']);
     }
 
     public function testImplementsDetectorInterface(): void
@@ -241,10 +240,9 @@ public function testShouldDetectForUserReturnsTrueForAdmin(): void
         self::assertTrue($result);
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['systemMaintainers' => [2, 3]]])]
     public function testShouldDetectForUserReturnsFalseForNonMaintainer(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] = [2, 3];
-
         $user = $this->createMockUser(['uid' => 123]);
         $configuration = ['affectedUsers' => 'maintainers'];
 
@@ -253,14 +251,11 @@ public function testShouldDetectForUserReturnsFalseForNonMaintainer(): void
         $result = $subject->shouldDetectForUser($user, $configuration);
 
         self::assertFalse($result);
-
-        unset($GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers']);
     }
 
+    #[WithTypo3ConfVars(['SYS' => ['systemMaintainers' => [123, 456]]])]
     public function testShouldDetectForUserReturnsTrueForMaintainer(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] = [123, 456];
-
         $user = $this->createMockUser(['uid' => 123]);
         $configuration = ['affectedUsers' => 'maintainers'];
 
@@ -269,8 +264,6 @@ public function testShouldDetectForUserReturnsTrueForMaintainer(): void
         $result = $subject->shouldDetectForUser($user, $configuration);
 
         self::assertTrue($result);
-
-        unset($GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers']);
     }
 
     public function testDetectAddsDeviceInfoWhenEnabled(): void

Tests/Unit/Notification/EmailNotificationTest.php

@@ -13,6 +13,7 @@
 
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Notification;
 
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Notification\{EmailNotification, NotifierInterface};
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
@@ -29,6 +30,7 @@
  * @author Konrad Michalik <km@move-elevator.de>
  * @license GPL-2.0-or-later
  */
+#[WithTypo3ConfVars(['BE' => ['warning_email_addr' => '']])]
 final class EmailNotificationTest extends TestCase
 {
     private MailerInterface&MockObject $mailer;
@@ -44,9 +46,6 @@ protected function setUp(): void
 
         $this->subject = new EmailNotification($this->mailer);
         $this->subject->setLogger($this->logger);
-
-        // Initialize TYPO3_CONF_VARS to prevent warnings
-        $GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = '';
     }
 
     public function testImplementsNotifierInterface(): void
@@ -71,8 +70,6 @@ public function testNotifyLogsInfoWhenNoRecipientConfigured(): void
         $user = $this->createMockBackendUser(['uid' => 123]);
         $configuration = [];
 
-        $GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = '';
-
         $this->logger
             ->expects(self::once())
             ->method('info')
@@ -101,13 +98,12 @@ public function testNotifyUsesConfiguredRecipient(): void
         $this->subject->notify($user, $this->request, 'TestTrigger', $configuration);
     }
 
+    #[WithTypo3ConfVars(['BE' => ['warning_email_addr' => 'global@example.com']])]
     public function testNotifyFallsBackToGlobalConfiguration(): void
     {
         $user = $this->createMockBackendUser(['uid' => 123]);
         $configuration = [];
 
-        $GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = 'global@example.com';
-
         $fluidEmail = $this->createMock(FluidEmail::class);
         $fluidEmail->expects(self::once())->method('to')->with('global@example.com')->willReturnSelf();
         $fluidEmail->expects(self::once())->method('setRequest')->willReturnSelf();

Tests/Unit/Security/LoginNotificationTest.php

@@ -13,6 +13,7 @@
 
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Security;
 
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Configuration;
 use MoveElevator\Typo3LoginWarning\Configuration\DetectorConfigurationBuilder;
 use MoveElevator\Typo3LoginWarning\Event\ModifyLoginNotificationEvent;
@@ -33,6 +34,10 @@
  * @author Konrad Michalik <km@move-elevator.de>
  * @license GPL-2.0-or-later
  */
+#[WithTypo3ConfVars([
+    'EXTCONF' => [Configuration::EXT_KEY => ['_notification' => [], '_detector' => []]],
+    'EXTENSIONS' => [Configuration::EXT_KEY => []],
+])]
 final class LoginNotificationTest extends TestCase
 {
     private LoggerInterface&MockObject $logger;
@@ -63,16 +68,6 @@ protected function setUp(): void
             $this->eventDispatcher,
         );
         $this->subject->setLogger($this->logger);
-
-        $GLOBALS['TYPO3_CONF_VARS']['EXTCONF'][Configuration::EXT_KEY]['_notification'] = [];
-        $GLOBALS['TYPO3_CONF_VARS']['EXTCONF'][Configuration::EXT_KEY]['_detector'] = [];
-        $GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS'][Configuration::EXT_KEY] = [];
-    }
-
-    protected function tearDown(): void
-    {
-        unset($GLOBALS['TYPO3_CONF_VARS']['EXTCONF'][Configuration::EXT_KEY]);
-        unset($GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS'][Configuration::EXT_KEY]);
     }
 
     public function testWarningAtLoginDoesNothingForNonBackendUsers(): void
@@ -99,19 +94,18 @@ public function testWarningAtLoginDoesNothingWhenUserArrayIsNotArray(): void
         $this->addToAssertionCount(1);
     }
 
+    #[WithTypo3ConfVars(['EXTENSIONS' => [Configuration::EXT_KEY => [
+        'newIp' => ['active' => false],
+        'longTimeNoSee' => ['active' => false],
+        'outOfOffice' => ['active' => false],
+    ]]])]
     public function testWarningAtLoginHandlesNoActiveDetectors(): void
     {
         $user = $this->createMock(BackendUserAuthentication::class);
         $user->user = ['uid' => 123];
         $request = $this->createMock(ServerRequestInterface::class);
         $event = new AfterUserLoggedInEvent($user, $request);
 
-        $GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS'][Configuration::EXT_KEY] = [
-            'newIp' => ['active' => false],
-            'longTimeNoSee' => ['active' => false],
-            'outOfOffice' => ['active' => false],
-        ];
-
         ($this->subject)($event);
 
         // Should complete without errors when no detectors are active

Tests/Unit/Utility/DeviceInfoParserTest.php

@@ -13,6 +13,7 @@
 
 namespace MoveElevator\Typo3LoginWarning\Tests\Unit\Utility;
 
+use KonradMichalik\Ttt\Attribute\WithTypo3ConfVars;
 use MoveElevator\Typo3LoginWarning\Utility\DeviceInfoParser;
 use PHPUnit\Framework\Attributes\{DataProvider, Test};
 use PHPUnit\Framework\TestCase;
@@ -258,11 +259,9 @@ public function parseOperatingSystemHandlesIosVersionFormat(): void
     }
 
     #[Test]
+    #[WithTypo3ConfVars(['SYS' => ['ddmmyy' => 'Y-m-d', 'hhmm' => 'H:i']])]
     public function parseFromRequestIncludesFormattedDate(): void
     {
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['ddmmyy'] = 'Y-m-d';
-        $GLOBALS['TYPO3_CONF_VARS']['SYS']['hhmm'] = 'H:i';
-
         $userAgent = 'Mozilla/5.0 (Test) AppleWebKit/537.36';
         $request = $this->createMock(ServerRequestInterface::class);
         $request->method('getHeaderLine')->with('User-Agent')->willReturn($userAgent);