test: add Security baseline and expand Unit/Integration coverage for lifecycle

phpunit.xml

@@ -14,6 +14,7 @@
     </php>
     <testsuites>
         <testsuite name="Plugin Monitor">
+            <directory>tests/Security</directory>
             <directory>tests/Unit</directory>
             <directory>tests/Integration</directory>
         </testsuite>

tests/.cacti-version

@@ -1 +1 @@
-1.2.31
+1.2.x

tests/Integration/MonitorInstallHooksTest.php

@@ -0,0 +1,48 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Integration coverage for plugin_monitor_install(): verifies every hook
+ * and the realm the plugin depends on at runtime are actually registered,
+ * together with the tables and defaults it needs, in a single end-to-end
+ * pass.
+ */
+
+beforeAll(function () {
+	require_once __DIR__ . '/../../setup.php';
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_registered_hooks']  = array();
+	$GLOBALS['__test_registered_realms'] = array();
+	$GLOBALS['__test_db_calls']          = array();
+	$GLOBALS['__test_config_options']    = array();
+});
+
+it('registers every hook monitor depends on, its realm, and provisions its tables and defaults', function () {
+	plugin_monitor_install();
+
+	$hooks = array();
+	foreach ($GLOBALS['__test_registered_hooks'] as $registered) {
+		$hooks[$registered['hook']] = $registered;
+	}
+
+	foreach (array('top_header_tabs', 'top_graph_header_tabs', 'top_graph_refresh', 'draw_navigation_text', 'config_form', 'config_settings', 'config_arrays', 'poller_bottom', 'page_head', 'api_device_save', 'device_action_array', 'device_action_execute', 'device_action_prepare', 'device_remove', 'device_filters', 'device_sql_where', 'device_table_bottom') as $expected) {
+		expect($hooks)->toHaveKey($expected);
+		expect($hooks[$expected]['name'])->toBe('monitor');
+	}
+
+	expect($GLOBALS['__test_registered_realms'])->toHaveCount(1);
+	expect($GLOBALS['__test_registered_realms'][0]['file'])->toBe('monitor.php');
+
+	expect($GLOBALS['__test_config_options']['monitor_view'])->toBe('default');
+	expect($GLOBALS['__test_config_options']['monitor_trim'])->toBe('4000');
+
+	$sql = implode("\n", array_column($GLOBALS['__test_db_calls'], 'sql'));
+
+	expect($sql)->toContain('plugin_monitor_notify_history');
+});

tests/Security/PhpCompatibilityTest.php

@@ -0,0 +1,149 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Verify plugin source files do not use PHP 8.3+/8.4-only syntax.
+ * This plugin's floor version is PHP 8.2, matching the shared CI test
+ * matrix (php: ['8.2', '8.3', '8.4']).
+ */
+
+$pluginRoot = realpath(__DIR__ . '/../..');
+
+if ($pluginRoot === false) {
+	throw new RuntimeException('Unable to resolve the plugin root directory');
+}
+
+$files = [];
+
+$iterator = new RecursiveIteratorIterator(
+	new RecursiveDirectoryIterator($pluginRoot, FilesystemIterator::SKIP_DOTS)
+);
+
+foreach ($iterator as $file) {
+	if ($file->getExtension() !== 'php') {
+		continue;
+	}
+
+	$relativeFile = ltrim(str_replace($pluginRoot, '', $file->getPathname()), DIRECTORY_SEPARATOR);
+	$relativeFile = str_replace(DIRECTORY_SEPARATOR, '/', $relativeFile);
+
+	if (strpos($relativeFile, 'tests/') === 0 || strpos($relativeFile, 'vendor/') === 0 || strpos($relativeFile, 'include/vendor/') === 0) {
+		continue;
+	}
+
+	$files[] = $relativeFile;
+}
+
+sort($files);
+
+function plugin_test_read_source_file($relativeFile) {
+	$path = realpath(__DIR__ . '/../../' . $relativeFile);
+
+	if ($path === false) {
+		throw new RuntimeException("Unable to resolve required plugin source: {$relativeFile}");
+	}
+
+	$contents = file_get_contents($path);
+
+	if ($contents === false) {
+		throw new RuntimeException("Unable to read required plugin source: {$relativeFile}");
+	}
+
+	return $contents;
+}
+
+it('does not use asymmetric visibility (PHP 8.4)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/\bprivate\s*\(\s*set\s*\)|\bprotected\s*\(\s*set\s*\)/', $contents))->toBe(0,
+			"{$relativeFile} uses asymmetric visibility which requires PHP 8.4"
+		);
+	}
+});
+
+it('does not use the #[Override] attribute (PHP 8.3)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/#\[\s*\\\\?Override\s*\]/i', $contents))->toBe(0,
+			"{$relativeFile} uses #[Override] which requires PHP 8.3"
+		);
+	}
+});
+
+it('does not use the #[Deprecated] attribute (PHP 8.4)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/#\[\s*\\\\?Deprecated\b/i', $contents))->toBe(0,
+			"{$relativeFile} uses #[Deprecated] which requires PHP 8.4"
+		);
+	}
+});
+
+it('does not use json_validate() (PHP 8.3)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/\bjson_validate\s*\(/', $contents))->toBe(0,
+			"{$relativeFile} uses json_validate() which requires PHP 8.3"
+		);
+	}
+});
+
+it('does not use array_find()/array_any()/array_all() (PHP 8.4)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/\barray_(find|any|all)\s*\(/', $contents))->toBe(0,
+			"{$relativeFile} uses array_find()/array_any()/array_all() which requires PHP 8.4"
+		);
+	}
+});
+
+it('does not use typed class constants (PHP 8.3)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/\bconst\s+(?:\?\s*)?[A-Za-z_\\\\][A-Za-z0-9_\\\\]*(?:\s*\|\s*(?:\?\s*)?[A-Za-z_\\\\][A-Za-z0-9_\\\\]*)*\s+[A-Za-z_][A-Za-z0-9_]*\s*=/', $contents))->toBe(0,
+			"{$relativeFile} uses a typed class constant which requires PHP 8.3"
+		);
+	}
+});
+
+it('does not use a dynamic class constant fetch (PHP 8.3)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/::\s*\{\s*\$/', $contents))->toBe(0,
+			"{$relativeFile} uses a dynamic class constant fetch (Foo::" . '{$bar}' . ") which requires PHP 8.3"
+		);
+	}
+});
+
+it('does not use each() (removed in PHP 8.0)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/(?<![.>])\beach\s*\(/', $contents))->toBe(0,
+			"{$relativeFile} uses each() which was removed in PHP 8.0"
+		);
+	}
+});
+
+it('does not use create_function() (removed in PHP 8.0)', function () use ($files) {
+	foreach ($files as $relativeFile) {
+		$contents = plugin_test_read_source_file($relativeFile);
+
+		expect(preg_match('/(?<![.>])\bcreate_function\s*\(/', $contents))->toBe(0,
+			"{$relativeFile} uses create_function() which was removed in PHP 8.0"
+		);
+	}
+});

tests/Security/SetupStructureTest.php

@@ -0,0 +1,35 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+$source = plugin_test_read_source('setup.php');
+$infoFile = parse_ini_file(__DIR__ . '/../../INFO', true);
+if (!is_array($infoFile) || !isset($infoFile['info']) || !is_array($infoFile['info'])) {
+	throw new RuntimeException('Unable to parse the INFO section');
+}
+$info = $infoFile['info'];
+
+it('defines plugin_monitor_install function', function () use ($source) {
+	expect($source)->toContain('function plugin_monitor_install');
+});
+
+it('defines plugin_monitor_version function', function () use ($source) {
+	expect($source)->toContain('function plugin_monitor_version');
+});
+
+it('defines plugin_monitor_uninstall function', function () use ($source) {
+	expect($source)->toContain('function plugin_monitor_uninstall');
+});
+
+it('declares a plugin name in INFO', function () use ($info) {
+	expect($info)->toHaveKey('name');
+});
+
+it('declares a plugin version in INFO', function () use ($info) {
+	expect($info)->toHaveKey('version');
+});

tests/Unit/MonitorDeviceHooksTest.php

@@ -0,0 +1,79 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for the device-list filter/action/removal hooks in
+ * setup.php: monitor_device_filters(), monitor_device_sql_where(),
+ * monitor_device_action_array(), monitor_device_remove(),
+ * monitor_draw_navigation_text(), and monitor_get_default().
+ */
+
+beforeAll(function () {
+	require_once __DIR__ . '/../../setup.php';
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_calls']       = array();
+	$GLOBALS['__test_request']        = array();
+	$GLOBALS['__test_config_options'] = array();
+});
+
+it('adds a criticality drop-down filter without disturbing existing filters', function () {
+	$filters = monitor_device_filters(array('other' => array('friendly_name' => 'Other')));
+
+	expect($filters)->toHaveKey('other');
+	expect($filters)->toHaveKey('criticality');
+	expect($filters['criticality']['default'])->toBe('-1');
+});
+
+it('does not add a criticality clause when criticality is -1 (any)', function () {
+	$GLOBALS['__test_request']['criticality'] = '-1';
+
+	expect(monitor_device_sql_where(''))->toBe('');
+});
+
+it('adds a criticality clause when a specific criticality is selected', function () {
+	$GLOBALS['__test_request']['criticality'] = '2';
+
+	expect(monitor_device_sql_where(''))->toBe('WHERE  monitor_criticality = 2');
+	expect(monitor_device_sql_where('WHERE host_status = 1'))->toBe('WHERE host_status = 1 AND  monitor_criticality = 2');
+});
+
+it('adds the monitoring actions to the device action dropdown', function () {
+	$actions = monitor_device_action_array(array('delete' => 'Delete'));
+
+	expect($actions)->toHaveKey('delete');
+	expect($actions)->toHaveKey('monitor_settings');
+	expect($actions)->toHaveKey('monitor_enable');
+	expect($actions)->toHaveKey('monitor_disable');
+});
+
+it('removes every per-device record on device_remove', function () {
+	$result = monitor_device_remove(array(3, 4));
+
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(3);
+	expect($result)->toBe(array(3, 4));
+
+	foreach ($GLOBALS['__test_db_calls'] as $call) {
+		expect($call['sql'])->toContain('IN(3,4)');
+	}
+});
+
+it('adds the monitor breadcrumb entry without disturbing existing ones', function () {
+	$nav = monitor_draw_navigation_text(array('other.php:' => array('title' => 'Other')));
+
+	expect($nav)->toHaveKey('other.php:');
+	expect($nav)->toHaveKey('monitor.php:');
+});
+
+it('reads the default monitor state only for a new (unsaved) host', function () {
+	$GLOBALS['__test_config_options']['monitor_new_enabled'] = 'on';
+
+	expect(monitor_get_default(0))->toBe('on');
+	expect(monitor_get_default(-1))->toBe('on');
+	expect(monitor_get_default(5))->toBe('');
+});