fix(federation): delete the orphaned publish wrapper and test the seam that ships (gate-57)

[rubenvdlinde]

What gate 57 found, and why the obvious reading was wrong

Gate 57 (orphaned-write-capability) named FederationService::publishEntryForFederation() — zero non-test production callers.

The obvious reading of a dead write capability is "the feature is missing". Here it was the opposite. PublicationService::publish() is live, through PublicationController::publish(), routed as publication#publish (PUT /api/publication/{objectType}/{uuid}/publish, appinfo/routes.php:195). Catalog entries can be published; the wrapper was a second seam that nothing used.

It was also the weaker of the two. Compared with the routed path it was missing:

• the per-object authorizeEntry() IDOR guard (ADR-005) — admin, or an aanbod-beheerder whose organisation owns the entry; peer-sourced mirrors refused;
• the optional ISO-8601 $when moment — its signature was (string $objectType, string $uuid), so a scheduled publication could not be expressed through it at all.

Wiring a route to it would therefore have duplicated a live capability and widened the auth surface. It is deleted, with its private getPublicationService() helper and the now-unused import.

The tests moved to where the code ships

The two testPublishEntryForFederation* tests were the only callers of the method anywhere in the repo — they constructed the service and invoked something no production path could reach. Deleting them exposed that there was no PublicationControllerTest at all: the live publish path and its IDOR guard were untested.

tests/Unit/Controller/PublicationControllerTest.php now covers:

• an admin publishes and $when is forwarded to the service;
• a non-owning aanbod-beheerder gets 403 and publish() is never reached;
• a peer-sourced (federated mirror) entry is refused even for an admin.

Verified both directions

Run in a disposable nextcloud:32-apache container (PHP 8.3) with the app bind-mounted at custom_apps/softwarecatalog, so the deployed code is the code under test. No shared dev instance was touched.

	result
gate 57 before	1 finding — publishEntryForFederation
gate 57 after	0 findings
new tests, guard intact	3/3 pass (17/17 across both changed test files)
new tests, guard removed + $when dropped (mutant)	3/3 FAIL

The mutant run is the positive control: all three assertions are about the guard and the forwarded argument, not about the mock shape.

php -l clean. phpcs: 0 errors on both changed lib/ files (the two remaining warnings are the pre-existing missing-@spec-on-class notices both classes already carried).

Spec

openspec/specs/federated-catalog-sync/spec.md named the deleted wrapper as the publish seam. It now names PublicationController::publish() and states explicitly that federation does not own a second publish entry point. The requirement's actual invariant — visibility enforced by the OpenRegister public RBAC read gate {group:public, match:{publicatiedatum:{$lte:$now}}} — is unchanged and still satisfied.

No waiver, no @orphaned-write-capability exclude, no baseline entry: the gate goes green because the dead code is gone.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ 0a5e560

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			✅	✅ 121/121
npm			✅	✅ 853/853
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-07 06:33 UTC

Download the full PDF report from the workflow artifacts.