# Backend tests

The cross-language authorization test starts PHP's built-in server on a random
loopback port, creates a temporary private/public installation under the Go test
directory, and drives the real PHP front controller from the Go Hub client. It
does not use the Internet, a database, or privileged network features.

With PHP 8.2+ and Sodium available on `PATH`:

```sh
go test ./internal/authorization/hubclient -run TestPHPAuthorizationEndToEnd -v
```

For a PHP executable that needs command-line extension options, pass the
executable separately and encode its fixed arguments as a JSON string array:

```sh
SAFETUN_PHP=/opt/php/bin/php \
SAFETUN_PHP_ARGS_JSON='["-n","-d","extension=sodium"]' \
go test ./internal/authorization/hubclient -run TestPHPAuthorizationEndToEnd -v
```

The test skips only when PHP 8.2+ with Sodium is unavailable. Any startup,
configuration, HTTP-contract, proof, authorization, or signature failure fails
the test. Temporary files and the PHP child process are cleaned up by `go test`.
