fix(auth): reject null/empty secret cleanly, configure CI Facebook creds

Root cause of the CI failure on testMatchedUserIsUnlinkedAndReturnsConfirmation:
.env.testing (which supplies FACEBOOK_CLIENT_SECRET locally) is gitignored,
and none of the three GitHub Actions workflows ever set FACEBOOK_CLIENT_ID/
FACEBOOK_CLIENT_SECRET - a pre-existing gap this PR was the first to depend
on. Config::get('services.facebook.client_secret') resolved to null in CI,
and FacebookSignedRequestParser::parse()'s non-nullable string $secret
parameter turned that into a fatal TypeError (500) instead of a clean
rejection.

- Widen parse()'s $secret to ?string and reject immediately on null/'' -
  a webhook endpoint should fail closed with 400 on missing server config,
  never 500.
- Add FACEBOOK_CLIENT_ID/FACEBOOK_CLIENT_SECRET/FACEBOOK_REDIRECT_URI
  (same dummy test values as .env.testing) to all three CI workflows.
- Two new parser tests lock in the defensive null/empty-secret behavior.

Reverts the temporary response-body-dump instrumentation from 477109d,
which was used to capture the real TypeError from CI's APP_DEBUG=true
error page.

Author: smarcet

.github/workflows/nightly_unit_tests.yml

@@ -32,6 +32,9 @@ jobs:
       SSL_ENABLED: false
       SESSION_DRIVER: redis
       PHP_VERSION: 8.3
+      FACEBOOK_CLIENT_ID: 214242500242860
+      FACEBOOK_CLIENT_SECRET: e62fa81aa898699d8cebf14bf5e586aa
+      FACEBOOK_REDIRECT_URI: /auth/login/facebook/callback
     services:
       mysql:
         image: mysql:8.0

.github/workflows/pull_request_unit_tests.yml

@@ -37,6 +37,9 @@ jobs:
       PHP_VERSION: 8.3
       OTEL_SDK_DISABLED: true
       OTEL_SERVICE_ENABLED: false
+      FACEBOOK_CLIENT_ID: 214242500242860
+      FACEBOOK_CLIENT_SECRET: e62fa81aa898699d8cebf14bf5e586aa
+      FACEBOOK_REDIRECT_URI: /auth/login/facebook/callback
     services:
       mysql:
         image: mysql:8.0

.github/workflows/push.yml

@@ -33,6 +33,9 @@ jobs:
       PHP_VERSION: 8.3
       OTEL_SDK_DISABLED: true
       OTEL_SERVICE_ENABLED: false
+      FACEBOOK_CLIENT_ID: 214242500242860
+      FACEBOOK_CLIENT_SECRET: e62fa81aa898699d8cebf14bf5e586aa
+      FACEBOOK_REDIRECT_URI: /auth/login/facebook/callback
     services:
       mysql:
         image: mysql:8.0

app/libs/Auth/FacebookSignedRequestParser.php

@@ -23,11 +23,13 @@ final class FacebookSignedRequestParser
 {
     /**
      * @param string $signed_request
-     * @param string $secret
+     * @param string|null $secret
      * @return array|null
      */
-    public static function parse(string $signed_request, string $secret): ?array
+    public static function parse(string $signed_request, ?string $secret): ?array
     {
+        if ($secret === null || $secret === '') return null;
+
         $parts = explode('.', $signed_request, 2);
         if (count($parts) !== 2) return null;
 

tests/FacebookDataDeletionApiTest.php

@@ -65,10 +65,6 @@ public function testMatchedUserIsUnlinkedAndReturnsConfirmation(): void
 
         $response = $this->post(self::CallbackUri, ['signed_request' => $sr]);
 
-        if ($response->response->getStatusCode() !== 200) {
-            fwrite(STDERR, "\n===DEBUG RESPONSE BODY===\n" . $response->response->getContent() . "\n===END DEBUG===\n");
-        }
-
         $this->assertResponseStatus(200);
         $json = json_decode($response->response->getContent(), true);
         $this->assertNotEmpty($json['confirmation_code']);

tests/unit/FacebookSignedRequestParserTest.php

@@ -92,4 +92,18 @@ public function testMissingUserIdReturnsNull(): void
 
         $this->assertNull(FacebookSignedRequestParser::parse($sr, self::Secret));
     }
+
+    public function testNullSecretReturnsNullInsteadOfThrowing(): void
+    {
+        $sr = $this->buildSignedRequest(['user_id' => '218471'], self::Secret);
+
+        $this->assertNull(FacebookSignedRequestParser::parse($sr, null));
+    }
+
+    public function testEmptySecretReturnsNullInsteadOfThrowing(): void
+    {
+        $sr = $this->buildSignedRequest(['user_id' => '218471'], self::Secret);
+
+        $this->assertNull(FacebookSignedRequestParser::parse($sr, ''));
+    }
 }