add tests

tests/system/Security/SecurityTest.php

@@ -25,6 +25,7 @@
 use Config\Security as SecurityConfig;
 use PHPUnit\Framework\Attributes\BackupGlobals;
 use PHPUnit\Framework\Attributes\Group;
+use ReflectionClass;
 
 /**
  * @internal
@@ -49,6 +50,16 @@ private function createMockSecurity(?SecurityConfig $config = null): MockSecurit
         return new MockSecurity($config);
     }
 
+    private function getPostedTokenMethod(): \ReflectionMethod
+    {
+        $reflection = new ReflectionClass(Security::class);
+        $method     = $reflection->getMethod('getPostedToken');
+
+        $method->setAccessible(true);
+
+        return $method;
+    }
+
     public function testBasicConfigIsSaved(): void
     {
         $security = $this->createMockSecurity();
@@ -315,4 +326,37 @@ public function testGetters(): void
         $this->assertIsString($security->getCookieName());
         $this->assertIsBool($security->shouldRedirect());
     }
+
+    public function testGetPostedTokenReturnsTokenWhenValid(): void
+    {
+        $method   = $this->getPostedTokenMethod();
+        $security = $this->createMockSecurity();
+
+        $_POST['csrf_test_name'] = '8b9218a55906f9dcc1dc263dce7f005a';
+        $request                 = $this->createIncomingRequest();
+
+        $this->assertSame('8b9218a55906f9dcc1dc263dce7f005a', $method->invoke($security, $request));
+    }
+
+    public function testGetPostedTokenReturnsNullWhenEmpty(): void
+    {
+        $method   = $this->getPostedTokenMethod();
+        $security = $this->createMockSecurity();
+
+        $_POST   = [];
+        $request = $this->createIncomingRequest();
+
+        $this->assertNull($method->invoke($security, $request));
+    }
+
+    public function testGetPostedTokenReturnsNullWhenMaliciousData(): void
+    {
+        $method   = $this->getPostedTokenMethod();
+        $security = $this->createMockSecurity();
+
+        $_POST['csrf_test_name'] = ['malicious' => 'data'];
+        $request                 = $this->createIncomingRequest();
+
+        $this->assertNull($method->invoke($security, $request));
+    }
 }