feat: harden admin auth and ticket workflows

- add rotating admin refresh tokens and password gates\n- expand ticket galleries, exports, and client resources\n- improve IP allocation auditing and dashboard data\n- enforce encrypted client access tokens on public routes
2026-10-16 17:00:55 +07:00
parent 0cdf224309
commit 0b08689ea4
52 changed files with 1421 additions and 118 deletions
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\Admin\Setting;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+use Tests\TestCase;
+
+class SystemConfigPasswordVerificationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function admin(): User
+    {
+        $permission = Permission::create(['name' => 'setting.manager', 'guard_name' => 'admin']);
+        $role = Role::create(['name' => 'settings-manager', 'guard_name' => 'admin']);
+        $role->givePermissionTo($permission);
+
+        $admin = User::factory()->create(['password' => Hash::make('CurrentPassword1')]);
+        $admin->assignRole($role);
+
+        return $admin;
+    }
+
+    public function test_admin_can_verify_their_current_password(): void
+    {
+        $this->actingAs($this->admin(), 'admin')
+            ->postJson('/api/v1/administrator/settings/verify-password', [
+                'password' => 'CurrentPassword1',
+            ])
+            ->assertOk()
+            ->assertJsonPath('error', false);
+    }
+
+    public function test_incorrect_password_is_rejected(): void
+    {
+        $this->actingAs($this->admin(), 'admin')
+            ->postJson('/api/v1/administrator/settings/verify-password', [
+                'password' => 'WrongPassword',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonPath('message', 'Mật khẩu hiện tại không chính xác.');
+    }
+}