feat: Turnstile captcha, menu khách + nút tắt topbar cấu hình từ admin, ẩn setting nhạy cảm

- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 15:53:43 +07:00
parent 823af4a56a
commit e888a6ed5d
33 changed files with 1022 additions and 52 deletions
@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\Client;
+
+use App\Models\ActivityLog;
+use App\Models\Customer;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ClientAccountSettingsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function api(): static
+    {
+        return $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()]);
+    }
+
+    public function test_customer_can_only_read_their_own_login_history(): void
+    {
+        $customer = Customer::factory()->create(['status' => 1]);
+        $other = Customer::factory()->create(['status' => 1]);
+
+        ActivityLog::create([
+            'log_name' => 'auth',
+            'event' => 'login',
+            'description' => 'customer login',
+            'causer_type' => 'customer',
+            'causer_id' => $customer->id,
+            'causer_name' => $customer->email,
+            'ip_address' => '203.0.113.10',
+            'user_agent' => 'Mozilla/5.0 Chrome/130.0',
+        ]);
+        ActivityLog::create([
+            'log_name' => 'auth',
+            'event' => 'login',
+            'description' => 'other customer login',
+            'causer_type' => 'customer',
+            'causer_id' => $other->id,
+            'causer_name' => $other->email,
+            'ip_address' => '198.51.100.20',
+        ]);
+
+        $response = $this->actingAs($customer, 'client')
+            ->api()
+            ->getJson('/v1/client/login-history?per_page=10')
+            ->assertOk()
+            ->assertJsonPath('meta.total', 1)
+            ->assertJsonPath('data.0.ip_address', '203.0.113.10');
+
+        $this->assertCount(1, $response->json('data'));
+    }
+
+    public function test_customer_can_update_account_preferences(): void
+    {
+        $customer = Customer::factory()->create([
+            'status' => 1,
+            'email_marketing' => 1,
+            'receive_deposit' => 1,
+        ]);
+
+        $this->actingAs($customer, 'client')
+            ->api()
+            ->putJson('/v1/client/preferences', [
+                'email_marketing' => false,
+                'receive_deposit' => true,
+            ])
+            ->assertOk()
+            ->assertJsonPath('data.client.customer.email_marketing', false)
+            ->assertJsonPath('data.client.customer.receive_deposit', true);
+
+        $customer->refresh();
+        $this->assertSame(0, (int) $customer->email_marketing);
+        $this->assertSame(1, (int) $customer->receive_deposit);
+    }
+
+    public function test_preferences_require_both_boolean_values(): void
+    {
+        $customer = Customer::factory()->create(['status' => 1]);
+
+        $this->actingAs($customer, 'client')
+            ->api()
+            ->putJson('/v1/client/preferences', ['email_marketing' => 'yes'])
+            ->assertStatus(422)
+            ->assertJsonValidationErrors(['email_marketing', 'receive_deposit']);
+    }
+}