baodev0andClaude Opus 5.5
e888a6ed5d
- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
1.9 KiB
PHP
57 lines
1.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Client;
|
|
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Http\UploadedFile;
|
|
use Tests\TestCase;
|
|
|
|
class SecurityHardeningTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
public function test_register_rejects_short_password(): void
|
|
{
|
|
$response = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])->postJson('/v1/client/register', [
|
|
'fullname' => 'Nguyen Van A',
|
|
'phone' => '0912345678',
|
|
'email' => 'short-pass@example.com',
|
|
'password' => 'abc12345',
|
|
'password_confirmation' => 'abc12345',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
$response->assertJsonValidationErrors('password');
|
|
}
|
|
|
|
public function test_register_accepts_password_with_at_least_ten_characters(): void
|
|
{
|
|
$response = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])->postJson('/v1/client/register', [
|
|
'fullname' => 'Nguyen Van B',
|
|
'email' => 'long-pass@example.com',
|
|
'password' => 'abcdefghij',
|
|
'password_confirmation' => 'abcdefghij',
|
|
]);
|
|
|
|
$response->assertJsonMissingValidationErrors(['password', 'phone']);
|
|
}
|
|
|
|
public function test_cccd_upload_rejects_svg(): void
|
|
{
|
|
$customer = \App\Models\Customer::factory()->create();
|
|
|
|
$response = $this->actingAs($customer, 'client')
|
|
->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->post('/v1/client/update-cccd', [
|
|
'cmnd' => '012345678901',
|
|
'cmnd_before' => UploadedFile::fake()->create('front.svg', 10, 'image/svg+xml'),
|
|
'cmnd_after' => UploadedFile::fake()->image('back.jpg'),
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
$response->assertJsonValidationErrors('cmnd_before');
|
|
}
|
|
}
|