baodev0andClaude Opus 5.5
bf78f3b810
- PUT v1/client/update: gender theo enum ClientGender (0 Nam/1 Nữ), thêm
birthday (cột mới), province_code/ward_code validate theo bảng provinces/wards
(phường phải thuộc tỉnh). Migration nạp dữ liệu hành chính 2025 từ
province_ward_import.sql (chỉ bảng trống), API GET v1/provinces[/{code}/wards].
- CustomerObserver/OrderObserver log giá trị cũ bằng getRawOriginal: getOriginal
trả enum object, nối chuỗi gây 500 khi khách đổi giới tính.
- ClientResource: các cờ trả boolean, CCCD chỉ trả cccd_updated (không lộ ảnh/số).
- GET v1/setting/menu trả cả items + quick_links, bỏ v1/setting/quick-links.
- Thông báo admin/khách tra theo uuid thay vì id tự tăng.
- Chặn gửi template marketing cho khách đã tắt nhận email marketing.
- Xoá ProvinceWardSeeder và Customer::$updatable không dùng.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
3.3 KiB
PHP
90 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Admin;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
use Tests\TestCase;
|
|
|
|
class ClientMenuTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private function admin(): User
|
|
{
|
|
$role = Role::create(['name' => 'role-' . uniqid(), 'guard_name' => 'admin']);
|
|
$role->givePermissionTo(Permission::firstOrCreate(['name' => 'setting.manager', 'guard_name' => 'admin']));
|
|
$admin = User::factory()->create();
|
|
$admin->assignRole($role);
|
|
|
|
return $admin;
|
|
}
|
|
|
|
public function test_admin_saves_menu_and_client_reads_it(): void
|
|
{
|
|
$items = [
|
|
['title' => 'Dashboard', 'icon' => 'hugeicons:home-01', 'href' => '/'],
|
|
['title' => 'Dịch vụ', 'icon' => null, 'href' => null, 'children' => [
|
|
['title' => 'VPS', 'href' => '/dich-vu/vps', 'disabled' => true],
|
|
]],
|
|
];
|
|
|
|
$this->actingAs($this->admin(), 'admin')
|
|
->putJson('/api/v1/administrator/client-menu', ['items' => $items])
|
|
->assertOk();
|
|
|
|
$this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->getJson('/v1/setting/menu')
|
|
->assertOk()
|
|
->assertJsonPath('data.items.0.title', 'Dashboard')
|
|
->assertJsonPath('data.items.0.children', [])
|
|
->assertJsonPath('data.items.1.href', null)
|
|
->assertJsonPath('data.items.1.children.0.href', '/dich-vu/vps')
|
|
->assertJsonPath('data.items.1.children.0.disabled', true);
|
|
}
|
|
|
|
public function test_rejects_unsafe_href_and_leaf_without_href(): void
|
|
{
|
|
$admin = $this->admin();
|
|
|
|
$this->actingAs($admin, 'admin')
|
|
->putJson('/api/v1/administrator/client-menu', ['items' => [
|
|
['title' => 'X', 'href' => 'javascript:alert(1)'],
|
|
['title' => 'Y', 'href' => '//evil.example'],
|
|
['title' => 'Z', 'href' => null],
|
|
['title' => 'W', 'href' => null, 'children' => [['title' => 'C', 'href' => 'data:text/html,x']]],
|
|
]])
|
|
->assertStatus(422)
|
|
->assertJsonValidationErrors(['items.0.href', 'items.1.href', 'items.2.href', 'items.3.children.0.href']);
|
|
}
|
|
|
|
public function test_admin_saves_quick_links_and_client_reads_them(): void
|
|
{
|
|
$admin = $this->admin();
|
|
|
|
$this->actingAs($admin, 'admin')
|
|
->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
|
|
['title' => 'Tạo Cloud VPS', 'icon' => 'lucide:cloud', 'href' => '/san-pham/vps'],
|
|
]])
|
|
->assertOk();
|
|
|
|
$this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->getJson('/v1/setting/menu')
|
|
->assertOk()
|
|
->assertJsonPath('data.quick_links.0.title', 'Tạo Cloud VPS')
|
|
->assertJsonPath('data.quick_links.0.disabled', false);
|
|
|
|
$this->actingAs($admin, 'admin')
|
|
->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
|
|
['title' => 'X', 'href' => 'javascript:alert(1)'],
|
|
['title' => 'Y', 'href' => null],
|
|
]])
|
|
->assertStatus(422)
|
|
->assertJsonValidationErrors(['items.0.href', 'items.1.href']);
|
|
}
|
|
}
|