117 lines
3.8 KiB
PHP
117 lines
3.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Admin\Employee;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
use Tests\TestCase;
|
|
|
|
class EmployeeRoleGuardTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
Permission::firstOrCreate(['name' => 'administrator.edit', 'guard_name' => 'admin']);
|
|
Permission::firstOrCreate(['name' => 'administrator.destroy', 'guard_name' => 'admin']);
|
|
|
|
Role::firstOrCreate(['name' => 'Full Administrator', 'guard_name' => 'admin']);
|
|
$administrator = Role::firstOrCreate(['name' => 'Administrator', 'guard_name' => 'admin']);
|
|
$sale = Role::firstOrCreate(['name' => 'Sale', 'guard_name' => 'admin']);
|
|
|
|
$administrator->givePermissionTo(['administrator.edit', 'administrator.destroy']);
|
|
$sale->givePermissionTo(['administrator.edit', 'administrator.destroy']);
|
|
}
|
|
|
|
private function makeEmployee(string $role): User
|
|
{
|
|
$user = User::factory()->create([
|
|
'username' => 'user-' . uniqid(),
|
|
'email' => uniqid() . '@example.com',
|
|
]);
|
|
$user->assignRole($role);
|
|
|
|
return $user;
|
|
}
|
|
|
|
private function payload(array $overrides = []): array
|
|
{
|
|
return array_merge([
|
|
'fullname' => 'Test User',
|
|
'username' => 'test-' . uniqid(),
|
|
'email' => uniqid() . '@example.com',
|
|
'role' => 'Sale',
|
|
], $overrides);
|
|
}
|
|
|
|
public function test_non_full_administrator_cannot_edit_a_full_administrator(): void
|
|
{
|
|
$fullAdmin = $this->makeEmployee('Full Administrator');
|
|
$caller = $this->makeEmployee('Administrator');
|
|
|
|
$response = $this->actingAs($caller, 'admin')->putJson(
|
|
"/api/v1/administrator/employees/{$fullAdmin->id}",
|
|
$this->payload(['role' => 'Sale']),
|
|
);
|
|
|
|
$response->assertStatus(403);
|
|
}
|
|
|
|
public function test_non_full_administrator_cannot_delete_a_full_administrator(): void
|
|
{
|
|
$fullAdmin = $this->makeEmployee('Full Administrator');
|
|
$caller = $this->makeEmployee('Administrator');
|
|
|
|
$response = $this->actingAs($caller, 'admin')->deleteJson(
|
|
"/api/v1/administrator/employees/{$fullAdmin->id}",
|
|
);
|
|
|
|
$response->assertStatus(403);
|
|
}
|
|
|
|
public function test_cannot_change_own_role(): void
|
|
{
|
|
$caller = $this->makeEmployee('Sale');
|
|
|
|
$response = $this->actingAs($caller, 'admin')->putJson(
|
|
"/api/v1/administrator/employees/{$caller->id}",
|
|
$this->payload(['username' => $caller->username, 'email' => $caller->email, 'role' => 'Administrator']),
|
|
);
|
|
|
|
$response->assertStatus(403);
|
|
}
|
|
|
|
public function test_non_full_administrator_cannot_assign_administrator_role(): void
|
|
{
|
|
$caller = $this->makeEmployee('Administrator');
|
|
$target = $this->makeEmployee('Sale');
|
|
|
|
$response = $this->actingAs($caller, 'admin')->putJson(
|
|
"/api/v1/administrator/employees/{$target->id}",
|
|
$this->payload(['username' => $target->username, 'email' => $target->email, 'role' => 'Administrator']),
|
|
);
|
|
|
|
$response->assertStatus(403);
|
|
}
|
|
|
|
public function test_full_administrator_can_assign_administrator_role(): void
|
|
{
|
|
$caller = $this->makeEmployee('Full Administrator');
|
|
$target = $this->makeEmployee('Sale');
|
|
|
|
$response = $this->actingAs($caller, 'admin')->putJson(
|
|
"/api/v1/administrator/employees/{$target->id}",
|
|
$this->payload(['username' => $target->username, 'email' => $target->email, 'role' => 'Administrator']),
|
|
);
|
|
|
|
$response->assertOk();
|
|
$this->assertTrue($target->fresh()->hasRole('Administrator'));
|
|
}
|
|
}
|