baodev0
c377c7e195
- Create a new Blade view for domain registration (`registrant-tochuc.blade.php`) to capture organization and manager details. - Implement email templates for new domain orders for both admin (`domain-order-new.blade.php`) and customers (`domain-order-received.blade.php`). - Add CSV exports for client and domain data. - Introduce tests for customer mass assignment, password reset, login throttling, and permission gating. - Ensure service renewals use current pricing and validate ownership for virtual machines. - Validate mass assignment behavior in service model.
81 lines
3.4 KiB
PHP
81 lines
3.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Admin;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
use Tests\TestCase;
|
|
|
|
class PermissionGatingTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
// CheckPermission throws when the checked permission row doesn't exist at all —
|
|
// seed every permission this test touches so unauthorized checks 403 instead of 500.
|
|
foreach (self::gatedRoutesProvider() as [, , $permission]) {
|
|
Permission::firstOrCreate(['name' => $permission, 'guard_name' => 'admin']);
|
|
}
|
|
Permission::firstOrCreate(['name' => 'some-other.manager', 'guard_name' => 'admin']);
|
|
}
|
|
|
|
private function makeAdminWithPermissions(array $permissions): User
|
|
{
|
|
$role = Role::create(['name' => 'role-' . uniqid(), 'guard_name' => 'admin']);
|
|
foreach ($permissions as $permission) {
|
|
$role->givePermissionTo(
|
|
Permission::firstOrCreate(['name' => $permission, 'guard_name' => 'admin']),
|
|
);
|
|
}
|
|
|
|
$admin = User::factory()->create();
|
|
$admin->assignRole($role);
|
|
|
|
return $admin;
|
|
}
|
|
|
|
/** @dataProvider gatedRoutesProvider */
|
|
public function test_route_requires_expected_permission(string $method, string $uri, string $requiredPermission): void
|
|
{
|
|
$unauthorized = $this->makeAdminWithPermissions(['some-other.manager']);
|
|
$this->actingAs($unauthorized, 'admin')->json($method, $uri)->assertStatus(403);
|
|
|
|
$authorized = $this->makeAdminWithPermissions([$requiredPermission]);
|
|
$response = $this->actingAs($authorized, 'admin')->json($method, $uri);
|
|
$this->assertNotSame(403, $response->status(), "Expected {$uri} to be accessible with '{$requiredPermission}', got 403.");
|
|
}
|
|
|
|
public static function gatedRoutesProvider(): array
|
|
{
|
|
return [
|
|
'settings index' => ['GET', '/api/v1/administrator/settings', 'setting.manager'],
|
|
'banks index' => ['GET', '/api/v1/administrator/banks', 'setting.manager'],
|
|
'domain-pricing index' => ['GET', '/api/v1/administrator/domain-pricing', 'setting.manager'],
|
|
'email-templates index' => ['GET', '/api/v1/administrator/email-templates', 'email-template.manager'],
|
|
'notification-templates' => ['GET', '/api/v1/administrator/notification-templates', 'email-template.manager'],
|
|
'tickets index' => ['GET', '/api/v1/administrator/tickets', 'support.view'],
|
|
'activity-logs index' => ['GET', '/api/v1/administrator/activity-logs', 'system-log.manager'],
|
|
'email-logs index' => ['GET', '/api/v1/administrator/email-logs', 'system-log.manager'],
|
|
];
|
|
}
|
|
|
|
public function test_full_administrator_bypasses_all_permission_gates(): void
|
|
{
|
|
Role::firstOrCreate(['name' => 'Full Administrator', 'guard_name' => 'admin']);
|
|
$admin = User::factory()->create();
|
|
$admin->assignRole('Full Administrator');
|
|
|
|
foreach (self::gatedRoutesProvider() as [$method, $uri]) {
|
|
$response = $this->actingAs($admin, 'admin')->json($method, $uri);
|
|
$this->assertNotSame(403, $response->status(), "Full Administrator should not be blocked from {$uri}.");
|
|
}
|
|
}
|
|
}
|