baodev0
c377c7e195
- Create a new Blade view for domain registration (`registrant-tochuc.blade.php`) to capture organization and manager details. - Implement email templates for new domain orders for both admin (`domain-order-new.blade.php`) and customers (`domain-order-received.blade.php`). - Add CSV exports for client and domain data. - Introduce tests for customer mass assignment, password reset, login throttling, and permission gating. - Ensure service renewals use current pricing and validate ownership for virtual machines. - Validate mass assignment behavior in service model.
48 lines
1.6 KiB
PHP
48 lines
1.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Service;
|
|
|
|
use App\Models\Customer;
|
|
use App\Models\ModuleVmware;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Tests\TestCase;
|
|
|
|
class VmOwnershipTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private function buildClientAccessToken(): string
|
|
{
|
|
$key = hex2bin((string) config('services.client_api.key'));
|
|
$secret = (string) config('services.client_api.secret');
|
|
$iv = random_bytes(16);
|
|
$ciphertext = openssl_encrypt($secret, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
|
|
|
|
return base64_encode($iv . $ciphertext);
|
|
}
|
|
|
|
public function test_customer_cannot_read_power_state_of_another_customers_vm_by_numeric_id(): void
|
|
{
|
|
$owner = Customer::factory()->create();
|
|
$attacker = Customer::factory()->create();
|
|
|
|
$vm = ModuleVmware::create([
|
|
'name' => 'owner-vm',
|
|
'customer_id' => $owner->id,
|
|
'vmware_id' => 'vm-1001',
|
|
'status' => 1,
|
|
]);
|
|
|
|
$response = $this->actingAs($attacker, 'client')
|
|
->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->getJson('/v1/system/vm-power-state?product=' . $vm->id);
|
|
|
|
// Query đã lọc theo customer_id nên VM của người khác không được tìm thấy (404)
|
|
// thay vì tìm thấy rồi mới bị chặn bởi check quyền sở hữu phía sau (403) — cả hai đều
|
|
// an toàn, nhưng 404 xác nhận query đã được scope đúng ngay từ đầu (defense-in-depth).
|
|
$response->assertStatus(404);
|
|
}
|
|
}
|