baodev0andClaude Opus 5.5
e888a6ed5d
- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
3.3 KiB
PHP
90 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Admin;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
use Tests\TestCase;
|
|
|
|
class ClientMenuTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private function admin(): User
|
|
{
|
|
$role = Role::create(['name' => 'role-' . uniqid(), 'guard_name' => 'admin']);
|
|
$role->givePermissionTo(Permission::firstOrCreate(['name' => 'setting.manager', 'guard_name' => 'admin']));
|
|
$admin = User::factory()->create();
|
|
$admin->assignRole($role);
|
|
|
|
return $admin;
|
|
}
|
|
|
|
public function test_admin_saves_menu_and_client_reads_it(): void
|
|
{
|
|
$items = [
|
|
['title' => 'Dashboard', 'icon' => 'hugeicons:home-01', 'href' => '/'],
|
|
['title' => 'Dịch vụ', 'icon' => null, 'href' => null, 'children' => [
|
|
['title' => 'VPS', 'href' => '/dich-vu/vps', 'disabled' => true],
|
|
]],
|
|
];
|
|
|
|
$this->actingAs($this->admin(), 'admin')
|
|
->putJson('/api/v1/administrator/client-menu', ['items' => $items])
|
|
->assertOk();
|
|
|
|
$this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->getJson('/v1/setting/menu')
|
|
->assertOk()
|
|
->assertJsonPath('data.0.title', 'Dashboard')
|
|
->assertJsonPath('data.0.children', [])
|
|
->assertJsonPath('data.1.href', null)
|
|
->assertJsonPath('data.1.children.0.href', '/dich-vu/vps')
|
|
->assertJsonPath('data.1.children.0.disabled', true);
|
|
}
|
|
|
|
public function test_rejects_unsafe_href_and_leaf_without_href(): void
|
|
{
|
|
$admin = $this->admin();
|
|
|
|
$this->actingAs($admin, 'admin')
|
|
->putJson('/api/v1/administrator/client-menu', ['items' => [
|
|
['title' => 'X', 'href' => 'javascript:alert(1)'],
|
|
['title' => 'Y', 'href' => '//evil.example'],
|
|
['title' => 'Z', 'href' => null],
|
|
['title' => 'W', 'href' => null, 'children' => [['title' => 'C', 'href' => 'data:text/html,x']]],
|
|
]])
|
|
->assertStatus(422)
|
|
->assertJsonValidationErrors(['items.0.href', 'items.1.href', 'items.2.href', 'items.3.children.0.href']);
|
|
}
|
|
|
|
public function test_admin_saves_quick_links_and_client_reads_them(): void
|
|
{
|
|
$admin = $this->admin();
|
|
|
|
$this->actingAs($admin, 'admin')
|
|
->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
|
|
['title' => 'Tạo Cloud VPS', 'icon' => 'lucide:cloud', 'href' => '/san-pham/vps'],
|
|
]])
|
|
->assertOk();
|
|
|
|
$this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->getJson('/v1/setting/quick-links')
|
|
->assertOk()
|
|
->assertJsonPath('data.0.title', 'Tạo Cloud VPS')
|
|
->assertJsonPath('data.0.disabled', false);
|
|
|
|
$this->actingAs($admin, 'admin')
|
|
->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
|
|
['title' => 'X', 'href' => 'javascript:alert(1)'],
|
|
['title' => 'Y', 'href' => null],
|
|
]])
|
|
->assertStatus(422)
|
|
->assertJsonValidationErrors(['items.0.href', 'items.1.href']);
|
|
}
|
|
}
|