Snapshot of main at 9f39a6e1e (2026-11-02)

tests/Feature/StatsAccessTest.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Admin;
+use App\Models\User;
+use Illuminate\Foundation\Testing\DatabaseTransactions;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+/**
+ * Stats exposes platform-wide financial data, so entry must be blocked for
+ * anyone without an Admin/Bank profile carrying the stats permission.
+ */
+class StatsAccessTest extends TestCase
+{
+    use DatabaseTransactions;
+
+    /** A user that clears the verified / registration-complete middleware. */
+    private function makeUser(string $name): User
+    {
+        $id = DB::table('users')->insertGetId([
+            'name'                      => $name,
+            'full_name'                 => $name,
+            'email'                     => $name . '@example.test',
+            'password'                  => bcrypt('secret'),
+            'email_verified_at'         => now(),
+            'principles_terms_accepted' => true,
+            'created_at'                => now(),
+            'updated_at'                => now(),
+        ]);
+
+        return User::find($id);
+    }
+
+    public function test_guest_is_redirected_to_login(): void
+    {
+        $this->get(route('stats'))->assertRedirect();
+        $this->get(route('stats.pdf'))->assertRedirect();
+    }
+
+    public function test_plain_user_profile_cannot_reach_stats(): void
+    {
+        $user = $this->makeUser('stats_plain_user');
+
+        $this->actingAs($user, 'web');
+        session(['activeProfileType' => User::class, 'activeProfileId' => $user->id]);
+
+        $this->assertNotSame(200, $this->get(route('stats'))->getStatusCode());
+        $this->assertNotSame(200, $this->get(route('stats.pdf'))->getStatusCode());
+    }
+
+    public function test_admin_profile_without_the_permission_cannot_reach_stats(): void
+    {
+        $user = $this->makeUser('stats_unprivileged_admin');
+
+        $adminId = DB::table('admins')->insertGetId([
+            'name'              => 'stats_admin_profile',
+            'full_name'         => 'Stats Admin Profile',
+            'email'             => 'stats_admin_profile@example.test',
+            'password'          => bcrypt('secret'),
+            'email_verified_at' => now(),
+            'created_at'        => now(),
+            'updated_at'        => now(),
+        ]);
+
+        $admin = Admin::find($adminId);
+        $admin->users()->attach($user->id);
+
+        // Authenticated on both guards, but holding no stats permission at all.
+        $this->actingAs($user, 'web');
+        session(['activeProfileType' => Admin::class, 'activeProfileId' => $admin->id]);
+
+        $this->assertNotSame(200, $this->get(route('stats'))->getStatusCode());
+        $this->assertNotSame(200, $this->get(route('stats.pdf'))->getStatusCode());
+    }
+}