78 lines
2.7 KiB
PHP
78 lines
2.7 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\Admin;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\DatabaseTransactions;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Stats exposes platform-wide financial data, so entry must be blocked for
|
|
* anyone without an Admin/Bank profile carrying the stats permission.
|
|
*/
|
|
class StatsAccessTest extends TestCase
|
|
{
|
|
use DatabaseTransactions;
|
|
|
|
/** A user that clears the verified / registration-complete middleware. */
|
|
private function makeUser(string $name): User
|
|
{
|
|
$id = DB::table('users')->insertGetId([
|
|
'name' => $name,
|
|
'full_name' => $name,
|
|
'email' => $name . '@example.test',
|
|
'password' => bcrypt('secret'),
|
|
'email_verified_at' => now(),
|
|
'principles_terms_accepted' => true,
|
|
'created_at' => now(),
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
return User::find($id);
|
|
}
|
|
|
|
public function test_guest_is_redirected_to_login(): void
|
|
{
|
|
$this->get(route('stats'))->assertRedirect();
|
|
$this->get(route('stats.pdf'))->assertRedirect();
|
|
}
|
|
|
|
public function test_plain_user_profile_cannot_reach_stats(): void
|
|
{
|
|
$user = $this->makeUser('stats_plain_user');
|
|
|
|
$this->actingAs($user, 'web');
|
|
session(['activeProfileType' => User::class, 'activeProfileId' => $user->id]);
|
|
|
|
$this->assertNotSame(200, $this->get(route('stats'))->getStatusCode());
|
|
$this->assertNotSame(200, $this->get(route('stats.pdf'))->getStatusCode());
|
|
}
|
|
|
|
public function test_admin_profile_without_the_permission_cannot_reach_stats(): void
|
|
{
|
|
$user = $this->makeUser('stats_unprivileged_admin');
|
|
|
|
$adminId = DB::table('admins')->insertGetId([
|
|
'name' => 'stats_admin_profile',
|
|
'full_name' => 'Stats Admin Profile',
|
|
'email' => 'stats_admin_profile@example.test',
|
|
'password' => bcrypt('secret'),
|
|
'email_verified_at' => now(),
|
|
'created_at' => now(),
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
$admin = Admin::find($adminId);
|
|
$admin->users()->attach($user->id);
|
|
|
|
// Authenticated on both guards, but holding no stats permission at all.
|
|
$this->actingAs($user, 'web');
|
|
session(['activeProfileType' => Admin::class, 'activeProfileId' => $admin->id]);
|
|
|
|
$this->assertNotSame(200, $this->get(route('stats'))->getStatusCode());
|
|
$this->assertNotSame(200, $this->get(route('stats.pdf'))->getStatusCode());
|
|
}
|
|
}
|