tbianchini/shopit-back
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(admin): implement CRUD for administrators with role management and tenant restrictions

Browse Source
This commit is contained in:
ncoronel
2026-09-04 10:28:33 -03:00
parent ac44e82454
commit 18f1217daa
10 changed files with 478 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
tests/Feature/Administrator/AdministratorControllerTest.php Normal file
View File

@@ -0,0 +1,148 @@
<?php
namespace Tests\Feature\Administrator;
use App\Domains\Attachable\Enums\AttachmentType;
use App\Domains\Attachable\Models\Attachment;
use App\Domains\Auth\Models\ResetPasswordAttempt;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Notification\Events\PasswordResetRequested;
use App\Domains\Tenant\Models\Tenant;
use App\Domains\Tenant\Models\WebsiteType;
use Database\Seeders\AuthorizationSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Event;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;
class AdministratorControllerTest extends TestCase
{
use RefreshDatabase;
private Tenant $tenant;
private User $admin;
protected function setUp(): void
{
parent::setUp();
Event::fake([PasswordResetRequested::class]);
$this->seed(AuthorizationSeeder::class);
WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
$headerLogo = $this->createAttachment('header.png');
$footerLogo = $this->createAttachment('footer.png');
$this->tenant = Tenant::query()->create([
'codigo' => 'acme',
'nombre' => 'Acme',
'dominio' => 'acme.test',
'website_type_code' => 'onticket',
'primary_color' => '#111111',
'secondary_color' => '#222222',
'danger_color' => '#cc0000',
'success_color' => '#008800',
'header_bg_color' => '#ffffff',
'footer_bg_color' => '#ffffff',
'header_logo_id' => $headerLogo->id,
'footer_logo_id' => $footerLogo->id,
]);
$this->admin = User::factory()->create([
'rol_codigo' => RoleCode::AdminApp->value,
'tenant_codigo' => $this->tenant->codigo,
]);
}
private const URL = '/api/v1/adminapp/tenant/administrators';
private function payload(): array
{
return ['nombre_apellido' => 'Ada Lovelace', 'dni' => '12345678', 'email' => 'ada@example.test'];
}
public function test_crud_and_password_setup_and_token_revocation(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson(self::URL, [...$this->payload(), 'email' => ' ADA@example.test ', 'rol_codigo' => 'admin', 'tenant_codigo' => 'other'])
->assertCreated()->assertJsonPath('data.email', 'ada@example.test')
->assertJsonPath('data.rol_codigo', 'adminapp')->assertJsonMissingPath('data.password');
$id = $response->json('data.id');
$this->assertDatabaseHas('users', ['id' => $id, 'tenant_codigo' => $this->tenant->codigo, 'rol_codigo' => 'adminapp']);
$this->assertDatabaseHas('reset_password_attempts', ['user_id' => $id, 'reason' => ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED, 'status' => ResetPasswordAttempt::STATUS_PENDING]);
Event::assertDispatched(PasswordResetRequested::class, fn ($event) => $event->channel === PasswordResetRequested::CHANNEL_ADMINAPP && $event->tenantCode === $this->tenant->codigo);
$this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(1, 'data');
$this->putJson(self::URL."/{$id}", [...$this->payload(), 'nombre_apellido' => 'Ada Byron', 'rol_codigo' => 'scanner'])
->assertOk()->assertJsonPath('data.nombre_apellido', 'Ada Byron')->assertJsonPath('data.rol_codigo', 'adminapp');
$token = User::findOrFail($id)->createToken('adminapp')->accessToken;
$this->deleteJson(self::URL."/{$id}")->assertNoContent();
$this->assertSoftDeleted('users', ['id' => $id]);
$this->assertDatabaseMissing('personal_access_tokens', ['id' => $token->id]);
$this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(0, 'data');
$this->postJson(self::URL, $this->payload())->assertCreated();
}
public function test_validation_and_case_insensitive_active_email_uniqueness(): void
{
Sanctum::actingAs($this->admin);
$this->postJson(self::URL, [])->assertUnprocessable()->assertJsonValidationErrors(['nombre_apellido', 'dni', 'email']);
$this->postJson(self::URL, [...$this->payload(), 'email' => 'invalid'])->assertUnprocessable()->assertJsonValidationErrors('email');
$this->postJson(self::URL, [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
$target = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
$this->putJson(self::URL."/{$target->id}", [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
}
public function test_other_tenants_and_roles_are_excluded(): void
{
Sanctum::actingAs($this->admin);
$otherTenant = $this->tenant->replicate();
$otherTenant->codigo = 'other';
$otherTenant->dominio = 'other.test';
$otherTenant->save();
$targets = [
User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $otherTenant->codigo]),
User::factory()->create(['rol_codigo' => 'scanner', 'tenant_codigo' => $this->tenant->codigo]),
User::factory()->create(['rol_codigo' => 'admin', 'tenant_codigo' => $this->tenant->codigo]),
];
$this->getJson(self::URL)->assertOk()->assertJsonCount(1, 'data')->assertJsonPath('data.0.id', $this->admin->id);
foreach ($targets as $target) {
$this->putJson(self::URL."/{$target->id}", $this->payload())->assertNotFound();
$this->deleteJson(self::URL."/{$target->id}")->assertNotFound();
$this->assertNotSoftDeleted($target);
}
}
public function test_cannot_delete_self_even_with_another_administrator(): void
{
Sanctum::actingAs($this->admin);
$this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
$this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable();
$this->assertNotSoftDeleted($this->admin);
}
public function test_in_flight_request_from_deleted_actor_cannot_remove_last_administrator(): void
{
$remaining = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
$this->admin->delete();
Sanctum::actingAs($this->admin);
$this->deleteJson(self::URL."/{$remaining->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
$this->assertNotSoftDeleted($remaining);
}
public function test_authentication_and_role_are_required_for_all_operations(): void
{
$this->getJson(self::URL)->assertUnauthorized();
foreach (['user', 'scanner', 'admin'] as $role) {
Sanctum::actingAs(User::factory()->create(['rol_codigo' => $role, 'tenant_codigo' => $this->tenant->codigo]));
$this->getJson(self::URL)->assertForbidden();
$this->postJson(self::URL, $this->payload())->assertForbidden();
$this->putJson(self::URL."/{$this->admin->id}", $this->payload())->assertForbidden();
$this->deleteJson(self::URL."/{$this->admin->id}")->assertForbidden();
}
}
private function createAttachment(string $filename): Attachment
{
return Attachment::query()->create(['path' => "test/{$filename}", 'filename' => $filename, 'type' => AttachmentType::Image, 'mime_type' => 'image/png']);
}
}