tbianchini/shopit-back
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): implement permission-based access for scanner functionality and update related tests

Browse Source
This commit is contained in:
ncoronel
2026-08-11 14:26:28 -03:00
parent 3eaa3f8202
commit 7d9489169d
10 changed files with 81 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
app/Domains/Auth/Models/User.php
View File

@@ -53,6 +53,16 @@ class User extends Authenticatable
return $this->belongsTo(Role::class, 'rol_codigo', 'codigo');
}
public function hasPermission(string $permissionCode): bool
{
return $this->role()
->whereHas(
'permissions',
fn ($query) => $query->where('permisos.codigo', $permissionCode)
)
->exists();
}
/**
* @return BelongsTo<Tenant, $this>
*/

22
app/Domains/Auth/Services/PasswordLoginService.php
View File

@@ -5,6 +5,7 @@ namespace App\Domains\Auth\Services;
use App\Domains\Auth\Exceptions\AccountLockedException;
use App\Domains\Auth\Models\LoginAttempt;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use Carbon\CarbonImmutable;
use Illuminate\Support\Facades\DB;
@@ -63,7 +64,7 @@ class PasswordLoginService
}
/**
* Authenticate a tenant-bound scanner without requiring its tenant code.
* Authenticate a tenant-bound user authorized to scan tickets.
*
* @throws AccountLockedException
* @throws ValidationException
@@ -80,8 +81,9 @@ class PasswordLoginService
null,
$ipAddress,
$userAgent,
RoleCode::Scanner,
null,
true,
PermissionCode::ScanTickets->value,
);
}
@@ -91,8 +93,9 @@ class PasswordLoginService
?string $tenantCode,
?string $ipAddress,
?string $userAgent,
RoleCode $requiredRole = RoleCode::User,
?RoleCode $requiredRole = RoleCode::User,
bool $requiresTenant = false,
?string $requiredPermission = null,
): User {
$normalizedEmail = mb_strtolower(trim($email));
$now = CarbonImmutable::now();
@@ -107,10 +110,21 @@ class PasswordLoginService
$now,
$requiredRole,
$requiresTenant,
$requiredPermission,
): array {
$user = User::query()
->where('email', $normalizedEmail)
->where('rol_codigo', $requiredRole->value)
->when(
$requiredRole !== null,
fn ($query) => $query->where('rol_codigo', $requiredRole->value),
)
->when(
$requiredPermission !== null,
fn ($query) => $query->whereHas(
'role.permissions',
fn ($query) => $query->where('permisos.codigo', $requiredPermission)
),
)
->when(
$requiresTenant,
fn ($query) => $query->whereNotNull('tenant_codigo'),

3
app/Domains/Auth/Services/ScannerContextService.php
View File

@@ -3,7 +3,6 @@
namespace App\Domains\Auth\Services;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\RoleCode;
class ScannerContextService
{
@@ -13,7 +12,7 @@ class ScannerContextService
->with([
'menues' => fn ($query) => $query->whereHas(
'roles',
fn ($query) => $query->where('codigo', RoleCode::Scanner->value)
fn ($query) => $query->where('codigo', $user->rol_codigo)
),
])
->firstOrFail();

8
app/Domains/Authorization/Enums/PermissionCode.php Normal file
View File

@@ -0,0 +1,8 @@
<?php
namespace App\Domains\Authorization\Enums;
enum PermissionCode: string
{
case ScanTickets = 'tickets.escanear';
}

6
app/Http/Middleware/EnsureScannerTenant.php
View File

@@ -2,7 +2,7 @@
namespace App\Http\Middleware;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Authorization\Enums\PermissionCode;
use Closure;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Http\Request;
@@ -11,7 +11,7 @@ use Symfony\Component\HttpFoundation\Response;
class EnsureScannerTenant
{
/**
* Ensure the authenticated user is a scanner bound to a tenant.
* Ensure the authenticated user can scan tickets for a tenant.
*/
public function handle(Request $request, Closure $next): Response
{
@@ -19,8 +19,8 @@ class EnsureScannerTenant
if (
! $user
|| $user->rol_codigo !== RoleCode::Scanner->value
|| ! $user->tenant_codigo
|| ! $user->hasPermission(PermissionCode::ScanTickets->value)
) {
throw new AuthorizationException;
}

7
database/seeders/AuthorizationSeeder.php
View File

@@ -2,6 +2,7 @@
namespace Database\Seeders;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Authorization\Models\Permission;
use App\Domains\Authorization\Models\Role;
@@ -81,7 +82,7 @@ class AuthorizationSeeder extends Seeder
'nombre' => 'Gestionar tickets',
'descripcion' => 'Permite emitir, invalidar o regenerar tickets.',
],
'tickets.escanear' => [
PermissionCode::ScanTickets->value => [
'nombre' => 'Escanear tickets',
'descripcion' => 'Permite validar y consumir tickets de las categorías asignadas al usuario.',
],
@@ -119,12 +120,12 @@ class AuthorizationSeeder extends Seeder
RoleCode::AdminApp->value => [
'nombre' => 'Administrador de la aplicación',
'descripcion' => 'Accede a los menús administrativos de la aplicación.',
'permisos' => [],
'permisos' => [PermissionCode::ScanTickets->value],
],
RoleCode::Scanner->value => [
'nombre' => 'Scanner',
'descripcion' => 'Valida y consume tickets de las categorías que tiene asignadas.',
'permisos' => ['tickets.escanear'],
'permisos' => [PermissionCode::ScanTickets->value],
],
RoleCode::User->value => [
'nombre' => 'Usuario',

27
tests/Feature/Auth/ScannerLoginControllerTest.php
View File

@@ -3,7 +3,9 @@
namespace Tests\Feature\Auth;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Authorization\Models\Permission;
use App\Domains\Authorization\Models\Role;
use App\Domains\Tenant\Models\Tenant;
use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -14,12 +16,17 @@ class ScannerLoginControllerTest extends TestCase
{
use RefreshDatabase;
public function test_it_logs_in_a_tenant_bound_scanner(): void
public function test_it_logs_in_a_tenant_bound_user_with_scan_permission(): void
{
$role = Role::query()->create([
'codigo' => RoleCode::Scanner->value,
'nombre' => 'Scanner',
'codigo' => RoleCode::AdminApp->value,
'nombre' => 'Operador',
]);
$permission = Permission::query()->create([
'codigo' => PermissionCode::ScanTickets->value,
'nombre' => 'Escanear tickets',
]);
$role->permissions()->attach($permission->codigo);
$tenant = Tenant::query()->create([
'codigo' => 'acme',
'nombre' => 'Acme',
@@ -40,22 +47,28 @@ class ScannerLoginControllerTest extends TestCase
$response
->assertOk()
->assertJsonPath('user.id', $user->id)
->assertJsonPath('user.rol_codigo', RoleCode::Scanner->value)
->assertJsonPath('user.rol_codigo', RoleCode::AdminApp->value)
->assertJsonPath('token_type', 'Bearer');
$this->assertSame(['scanner'], $user->tokens()->sole()->abilities);
}
public function test_it_rejects_a_non_scanner_user(): void
public function test_it_rejects_a_user_without_scan_permission(): void
{
$role = Role::query()->create([
'codigo' => RoleCode::User->value,
'nombre' => 'Usuario',
'codigo' => RoleCode::Scanner->value,
'nombre' => 'Scanner sin permiso',
]);
$tenant = Tenant::query()->create([
'codigo' => 'acme',
'nombre' => 'Acme',
'dominio' => 'acme.test',
]);
$user = User::factory()->create([
'email' => 'customer@example.com',
'password' => Hash::make('secret123'),
'rol_codigo' => $role->codigo,
'tenant_codigo' => $tenant->codigo,
]);
$this->postJson('/api/v1/scanner/login', [

7
tests/Feature/Auth/ScannerMeControllerTest.php
View File

@@ -3,7 +3,9 @@
namespace Tests\Feature\Auth;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Authorization\Models\Permission;
use App\Domains\Authorization\Models\Role;
use App\Domains\Menu\Models\Menu;
use App\Domains\Tenant\Models\Tenant;
@@ -21,6 +23,11 @@ class ScannerMeControllerTest extends TestCase
'codigo' => RoleCode::Scanner->value,
'nombre' => 'Scanner',
]);
$permission = Permission::query()->create([
'codigo' => PermissionCode::ScanTickets->value,
'nombre' => 'Escanear tickets',
]);
$scannerRole->permissions()->attach($permission->codigo);
$tenant = Tenant::query()->create([
'codigo' => 'acme',
'nombre' => 'Acme',

11
tests/Feature/Seeders/AuthorizationSeederTest.php
View File

@@ -2,6 +2,7 @@
namespace Tests\Feature\Seeders;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Authorization\Models\Permission;
use App\Domains\Authorization\Models\Role;
@@ -21,6 +22,7 @@ class AuthorizationSeederTest extends TestCase
[
RoleCode::Admin->value,
RoleCode::AdminApp->value,
RoleCode::Scanner->value,
RoleCode::User->value,
],
Role::query()->orderBy('codigo')->pluck('codigo')->all()
@@ -34,10 +36,15 @@ class AuthorizationSeederTest extends TestCase
$admin = Role::query()->where('codigo', RoleCode::Admin->value)->firstOrFail();
$appAdmin = Role::query()->where('codigo', RoleCode::AdminApp->value)->firstOrFail();
$scanner = Role::query()->where('codigo', RoleCode::Scanner->value)->firstOrFail();
$user = Role::query()->where('codigo', RoleCode::User->value)->firstOrFail();
$this->assertCount(22, $admin->permissions);
$this->assertCount(0, $appAdmin->permissions);
$this->assertSame(
[PermissionCode::ScanTickets->value],
$scanner->permissions->pluck('codigo')->all()
);
$this->assertCount(0, $user->permissions);
}
@@ -46,8 +53,8 @@ class AuthorizationSeederTest extends TestCase
$this->seed(AuthorizationSeeder::class);
$this->seed(AuthorizationSeeder::class);
$this->assertCount(3, Role::query()->get());
$this->assertCount(4, Role::query()->get());
$this->assertCount(22, Permission::query()->get());
$this->assertDatabaseCount('roles_permisos', 22);
$this->assertDatabaseCount('roles_permisos', 23);
}
}

2
tests/Feature/Ticket/ScannerTicketControllerTest.php
View File

@@ -47,7 +47,7 @@ class ScannerTicketControllerTest extends TestCase
$this->scanner->scanCategories()->attach($this->category);
}
public function test_scanner_routes_require_authentication_and_scanner_role(): void
public function test_scanner_routes_require_authentication_and_scan_permission(): void
{
$this->getJson('/api/v1/scanner/tickets')->assertUnauthorized();