feat(users): enforce active email uniqueness per role
This commit is contained in:
@@ -60,6 +60,17 @@ class AdministratorControllerTest extends TestCase
|
||||
return ['nombre_apellido' => 'Ada Lovelace', 'dni' => '12345678', 'email' => 'ada@example.test'];
|
||||
}
|
||||
|
||||
public function test_email_can_be_shared_with_customers_and_scanners(): void
|
||||
{
|
||||
Sanctum::actingAs($this->admin);
|
||||
foreach (['user', 'scanner'] as $role) {
|
||||
User::factory()->create(['email' => 'ada@example.test', 'rol_codigo' => $role]);
|
||||
}
|
||||
$response = $this->postJson(self::URL, $this->payload())->assertCreated();
|
||||
$this->putJson(self::URL.'/'.$response->json('data.id'), $this->payload())->assertOk();
|
||||
$this->postJson(self::URL, $this->payload())->assertUnprocessable()->assertJsonValidationErrors('email');
|
||||
}
|
||||
|
||||
public function test_crud_and_password_setup_and_token_revocation(): void
|
||||
{
|
||||
Sanctum::actingAs($this->admin);
|
||||
|
||||
133
tests/Feature/Auth/EmailUniquenessPerRoleTest.php
Normal file
133
tests/Feature/Auth/EmailUniquenessPerRoleTest.php
Normal file
@@ -0,0 +1,133 @@
|
||||
<?php
|
||||
|
||||
namespace Tests\Feature\Auth;
|
||||
|
||||
use App\Domains\Attachable\Enums\AttachmentType;
|
||||
use App\Domains\Attachable\Models\Attachment;
|
||||
use App\Domains\Auth\Models\ResetPasswordAttempt;
|
||||
use App\Domains\Auth\Models\User;
|
||||
use App\Domains\Authorization\Enums\RoleCode;
|
||||
use App\Domains\Notification\Events\PasswordResetRequested;
|
||||
use App\Domains\Tenant\Models\Tenant;
|
||||
use Database\Seeders\AuthorizationSeeder;
|
||||
use Illuminate\Database\UniqueConstraintViolationException;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Illuminate\Routing\Middleware\ThrottleRequests;
|
||||
use Illuminate\Support\Facades\Event;
|
||||
use Illuminate\Support\Facades\Hash;
|
||||
use Tests\TestCase;
|
||||
|
||||
class EmailUniquenessPerRoleTest extends TestCase
|
||||
{
|
||||
use RefreshDatabase;
|
||||
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
$this->withoutMiddleware(ThrottleRequests::class);
|
||||
$this->seed(AuthorizationSeeder::class);
|
||||
Event::fake([PasswordResetRequested::class]);
|
||||
}
|
||||
|
||||
public function test_database_allows_different_roles_and_reuse_after_soft_delete(): void
|
||||
{
|
||||
foreach (RoleCode::cases() as $role) {
|
||||
User::factory()->create(['email' => 'Shared@example.com', 'rol_codigo' => $role->value]);
|
||||
}
|
||||
$user = User::where('rol_codigo', 'user')->sole();
|
||||
$user->delete();
|
||||
$replacement = User::factory()->create(['email' => 'shared@example.com']);
|
||||
$this->assertNotSame($user->id, $replacement->id);
|
||||
$this->assertSame(4, User::where('active_email', 'shared@example.com')->count());
|
||||
}
|
||||
|
||||
public function test_database_rejects_same_role_case_insensitively_across_tenants(): void
|
||||
{
|
||||
foreach (['one', 'two'] as $code) {
|
||||
$this->createTenant($code);
|
||||
}
|
||||
User::factory()->create(['email' => 'Shared@example.com', 'tenant_codigo' => 'one']);
|
||||
$this->expectException(UniqueConstraintViolationException::class);
|
||||
User::factory()->create(['email' => 'shared@example.com', 'tenant_codigo' => 'two']);
|
||||
}
|
||||
|
||||
public function test_role_change_cannot_create_a_duplicate_active_identity(): void
|
||||
{
|
||||
User::factory()->create(['email' => 'shared@example.com']);
|
||||
$admin = User::factory()->create(['email' => 'shared@example.com', 'rol_codigo' => 'adminapp']);
|
||||
$this->expectException(UniqueConstraintViolationException::class);
|
||||
$admin->update(['rol_codigo' => 'user']);
|
||||
}
|
||||
|
||||
public function test_registration_accepts_another_role_but_rejects_same_role(): void
|
||||
{
|
||||
User::factory()->create(['email' => 'SHARED@example.com', 'rol_codigo' => 'adminapp']);
|
||||
$payload = ['nombre_apellido' => 'Shared', 'email' => ' Shared@Example.com ',
|
||||
'password' => 'Secret!123', 'password_confirmation' => 'Secret!123'];
|
||||
$this->postJson('/api/register', $payload)->assertCreated()->assertJsonPath('data.email', 'shared@example.com');
|
||||
$this->postJson('/api/register', $payload)->assertUnprocessable()->assertJsonValidationErrors('email');
|
||||
}
|
||||
|
||||
public function test_login_and_password_reset_select_the_role_from_each_application(): void
|
||||
{
|
||||
$tenant = $this->createTenant('acme');
|
||||
$users = [];
|
||||
// Create staff first so an email-only lookup would select the wrong account.
|
||||
foreach (['adminapp', 'scanner', 'user'] as $role) {
|
||||
$users[$role] = User::factory()->create([
|
||||
'email' => 'Shared@example.com', 'rol_codigo' => $role,
|
||||
'tenant_codigo' => $tenant->codigo, 'password' => 'Old!'.$role,
|
||||
]);
|
||||
}
|
||||
foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
|
||||
$this->postJson($base.'/login', [
|
||||
'email' => 'SHARED@example.com', 'password' => 'Old!'.$role, 'tenant_codigo' => 'acme',
|
||||
])->assertOk()->assertJsonPath('user.id', $users[$role]->id);
|
||||
$this->postJson($base.'/password/reset-attempts', [
|
||||
'email' => 'shared@example.com', 'tenant_codigo' => 'acme',
|
||||
])->assertAccepted();
|
||||
}
|
||||
// Identical codes across roles must still only change the intended account.
|
||||
ResetPasswordAttempt::query()->update(['codigo' => '1234']);
|
||||
foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
|
||||
$this->postJson($base.'/password/reset-attempts/validate', [
|
||||
'email' => 'shared@example.com', 'codigo' => '1234',
|
||||
])->assertOk();
|
||||
$this->postJson($base.'/password/reset', [
|
||||
'email' => 'shared@example.com', 'codigo' => '1234',
|
||||
'password' => 'New!'.$role, 'password_confirmation' => 'New!'.$role,
|
||||
])->assertOk();
|
||||
$this->assertTrue(Hash::check('New!'.$role, $users[$role]->fresh()->password));
|
||||
}
|
||||
}
|
||||
|
||||
private function createTenant(string $code): Tenant
|
||||
{
|
||||
$headerLogo = $this->createAttachment("{$code}-header");
|
||||
$footerLogo = $this->createAttachment("{$code}-footer");
|
||||
|
||||
return Tenant::query()->create([
|
||||
'codigo' => $code,
|
||||
'nombre' => ucfirst($code),
|
||||
'dominio' => "{$code}.local",
|
||||
'primary_color' => '#000000',
|
||||
'secondary_color' => '#000000',
|
||||
'danger_color' => '#000000',
|
||||
'success_color' => '#000000',
|
||||
'header_bg_color' => '#000000',
|
||||
'footer_bg_color' => '#000000',
|
||||
'header_logo_id' => $headerLogo->id,
|
||||
'footer_logo_id' => $footerLogo->id,
|
||||
]);
|
||||
}
|
||||
|
||||
private function createAttachment(string $name): Attachment
|
||||
{
|
||||
return Attachment::query()->create([
|
||||
'path' => "test/{$name}.png",
|
||||
'filename' => "{$name}.png",
|
||||
'type' => AttachmentType::Image,
|
||||
'mime_type' => 'image/png',
|
||||
]);
|
||||
}
|
||||
}
|
||||
@@ -56,6 +56,17 @@ class StaffControllerTest extends TestCase
|
||||
]);
|
||||
}
|
||||
|
||||
public function test_staff_email_can_be_shared_with_adminapp_and_customers(): void
|
||||
{
|
||||
Sanctum::actingAs($this->admin);
|
||||
User::factory()->create(['email' => $this->admin->email]);
|
||||
$payload = ['nombre_apellido' => 'Shared', 'dni' => '12345678',
|
||||
'email' => strtoupper($this->admin->email), 'category_ids' => [$this->createCategory('Tickets')->id]];
|
||||
$response = $this->postJson('/api/v1/adminapp/tenant/staff', $payload)->assertSuccessful();
|
||||
$this->putJson('/api/v1/adminapp/tenant/staff/'.$response->json('data.id'), $payload)->assertOk();
|
||||
$this->postJson('/api/v1/adminapp/tenant/staff', $payload)->assertUnprocessable()->assertJsonValidationErrors('email');
|
||||
}
|
||||
|
||||
public function test_adminapp_can_create_update_list_and_delete_staff_with_categories(): void
|
||||
{
|
||||
Sanctum::actingAs($this->admin);
|
||||
|
||||
Reference in New Issue
Block a user