refactor(auth): remove role-based logic from scanner authentication and permissions

tests/Feature/Auth/ScannerMeControllerTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Auth;
 
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
@@ -10,6 +11,7 @@ use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
 use Laravel\Sanctum\Sanctum;
 use Tests\TestCase;
 
@@ -28,11 +30,7 @@ class ScannerMeControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $scannerRole->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
+        $tenant = $this->createTenant();
         $home = Menu::query()->create([
             'code' => 'scanner.inicio',
             'label' => 'Inicio',
@@ -65,4 +63,51 @@ class ScannerMeControllerTest extends TestCase
             ->assertJsonCount(2, 'data.tenant.menues')
             ->assertJsonMissing(['code' => $foreign->code]);
     }
+
+    public function test_it_rejects_an_adminapp_user_even_with_scan_permission(): void
+    {
+        $adminAppRole = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $adminAppRole->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        $adminApp = User::factory()->create([
+            'rol_codigo' => $adminAppRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        Sanctum::actingAs($adminApp);
+
+        $this->getJson('/api/v1/scanner/me')->assertForbidden();
+    }
+
+    private function createTenant(): Tenant
+    {
+        $logo = Attachment::query()->create([
+            'key' => (string) Str::uuid(),
+            'path' => 'tests/scanner-me-logo.png',
+            'filename' => 'scanner-me-logo.png',
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => 1,
+        ]);
+
+        return Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $logo->id,
+            'footer_logo_id' => $logo->id,
+        ]);
+    }
 }