tbianchini/shopit-back
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): remove role-based logic from scanner authentication and permissions

Browse Source
This commit is contained in:
ncoronel
2026-09-04 15:33:01 -03:00
parent 2feca2bed5
commit a4b5c2eb19
12 changed files with 213 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
tests/Feature/Ticket/ScannerTicketControllerTest.php
View File

@@ -4,6 +4,7 @@ namespace Tests\Feature\Ticket;
use App\Domains\Attachable\Models\Attachment;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\PermissionCode;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Catalog\Models\CatalogItem;
use App\Domains\Catalog\Models\Category;
@@ -300,42 +301,19 @@ class ScannerTicketControllerTest extends TestCase
->assertNotFound();
}
public function test_adminapp_can_read_and_scan_all_tenant_categories_without_assignments(): void
public function test_adminapp_cannot_access_scanner_routes_even_with_scan_permission(): void
{
$this->tenant->update(['scanner_category_validation_enabled' => true]);
$admin = User::factory()->create([
'rol_codigo' => RoleCode::AdminApp->value,
'tenant_codigo' => $this->tenant->codigo,
]);
$this->assertCount(0, $admin->scanCategories);
$otherCategory = Category::query()->create([
'tenant_code' => $this->tenant->codigo, 'nombre' => 'Comidas',
]);
$admin->role()->firstOrFail()->permissions()->attach(PermissionCode::ScanTickets->value);
$ticket = $this->createTicket((string) Str::uuid());
Sanctum::actingAs($admin);
foreach ([$this->category, $otherCategory] as $category) {
$ticket = $this->createTicket((string) Str::uuid(), [], $category);
$this->getJson("/api/v1/scanner/tickets/{$ticket->ticket}")->assertOk();
$this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")
->assertOk()->assertJsonPath('data.scanner_user_id', $admin->id);
$this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")
->assertUnprocessable()->assertJsonValidationErrors('ticket');
}
}
public function test_adminapp_cannot_read_or_scan_another_tenants_ticket(): void
{
$admin = User::factory()->create([
'rol_codigo' => RoleCode::AdminApp->value,
'tenant_codigo' => $this->tenant->codigo,
]);
$foreignTenant = $this->createTenant('foreign');
$foreignCategory = Category::query()->create([
'tenant_code' => $foreignTenant->codigo, 'nombre' => 'Externas',
]);
$ticket = $this->createTicket((string) Str::uuid(), [], $foreignCategory, $foreignTenant);
Sanctum::actingAs($admin);
$this->getJson("/api/v1/scanner/tickets/{$ticket->ticket}")->assertNotFound();
$this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")->assertNotFound();
$this->getJson('/api/v1/scanner/tickets')->assertForbidden();
$this->getJson("/api/v1/scanner/tickets/{$ticket->ticket}")->assertForbidden();
$this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")->assertForbidden();
$this->assertNull($ticket->fresh()->used_at);
}