feat(staff): implement event scope for staff management; update controllers, services, and resources to handle event_id; add tests for event-based access
This commit is contained in:
158
tests/Feature/Staff/StaffEventScopeTest.php
Normal file
158
tests/Feature/Staff/StaffEventScopeTest.php
Normal file
@@ -0,0 +1,158 @@
|
||||
<?php
|
||||
|
||||
namespace Tests\Feature\Staff;
|
||||
|
||||
use App\Domains\Core\Auth\Models\User;
|
||||
use App\Domains\Core\Auth\Services\ResetPasswordAttemptService;
|
||||
use Illuminate\Database\Schema\Blueprint;
|
||||
use Illuminate\Support\Facades\DB;
|
||||
use Illuminate\Support\Facades\Schema;
|
||||
use Laravel\Sanctum\Sanctum;
|
||||
use Mockery\MockInterface;
|
||||
use Tests\TestCase;
|
||||
|
||||
class StaffEventScopeTest extends TestCase
|
||||
{
|
||||
protected function setUp(): void
|
||||
{
|
||||
parent::setUp();
|
||||
|
||||
// Exercise HTTP authorization on SQLite without the incompatible legacy migrations.
|
||||
Schema::create('tenants', function (Blueprint $table): void {
|
||||
$table->id();
|
||||
$table->string('codigo');
|
||||
$table->boolean('scanner_category_validation_enabled')->default(false);
|
||||
});
|
||||
Schema::create('roles', function (Blueprint $table): void {
|
||||
$table->id();
|
||||
$table->string('codigo');
|
||||
$table->string('nombre');
|
||||
});
|
||||
Schema::create('users', function (Blueprint $table): void {
|
||||
$table->id();
|
||||
$table->string('rol_codigo');
|
||||
$table->string('tenant_codigo');
|
||||
$table->unsignedBigInteger('event_id')->nullable();
|
||||
$table->string('nombre_apellido');
|
||||
$table->string('dni');
|
||||
$table->string('email');
|
||||
$table->string('active_email')->nullable();
|
||||
$table->string('password')->nullable();
|
||||
$table->timestamps();
|
||||
$table->softDeletes();
|
||||
});
|
||||
Schema::create('categorias', function (Blueprint $table): void {
|
||||
$table->id();
|
||||
$table->string('nombre');
|
||||
$table->string('tenant_code')->nullable();
|
||||
$table->unsignedBigInteger('categoria_id')->nullable();
|
||||
});
|
||||
Schema::create('catalog_items', function (Blueprint $table): void {
|
||||
$table->id();
|
||||
$table->unsignedBigInteger('category_id');
|
||||
$table->string('tenant_code');
|
||||
$table->softDeletes();
|
||||
});
|
||||
Schema::create('category_scanners', function (Blueprint $table): void {
|
||||
$table->unsignedBigInteger('user_id');
|
||||
$table->unsignedBigInteger('categoria_id');
|
||||
$table->timestamps();
|
||||
});
|
||||
Schema::create('personal_access_tokens', function (Blueprint $table): void {
|
||||
$table->id();
|
||||
$table->string('tokenable_type');
|
||||
$table->unsignedBigInteger('tokenable_id');
|
||||
});
|
||||
|
||||
DB::table('tenants')->insert(['codigo' => 'onticket']);
|
||||
foreach (['adminapp', 'scanner'] as $role) {
|
||||
DB::table('roles')->insert(['codigo' => $role, 'nombre' => $role]);
|
||||
foreach ([10, 20, null] as $eventId) {
|
||||
$this->insertUser($role, 'onticket', $eventId);
|
||||
}
|
||||
$this->insertUser($role, 'other', 10);
|
||||
}
|
||||
Sanctum::actingAs(User::query()->findOrFail(1));
|
||||
}
|
||||
|
||||
public function test_lists_and_searches_are_restricted_to_the_authenticated_event(): void
|
||||
{
|
||||
foreach (['administrators' => 1, 'staff' => 5] as $path => $id) {
|
||||
foreach (['', '?search=Persona&event_id=20'] as $query) {
|
||||
$this->getJson("/api/v1/adminapp/tenant/{$path}{$query}")
|
||||
->assertOk()->assertJsonCount(1, 'data')
|
||||
->assertJsonPath('data.0.id', $id)->assertJsonPath('data.0.event_id', 10);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public function test_creation_inherits_the_actor_event_even_if_the_client_supplies_another(): void
|
||||
{
|
||||
$this->mock(ResetPasswordAttemptService::class, function (MockInterface $mock): void {
|
||||
$mock->shouldReceive('createForAdminAppEmail')->once();
|
||||
$mock->shouldReceive('createForScannerEmail')->once();
|
||||
});
|
||||
foreach (['administrators' => 'adminapp', 'staff' => 'scanner'] as $path => $role) {
|
||||
$this->postJson("/api/v1/adminapp/tenant/{$path}", [
|
||||
...$this->payload("new-{$role}@example.com"), 'event_id' => 20,
|
||||
])->assertSuccessful()->assertJsonPath('data.event_id', 10);
|
||||
$this->assertDatabaseHas('users', ['email' => "new-{$role}@example.com", 'event_id' => 10, 'rol_codigo' => $role]);
|
||||
}
|
||||
}
|
||||
|
||||
public function test_foreign_and_unassigned_staff_cannot_be_edited_deleted_or_inspected(): void
|
||||
{
|
||||
foreach (['administrators' => [2, 3, 4], 'staff' => [6, 7, 8]] as $path => $ids) {
|
||||
foreach ($ids as $id) {
|
||||
$this->putJson("/api/v1/adminapp/tenant/{$path}/{$id}", $this->payload("update-{$id}@example.com"))->assertNotFound();
|
||||
$this->deleteJson("/api/v1/adminapp/tenant/{$path}/{$id}")->assertNotFound();
|
||||
$this->assertDatabaseHas('users', ['id' => $id, 'deleted_at' => null, 'email' => "person-{$id}@example.com"]);
|
||||
if ($path === 'staff') {
|
||||
$this->getJson("/api/v1/adminapp/tenant/staff/{$id}/scan-attempts")->assertNotFound();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public function test_own_staff_can_be_edited_and_deleted_without_changing_its_event(): void
|
||||
{
|
||||
$adminId = $this->insertUser('adminapp', 'onticket', 10);
|
||||
foreach (['administrators' => $adminId, 'staff' => 5] as $path => $id) {
|
||||
$this->putJson("/api/v1/adminapp/tenant/{$path}/{$id}", [
|
||||
...$this->payload("updated-{$id}@example.com"), 'event_id' => 20,
|
||||
])->assertOk()->assertJsonPath('data.event_id', 10);
|
||||
$this->deleteJson("/api/v1/adminapp/tenant/{$path}/{$id}")->assertNoContent();
|
||||
$this->assertSoftDeleted('users', ['id' => $id]);
|
||||
}
|
||||
}
|
||||
|
||||
public function test_unscoped_actor_keeps_tenant_lists_and_creates_without_an_event(): void
|
||||
{
|
||||
Sanctum::actingAs(User::query()->findOrFail(3));
|
||||
$this->mock(ResetPasswordAttemptService::class, function (MockInterface $mock): void {
|
||||
$mock->shouldReceive('createForAdminAppEmail')->once();
|
||||
$mock->shouldReceive('createForScannerEmail')->once();
|
||||
});
|
||||
foreach (['administrators', 'staff'] as $path) {
|
||||
$this->getJson("/api/v1/adminapp/tenant/{$path}")->assertOk()->assertJsonCount(3, 'data');
|
||||
$this->postJson("/api/v1/adminapp/tenant/{$path}", $this->payload("legacy-{$path}@example.com"))
|
||||
->assertSuccessful()->assertJsonPath('data.event_id', null);
|
||||
}
|
||||
}
|
||||
|
||||
private function insertUser(string $role, string $tenant, ?int $eventId): int
|
||||
{
|
||||
$id = DB::table('users')->count() + 1;
|
||||
|
||||
return DB::table('users')->insertGetId([
|
||||
'id' => $id, 'rol_codigo' => $role, 'tenant_codigo' => $tenant,
|
||||
'event_id' => $eventId, 'nombre_apellido' => 'Persona', 'dni' => '12345678',
|
||||
'email' => "person-{$id}@example.com", 'active_email' => "person-{$id}@example.com",
|
||||
]);
|
||||
}
|
||||
|
||||
private function payload(string $email): array
|
||||
{
|
||||
return ['nombre_apellido' => 'Persona editada', 'dni' => '87654321', 'email' => $email];
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user