fix: allow project admins to delete projects (KAN-64)

2026-09-30 11:20:09 +02:00
parent ce36060ba1
commit 78e321f665
5 changed files with 91 additions and 7 deletions
@@ -817,6 +817,75 @@ class ProjectControllerTest extends TestCase
        ]);
    }

+    public function test_project_admins_can_delete_their_own_projects_and_reuse_the_key(): void
+    {
+        $user = User::factory()->create();
+        $this->syncGlobalPermissions($user, ['create']);
+
+        $this->actingAs($user)
+            ->post(route('projects.store'), [
+                'creation_mode' => 'scratch',
+                'name' => 'Core Platform',
+                'key' => 'CORE',
+            ])
+            ->assertRedirect();
+
+        $project = Project::query()->where('key', 'CORE')->firstOrFail();
+        $baseTemplateId = $project->project_template_id;
+        $this->assertTrue($user->can('admin-project', $project));
+
+        $this->actingAs($user)
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertRedirect(route('projects.index'));
+
+        $this->assertDatabaseMissing('projects', ['id' => $project->id]);
+        $this->assertDatabaseMissing('project_templates', ['id' => $baseTemplateId]);
+
+        $this->actingAs($user)
+            ->post(route('projects.store'), [
+                'creation_mode' => 'scratch',
+                'name' => 'New Core Platform',
+                'key' => 'CORE',
+            ])
+            ->assertRedirect();
+
+        $this->assertDatabaseHas('projects', [
+            'key' => 'CORE',
+            'name' => 'New Core Platform',
+        ]);
+    }
+
+    public function test_deleting_a_project_preserves_its_published_template_and_linked_projects(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $project = Project::factory()->create(['key' => 'CORE']);
+        $otherProject = Project::factory()->create(['key' => 'OTHER']);
+        $template = ProjectTemplate::factory()->create([
+            'source_project_id' => $project->id,
+            'is_published' => true,
+        ]);
+
+        $project->update(['project_template_id' => $template->id]);
+        $otherProject->update(['project_template_id' => $template->id]);
+
+        $this->actingAs($admin)
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertRedirect(route('projects.index'));
+
+        $this->assertDatabaseHas('project_templates', [
+            'id' => $template->id,
+            'source_project_id' => null,
+        ]);
+        $this->assertDatabaseHas('projects', [
+            'id' => $otherProject->id,
+            'project_template_id' => $template->id,
+        ]);
+    }
+
    /**
     * Ensure project deletion requires the exact project key confirmation.
     */
@@ -841,16 +910,18 @@ class ProjectControllerTest extends TestCase
    }

    /**
-     * Ensure non-admin users cannot delete projects.
+     * Ensure users without project administration cannot delete projects.
     */
-    public function test_non_admin_users_cannot_delete_projects(): void
+    public function test_project_readers_cannot_delete_projects(): void
    {
        $user = User::factory()->create();
+        $otherProject = Project::factory()->create();
        $project = Project::factory()->create([
            'key' => 'CORE',
        ]);

-        $this->syncProjectPermissions($project, $user, ['admin']);
+        $this->syncProjectPermissions($otherProject, $user, ['admin']);
+        $this->syncProjectPermissions($project, $user, ['view']);

        $this->actingAs($user)
            ->delete(route('projects.destroy', $project), [