PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

Implement project memberships teams and permission model

Browse Source
This commit is contained in:
Twyco
2026-03-25 01:10:08 +01:00
parent 7d4b0733b3
commit 840d01f6fc
27 changed files with 1722 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/Models/TeamTest.php
+85
View File
@@ -0,0 +1,85 @@
<?php
namespace Tests\Feature\Models;
use App\Models\Project;
use App\Models\Team;
use App\Models\User;
use Database\Seeders\ProjectAccessSeeder;
use Database\Seeders\ProjectSeeder;
use Database\Seeders\TeamSeeder;
use Database\Seeders\UserSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class TeamTest extends TestCase
{
use RefreshDatabase;
/**
* Ensure the team factory creates a usable default name.
*/
public function test_team_factory_creates_a_name(): void
{
$team = Team::factory()->create();
$this->assertNotSame('', $team->name);
}
/**
* Ensure teams can have many users attached.
*/
public function test_team_users_relationship_can_be_synced(): void
{
$team = Team::factory()->create();
$users = User::factory()->count(2)->create();
$team->users()->sync($users->modelKeys());
$this->assertCount(2, $team->fresh()->users);
}
/**
* Ensure the team seeder creates starter teams with members.
*/
public function test_team_seeder_creates_expected_teams_and_members(): void
{
$this->seed(UserSeeder::class);
$this->seed(TeamSeeder::class);
$platformTeam = Team::query()->where('name', 'Platform Team')->firstOrFail();
$deliveryTeam = Team::query()->where('name', 'Delivery Team')->firstOrFail();
$this->assertGreaterThan(0, $platformTeam->users()->count());
$this->assertGreaterThan(0, $deliveryTeam->users()->count());
}
/**
* Ensure the project access seeder grants direct admin access and team permissions.
*/
public function test_project_access_seeder_creates_permission_assignments(): void
{
$this->seed([
UserSeeder::class,
ProjectSeeder::class,
TeamSeeder::class,
ProjectAccessSeeder::class,
]);
$admin = User::query()->where('email', 'admin@kanbangit.test')->firstOrFail();
$coreProject = Project::query()->where('key', 'CORE')->firstOrFail();
$platformTeam = Team::query()->where('name', 'Platform Team')->firstOrFail();
$this->assertDatabaseHas('project_user_permissions', [
'project_id' => $coreProject->id,
'user_id' => $admin->id,
'permission' => 'view',
]);
$this->assertDatabaseHas('project_team_permissions', [
'project_id' => $coreProject->id,
'team_id' => $platformTeam->id,
'permission' => 'edit',
]);
}
}
tests/Feature/Models/UserTest.php
+14
View File
@@ -2,6 +2,7 @@
namespace Tests\Feature\Models;
use App\Models\Team;
use App\Models\User;
use Database\Seeders\UserSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -48,4 +49,17 @@ class UserTest extends TestCase
'is_admin' => false,
]);
}
/**
* Ensure users can belong to teams.
*/
public function test_users_can_belong_to_teams(): void
{
$user = User::factory()->create();
$teams = Team::factory()->count(2)->create();
$user->teams()->sync($teams->modelKeys());
$this->assertCount(2, $user->fresh()->teams);
}
}
tests/Feature/Projects/ProjectControllerTest.php
+183 -1
View File
@@ -2,7 +2,9 @@
namespace Tests\Feature\Projects;
use App\Actions\ProjectPermissions\ProjectPermissionService;
use App\Models\Project;
use App\Models\Team;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Inertia\Testing\AssertableInertia as Assert;
@@ -29,7 +31,7 @@ class ProjectControllerTest extends TestCase
*/
public function test_authenticated_users_can_view_the_projects_index(): void
{
$user = User::factory()->create();
$user = User::factory()->admin()->create();
$firstProject = Project::factory()->create([
'name' => 'Core Platform',
'key' => 'CORE',
@@ -50,6 +52,45 @@ class ProjectControllerTest extends TestCase
);
}
/**
* Ensure non-admin users only see projects they can access directly or through teams.
*/
public function test_users_only_see_accessible_projects_on_the_index(): void
{
$user = User::factory()->create();
$team = Team::factory()->create([
'name' => 'Platform Team',
]);
$team->users()->attach($user);
$directProject = Project::factory()->create([
'name' => 'Direct Access',
'key' => 'DIR',
]);
$teamProject = Project::factory()->create([
'name' => 'Team Access',
'key' => 'TEAM',
]);
Project::factory()->create([
'name' => 'Hidden Project',
'key' => 'HIDE',
]);
$projectPermissionService = app(ProjectPermissionService::class);
$projectPermissionService->syncUserPermissions($directProject, $user, ['view']);
$projectPermissionService->syncTeamPermissions($teamProject, $team, ['view']);
$this->actingAs($user)
->get(route('projects.index'))
->assertOk()
->assertInertia(fn (Assert $page) => $page
->component('projects/Index')
->has('projects', 2)
->where('projects.0.id', $teamProject->id)
->where('projects.1.id', $directProject->id),
);
}
/**
* Ensure authenticated users can view the project creation screen.
*/
@@ -86,6 +127,14 @@ class ProjectControllerTest extends TestCase
'name' => 'Kanban Foundation',
'key' => 'CORE',
]);
foreach (ProjectPermissionService::permissions() as $permission) {
$this->assertDatabaseHas('project_user_permissions', [
'project_id' => $project->id,
'user_id' => $user->id,
'permission' => $permission,
]);
}
}
/**
@@ -136,14 +185,147 @@ class ProjectControllerTest extends TestCase
'name' => 'Core Platform',
'key' => 'CORE',
]);
app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view']);
$this->actingAs($user)
->get(route('projects.show', $project))
->assertOk()
->assertInertia(fn (Assert $page) => $page
->component('projects/Show')
->where('canManageAccess', false)
->where('project.id', $project->id)
->where('project.key', 'CORE'),
);
}
/**
* Ensure team-inherited permissions allow users to open a project.
*/
public function test_team_permissions_allow_users_to_view_a_project(): void
{
$user = User::factory()->create();
$team = Team::factory()->create();
$project = Project::factory()->create([
'key' => 'TEAM',
]);
$team->users()->attach($user);
app(ProjectPermissionService::class)->syncTeamPermissions($project, $team, ['view']);
$this->actingAs($user)
->get(route('projects.show', $project))
->assertOk()
->assertInertia(fn (Assert $page) => $page
->component('projects/Show')
->where('project.id', $project->id),
);
}
/**
* Ensure users without direct or inherited access are forbidden.
*/
public function test_users_without_permission_cannot_view_a_project(): void
{
$user = User::factory()->create();
$project = Project::factory()->create();
$this->actingAs($user)
->get(route('projects.show', $project))
->assertForbidden();
}
/**
* Ensure edit access allows opening the project access management page.
*/
public function test_users_with_edit_permission_can_view_project_access_management(): void
{
$user = User::factory()->create();
$project = Project::factory()->create([
'key' => 'CORE',
]);
$team = Team::factory()->create([
'name' => 'Platform Team',
]);
app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['edit']);
$this->actingAs($user)
->get(route('projects.access', $project))
->assertOk()
->assertInertia(fn (Assert $page) => $page
->component('projects/Access')
->where('project.id', $project->id)
->has('users', 1)
->has('teams', 1)
->where('permissionOptions.0.value', 'create'),
);
}
/**
* Ensure admins can update direct project permissions for a user.
*/
public function test_admins_can_update_direct_project_permissions(): void
{
$admin = User::factory()->admin()->create();
$member = User::factory()->create([
'name' => 'Regular User',
]);
$project = Project::factory()->create([
'key' => 'AUTH',
]);
$this->actingAs($admin)
->patch(route('projects.permissions.users.update', [$project, $member]), [
'permissions' => ['view', 'edit'],
])
->assertRedirect(route('projects.access', $project))
->assertSessionHas('status', 'Regular User permissions were updated.');
$this->assertDatabaseHas('project_user_permissions', [
'project_id' => $project->id,
'user_id' => $member->id,
'permission' => 'view',
]);
$this->assertDatabaseHas('project_user_permissions', [
'project_id' => $project->id,
'user_id' => $member->id,
'permission' => 'edit',
]);
}
/**
* Ensure users with project edit access can update team permissions.
*/
public function test_users_with_edit_permission_can_update_team_permissions(): void
{
$manager = User::factory()->create();
$team = Team::factory()->create([
'name' => 'Delivery Team',
]);
$project = Project::factory()->create([
'key' => 'OPS',
]);
app(ProjectPermissionService::class)->syncUserPermissions($project, $manager, ['edit']);
$this->actingAs($manager)
->patch(route('projects.permissions.teams.update', [$project, $team]), [
'permissions' => ['view', 'create'],
])
->assertRedirect(route('projects.access', $project))
->assertSessionHas('status', 'Delivery Team permissions were updated.');
$this->assertDatabaseHas('project_team_permissions', [
'project_id' => $project->id,
'team_id' => $team->id,
'permission' => 'view',
]);
$this->assertDatabaseHas('project_team_permissions', [
'project_id' => $project->id,
'team_id' => $team->id,
'permission' => 'create',
]);
}
}
tests/Feature/Teams/TeamControllerTest.php
+130
View File
@@ -0,0 +1,130 @@
<?php
namespace Tests\Feature\Teams;
use App\Models\Team;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Inertia\Testing\AssertableInertia as Assert;
use Tests\TestCase;
class TeamControllerTest extends TestCase
{
use RefreshDatabase;
/**
* Ensure admins can view the teams management page.
*/
public function test_admins_can_view_the_teams_management_page(): void
{
$admin = User::factory()->admin()->create();
$member = User::factory()->create([
'name' => 'Regular User',
'email' => 'member@example.com',
]);
$team = Team::factory()->create([
'name' => 'Platform Team',
]);
$team->users()->attach($member);
$this->actingAs($admin)
->get(route('admin.teams.index'))
->assertOk()
->assertInertia(fn (Assert $page) => $page
->component('teams/Index')
->where('teams.0.name', 'Platform Team')
->where('teams.0.user_ids.0', $member->id)
->where('teams.0.users.0.email', 'member@example.com'),
);
}
/**
* Ensure admins can create teams.
*/
public function test_admins_can_create_teams(): void
{
$admin = User::factory()->admin()->create();
$this->actingAs($admin)
->post(route('admin.teams.store'), [
'name' => 'Delivery Team',
])
->assertRedirect(route('admin.teams.index'))
->assertSessionHas('status', 'Delivery Team was created.');
$this->assertDatabaseHas('teams', [
'name' => 'Delivery Team',
]);
}
/**
* Ensure admins can update team memberships.
*/
public function test_admins_can_update_team_memberships(): void
{
$admin = User::factory()->admin()->create();
$firstMember = User::factory()->create();
$secondMember = User::factory()->create();
$team = Team::factory()->create([
'name' => 'Platform Team',
]);
$this->actingAs($admin)
->patch(route('admin.teams.members.update', $team), [
'user_ids' => [$firstMember->id, $secondMember->id],
])
->assertRedirect(route('admin.teams.index'))
->assertSessionHas('status', 'Platform Team members were updated.');
$this->assertDatabaseHas('team_user', [
'team_id' => $team->id,
'user_id' => $firstMember->id,
]);
$this->assertDatabaseHas('team_user', [
'team_id' => $team->id,
'user_id' => $secondMember->id,
]);
}
/**
* Ensure non-admin users cannot view the teams management page.
*/
public function test_non_admins_cannot_view_the_teams_management_page(): void
{
$user = User::factory()->create();
$this->actingAs($user)
->get(route('admin.teams.index'))
->assertForbidden();
}
/**
* Ensure non-admin users cannot create teams.
*/
public function test_non_admins_cannot_create_teams(): void
{
$user = User::factory()->create();
$this->actingAs($user)
->post(route('admin.teams.store'), [
'name' => 'Platform Team',
])
->assertForbidden();
}
/**
* Ensure non-admin users cannot update team memberships.
*/
public function test_non_admins_cannot_update_team_memberships(): void
{
$user = User::factory()->create();
$team = Team::factory()->create();
$this->actingAs($user)
->patch(route('admin.teams.members.update', $team), [
'user_ids' => [],
])
->assertForbidden();
}
}