Implement project memberships teams and permission model
This commit is contained in:
@@ -2,7 +2,9 @@
|
||||
|
||||
namespace Tests\Feature\Projects;
|
||||
|
||||
use App\Actions\ProjectPermissions\ProjectPermissionService;
|
||||
use App\Models\Project;
|
||||
use App\Models\Team;
|
||||
use App\Models\User;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Inertia\Testing\AssertableInertia as Assert;
|
||||
@@ -29,7 +31,7 @@ class ProjectControllerTest extends TestCase
|
||||
*/
|
||||
public function test_authenticated_users_can_view_the_projects_index(): void
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$user = User::factory()->admin()->create();
|
||||
$firstProject = Project::factory()->create([
|
||||
'name' => 'Core Platform',
|
||||
'key' => 'CORE',
|
||||
@@ -50,6 +52,45 @@ class ProjectControllerTest extends TestCase
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure non-admin users only see projects they can access directly or through teams.
|
||||
*/
|
||||
public function test_users_only_see_accessible_projects_on_the_index(): void
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$team = Team::factory()->create([
|
||||
'name' => 'Platform Team',
|
||||
]);
|
||||
$team->users()->attach($user);
|
||||
|
||||
$directProject = Project::factory()->create([
|
||||
'name' => 'Direct Access',
|
||||
'key' => 'DIR',
|
||||
]);
|
||||
$teamProject = Project::factory()->create([
|
||||
'name' => 'Team Access',
|
||||
'key' => 'TEAM',
|
||||
]);
|
||||
Project::factory()->create([
|
||||
'name' => 'Hidden Project',
|
||||
'key' => 'HIDE',
|
||||
]);
|
||||
|
||||
$projectPermissionService = app(ProjectPermissionService::class);
|
||||
$projectPermissionService->syncUserPermissions($directProject, $user, ['view']);
|
||||
$projectPermissionService->syncTeamPermissions($teamProject, $team, ['view']);
|
||||
|
||||
$this->actingAs($user)
|
||||
->get(route('projects.index'))
|
||||
->assertOk()
|
||||
->assertInertia(fn (Assert $page) => $page
|
||||
->component('projects/Index')
|
||||
->has('projects', 2)
|
||||
->where('projects.0.id', $teamProject->id)
|
||||
->where('projects.1.id', $directProject->id),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure authenticated users can view the project creation screen.
|
||||
*/
|
||||
@@ -86,6 +127,14 @@ class ProjectControllerTest extends TestCase
|
||||
'name' => 'Kanban Foundation',
|
||||
'key' => 'CORE',
|
||||
]);
|
||||
|
||||
foreach (ProjectPermissionService::permissions() as $permission) {
|
||||
$this->assertDatabaseHas('project_user_permissions', [
|
||||
'project_id' => $project->id,
|
||||
'user_id' => $user->id,
|
||||
'permission' => $permission,
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -136,14 +185,147 @@ class ProjectControllerTest extends TestCase
|
||||
'name' => 'Core Platform',
|
||||
'key' => 'CORE',
|
||||
]);
|
||||
app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view']);
|
||||
|
||||
$this->actingAs($user)
|
||||
->get(route('projects.show', $project))
|
||||
->assertOk()
|
||||
->assertInertia(fn (Assert $page) => $page
|
||||
->component('projects/Show')
|
||||
->where('canManageAccess', false)
|
||||
->where('project.id', $project->id)
|
||||
->where('project.key', 'CORE'),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure team-inherited permissions allow users to open a project.
|
||||
*/
|
||||
public function test_team_permissions_allow_users_to_view_a_project(): void
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$team = Team::factory()->create();
|
||||
$project = Project::factory()->create([
|
||||
'key' => 'TEAM',
|
||||
]);
|
||||
|
||||
$team->users()->attach($user);
|
||||
app(ProjectPermissionService::class)->syncTeamPermissions($project, $team, ['view']);
|
||||
|
||||
$this->actingAs($user)
|
||||
->get(route('projects.show', $project))
|
||||
->assertOk()
|
||||
->assertInertia(fn (Assert $page) => $page
|
||||
->component('projects/Show')
|
||||
->where('project.id', $project->id),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure users without direct or inherited access are forbidden.
|
||||
*/
|
||||
public function test_users_without_permission_cannot_view_a_project(): void
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$project = Project::factory()->create();
|
||||
|
||||
$this->actingAs($user)
|
||||
->get(route('projects.show', $project))
|
||||
->assertForbidden();
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure edit access allows opening the project access management page.
|
||||
*/
|
||||
public function test_users_with_edit_permission_can_view_project_access_management(): void
|
||||
{
|
||||
$user = User::factory()->create();
|
||||
$project = Project::factory()->create([
|
||||
'key' => 'CORE',
|
||||
]);
|
||||
$team = Team::factory()->create([
|
||||
'name' => 'Platform Team',
|
||||
]);
|
||||
|
||||
app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['edit']);
|
||||
|
||||
$this->actingAs($user)
|
||||
->get(route('projects.access', $project))
|
||||
->assertOk()
|
||||
->assertInertia(fn (Assert $page) => $page
|
||||
->component('projects/Access')
|
||||
->where('project.id', $project->id)
|
||||
->has('users', 1)
|
||||
->has('teams', 1)
|
||||
->where('permissionOptions.0.value', 'create'),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure admins can update direct project permissions for a user.
|
||||
*/
|
||||
public function test_admins_can_update_direct_project_permissions(): void
|
||||
{
|
||||
$admin = User::factory()->admin()->create();
|
||||
$member = User::factory()->create([
|
||||
'name' => 'Regular User',
|
||||
]);
|
||||
$project = Project::factory()->create([
|
||||
'key' => 'AUTH',
|
||||
]);
|
||||
|
||||
$this->actingAs($admin)
|
||||
->patch(route('projects.permissions.users.update', [$project, $member]), [
|
||||
'permissions' => ['view', 'edit'],
|
||||
])
|
||||
->assertRedirect(route('projects.access', $project))
|
||||
->assertSessionHas('status', 'Regular User permissions were updated.');
|
||||
|
||||
$this->assertDatabaseHas('project_user_permissions', [
|
||||
'project_id' => $project->id,
|
||||
'user_id' => $member->id,
|
||||
'permission' => 'view',
|
||||
]);
|
||||
|
||||
$this->assertDatabaseHas('project_user_permissions', [
|
||||
'project_id' => $project->id,
|
||||
'user_id' => $member->id,
|
||||
'permission' => 'edit',
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure users with project edit access can update team permissions.
|
||||
*/
|
||||
public function test_users_with_edit_permission_can_update_team_permissions(): void
|
||||
{
|
||||
$manager = User::factory()->create();
|
||||
$team = Team::factory()->create([
|
||||
'name' => 'Delivery Team',
|
||||
]);
|
||||
$project = Project::factory()->create([
|
||||
'key' => 'OPS',
|
||||
]);
|
||||
|
||||
app(ProjectPermissionService::class)->syncUserPermissions($project, $manager, ['edit']);
|
||||
|
||||
$this->actingAs($manager)
|
||||
->patch(route('projects.permissions.teams.update', [$project, $team]), [
|
||||
'permissions' => ['view', 'create'],
|
||||
])
|
||||
->assertRedirect(route('projects.access', $project))
|
||||
->assertSessionHas('status', 'Delivery Team permissions were updated.');
|
||||
|
||||
$this->assertDatabaseHas('project_team_permissions', [
|
||||
'project_id' => $project->id,
|
||||
'team_id' => $team->id,
|
||||
'permission' => 'view',
|
||||
]);
|
||||
|
||||
$this->assertDatabaseHas('project_team_permissions', [
|
||||
'project_id' => $project->id,
|
||||
'team_id' => $team->id,
|
||||
'permission' => 'create',
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user