Add application API and OpenAPI docs

2026-04-20 13:22:56 +02:00
parent 70d760e3a6
commit 8b25421e7c
80 changed files with 6908 additions and 1277 deletions
@@ -0,0 +1,87 @@
+<?php
+
+namespace Tests\Feature\Api;
+
+use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
+use App\Models\Project;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ProjectApiTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_users_can_list_only_visible_projects(): void
+    {
+        $user = User::factory()->create();
+        $visibleProject = Project::factory()->create([
+            'name' => 'Visible project',
+        ]);
+        Project::factory()->create([
+            'name' => 'Hidden project',
+        ]);
+
+        $this->syncProjectPermissions($visibleProject, $user, ['view']);
+
+        $this->actingAs($user)
+            ->getJson(route('api.projects.index'))
+            ->assertOk()
+            ->assertJsonPath('data.0.name', 'Visible project')
+            ->assertJsonCount(1, 'data');
+    }
+
+    public function test_users_with_project_create_permission_can_create_projects(): void
+    {
+        $user = User::factory()->create();
+        $this->syncGlobalPermissions($user, ['create']);
+
+        $this->actingAs($user)
+            ->postJson(route('api.projects.store'), [
+                'key' => 'api',
+                'name' => 'API Project',
+            ])
+            ->assertCreated()
+            ->assertJsonPath('data.key', 'API')
+            ->assertJsonPath('data.name', 'API Project')
+            ->assertJsonPath('meta.message', 'API Project was created.');
+
+        $project = Project::query()->where('key', 'API')->firstOrFail();
+        $this->assertSame(2, $project->ticketTypes()->count());
+        $this->assertSame(1, $project->ticketStatuses()->count());
+    }
+
+    public function test_project_show_and_delete_enforce_permissions(): void
+    {
+        $user = User::factory()->create();
+        $admin = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        app(InitializeProjectTicketMetadata::class)->handle($project);
+
+        $this->actingAs($user)
+            ->getJson(route('api.projects.show', $project))
+            ->assertForbidden();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->getJson(route('api.projects.show', $project))
+            ->assertOk()
+            ->assertJsonPath('data.key', 'CORE');
+
+        $this->syncGlobalPermissions($admin, ['admin']);
+
+        $this->actingAs($admin)
+            ->deleteJson(route('api.projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertNoContent();
+
+        $this->assertDatabaseMissing('projects', [
+            'id' => $project->id,
+        ]);
+    }
+}