Add project general settings danger zone

2026-04-11 17:42:43 +02:00
parent 50d4d864b5
commit 97b188e942
11 changed files with 470 additions and 3 deletions
@@ -3,8 +3,12 @@
 namespace Tests\Feature\Projects;

 use App\Actions\ProjectPermissions\ProjectPermissionService;
+use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
+use App\Models\BoardColumn;
 use App\Models\Project;
 use App\Models\Team;
+use App\Models\Ticket;
+use App\Models\TicketPriority;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Inertia\Testing\AssertableInertia as Assert;
@@ -275,6 +279,146 @@ class ProjectControllerTest extends TestCase
            );
    }

+    /**
+     * Ensure admins can open the general project settings page.
+     */
+    public function test_admins_can_view_general_project_settings(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        $this->actingAs($admin)
+            ->get(route('projects.settings.general', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/General')
+                ->where('project.id', $project->id)
+                ->where('project.key', 'CORE'),
+            );
+    }
+
+    /**
+     * Ensure non-admin users cannot open general project settings even with project permissions.
+     */
+    public function test_non_admin_users_cannot_view_general_project_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.general', $project))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure admins can delete projects and their dependent project-scoped data.
+     */
+    public function test_admins_can_delete_projects_from_general_settings(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+            'name' => 'Core Platform',
+        ]);
+
+        app(InitializeProjectTicketMetadata::class)->handle($project);
+
+        $priority = TicketPriority::factory()->for($project)->create([
+            'name' => 'Medium',
+            'position' => 1,
+        ]);
+        $boardColumn = BoardColumn::factory()->for($project)->create([
+            'name' => 'In Progress',
+            'position' => 1,
+        ]);
+        $ticket = Ticket::factory()->create([
+            'board_column_id' => $boardColumn->id,
+            'project_id' => $project->id,
+            'sequence_number' => 1,
+            'ticket_key' => 'CORE-1',
+            'ticket_priority_id' => $priority->id,
+            'ticket_type_id' => $project->ticketTypes()->where('system_key', 'task')->firstOrFail()->id,
+            'title' => 'Delete me',
+        ]);
+
+        app(ProjectPermissionService::class)->syncUserPermissions($project, $member, ['view']);
+
+        $this->actingAs($admin)
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertRedirect(route('projects.index'))
+            ->assertSessionHas('status', 'Project Core Platform was deleted.');
+
+        $this->assertDatabaseMissing('projects', [
+            'id' => $project->id,
+        ]);
+        $this->assertDatabaseMissing('board_columns', [
+            'id' => $boardColumn->id,
+        ]);
+        $this->assertDatabaseMissing('tickets', [
+            'id' => $ticket->id,
+        ]);
+        $this->assertDatabaseMissing('project_user_permissions', [
+            'project_id' => $project->id,
+            'user_id' => $member->id,
+            'permission' => 'view',
+        ]);
+    }
+
+    /**
+     * Ensure project deletion requires the exact project key confirmation.
+     */
+    public function test_admins_must_confirm_the_exact_project_key_to_delete_a_project(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        $this->actingAs($admin)
+            ->from(route('projects.settings.general', $project))
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'core',
+            ])
+            ->assertRedirect(route('projects.settings.general', $project))
+            ->assertSessionHasErrors('confirmation_key');
+
+        $this->assertDatabaseHas('projects', [
+            'id' => $project->id,
+        ]);
+    }
+
+    /**
+     * Ensure non-admin users cannot delete projects.
+     */
+    public function test_non_admin_users_cannot_delete_projects(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+
+        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
+
+        $this->actingAs($user)
+            ->delete(route('projects.destroy', $project), [
+                'confirmation_key' => 'CORE',
+            ])
+            ->assertForbidden();
+
+        $this->assertDatabaseHas('projects', [
+            'id' => $project->id,
+        ]);
+    }
+
    /**
     * Ensure admins can update direct project permissions for a user.
     */