permissions refactoring

tests/Feature/Models/PermissionAssignmentTest.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace Tests\Feature\Models;
+
+use App\Models\PermissionAssignment;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class PermissionAssignmentTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure the permission assignment factory creates a user-to-project assignment.
+     */
+    public function test_permission_assignment_factory_creates_a_project_assignment(): void
+    {
+        $assignment = PermissionAssignment::factory()->create();
+
+        $this->assertInstanceOf(User::class, $assignment->assignee);
+        $this->assertInstanceOf(Project::class, $assignment->scope);
+        $this->assertSame('project:read', $assignment->permission->value);
+    }
+
+    /**
+     * Ensure deleting users, teams, and projects removes related permission assignments.
+     */
+    public function test_related_permission_assignments_are_removed_when_parent_models_are_deleted(): void
+    {
+        $user = User::factory()->create();
+        $team = Team::factory()->create();
+        $project = Project::factory()->create();
+
+        $userAssignment = PermissionAssignment::factory()
+            ->forAssignee($user)
+            ->globalAdmin()
+            ->create();
+        $teamAssignment = PermissionAssignment::factory()
+            ->forAssignee($team)
+            ->forScope($project)
+            ->projectWrite()
+            ->create();
+        $teamScopeAssignment = PermissionAssignment::factory()
+            ->forAssignee($user)
+            ->forScope($team)
+            ->teamManage()
+            ->create();
+
+        $user->delete();
+        $project->delete();
+        $team->delete();
+
+        $this->assertDatabaseMissing('permission_assignments', [
+            'id' => $userAssignment->id,
+        ]);
+        $this->assertDatabaseMissing('permission_assignments', [
+            'id' => $teamAssignment->id,
+        ]);
+        $this->assertDatabaseMissing('permission_assignments', [
+            'id' => $teamScopeAssignment->id,
+        ]);
+    }
+}

tests/Feature/Models/TeamTest.php

@@ -66,20 +66,24 @@ class TeamTest extends TestCase
             ProjectAccessSeeder::class,
         ]);
 
-        $admin = User::query()->where('email', 'admin@kanbangit.test')->firstOrFail();
         $coreProject = Project::query()->where('key', 'CORE')->firstOrFail();
         $platformTeam = Team::query()->where('name', 'Platform Team')->firstOrFail();
+        $testUser = User::query()->where('email', 'test@example.com')->firstOrFail();
 
-        $this->assertDatabaseHas('project_user_permissions', [
-            'project_id' => $coreProject->id,
-            'user_id' => $admin->id,
-            'permission' => 'view',
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $platformTeam->id,
+            'assignee_type' => $platformTeam->getMorphClass(),
+            'permission' => 'project:write',
+            'scope_id' => $coreProject->id,
+            'scope_type' => $coreProject->getMorphClass(),
         ]);
 
-        $this->assertDatabaseHas('project_team_permissions', [
-            'project_id' => $coreProject->id,
-            'team_id' => $platformTeam->id,
-            'permission' => 'edit',
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $testUser->id,
+            'assignee_type' => $testUser->getMorphClass(),
+            'permission' => 'team:manage',
+            'scope_id' => $platformTeam->id,
+            'scope_type' => $platformTeam->getMorphClass(),
         ]);
     }
 }

tests/Feature/Models/UserTest.php

@@ -13,13 +13,19 @@ class UserTest extends TestCase
     use RefreshDatabase;
 
     /**
-     * Ensure the default user factory creates non-admin users.
+     * Ensure the default user factory does not grant global admin access.
      */
-    public function test_user_factory_defaults_to_non_admin(): void
+    public function test_user_factory_defaults_to_no_global_admin_access(): void
     {
         $user = User::factory()->create();
 
-        $this->assertFalse($user->is_admin);
+        $this->assertDatabaseMissing('permission_assignments', [
+            'assignee_id' => $user->id,
+            'assignee_type' => $user->getMorphClass(),
+            'permission' => 'global:admin',
+            'scope_id' => null,
+            'scope_type' => null,
+        ]);
     }
 
     /**
@@ -29,7 +35,13 @@ class UserTest extends TestCase
     {
         $user = User::factory()->admin()->create();
 
-        $this->assertTrue($user->is_admin);
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $user->id,
+            'assignee_type' => $user->getMorphClass(),
+            'permission' => 'global:admin',
+            'scope_id' => null,
+            'scope_type' => null,
+        ]);
     }
 
     /**
@@ -39,14 +51,23 @@ class UserTest extends TestCase
     {
         $this->seed(UserSeeder::class);
 
-        $this->assertDatabaseHas('users', [
-            'email' => 'admin@kanbangit.test',
-            'is_admin' => true,
+        $admin = User::query()->where('email', 'admin@kanbangit.test')->firstOrFail();
+        $member = User::query()->where('email', 'test@example.com')->firstOrFail();
+
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $admin->id,
+            'assignee_type' => $admin->getMorphClass(),
+            'permission' => 'global:admin',
+            'scope_id' => null,
+            'scope_type' => null,
         ]);
 
-        $this->assertDatabaseHas('users', [
-            'email' => 'test@example.com',
-            'is_admin' => false,
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $member->id,
+            'assignee_type' => $member->getMorphClass(),
+            'permission' => 'project:create',
+            'scope_id' => null,
+            'scope_type' => null,
         ]);
     }