permissions refactoring

2026-04-12 19:21:04 +02:00
parent 51014395a2
commit 9dcdfb981a
64 changed files with 1842 additions and 656 deletions
@@ -2,7 +2,6 @@

 namespace Tests\Feature\Projects;

-use App\Actions\ProjectPermissions\ProjectPermissionService;
 use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
 use App\Models\BoardColumn;
 use App\Models\Project;
@@ -80,9 +79,8 @@ class ProjectControllerTest extends TestCase
            'key' => 'HIDE',
        ]);

-        $projectPermissionService = app(ProjectPermissionService::class);
-        $projectPermissionService->syncUserPermissions($directProject, $user, ['view']);
-        $projectPermissionService->syncTeamPermissions($teamProject, $team, ['view']);
+        $this->syncProjectPermissions($directProject, $user, ['view']);
+        $this->syncProjectPermissions($teamProject, $team, ['view']);

        $this->actingAs($user)
            ->get(route('projects.index'))
@@ -96,11 +94,12 @@ class ProjectControllerTest extends TestCase
    }

    /**
-     * Ensure authenticated users can view the project creation screen.
+     * Ensure users with project create permission can view the project creation screen.
     */
    public function test_authenticated_users_can_view_the_project_creation_screen(): void
    {
        $user = User::factory()->create();
+        $this->syncGlobalPermissions($user, ['project:create']);

        $this->actingAs($user)
            ->get(route('projects.create'))
@@ -111,11 +110,24 @@ class ProjectControllerTest extends TestCase
    }

    /**
-     * Ensure project keys are normalized to uppercase on creation.
+     * Ensure users without project create permission cannot view the project creation screen.
+     */
+    public function test_users_without_project_create_permission_cannot_view_the_project_creation_screen(): void
+    {
+        $user = User::factory()->create();
+
+        $this->actingAs($user)
+            ->get(route('projects.create'))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure users with project create permission can create projects with uppercase keys.
     */
    public function test_authenticated_users_can_create_projects_with_uppercase_keys(): void
    {
        $user = User::factory()->create();
+        $this->syncGlobalPermissions($user, ['project:create']);

        $response = $this->actingAs($user)
            ->post(route('projects.store'), [
@@ -132,13 +144,13 @@ class ProjectControllerTest extends TestCase
            'key' => 'CORE',
        ]);

-        foreach (ProjectPermissionService::permissions() as $permission) {
-            $this->assertDatabaseHas('project_user_permissions', [
-                'project_id' => $project->id,
-                'user_id' => $user->id,
-                'permission' => $permission,
-            ]);
-        }
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $user->id,
+            'assignee_type' => $user->getMorphClass(),
+            'permission' => 'project:admin',
+            'scope_id' => $project->id,
+            'scope_type' => $project->getMorphClass(),
+        ]);

        $this->assertDatabaseHas('ticket_types', [
            'project_id' => $project->id,
@@ -161,6 +173,7 @@ class ProjectControllerTest extends TestCase
    public function test_project_keys_must_be_unique_case_insensitively(): void
    {
        $user = User::factory()->create();
+        $this->syncGlobalPermissions($user, ['project:create']);

        Project::factory()->create([
            'key' => 'AUTH',
@@ -182,6 +195,7 @@ class ProjectControllerTest extends TestCase
    public function test_project_keys_may_not_exceed_five_characters(): void
    {
        $user = User::factory()->create();
+        $this->syncGlobalPermissions($user, ['project:create']);

        $this->actingAs($user)
            ->from(route('projects.create'))
@@ -203,7 +217,7 @@ class ProjectControllerTest extends TestCase
            'name' => 'Core Platform',
            'key' => 'CORE',
        ]);
-        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view']);
+        $this->syncProjectPermissions($project, $user, ['view']);

        $this->actingAs($user)
            ->get(route('projects.show', $project))
@@ -228,7 +242,7 @@ class ProjectControllerTest extends TestCase
        ]);

        $team->users()->attach($user);
-        app(ProjectPermissionService::class)->syncTeamPermissions($project, $team, ['view']);
+        $this->syncProjectPermissions($project, $team, ['view']);

        $this->actingAs($user)
            ->get(route('projects.show', $project))
@@ -253,9 +267,9 @@ class ProjectControllerTest extends TestCase
    }

    /**
-     * Ensure edit access allows opening the project access management page.
+     * Ensure project admin access allows opening the project access management page.
     */
-    public function test_users_with_edit_permission_can_view_project_access_management(): void
+    public function test_users_with_project_admin_permission_can_view_project_access_management(): void
    {
        $user = User::factory()->create();
        $project = Project::factory()->create([
@@ -265,7 +279,7 @@ class ProjectControllerTest extends TestCase
            'name' => 'Platform Team',
        ]);

-        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['edit']);
+        $this->syncProjectPermissions($project, $user, ['admin']);

        $this->actingAs($user)
            ->get(route('projects.access', $project))
@@ -275,7 +289,7 @@ class ProjectControllerTest extends TestCase
                ->where('project.id', $project->id)
                ->has('users', 1)
                ->has('teams', 1)
-                ->where('permissionOptions.0.value', 'create'),
+                ->where('permissionOptions.0.value', 'project:read'),
            );
    }

@@ -309,7 +323,7 @@ class ProjectControllerTest extends TestCase
            'key' => 'CORE',
        ]);

-        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
+        $this->syncProjectPermissions($project, $user, ['admin']);

        $this->actingAs($user)
            ->get(route('projects.settings.general', $project))
@@ -348,7 +362,7 @@ class ProjectControllerTest extends TestCase
            'title' => 'Delete me',
        ]);

-        app(ProjectPermissionService::class)->syncUserPermissions($project, $member, ['view']);
+        $this->syncProjectPermissions($project, $member, ['view']);

        $this->actingAs($admin)
            ->delete(route('projects.destroy', $project), [
@@ -366,10 +380,12 @@ class ProjectControllerTest extends TestCase
        $this->assertDatabaseMissing('tickets', [
            'id' => $ticket->id,
        ]);
-        $this->assertDatabaseMissing('project_user_permissions', [
-            'project_id' => $project->id,
-            'user_id' => $member->id,
-            'permission' => 'view',
+        $this->assertDatabaseMissing('permission_assignments', [
+            'assignee_id' => $member->id,
+            'assignee_type' => $member->getMorphClass(),
+            'permission' => 'project:read',
+            'scope_id' => $project->id,
+            'scope_type' => $project->getMorphClass(),
        ]);
    }

@@ -406,7 +422,7 @@ class ProjectControllerTest extends TestCase
            'key' => 'CORE',
        ]);

-        app(ProjectPermissionService::class)->syncUserPermissions($project, $user, ['view', 'edit', 'delete']);
+        $this->syncProjectPermissions($project, $user, ['admin']);

        $this->actingAs($user)
            ->delete(route('projects.destroy', $project), [
@@ -434,28 +450,32 @@ class ProjectControllerTest extends TestCase

        $this->actingAs($admin)
            ->patch(route('projects.permissions.users.update', [$project, $member]), [
-                'permissions' => ['view', 'edit'],
+                'permissions' => ['project:read', 'project:write'],
            ])
            ->assertRedirect(route('projects.access', $project))
            ->assertSessionHas('status', 'Regular User permissions were updated.');

-        $this->assertDatabaseHas('project_user_permissions', [
-            'project_id' => $project->id,
-            'user_id' => $member->id,
-            'permission' => 'view',
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $member->id,
+            'assignee_type' => $member->getMorphClass(),
+            'permission' => 'project:read',
+            'scope_id' => $project->id,
+            'scope_type' => $project->getMorphClass(),
        ]);

-        $this->assertDatabaseHas('project_user_permissions', [
-            'project_id' => $project->id,
-            'user_id' => $member->id,
-            'permission' => 'edit',
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $member->id,
+            'assignee_type' => $member->getMorphClass(),
+            'permission' => 'project:write',
+            'scope_id' => $project->id,
+            'scope_type' => $project->getMorphClass(),
        ]);
    }

    /**
-     * Ensure users with project edit access can update team permissions.
+     * Ensure users with project admin access can update team permissions.
     */
-    public function test_users_with_edit_permission_can_update_team_permissions(): void
+    public function test_users_with_project_admin_permission_can_update_team_permissions(): void
    {
        $manager = User::factory()->create();
        $team = Team::factory()->create([
@@ -465,25 +485,29 @@ class ProjectControllerTest extends TestCase
            'key' => 'OPS',
        ]);

-        app(ProjectPermissionService::class)->syncUserPermissions($project, $manager, ['edit']);
+        $this->syncProjectPermissions($project, $manager, ['admin']);

        $this->actingAs($manager)
            ->patch(route('projects.permissions.teams.update', [$project, $team]), [
-                'permissions' => ['view', 'create'],
+                'permissions' => ['project:read', 'project:write'],
            ])
            ->assertRedirect(route('projects.access', $project))
            ->assertSessionHas('status', 'Delivery Team permissions were updated.');

-        $this->assertDatabaseHas('project_team_permissions', [
-            'project_id' => $project->id,
-            'team_id' => $team->id,
-            'permission' => 'view',
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $team->id,
+            'assignee_type' => $team->getMorphClass(),
+            'permission' => 'project:read',
+            'scope_id' => $project->id,
+            'scope_type' => $project->getMorphClass(),
        ]);

-        $this->assertDatabaseHas('project_team_permissions', [
-            'project_id' => $project->id,
-            'team_id' => $team->id,
-            'permission' => 'create',
+        $this->assertDatabaseHas('permission_assignments', [
+            'assignee_id' => $team->id,
+            'assignee_type' => $team->getMorphClass(),
+            'permission' => 'project:write',
+            'scope_id' => $project->id,
+            'scope_type' => $project->getMorphClass(),
        ]);
    }
 }