Implement admin and user management foundation

2026-03-25 00:38:30 +01:00
parent 9d90bde323
commit aeee3d2640
17 changed files with 505 additions and 25 deletions
@@ -0,0 +1,87 @@
+<?php
+
+namespace Tests\Feature\Admin;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Inertia\Testing\AssertableInertia as Assert;
+use Tests\TestCase;
+
+class UserManagementControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure admins can view the user management page.
+     */
+    public function test_admin_can_view_the_user_management_page(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create([
+            'name' => 'Regular User',
+            'email' => 'member@example.com',
+        ]);
+
+        $this->actingAs($admin)
+            ->get(route('admin.users.index'))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('admin/users/Index')
+                ->where('users.0.email', $admin->email)
+                ->where('users.1.email', $member->email)
+                ->where('users.0.is_admin', true)
+                ->where('users.1.is_admin', false),
+            );
+    }
+
+    /**
+     * Ensure non-admin users cannot view the user management page.
+     */
+    public function test_non_admin_cannot_view_the_user_management_page(): void
+    {
+        $member = User::factory()->create();
+
+        $this->actingAs($member)
+            ->get(route('admin.users.index'))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure admins can update another user's admin access.
+     */
+    public function test_admin_can_update_a_users_admin_access(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create([
+            'name' => 'Regular User',
+        ]);
+
+        $this->actingAs($admin)
+            ->patch(route('admin.users.update', $member), [
+                'is_admin' => true,
+            ])
+            ->assertRedirect(route('admin.users.index'))
+            ->assertSessionHas('status', 'Regular User now has admin access.');
+
+        $this->assertTrue($member->refresh()->is_admin);
+    }
+
+    /**
+     * Ensure non-admin users cannot update admin access.
+     */
+    public function test_non_admin_cannot_update_a_users_admin_access(): void
+    {
+        $member = User::factory()->create();
+        $otherUser = User::factory()->create([
+            'is_admin' => false,
+        ]);
+
+        $this->actingAs($member)
+            ->patch(route('admin.users.update', $otherUser), [
+                'is_admin' => true,
+            ])
+            ->assertForbidden();
+
+        $this->assertFalse($otherUser->refresh()->is_admin);
+    }
+}