Add project notification settings UI

2026-04-20 22:29:46 +02:00
parent e4762f8e32
commit ee15efe739
17 changed files with 1374 additions and 0 deletions
@@ -0,0 +1,334 @@
+<?php
+
+namespace Tests\Feature\Projects;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use App\Models\NotificationAction;
+use App\Models\Project;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Inertia\Testing\AssertableInertia as Assert;
+use Tests\TestCase;
+
+class ProjectNotificationSettingsControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure project admins can view notification settings with notification action metadata.
+     */
+    public function test_project_admins_can_view_notification_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+        $notificationAction = NotificationAction::factory()
+            ->discord()
+            ->for($project)
+            ->create([
+                'name' => 'Discord alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/Notifications')
+                ->where('project.id', $project->id)
+                ->where('notificationActions.0.name', 'Discord alerts')
+                ->where('notificationActions.0.channel', NotificationChannel::Discord->value)
+                ->where('notificationActions.0.event_type', NotificationEventType::TicketStatusChanged->value)
+                ->where('notificationActions.0.enabled', true)
+                ->where('notificationActions.0.has_delivery_url', true)
+                ->where('notificationActions.0.updated_at', $notificationAction->updated_at?->toISOString())
+                ->where('channelOptions.0.value', NotificationChannel::Discord->value)
+                ->where('eventTypeOptions.0.value', NotificationEventType::TicketStatusChanged->value)
+                ->where('templateVariables.0.value', '$url')
+                ->where('templateVariables.6.value', '$actor_name')
+                ->missing('notificationActions.0.delivery_url'),
+            );
+    }
+
+    /**
+     * Ensure non-admin project users cannot open notification settings.
+     */
+    public function test_non_admin_users_cannot_view_notification_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure project admins can create notification actions from settings.
+     */
+    public function test_project_admins_can_create_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => 'Discord alerts',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://discord.com/api/webhooks/123456/discord-alerts',
+                'message_template' => '$ticket_key moved from $status_from to $status_to by $actor_name: $url',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Discord alerts notification was added.');
+
+        $notificationAction = NotificationAction::query()->firstOrFail();
+
+        $this->assertSame($project->id, $notificationAction->project_id);
+        $this->assertSame(NotificationChannel::Discord, $notificationAction->channel);
+        $this->assertSame(NotificationEventType::TicketStatusChanged, $notificationAction->event_type);
+        $this->assertTrue($notificationAction->enabled);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/discord-alerts',
+            $notificationAction->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure project admins can update notification actions without replacing stored secret URLs.
+     */
+    public function test_project_admins_can_update_notification_actions_without_replacing_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->discord()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://discord.com/api/webhooks/123456/original-secret',
+                'name' => 'Ops alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Ops escalation alerts',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => '1',
+                'delivery_url' => '',
+                'message_template' => '$ticket_key moved to $status_to: $url',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Ops escalation alerts notification was updated.');
+
+        $notificationAction->refresh();
+
+        $this->assertSame('Ops escalation alerts', $notificationAction->name);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/original-secret',
+            $notificationAction->delivery_url,
+        );
+        $this->assertSame('$ticket_key moved to $status_to: $url', $notificationAction->message_template);
+    }
+
+    /**
+     * Ensure project admins can disable and re-enable notification actions.
+     */
+    public function test_project_admins_can_toggle_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'enabled' => true,
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => $notificationAction->name,
+                'event_type' => $notificationAction->event_type->value,
+                'channel' => $notificationAction->channel->value,
+                'enabled' => '0',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertFalse($notificationAction->fresh()->enabled);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => $notificationAction->fresh()->name,
+                'event_type' => $notificationAction->fresh()->event_type->value,
+                'channel' => $notificationAction->fresh()->channel->value,
+                'enabled' => '1',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertTrue($notificationAction->fresh()->enabled);
+    }
+
+    /**
+     * Ensure project admins can replace stored delivery URLs when a new secret is submitted.
+     */
+    public function test_project_admins_can_replace_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->webhook()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://hooks.example.test/kanbangit/original-secret',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Primary webhook',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Webhook->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://hooks.example.test/kanbangit/replaced-secret',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertSame(
+            'https://hooks.example.test/kanbangit/replaced-secret',
+            $notificationAction->fresh()->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure project admins can delete configured notification actions.
+     */
+    public function test_project_admins_can_delete_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'name' => 'Webhook alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->delete(route('projects.settings.notifications.destroy', [$project, $notificationAction]))
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Webhook alerts notification was deleted.');
+
+        $this->assertModelMissing($notificationAction);
+    }
+
+    /**
+     * Ensure validation errors are returned for notification action forms.
+     */
+    public function test_notification_action_validation_errors_are_returned_for_relevant_fields(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->from(route('projects.settings.notifications', $project))
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => '',
+                'event_type' => 'invalid-event',
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => 'definitely-not-a-boolean',
+                'delivery_url' => 'not-a-url',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHasErrors([
+                'name',
+                'event_type',
+                'enabled',
+                'delivery_url',
+                'message_template',
+            ]);
+    }
+
+    /**
+     * Ensure non-admin project users cannot mutate notification actions.
+     */
+    public function test_non_admin_users_cannot_mutate_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->for($project)->create();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => 'Forbidden webhook',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Webhook->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://hooks.example.test/kanbangit/forbidden-secret',
+                'message_template' => '',
+            ])
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Forbidden update',
+                'event_type' => $notificationAction->event_type->value,
+                'channel' => $notificationAction->channel->value,
+                'enabled' => '0',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->delete(route('projects.settings.notifications.destroy', [$project, $notificationAction]))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure notification settings props never render stored secret URLs back to the browser.
+     */
+    public function test_notification_settings_do_not_render_secret_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://hooks.example.test/kanbangit/secret-token',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/Notifications')
+                ->where('notificationActions.0.has_delivery_url', true)
+                ->missing('notificationActions.0.delivery_url'),
+            );
+    }
+}