Merge pull request 'codex/v0.5-webhook-notification/02-project-notification-settings-ui' (#48) from codex/v0.5-webhook-notification/02-project-notification-settings-ui into main

Reviewed-on: OpenSource/KanbanGit#48
2026-04-24 16:38:43 +00:00
parent c97bf66549 618db86873
commit f5664b6b5a
39 changed files with 2421 additions and 0 deletions
@@ -0,0 +1,65 @@
+<?php
+
+namespace Tests\Feature\Models;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use App\Http\Resources\NotificationActionResource;
+use App\Models\NotificationAction;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+class NotificationActionTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure webhook notification actions encrypt their delivery URL and cast enum fields.
+     */
+    public function test_factory_creates_an_encrypted_webhook_notification_action(): void
+    {
+        $notificationAction = NotificationAction::factory()->webhook()->create([
+            'delivery_url' => 'https://hooks.example.test/kanbangit/core-status',
+        ]);
+
+        $storedDeliveryUrl = DB::table('notification_actions')
+            ->where('id', $notificationAction->id)
+            ->value('delivery_url');
+
+        $this->assertNotSame('https://hooks.example.test/kanbangit/core-status', $storedDeliveryUrl);
+        $this->assertSame('https://hooks.example.test/kanbangit/core-status', $notificationAction->fresh()->delivery_url);
+        $this->assertSame(NotificationEventType::TicketStatusChanged, $notificationAction->fresh()->event_type);
+        $this->assertSame(NotificationChannel::Webhook, $notificationAction->fresh()->channel);
+        $this->assertSame([], $notificationAction->fresh()->channel_configuration);
+    }
+
+    /**
+     * Ensure the Discord factory state creates message-driven Discord actions.
+     */
+    public function test_factory_can_create_discord_notification_actions(): void
+    {
+        $notificationAction = NotificationAction::factory()->discord()->create();
+
+        $this->assertSame(NotificationChannel::Discord, $notificationAction->fresh()->channel);
+        $this->assertNotNull($notificationAction->fresh()->message_template);
+        $this->assertStringStartsWith('https://discord.com/api/webhooks/', $notificationAction->fresh()->delivery_url);
+    }
+
+    /**
+     * Ensure notification actions belong to a project and keep secret URLs out of serialized output.
+     */
+    public function test_notification_actions_belong_to_projects_and_hide_delivery_urls(): void
+    {
+        $notificationAction = NotificationAction::factory()->create();
+        $resource = (new NotificationActionResource($notificationAction->fresh()))
+            ->toArray(Request::create('/'));
+
+        $this->assertTrue($notificationAction->project()->exists());
+        $this->assertTrue($notificationAction->project->is($notificationAction->fresh()->project));
+        $this->assertArrayNotHasKey('delivery_url', $notificationAction->fresh()->toArray());
+        $this->assertArrayNotHasKey('delivery_url', $resource);
+        $this->assertTrue($resource['has_delivery_url']);
+    }
+}
@@ -0,0 +1,66 @@
+<?php
+
+namespace Tests\Feature\Models;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationDeliveryStatus;
+use App\Models\NotificationDeliveryLog;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class NotificationDeliveryLogTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure delivery log factories create related notification actions with consistent casts.
+     */
+    public function test_delivery_log_factory_creates_a_related_notification_action(): void
+    {
+        $deliveryLog = NotificationDeliveryLog::factory()->create();
+
+        $this->assertTrue($deliveryLog->notificationAction()->exists());
+        $this->assertTrue($deliveryLog->notificationAction->is($deliveryLog->fresh()->notificationAction));
+        $this->assertSame(NotificationChannel::Webhook, $deliveryLog->fresh()->channel);
+        $this->assertSame(NotificationDeliveryStatus::Pending, $deliveryLog->fresh()->delivery_status);
+    }
+
+    /**
+     * Ensure delivery logs can represent every supported delivery state.
+     */
+    public function test_delivery_logs_support_pending_succeeded_failed_and_retryable_statuses(): void
+    {
+        NotificationDeliveryLog::factory()->pending()->create();
+        NotificationDeliveryLog::factory()->succeeded()->create();
+        NotificationDeliveryLog::factory()->failed()->create();
+        NotificationDeliveryLog::factory()->retryable()->create();
+
+        $this->assertSame(
+            [
+                NotificationDeliveryStatus::Pending,
+                NotificationDeliveryStatus::Succeeded,
+                NotificationDeliveryStatus::Failed,
+                NotificationDeliveryStatus::Retryable,
+            ],
+            NotificationDeliveryLog::query()->orderBy('id')->get()->pluck('delivery_status')->all(),
+        );
+    }
+
+    /**
+     * Ensure delivery logs cast metadata and attempt information for later delivery tracking.
+     */
+    public function test_delivery_logs_cast_metadata_and_attempt_information(): void
+    {
+        $deliveryLog = NotificationDeliveryLog::factory()->succeeded()->create([
+            'payload_metadata' => [
+                'project_key' => 'CORE',
+                'ticket_key' => 'CORE-27',
+            ],
+        ])->fresh();
+
+        $this->assertSame('CORE-27', $deliveryLog->payload_metadata['ticket_key']);
+        $this->assertSame(204, $deliveryLog->http_status);
+        $this->assertNotNull($deliveryLog->last_attempted_at);
+        $this->assertNotNull($deliveryLog->delivered_at);
+    }
+}
@@ -0,0 +1,144 @@
+<?php
+
+namespace Tests\Feature\Notifications;
+
+use App\Actions\Notifications\DeleteProjectNotificationAction;
+use App\Actions\Notifications\ListProjectNotificationActions;
+use App\Actions\Notifications\StoreProjectNotificationAction;
+use App\Actions\Notifications\UpdateProjectNotificationAction;
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use App\Models\NotificationAction;
+use App\Models\Project;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ProjectNotificationActionManagementTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure notification actions can be created and listed for a single project.
+     */
+    public function test_notification_actions_can_be_created_and_listed_for_a_project(): void
+    {
+        $storeAction = app(StoreProjectNotificationAction::class);
+        $listAction = app(ListProjectNotificationActions::class);
+        $project = Project::factory()->create();
+        $otherProject = Project::factory()->create();
+
+        $storeAction->handle($project, [
+            'name' => 'Discord alerts',
+            'enabled' => false,
+            'event_type' => NotificationEventType::TicketStatusChanged,
+            'channel' => NotificationChannel::Discord,
+            'channel_configuration' => ['mentions' => ['ops']],
+            'message_template' => '$ticket_key changed to $status_to',
+            'delivery_url' => 'https://discord.com/api/webhooks/123456/discord-alerts',
+        ]);
+
+        $webhookAction = $storeAction->handle($project, [
+            'name' => 'Webhook alerts',
+            'enabled' => true,
+            'event_type' => NotificationEventType::TicketStatusChanged,
+            'channel' => NotificationChannel::Webhook,
+            'channel_configuration' => ['source' => 'n8n'],
+            'message_template' => null,
+            'delivery_url' => 'https://hooks.example.test/kanbangit/webhook-alerts',
+        ]);
+
+        NotificationAction::factory()->for($otherProject)->create([
+            'name' => 'Foreign project webhook',
+        ]);
+
+        $listedActions = $listAction->handle($project);
+
+        $this->assertModelExists($webhookAction);
+        $this->assertCount(2, $listedActions);
+        $this->assertSame(['Discord alerts', 'Webhook alerts'], $listedActions->pluck('name')->all());
+        $this->assertSame(['mentions' => ['ops']], $listedActions->first()->channel_configuration);
+    }
+
+    /**
+     * Ensure notification actions can be updated without overwriting their saved secret URL.
+     */
+    public function test_notification_actions_can_be_updated_without_replacing_the_existing_delivery_url(): void
+    {
+        $updateAction = app(UpdateProjectNotificationAction::class);
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->discord()->for($project)->create([
+            'delivery_url' => 'https://discord.com/api/webhooks/123456/original-secret',
+            'message_template' => '$ticket_key moved to $status_to',
+        ]);
+
+        $updatedAction = $updateAction->handle($project, $notificationAction, [
+            'enabled' => false,
+            'message_template' => '$ticket_key moved from $status_from to $status_to',
+            'channel_configuration' => ['mentions' => ['support']],
+            'delivery_url' => '',
+        ]);
+
+        $this->assertFalse($updatedAction->enabled);
+        $this->assertSame(
+            '$ticket_key moved from $status_from to $status_to',
+            $updatedAction->message_template,
+        );
+        $this->assertSame(['mentions' => ['support']], $updatedAction->channel_configuration);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/original-secret',
+            $updatedAction->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure notification actions can replace their delivery URL when a new secret is submitted.
+     */
+    public function test_notification_actions_can_replace_delivery_urls(): void
+    {
+        $updateAction = app(UpdateProjectNotificationAction::class);
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->for($project)->create([
+            'delivery_url' => 'https://hooks.example.test/kanbangit/original-secret',
+        ]);
+
+        $updatedAction = $updateAction->handle($project, $notificationAction, [
+            'delivery_url' => 'https://hooks.example.test/kanbangit/replaced-secret',
+            'name' => 'Primary webhook',
+        ]);
+
+        $this->assertSame('Primary webhook', $updatedAction->name);
+        $this->assertSame('https://hooks.example.test/kanbangit/replaced-secret', $updatedAction->delivery_url);
+    }
+
+    /**
+     * Ensure notification actions can be deleted from their owning project.
+     */
+    public function test_notification_actions_can_be_deleted_from_their_project(): void
+    {
+        $deleteAction = app(DeleteProjectNotificationAction::class);
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->for($project)->create();
+
+        $deleteAction->handle($project, $notificationAction);
+
+        $this->assertModelMissing($notificationAction);
+    }
+
+    /**
+     * Ensure project-scoped actions reject notification actions from other projects.
+     */
+    public function test_project_scoped_management_rejects_foreign_notification_actions(): void
+    {
+        $updateAction = app(UpdateProjectNotificationAction::class);
+        $project = Project::factory()->create();
+        $otherProject = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->for($otherProject)->create();
+
+        $this->expectException(ModelNotFoundException::class);
+
+        $updateAction->handle($project, $notificationAction, [
+            'name' => 'Should not update',
+        ]);
+    }
+}
@@ -0,0 +1,334 @@
+<?php
+
+namespace Tests\Feature\Projects;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use App\Models\NotificationAction;
+use App\Models\Project;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Inertia\Testing\AssertableInertia as Assert;
+use Tests\TestCase;
+
+class ProjectNotificationSettingsControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure project admins can view notification settings with notification action metadata.
+     */
+    public function test_project_admins_can_view_notification_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+        $notificationAction = NotificationAction::factory()
+            ->discord()
+            ->for($project)
+            ->create([
+                'name' => 'Discord alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/Notifications')
+                ->where('project.id', $project->id)
+                ->where('notificationActions.0.name', 'Discord alerts')
+                ->where('notificationActions.0.channel', NotificationChannel::Discord->value)
+                ->where('notificationActions.0.event_type', NotificationEventType::TicketStatusChanged->value)
+                ->where('notificationActions.0.enabled', true)
+                ->where('notificationActions.0.has_delivery_url', true)
+                ->where('notificationActions.0.updated_at', $notificationAction->updated_at?->toISOString())
+                ->where('channelOptions.0.value', NotificationChannel::Discord->value)
+                ->where('eventTypeOptions.0.value', NotificationEventType::TicketStatusChanged->value)
+                ->where('templateVariables.0.value', '$url')
+                ->where('templateVariables.6.value', '$actor_name')
+                ->missing('notificationActions.0.delivery_url'),
+            );
+    }
+
+    /**
+     * Ensure non-admin project users cannot open notification settings.
+     */
+    public function test_non_admin_users_cannot_view_notification_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure project admins can create notification actions from settings.
+     */
+    public function test_project_admins_can_create_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => 'Discord alerts',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://discord.com/api/webhooks/123456/discord-alerts',
+                'message_template' => '$ticket_key moved from $status_from to $status_to by $actor_name: $url',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Discord alerts notification was added.');
+
+        $notificationAction = NotificationAction::query()->firstOrFail();
+
+        $this->assertSame($project->id, $notificationAction->project_id);
+        $this->assertSame(NotificationChannel::Discord, $notificationAction->channel);
+        $this->assertSame(NotificationEventType::TicketStatusChanged, $notificationAction->event_type);
+        $this->assertTrue($notificationAction->enabled);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/discord-alerts',
+            $notificationAction->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure project admins can update notification actions without replacing stored secret URLs.
+     */
+    public function test_project_admins_can_update_notification_actions_without_replacing_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->discord()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://discord.com/api/webhooks/123456/original-secret',
+                'name' => 'Ops alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Ops escalation alerts',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => '1',
+                'delivery_url' => '',
+                'message_template' => '$ticket_key moved to $status_to: $url',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Ops escalation alerts notification was updated.');
+
+        $notificationAction->refresh();
+
+        $this->assertSame('Ops escalation alerts', $notificationAction->name);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/original-secret',
+            $notificationAction->delivery_url,
+        );
+        $this->assertSame('$ticket_key moved to $status_to: $url', $notificationAction->message_template);
+    }
+
+    /**
+     * Ensure project admins can disable and re-enable notification actions.
+     */
+    public function test_project_admins_can_toggle_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'enabled' => true,
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => $notificationAction->name,
+                'event_type' => $notificationAction->event_type->value,
+                'channel' => $notificationAction->channel->value,
+                'enabled' => '0',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertFalse($notificationAction->fresh()->enabled);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => $notificationAction->fresh()->name,
+                'event_type' => $notificationAction->fresh()->event_type->value,
+                'channel' => $notificationAction->fresh()->channel->value,
+                'enabled' => '1',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertTrue($notificationAction->fresh()->enabled);
+    }
+
+    /**
+     * Ensure project admins can replace stored delivery URLs when a new secret is submitted.
+     */
+    public function test_project_admins_can_replace_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->webhook()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://hooks.example.test/kanbangit/original-secret',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Primary webhook',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Webhook->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://hooks.example.test/kanbangit/replaced-secret',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertSame(
+            'https://hooks.example.test/kanbangit/replaced-secret',
+            $notificationAction->fresh()->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure project admins can delete configured notification actions.
+     */
+    public function test_project_admins_can_delete_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'name' => 'Webhook alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->delete(route('projects.settings.notifications.destroy', [$project, $notificationAction]))
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Webhook alerts notification was deleted.');
+
+        $this->assertModelMissing($notificationAction);
+    }
+
+    /**
+     * Ensure validation errors are returned for notification action forms.
+     */
+    public function test_notification_action_validation_errors_are_returned_for_relevant_fields(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->from(route('projects.settings.notifications', $project))
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => '',
+                'event_type' => 'invalid-event',
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => 'definitely-not-a-boolean',
+                'delivery_url' => 'not-a-url',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHasErrors([
+                'name',
+                'event_type',
+                'enabled',
+                'delivery_url',
+                'message_template',
+            ]);
+    }
+
+    /**
+     * Ensure non-admin project users cannot mutate notification actions.
+     */
+    public function test_non_admin_users_cannot_mutate_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->for($project)->create();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => 'Forbidden webhook',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Webhook->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://hooks.example.test/kanbangit/forbidden-secret',
+                'message_template' => '',
+            ])
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Forbidden update',
+                'event_type' => $notificationAction->event_type->value,
+                'channel' => $notificationAction->channel->value,
+                'enabled' => '0',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->delete(route('projects.settings.notifications.destroy', [$project, $notificationAction]))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure notification settings props never render stored secret URLs back to the browser.
+     */
+    public function test_notification_settings_do_not_render_secret_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://hooks.example.test/kanbangit/secret-token',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/Notifications')
+                ->where('notificationActions.0.has_delivery_url', true)
+                ->missing('notificationActions.0.delivery_url'),
+            );
+    }
+}