KanbanGit/tests/Feature/Teams/TeamControllerTest.php

<?php

namespace Tests\Feature\Teams;

use App\Models\Team;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Inertia\Testing\AssertableInertia as Assert;
use Tests\TestCase;

class TeamControllerTest extends TestCase
{
    use RefreshDatabase;

    /**
     * Ensure admins can view the teams management page.
     */
    public function test_admins_can_view_the_teams_management_page(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
            'email' => 'member@example.com',
        ]);
        $team = Team::factory()->create([
            'name' => 'Platform Team',
        ]);
        $team->users()->attach($member);

        $this->actingAs($admin)
            ->get(route('teams.index'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('teams/Index')
                ->where('canCreateTeams', true)
                ->where('teams.0.name', 'Platform Team')
                ->where('teams.0.user_ids.0', $member->id)
                ->where('teams.0.users.0.email', 'member@example.com'),
            );
    }

    /**
     * Ensure admins can create teams.
     */
    public function test_admins_can_create_teams(): void
    {
        $admin = User::factory()->admin()->create();

        $this->actingAs($admin)
            ->post(route('teams.store'), [
                'name' => 'Delivery Team',
            ])
            ->assertRedirect(route('teams.index'))
            ->assertSessionHas('status', 'Delivery Team was created.');

        $this->assertDatabaseHas('teams', [
            'name' => 'Delivery Team',
        ]);
    }

    /**
     * Ensure admins can update team memberships.
     */
    public function test_admins_can_update_team_memberships(): void
    {
        $admin = User::factory()->admin()->create();
        $firstMember = User::factory()->create();
        $secondMember = User::factory()->create();
        $team = Team::factory()->create([
            'name' => 'Platform Team',
        ]);

        $this->actingAs($admin)
            ->patch(route('teams.members.update', $team), [
                'user_ids' => [$firstMember->id, $secondMember->id],
            ])
            ->assertRedirect(route('teams.index'))
            ->assertSessionHas('status', 'Platform Team members were updated.');

        $this->assertDatabaseHas('team_user', [
            'team_id' => $team->id,
            'user_id' => $firstMember->id,
        ]);

        $this->assertDatabaseHas('team_user', [
            'team_id' => $team->id,
            'user_id' => $secondMember->id,
        ]);
    }

    /**
     * Ensure admins can view the teams management page.
     */
    public function test_non_admins_with_team_create_permission_can_view_the_teams_management_page(): void
    {
        $createTeamUser = User::factory()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
            'email' => 'member@example.com',
        ]);
        $team = Team::factory()->create([
            'name' => 'Platform Team',
        ]);
        $team->users()->attach($member);

        $this->syncGlobalPermissions($createTeamUser, ['team:create']);

        $this->actingAs($createTeamUser)
            ->get(route('teams.index'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('teams/Index')
                ->where('canCreateTeams', true)
            );
    }

    /**
     * Ensure admins can create teams.
     */
    public function test_non_admins_with_team_create_permission_can_create_teams(): void
    {
        $createTeamUser = User::factory()->create();

        $this->syncGlobalPermissions($createTeamUser, ['team:create']);

        $this->actingAs($createTeamUser)
            ->post(route('teams.store'), [
                'name' => 'Delivery Team',
            ])
            ->assertRedirect(route('teams.index'))
            ->assertSessionHas('status', 'Delivery Team was created.');

        $this->assertDatabaseHas('teams', [
            'name' => 'Delivery Team',
        ]);
    }

    /**
     * Ensure users without team management access cannot view the teams page.
     */
    public function test_non_admins_cannot_view_the_teams_management_page(): void
    {
        $user = User::factory()->create();

        $this->actingAs($user)
            ->get(route('teams.index'))
            ->assertForbidden();
    }

    /**
     * Ensure non-admin users cannot create teams.
     */
    public function test_non_admins_cannot_create_teams(): void
    {
        $user = User::factory()->create();

        $this->actingAs($user)
            ->post(route('teams.store'), [
                'name' => 'Platform Team',
            ])
            ->assertForbidden();
    }

    /**
     * Ensure non-admin users cannot update team memberships.
     */
    public function test_non_admins_cannot_update_team_memberships(): void
    {
        $user = User::factory()->create();
        $team = Team::factory()->create();

        $this->actingAs($user)
            ->patch(route('teams.members.update', $team), [
                'user_ids' => [],
            ])
            ->assertForbidden();
    }

    /**
     * Ensure users with team manage access can view and update their assigned teams.
     */
    public function test_team_managers_can_view_and_update_their_team(): void
    {
        $manager = User::factory()->create();
        $member = User::factory()->create();
        $team = Team::factory()->create([
            'name' => 'Platform Team',
        ]);

        $this->syncTeamPermissions($team, $manager, ['team:manage']);

        $this->actingAs($manager)
            ->get(route('teams.index'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('teams/Index')
                ->where('canCreateTeams', false)
                ->where('teams.0.name', 'Platform Team')
                ->where("teamPermissions.{$team->id}.{$manager->id}.0", 'team:manage'),
            );

        $this->actingAs($manager)
            ->patch(route('teams.permissions.users.update', [$team, $member]), [
                'permissions' => ['team:invite'],
            ])
            ->assertRedirect(route('teams.index'))
            ->assertSessionHas('status', "{$member->name} permissions on {$team->name} were updated.");

        $this->assertDatabaseHas('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'permission' => 'team:invite',
            'scope_id' => $team->id,
            'scope_type' => $team->getMorphClass(),
        ]);
    }

    public function test_team_managers_only_see_their_manageable_teams(): void
    {
        $manager = User::factory()->create();
        $managed = Team::factory()->create();
        $other = Team::factory()->create();
        $other->users()->attach($manager);
        $this->syncTeamPermissions($managed, $manager, ['team:manage']);

        $this->actingAs($manager)->get(route('teams.index'))
            ->assertInertia(fn (Assert $page) => $page
                ->has('teams', 1)
                ->where('teams.0.id', $managed->id)
                ->where('canCreateTeams', false)
            );

        $this->actingAs($manager)->patch(route('teams.members.update', $other), ['user_ids' => []])
            ->assertForbidden();
        $this->actingAs($manager)->patch(route('teams.permissions.users.update', [$other, $manager]), ['permissions' => ['team:admin']])
            ->assertForbidden();
        $this->assertDatabaseHas('team_user', ['team_id' => $other->id, 'user_id' => $manager->id]);
        $this->assertDatabaseMissing('permission_assignments', ['scope_id' => $other->id, 'scope_type' => $other->getMorphClass()]);
    }

    public function test_invalid_team_names_are_rejected(): void
    {
        $admin = User::factory()->admin()->create();
        $team = Team::factory()->create();

        foreach (['', $team->name, str_repeat('a', 256)] as $name) {
            $this->actingAs($admin)->from(route('teams.index'))->post(route('teams.store'), ['name' => $name])
                ->assertRedirect(route('teams.index'))->assertSessionHasErrors('name');
        }
        $this->assertDatabaseCount('teams', 1);
    }

    public function test_invalid_members_preserve_existing_membership(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create();
        $team = Team::factory()->create();
        $team->users()->attach($member);

        foreach ([[$member->id, $member->id], [999999], ['invalid']] as $ids) {
            $this->actingAs($admin)->patch(route('teams.members.update', $team), ['user_ids' => $ids])
                ->assertSessionHasErrors('user_ids.0');
            $this->assertSame([$member->id], $team->users()->pluck('users.id')->all());
        }
    }

    public function test_membership_and_direct_permissions_can_be_cleared_independently(): void
    {
        $manager = User::factory()->create();
        $member = User::factory()->create();
        $team = Team::factory()->create();
        $team->users()->attach($member);
        $this->syncTeamPermissions($team, $manager, ['team:manage']);
        $this->syncTeamPermissions($team, $member, ['team:invite']);

        $this->actingAs($manager)->patch(route('teams.members.update', $team), ['user_ids' => []])
            ->assertRedirect(route('teams.index'))->assertSessionHasNoErrors();
        $this->assertDatabaseMissing('team_user', ['team_id' => $team->id]);
        $this->assertDatabaseHas('permission_assignments', ['assignee_id' => $member->id, 'scope_id' => $team->id, 'permission' => 'team:invite']);

        $team->users()->attach($member);
        $this->actingAs($manager)->patch(route('teams.permissions.users.update', [$team, $member]), ['permissions' => []])
            ->assertRedirect(route('teams.index'))->assertSessionHasNoErrors();
        $this->assertDatabaseHas('team_user', ['team_id' => $team->id, 'user_id' => $member->id]);
        $this->assertDatabaseMissing('permission_assignments', ['assignee_id' => $member->id, 'scope_id' => $team->id, 'scope_type' => $team->getMorphClass()]);
    }

    public function test_invalid_permissions_preserve_existing_assignments(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create();
        $team = Team::factory()->create();
        $this->syncTeamPermissions($team, $member, ['team:invite']);

        foreach ([['global:admin'], ['team:manage', 'team:manage'], ['unknown']] as $permissions) {
            $this->actingAs($admin)->patch(route('teams.permissions.users.update', [$team, $member]), ['permissions' => $permissions])
                ->assertSessionHasErrors('permissions.0');
            $this->assertDatabaseHas('permission_assignments', ['assignee_id' => $member->id, 'scope_id' => $team->id, 'permission' => 'team:invite']);
            $this->assertDatabaseMissing('permission_assignments', ['assignee_id' => $member->id, 'permission' => 'global:admin']);
        }
    }
}