130 lines
4.2 KiB
PHP
130 lines
4.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Admin;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Inertia\Testing\AssertableInertia as Assert;
|
|
use Tests\TestCase;
|
|
|
|
class UserManagementControllerTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
/**
|
|
* Ensure admins can view the user management page.
|
|
*/
|
|
public function test_admin_can_view_the_user_management_page(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create([
|
|
'name' => 'Regular User',
|
|
'email' => 'member@example.com',
|
|
]);
|
|
|
|
$this->actingAs($admin)
|
|
->get(route('admin.users.index'))
|
|
->assertOk()
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('admin/users/Index')
|
|
->has('users', 2)
|
|
->where("directPermissions.{$admin->id}.0", 'global:admin')
|
|
->where('permissionOptions.0.value', 'global:admin')
|
|
->where('permissionOptions.1.value', 'project:create'),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Ensure non-admin users cannot view the user management page.
|
|
*/
|
|
public function test_non_admin_cannot_view_the_user_management_page(): void
|
|
{
|
|
$member = User::factory()->create();
|
|
|
|
$this->actingAs($member)
|
|
->get(route('admin.users.index'))
|
|
->assertForbidden();
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can update another user's global permissions.
|
|
*/
|
|
public function test_admin_can_update_a_users_global_permissions(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create([
|
|
'name' => 'Regular User',
|
|
]);
|
|
|
|
$this->actingAs($admin)
|
|
->patch(route('admin.users.update', $member), [
|
|
'permissions' => ['global:admin', 'project:create'],
|
|
])
|
|
->assertRedirect(route('admin.users.index'))
|
|
->assertSessionHas('status', 'Regular User global permissions were updated.');
|
|
|
|
$this->assertDatabaseHas('permission_assignments', [
|
|
'assignee_id' => $member->id,
|
|
'assignee_type' => $member->getMorphClass(),
|
|
'permission' => 'global:admin',
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
|
|
$this->assertDatabaseHas('permission_assignments', [
|
|
'assignee_id' => $member->id,
|
|
'assignee_type' => $member->getMorphClass(),
|
|
'permission' => 'project:create',
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can also clear a user's global permissions.
|
|
*/
|
|
public function test_admin_can_clear_a_users_global_permissions(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create();
|
|
$this->syncGlobalPermissions($member, ['global:admin', 'project:create']);
|
|
|
|
$this->actingAs($admin)
|
|
->patch(route('admin.users.update', $member), [
|
|
'permissions' => [],
|
|
])
|
|
->assertRedirect(route('admin.users.index'))
|
|
->assertSessionHas('status', "{$member->name} global permissions were updated.");
|
|
|
|
$this->assertDatabaseMissing('permission_assignments', [
|
|
'assignee_id' => $member->id,
|
|
'assignee_type' => $member->getMorphClass(),
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure non-admin users cannot update global permissions.
|
|
*/
|
|
public function test_non_admin_cannot_update_a_users_global_permissions(): void
|
|
{
|
|
$member = User::factory()->create();
|
|
$otherUser = User::factory()->create();
|
|
|
|
$this->actingAs($member)
|
|
->patch(route('admin.users.update', $otherUser), [
|
|
'permissions' => ['global:admin'],
|
|
])
|
|
->assertForbidden();
|
|
|
|
$this->assertDatabaseMissing('permission_assignments', [
|
|
'assignee_id' => $otherUser->id,
|
|
'assignee_type' => $otherUser->getMorphClass(),
|
|
'permission' => 'global:admin',
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
}
|
|
}
|