265 lines
8.8 KiB
PHP
265 lines
8.8 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Admin;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Inertia\Testing\AssertableInertia as Assert;
|
|
use Tests\TestCase;
|
|
|
|
class UserManagementControllerTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
/**
|
|
* Ensure admins can view the user management page.
|
|
*/
|
|
public function test_admin_can_view_the_user_management_page(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create([
|
|
'name' => 'Regular User',
|
|
'email' => 'member@example.com',
|
|
]);
|
|
|
|
$this->actingAs($admin)
|
|
->get(route('admin.users.index'))
|
|
->assertOk()
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('admin/users/Index')
|
|
->has('users', 2)
|
|
->where("directPermissions.{$admin->id}.0", 'global:admin')
|
|
->where('permissionOptions.0.value', 'global:admin')
|
|
->where('permissionOptions.1.value', 'project:create'),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Ensure non-admin users cannot view the user management page.
|
|
*/
|
|
public function test_non_admin_cannot_view_the_user_management_page(): void
|
|
{
|
|
$member = User::factory()->create();
|
|
|
|
$this->actingAs($member)
|
|
->get(route('admin.users.index'))
|
|
->assertForbidden();
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can view the create user page.
|
|
*/
|
|
public function test_admin_can_view_the_create_user_page(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
|
|
$this->actingAs($admin)
|
|
->get(route('admin.users.create'))
|
|
->assertOk()
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('admin/users/Create'),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can view the edit user page.
|
|
*/
|
|
public function test_admin_can_view_the_edit_user_page(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create();
|
|
|
|
$this->actingAs($admin)
|
|
->get(route('admin.users.edit', $member))
|
|
->assertOk()
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('admin/users/Edit')
|
|
->where('user.id', $member->id)
|
|
->where('user.email', $member->email),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can create managed users.
|
|
*/
|
|
public function test_admin_can_create_a_user_that_must_change_password_on_next_login(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
|
|
$this->actingAs($admin)
|
|
->post(route('admin.users.store'), [
|
|
'name' => 'New Member',
|
|
'email' => 'new-member@example.com',
|
|
'password' => 'temporary-password',
|
|
'password_confirmation' => 'temporary-password',
|
|
'must_change_password_on_next_login' => true,
|
|
])
|
|
->assertRedirect(route('admin.users.index'))
|
|
->assertSessionHas('status', 'User was created.');
|
|
|
|
$this->assertDatabaseHas('users', [
|
|
'name' => 'New Member',
|
|
'email' => 'new-member@example.com',
|
|
'must_change_password_on_next_login' => true,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can update another user's global permissions.
|
|
*/
|
|
public function test_admin_can_update_a_users_global_permissions(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create([
|
|
'name' => 'Regular User',
|
|
]);
|
|
|
|
$this->actingAs($admin)
|
|
->patch(route('admin.users.update', $member), [
|
|
'permissions' => ['global:admin', 'project:create'],
|
|
])
|
|
->assertRedirect(route('admin.users.index'))
|
|
->assertSessionHas('status', 'Regular User global permissions were updated.');
|
|
|
|
$this->assertDatabaseHas('permission_assignments', [
|
|
'assignee_id' => $member->id,
|
|
'assignee_type' => $member->getMorphClass(),
|
|
'permission' => 'global:admin',
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
|
|
$this->assertDatabaseHas('permission_assignments', [
|
|
'assignee_id' => $member->id,
|
|
'assignee_type' => $member->getMorphClass(),
|
|
'permission' => 'project:create',
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can update managed users, including password and forced password changes.
|
|
*/
|
|
public function test_admin_can_update_a_managed_user(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create([
|
|
'name' => 'Regular User',
|
|
'email' => 'member@example.com',
|
|
'must_change_password_on_next_login' => false,
|
|
]);
|
|
|
|
$this->actingAs($admin)
|
|
->patch(route('admin.users.save', $member), [
|
|
'name' => 'Updated User',
|
|
'email' => 'updated-user@example.com',
|
|
'password' => 'fresh-password',
|
|
'password_confirmation' => 'fresh-password',
|
|
'must_change_password_on_next_login' => true,
|
|
])
|
|
->assertRedirect(route('admin.users.index'))
|
|
->assertSessionHas('status', 'Updated User was updated.');
|
|
|
|
$member->refresh();
|
|
|
|
$this->assertSame('Updated User', $member->name);
|
|
$this->assertSame('updated-user@example.com', $member->email);
|
|
$this->assertTrue($member->must_change_password_on_next_login);
|
|
$this->assertTrue(Hash::check('fresh-password', $member->password));
|
|
}
|
|
|
|
/**
|
|
* Ensure admins can also clear a user's global permissions.
|
|
*/
|
|
public function test_admin_can_clear_a_users_global_permissions(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$member = User::factory()->create();
|
|
$this->syncGlobalPermissions($member, ['global:admin', 'project:create']);
|
|
|
|
$this->actingAs($admin)
|
|
->patch(route('admin.users.update', $member), [
|
|
'permissions' => [],
|
|
])
|
|
->assertRedirect(route('admin.users.index'))
|
|
->assertSessionHas('status', "{$member->name} global permissions were updated.");
|
|
|
|
$this->assertDatabaseMissing('permission_assignments', [
|
|
'assignee_id' => $member->id,
|
|
'assignee_type' => $member->getMorphClass(),
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure non-admin users cannot update global permissions.
|
|
*/
|
|
public function test_non_admin_cannot_update_a_users_global_permissions(): void
|
|
{
|
|
$member = User::factory()->create();
|
|
$otherUser = User::factory()->create();
|
|
|
|
$this->actingAs($member)
|
|
->patch(route('admin.users.update', $otherUser), [
|
|
'permissions' => ['global:admin'],
|
|
])
|
|
->assertForbidden();
|
|
|
|
$this->assertDatabaseMissing('permission_assignments', [
|
|
'assignee_id' => $otherUser->id,
|
|
'assignee_type' => $otherUser->getMorphClass(),
|
|
'permission' => 'global:admin',
|
|
'scope_id' => null,
|
|
'scope_type' => null,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure non-admin users cannot create managed users.
|
|
*/
|
|
public function test_non_admin_cannot_create_a_user(): void
|
|
{
|
|
$member = User::factory()->create();
|
|
|
|
$this->actingAs($member)
|
|
->post(route('admin.users.store'), [
|
|
'name' => 'Blocked User',
|
|
'email' => 'blocked-user@example.com',
|
|
'password' => 'temporary-password',
|
|
'password_confirmation' => 'temporary-password',
|
|
'must_change_password_on_next_login' => true,
|
|
])
|
|
->assertForbidden();
|
|
|
|
$this->assertDatabaseMissing('users', [
|
|
'email' => 'blocked-user@example.com',
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Ensure non-admin users cannot edit managed users.
|
|
*/
|
|
public function test_non_admin_cannot_edit_a_user(): void
|
|
{
|
|
$member = User::factory()->create();
|
|
$otherUser = User::factory()->create();
|
|
|
|
$this->actingAs($member)
|
|
->patch(route('admin.users.save', $otherUser), [
|
|
'name' => 'Blocked User',
|
|
'email' => 'blocked-user@example.com',
|
|
'password' => 'fresh-password',
|
|
'password_confirmation' => 'fresh-password',
|
|
'must_change_password_on_next_login' => true,
|
|
])
|
|
->assertForbidden();
|
|
|
|
$this->assertDatabaseMissing('users', [
|
|
'email' => 'blocked-user@example.com',
|
|
]);
|
|
}
|
|
}
|