62 lines
2.5 KiB
PHP
62 lines
2.5 KiB
PHP
<?php
|
|
|
|
use App\Models\Operator;
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
|
|
/**
|
|
* R21 — the console and the portal share no identity.
|
|
*
|
|
* Not a style rule. A shared sign-in page showed an operator a registration
|
|
* link with a 404 behind it, and that was not a display fault: it was two
|
|
* different groups of people in one table.
|
|
*/
|
|
|
|
it('leaves no role or permission on the web guard', function () {
|
|
expect(Role::where('guard_name', 'web')->count())->toBe(0)
|
|
->and(Permission::where('guard_name', 'web')->count())->toBe(0);
|
|
});
|
|
|
|
it('gives the User model no way to hold a role', function () {
|
|
expect(method_exists(User::class, 'hasRole'))->toBeFalse()
|
|
->and(method_exists(User::class, 'isOperator'))->toBeFalse();
|
|
});
|
|
|
|
it('cannot authenticate an operator on the web guard', function () {
|
|
$operator = Operator::factory()->role('Owner')->create(['password' => 'operator-passwort']);
|
|
|
|
expect(Auth::guard('web')->attempt([
|
|
'email' => $operator->email, 'password' => 'operator-passwort',
|
|
]))->toBeFalse();
|
|
});
|
|
|
|
it('cannot authenticate a portal user on the operator guard', function () {
|
|
$user = User::factory()->create(['password' => 'kunden-passwort']);
|
|
|
|
expect(Auth::guard('operator')->attempt([
|
|
'email' => $user->email, 'password' => 'kunden-passwort',
|
|
]))->toBeFalse();
|
|
});
|
|
|
|
it('shares no authentication route between the two sides', function () {
|
|
$shared = (new ReflectionClass(App\Http\Middleware\RestrictAdminHost::class))
|
|
->getConstant('SHARED');
|
|
|
|
foreach (['login', 'logout', 'register', 'two-factor-challenge'] as $path) {
|
|
expect($shared)->not->toContain($path);
|
|
}
|
|
});
|
|
|
|
it('has no console-aware login response left, because there is nothing to disambiguate', function () {
|
|
// A third class lived here too: ConsoleAwareTwoFactorLoginResponse, Fortify's
|
|
// TwoFactorLoginResponse-contract sibling of ConsoleAwareLoginResponse, for
|
|
// the two-factor completion path (see the deletion in 8f8a0ad — every one of
|
|
// the three landing-disambiguation classes went together, not just these two).
|
|
// Checking two of the three would let the third quietly come back.
|
|
expect(class_exists(App\Http\Responses\ConsoleAwareLoginResponse::class))->toBeFalse()
|
|
->and(class_exists(App\Http\Responses\ConsoleAwareTwoFactorLoginResponse::class))->toBeFalse()
|
|
->and(class_exists(App\Http\Responses\LandsWhereSignedIn::class))->toBeFalse();
|
|
});
|