54 lines
1.8 KiB
PHP
54 lines
1.8 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
|
|
// operator() helper is defined in RbacTest.
|
|
|
|
it('serves the console on any host when ADMIN_HOSTS is empty (default)', function () {
|
|
config()->set('admin_access.hosts', []);
|
|
|
|
$this->actingAs(operator('Owner'))
|
|
->get('http://app.dev.clupilot.com/admin')
|
|
->assertOk();
|
|
});
|
|
|
|
it('404s the console on a hostname that is not allowed', function () {
|
|
config()->set('admin_access.hosts', ['admin.dev.clupilot.com']);
|
|
|
|
// A PUBLIC hostname must not even hint that a console exists here.
|
|
$this->actingAs(operator('Owner'))
|
|
->get('http://app.dev.clupilot.com/admin')
|
|
->assertNotFound();
|
|
|
|
$this->actingAs(operator('Owner'))
|
|
->get('http://www.dev.clupilot.com/admin/hosts')
|
|
->assertNotFound();
|
|
});
|
|
|
|
it('serves the console on an allowed hostname', function () {
|
|
config()->set('admin_access.hosts', ['admin.dev.clupilot.com', '10.10.90.185']);
|
|
|
|
$this->actingAs(operator('Owner'))
|
|
->get('http://admin.dev.clupilot.com/admin')
|
|
->assertOk();
|
|
|
|
$this->actingAs(operator('Owner'))
|
|
->get('http://10.10.90.185/admin')
|
|
->assertOk();
|
|
});
|
|
|
|
it('404s before revealing a login redirect to guests on a public host', function () {
|
|
config()->set('admin_access.hosts', ['admin.dev.clupilot.com']);
|
|
|
|
// Not a redirect to /login — that would confirm the console's existence.
|
|
$this->get('http://www.dev.clupilot.com/admin')->assertNotFound();
|
|
});
|
|
|
|
it('keeps the customer portal reachable on public hosts', function () {
|
|
config()->set('admin_access.hosts', ['admin.dev.clupilot.com']);
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user)->get('http://app.dev.clupilot.com/dashboard')->assertOk();
|
|
$this->get('http://www.dev.clupilot.com/')->assertOk();
|
|
});
|