60 lines
2.8 KiB
PHP
60 lines
2.8 KiB
PHP
<?php
|
|
|
|
use App\Livewire\Admin\Datacenters;
|
|
use App\Livewire\Admin\Provisioning;
|
|
use App\Models\Datacenter;
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Access\AuthorizationException;
|
|
use Livewire\Livewire;
|
|
|
|
it('grants console access to every operator role but not to customers', function () {
|
|
foreach (['Owner', 'Admin', 'Support', 'Billing', 'Read-only'] as $role) {
|
|
$this->actingAs(operator($role))->get(route('admin.overview'))->assertOk();
|
|
}
|
|
$customer = User::factory()->create(); // no role
|
|
$this->actingAs($customer)->get(route('admin.overview'))->assertForbidden();
|
|
});
|
|
|
|
it('denies console access to a role-less account even if is_admin is set', function () {
|
|
// RBAC is the boundary — the bare legacy flag must never grant access, so a
|
|
// revoked operator (roles removed) cannot reach the console.
|
|
$noRole = User::factory()->create(['is_admin' => true]);
|
|
$noRole->syncRoles([]);
|
|
|
|
$this->actingAs($noRole)->get(route('admin.overview'))->assertForbidden();
|
|
});
|
|
|
|
it('denies datacenter management to roles without the capability', function () {
|
|
foreach (['Support', 'Billing', 'Read-only'] as $role) {
|
|
Livewire::actingAs(operator($role))->test(Datacenters::class)
|
|
->set('code', 'xy')->set('name', 'X')->call('save')->assertForbidden();
|
|
}
|
|
expect(Datacenter::query()->where('code', 'xy')->exists())->toBeFalse();
|
|
|
|
// Admin has the capability.
|
|
Livewire::actingAs(operator('Admin'))->test(Datacenters::class)
|
|
->set('code', 'nbg2')->set('name', 'Nürnberg')->call('save')->assertHasNoErrors();
|
|
expect(Datacenter::query()->where('code', 'nbg2')->exists())->toBeTrue();
|
|
});
|
|
|
|
it('lets Support retry provisioning but not manage datacenters', function () {
|
|
// Support can retry (capability present) — the action runs (no-op on a missing run).
|
|
Livewire::actingAs(operator('Support'))->test(Provisioning::class)->call('retry', 'nonexistent-uuid')->assertOk();
|
|
|
|
// ...but cannot manage datacenters.
|
|
Livewire::actingAs(operator('Support'))->test(Datacenters::class)->call('toggle', 'x')->assertForbidden();
|
|
});
|
|
|
|
it('replays the operator and account checks on every Livewire action', function () {
|
|
// Livewire re-applies only the middleware on this list when an action posts
|
|
// to /livewire/update, and its defaults cover auth but not ours. Without
|
|
// these, the console page would refuse a non-operator while the console's
|
|
// actions still answered them — the page is not where the actions run.
|
|
$persistent = app(\Livewire\Mechanisms\PersistentMiddleware\PersistentMiddleware::class)
|
|
->getPersistentMiddleware();
|
|
|
|
expect($persistent)->toContain(\App\Http\Middleware\EnsureAdmin::class)
|
|
->and($persistent)->toContain(\App\Http\Middleware\EnsureCustomerActive::class)
|
|
->and($persistent)->toContain(\App\Http\Middleware\RestrictAdminHost::class);
|
|
});
|