52 lines
2.1 KiB
PHP
52 lines
2.1 KiB
PHP
<?php
|
|
|
|
use App\Livewire\Admin\Datacenters;
|
|
use App\Livewire\Admin\Provisioning;
|
|
use App\Models\Datacenter;
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Access\AuthorizationException;
|
|
use Livewire\Livewire;
|
|
|
|
function operator(string $role): User
|
|
{
|
|
return User::factory()->operator($role)->create();
|
|
}
|
|
|
|
it('grants console access to every operator role but not to customers', function () {
|
|
foreach (['Owner', 'Admin', 'Support', 'Billing', 'Read-only'] as $role) {
|
|
$this->actingAs(operator($role))->get(route('admin.overview'))->assertOk();
|
|
}
|
|
$customer = User::factory()->create(); // no role
|
|
$this->actingAs($customer)->get(route('admin.overview'))->assertForbidden();
|
|
});
|
|
|
|
it('self-heals a legacy is_admin account with no role into Owner', function () {
|
|
$legacy = User::factory()->create(['is_admin' => true]);
|
|
$legacy->syncRoles([]); // simulate a pre-RBAC admin with no operator role
|
|
|
|
$this->actingAs($legacy)->get(route('admin.overview'))->assertOk();
|
|
|
|
expect($legacy->fresh()->hasRole('Owner'))->toBeTrue();
|
|
});
|
|
|
|
it('denies datacenter management to roles without the capability', function () {
|
|
foreach (['Support', 'Billing', 'Read-only'] as $role) {
|
|
Livewire::actingAs(operator($role))->test(Datacenters::class)
|
|
->set('code', 'xy')->set('name', 'X')->call('save')->assertForbidden();
|
|
}
|
|
expect(Datacenter::query()->where('code', 'xy')->exists())->toBeFalse();
|
|
|
|
// Admin has the capability.
|
|
Livewire::actingAs(operator('Admin'))->test(Datacenters::class)
|
|
->set('code', 'nbg2')->set('name', 'Nürnberg')->call('save')->assertHasNoErrors();
|
|
expect(Datacenter::query()->where('code', 'nbg2')->exists())->toBeTrue();
|
|
});
|
|
|
|
it('lets Support retry provisioning but not manage datacenters', function () {
|
|
// Support can retry (capability present) — the action runs (no-op on a missing run).
|
|
Livewire::actingAs(operator('Support'))->test(Provisioning::class)->call('retry', 'nonexistent-uuid')->assertOk();
|
|
|
|
// ...but cannot manage datacenters.
|
|
Livewire::actingAs(operator('Support'))->test(Datacenters::class)->call('toggle', 'x')->assertForbidden();
|
|
});
|