67 lines
3.4 KiB
PHP
67 lines
3.4 KiB
PHP
<?php
|
|
|
|
use App\Livewire\Admin\Datacenters;
|
|
use App\Livewire\Admin\Provisioning;
|
|
use App\Models\Datacenter;
|
|
use App\Models\User;
|
|
use Illuminate\Auth\Access\AuthorizationException;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Livewire\Livewire;
|
|
|
|
it('grants console access to every operator role but not to customers', function () {
|
|
foreach (['Owner', 'Admin', 'Support', 'Billing', 'Read-only'] as $role) {
|
|
$this->actingAs(operator($role), 'operator')->get(route('admin.overview'))->assertOk();
|
|
}
|
|
// The operator guard itself, not only the default driver, has to be reset:
|
|
// actingAs() caches a user directly on the guard instance it targets, and
|
|
// switching the default guard back to 'web' does not clear it — the last
|
|
// loop iteration's operator would otherwise still answer for
|
|
// Auth::guard('operator') and this customer would inherit their access.
|
|
Auth::guard('operator')->logout();
|
|
$customer = User::factory()->create(); // no role
|
|
$this->actingAs($customer, 'web')->get(route('admin.overview'))->assertForbidden();
|
|
});
|
|
|
|
it('denies console access to a role-less account even if is_admin is set', function () {
|
|
// RBAC is the boundary — the bare legacy flag must never grant access. A
|
|
// User cannot hold a role at all any more, so this is no longer even a
|
|
// question of a role being removed — there is nowhere for one to be.
|
|
$noRole = User::factory()->create(['is_admin' => true]);
|
|
|
|
$this->actingAs($noRole)->get(route('admin.overview'))->assertForbidden();
|
|
});
|
|
|
|
it('denies datacenter management to roles without the capability', function () {
|
|
foreach (['Support', 'Billing', 'Read-only'] as $role) {
|
|
Livewire::actingAs(operator($role), 'operator')->test(Datacenters::class)
|
|
->set('code', 'xy')->set('name', 'X')->call('save')->assertForbidden();
|
|
}
|
|
expect(Datacenter::query()->where('code', 'xy')->exists())->toBeFalse();
|
|
|
|
// Admin has the capability.
|
|
Livewire::actingAs(operator('Admin'), 'operator')->test(Datacenters::class)
|
|
->set('code', 'nbg2')->set('name', 'Nürnberg')->call('save')->assertHasNoErrors();
|
|
expect(Datacenter::query()->where('code', 'nbg2')->exists())->toBeTrue();
|
|
});
|
|
|
|
it('lets Support retry provisioning but not manage datacenters', function () {
|
|
// Support can retry (capability present) — the action runs (no-op on a missing run).
|
|
Livewire::actingAs(operator('Support'), 'operator')->test(Provisioning::class)->call('retry', 'nonexistent-uuid')->assertOk();
|
|
|
|
// ...but cannot manage datacenters.
|
|
Livewire::actingAs(operator('Support'), 'operator')->test(Datacenters::class)->call('toggle', 'x')->assertForbidden();
|
|
});
|
|
|
|
it('replays the operator and account checks on every Livewire action', function () {
|
|
// Livewire re-applies only the middleware on this list when an action posts
|
|
// to /livewire/update, and its defaults cover auth but not ours. Without
|
|
// these, the console page would refuse a non-operator while the console's
|
|
// actions still answered them — the page is not where the actions run.
|
|
$persistent = app(\Livewire\Mechanisms\PersistentMiddleware\PersistentMiddleware::class)
|
|
->getPersistentMiddleware();
|
|
|
|
expect($persistent)->toContain(\App\Http\Middleware\EnsureAdmin::class)
|
|
->and($persistent)->toContain(\App\Http\Middleware\EnsureCustomerActive::class)
|
|
->and($persistent)->toContain(\App\Http\Middleware\RestrictAdminHost::class);
|
|
});
|