120 lines
4.4 KiB
PHP
120 lines
4.4 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use App\Support\Settings;
|
|
|
|
it('serves the site normally while it is public', function () {
|
|
Settings::set('site.public', true);
|
|
|
|
$this->get('/')->assertOk();
|
|
$this->get('/login')->assertOk();
|
|
});
|
|
|
|
it('shows outsiders a placeholder while the site is hidden', function () {
|
|
Settings::set('site.public', false);
|
|
|
|
$response = $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])->get('/');
|
|
|
|
// 503, not 200: a 200 invites search engines to index the placeholder as
|
|
// the site's content, and that is much harder to undo than to prevent.
|
|
$response->assertStatus(503)
|
|
->assertSee(__('coming_soon.title'))
|
|
->assertHeader('X-Robots-Tag', 'noindex, nofollow, noarchive')
|
|
->assertHeader('Retry-After', 3600);
|
|
|
|
// The portal is hidden too, not just the marketing page.
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])->get('/login')->assertStatus(503);
|
|
});
|
|
|
|
it('lets the management VPN through', function () {
|
|
Settings::set('site.public', false);
|
|
config()->set('admin_access.trusted_ranges', ['10.66.0.0/24']);
|
|
|
|
$this->withServerVariables(['REMOTE_ADDR' => '10.66.0.4'])->get('/')->assertOk();
|
|
$this->withServerVariables(['REMOTE_ADDR' => '10.66.9.4'])->get('/')->assertStatus(503);
|
|
});
|
|
|
|
it('lets a signed-in operator see the real site from anywhere', function () {
|
|
Settings::set('site.public', false);
|
|
|
|
$this->actingAs(operator('Support'))
|
|
->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->get('/')
|
|
->assertOk();
|
|
|
|
// A customer account is not staff — the portal stays hidden for them.
|
|
$this->actingAs(User::factory()->create())
|
|
->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->get('/')
|
|
->assertStatus(503);
|
|
});
|
|
|
|
it('keeps the console and the webhook reachable while hidden', function () {
|
|
Settings::set('site.public', false);
|
|
|
|
// Otherwise the switch could only ever be flipped once.
|
|
$this->actingAs(operator('Owner'))
|
|
->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->get(route('admin.settings'))
|
|
->assertOk();
|
|
|
|
// Stripe must still be able to deliver a paid order: whatever the webhook
|
|
// makes of an empty body, the gate must not be what answers.
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->post('/webhooks/stripe', [])
|
|
->assertStatus(200);
|
|
});
|
|
|
|
it('tells crawlers to stay away while hidden', function () {
|
|
Settings::set('site.public', false);
|
|
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->get('/robots.txt')
|
|
->assertOk()
|
|
->assertSee('Disallow: /');
|
|
|
|
Settings::set('site.public', true);
|
|
$this->get('/robots.txt')->assertOk()->assertSee('Allow: /');
|
|
});
|
|
|
|
it('flips visibility from the console, and only with the capability', function () {
|
|
Settings::set('site.public', true);
|
|
|
|
Livewire\Livewire::actingAs(operator('Support'))->test(App\Livewire\Admin\Settings::class)
|
|
->call('toggleSiteVisibility')
|
|
->assertForbidden();
|
|
expect(Settings::bool('site.public', true))->toBeTrue();
|
|
|
|
Livewire\Livewire::actingAs(operator('Owner'))->test(App\Livewire\Admin\Settings::class)
|
|
->call('toggleSiteVisibility');
|
|
expect(Settings::bool('site.public', true))->toBeFalse();
|
|
});
|
|
|
|
it('keeps serving when the settings table is unavailable', function () {
|
|
// A deploy that runs new code before migrations, or a database blip: the
|
|
// gate must fall back to "public", not take the whole site down with a 500.
|
|
Illuminate\Support\Facades\Schema::drop('app_settings');
|
|
|
|
$this->get('/')->assertOk();
|
|
});
|
|
|
|
it('does not leave the portal drivable through Livewire while hidden', function () {
|
|
Settings::set('site.public', false);
|
|
|
|
// A customer with a live session must not be able to keep using the portal
|
|
// through the shared Livewire endpoint while it is supposed to be offline.
|
|
$this->actingAs(User::factory()->create())
|
|
->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->post('/livewire/update', [])
|
|
->assertStatus(503);
|
|
|
|
// Operators keep working — that is what the console needs. Whatever
|
|
// Livewire makes of an empty payload, the gate must not be what answers.
|
|
$status = $this->actingAs(operator('Owner'))
|
|
->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
|
|
->post('/livewire/update', [])
|
|
->getStatusCode();
|
|
|
|
expect($status)->not->toBe(503);
|
|
});
|