取消
diff --git a/tests/Feature/Business/AgreementSigningPermissionsTest.php b/tests/Feature/Business/AgreementSigningPermissionsTest.php
new file mode 100644
index 00000000..20d2752b
--- /dev/null
+++ b/tests/Feature/Business/AgreementSigningPermissionsTest.php
@@ -0,0 +1,128 @@
+withExceptionHandling();
+ $this->user->attachPermission(Permission::where('name', 'read-admin-panel')->firstOrFail());
+ Http::preventStrayRequests();
+ Storage::fake('uploads');
+ config(['services.esign.environment' => 'sandbox', 'services.esign.base_url' => 'https://smlopenapi.esign.test',
+ 'services.esign.app_id' => 'sandbox-app-id', 'services.esign.app_secret' => 'sandbox-app-secret']);
+ }
+
+ public function test_operation_requires_an_enabled_company_member_with_page_access_and_explicit_grant(): void
+ {
+ $this->regularUser();
+ $this->assertFalse(AgreementSigningPermissions::canOperate($this->user));
+ AgreementSigningPermissions::setGranted($this->user, true);
+ $this->assertTrue(AgreementSigningPermissions::canOperate($this->user));
+ $this->assertFalse(AgreementSigningPermissions::canAdminister($this->user));
+ $this->user->enabled = false;
+ $this->assertFalse(AgreementSigningPermissions::canOperate($this->user));
+ $this->user->enabled = true;
+ $this->user->companies()->detach();
+ $this->assertFalse(AgreementSigningPermissions::canOperate($this->user));
+ }
+
+ public function test_page_permission_is_required_even_with_an_operation_grant(): void
+ {
+ $this->regularUser();
+ AgreementSigningPermissions::setGranted($this->user, true);
+ $subject = 'user_' . $this->user->id;
+ foreach ([[], ['courier-payables/agreement-signing'], ['courier-payables']] as $pages) {
+ setting()->set('system.sidebar_permissions', ['configured' => [$subject], 'subjects' => [$subject => $pages]]);
+ $this->assertSame($pages !== [], AgreementSigningPermissions::canOperate($this->user));
+ }
+ }
+
+ public function test_administrators_keep_signing_and_management_access(): void
+ {
+ foreach (['admin', 'super_admin'] as $role) {
+ $this->user->syncRoles([Role::where('name', $role)->firstOrFail()->id]);
+ $this->assertTrue(AgreementSigningPermissions::canOperate($this->user));
+ $this->assertTrue(AgreementSigningPermissions::canAdminister($this->user));
+ }
+ }
+
+ public function test_button_and_task_actions_follow_the_same_grant_as_the_interface(): void
+ {
+ $this->regularUser();
+ $this->task();
+ foreach ([false, true, false] as $granted) {
+ AgreementSigningPermissions::setGranted($this->user, $granted);
+ $html = $this->loginAs()->get($this->pageUrl())->assertOk()->getContent();
+ $document = new DOMDocument();
+ @$document->loadHTML('' . $html);
+ $xpath = new DOMXPath($document);
+ $button = $xpath->query('//button[@data-sign-request-send]')->item(0);
+ $this->assertNotNull($button);
+ $this->assertSame(! $granted, $button->hasAttribute('disabled'));
+ $this->assertSame($granted ? 1 : 0, $xpath->query('//td[contains(@class,"agreement-table-actions")]//a[@title="下载签署原文"]')->length);
+ $this->assertSame(0, $xpath->query('//form[@data-delete-task-form]')->length);
+ $this->assertSame(1, $xpath->query('//button[@data-subject-manage-open and @disabled]')->length);
+ $this->assertSame($granted ? 0 : 1, $xpath->query('//*[@data-signing-permission-hint]')->length);
+ }
+ }
+
+ public function test_authorized_users_can_download_and_sync_but_cannot_delete_or_manage_company_subjects(): void
+ {
+ $this->regularUser();
+ AgreementSigningPermissions::setGranted($this->user, true);
+ $task = $this->task();
+ Storage::disk('uploads')->put($task->source_pdf_path, '%PDF-test');
+ $this->loginAs()->get(route('business.courier-agreement-signatures.download', [$task, 'source']))->assertOk();
+ $this->post(route('business.courier-agreement-signatures.synchronize', $task))->assertRedirect();
+ $this->deleteJson(route('business.courier-agreement-signatures.destroy', $task), ['delete_confirmed' => true])->assertForbidden();
+ $this->postJson(route('business.courier-agreement-signatures.subjects.store'), ['name' => '禁止新增主体'])->assertForbidden();
+ $this->assertFalse($task->fresh()->trashed());
+ Http::assertNothingSent();
+ }
+
+ public function test_unauthorized_users_cannot_use_task_interfaces_or_grant_themselves_access(): void
+ {
+ $this->regularUser();
+ $task = $this->task();
+ $this->loginAs()->get(route('business.courier-agreement-signatures.download', [$task, 'source']))->assertForbidden();
+ $this->post(route('business.courier-agreement-signatures.synchronize', $task))->assertForbidden();
+ $this->patchJson(route('system-settings.users.update', $this->user->id), ['agreement_signing_allowed' => true])->assertForbidden();
+ $this->get(route('system-settings.users.index'))->assertForbidden();
+ $this->assertSame([], AgreementSigningPermissions::grantedUserIds());
+ Http::assertNothingSent();
+ }
+
+ private function regularUser(): void
+ {
+ $this->user->syncRoles([Role::where('name', SystemAccess::USER)->firstOrFail()->id]);
+ }
+
+ private function pageUrl(): string
+ {
+ return route('business.pages.show', ['section' => 'courier-payables', 'page' => 'agreement-signing', 'agreement_view' => 'create']);
+ }
+
+ private function task(): CourierAgreementSignature
+ {
+ return CourierAgreementSignature::create(['company_id' => $this->company->id, 'business_no' => 'SIGN-PERMISSION-TEST',
+ 'idempotency_key' => 'permission-test', 'document_type' => 'account-proof', 'template_code' => 'TPL-ACCOUNT-CERT-V2',
+ 'template_version' => '2', 'source_file_name' => 'test.doc', 'provider' => 'esign', 'environment' => 'sandbox',
+ 'status' => 'prepared', 'courier_name' => '测试快递', 'organization_name' => '测试主体', 'company_full_name' => '测试公司',
+ 'operator_account' => '13800138000', 'notice_types' => '', 'source_pdf_path' => 'permission-test.pdf', 'source_pdf_sha256' => str_repeat('a', 64),
+ 'payload' => [], 'created_by' => $this->user->id, 'updated_by' => $this->user->id]);
+ }
+}
diff --git a/tests/Feature/Business/CourierAgreementSignatureWorkflowTest.php b/tests/Feature/Business/CourierAgreementSignatureWorkflowTest.php
index 787ac8b9..406c5505 100644
--- a/tests/Feature/Business/CourierAgreementSignatureWorkflowTest.php
+++ b/tests/Feature/Business/CourierAgreementSignatureWorkflowTest.php
@@ -4,12 +4,14 @@ namespace Tests\Feature\Business;
use App\Jobs\Business\ArchiveCourierAgreementSignature;
use App\Models\Auth\Permission;
+use App\Models\Auth\Role;
use App\Models\Business\CourierAgreementSignature;
use App\Models\Business\CourierQuoteChange;
use App\Models\Business\CourierQuoteSignature;
use App\Models\Business\CourierQuoteVersion;
use App\Support\CourierAgreementPdf;
use App\Support\SupplierCooperationTemplates;
+use App\Utilities\AgreementSigningPermissions;
use DOMDocument;
use DOMXPath;
use Illuminate\Http\Client\Request as ClientRequest;
@@ -76,6 +78,43 @@ class CourierAgreementSignatureWorkflowTest extends FeatureTestCase
$this->assertSame(1, CourierAgreementSignature::query()->count());
}
+ public function test_authorized_business_user_can_push_without_becoming_an_administrator(): void
+ {
+ $this->user->syncRoles([Role::where('name', 'user')->firstOrFail()->id]);
+ AgreementSigningPermissions::setGranted($this->user, true);
+ $this->fakeEsign();
+
+ $this->loginAs()->post(route('business.courier-agreement-signatures.store'), $this->accountProofPayload('business-authorized'))
+ ->assertRedirect();
+
+ $signature = CourierAgreementSignature::query()->firstOrFail();
+ $this->assertSame('flow-agreement-001', $signature->esign_sign_flow_id);
+ $this->assertSame($this->user->id, $signature->created_by);
+ $this->assertSame(['user'], $this->user->roles()->pluck('name')->all());
+ $this->assertFalse(AgreementSigningPermissions::canAdminister($this->user));
+ }
+
+ public function test_revoked_signing_or_page_permission_blocks_push_before_any_esign_call(): void
+ {
+ $this->withExceptionHandling();
+ Http::preventStrayRequests();
+ $this->user->syncRoles([Role::where('name', 'user')->firstOrFail()->id]);
+ $this->loginAs();
+ $url = route('business.courier-agreement-signatures.store');
+ $payload = $this->accountProofPayload('business-not-authorized');
+ $this->post($url, $payload)->assertForbidden();
+ AgreementSigningPermissions::setGranted($this->user, true);
+ AgreementSigningPermissions::setGranted($this->user, false);
+ $this->post($url, $payload)->assertForbidden();
+
+ AgreementSigningPermissions::setGranted($this->user, true);
+ $subject = 'user_' . $this->user->id;
+ setting()->set('system.sidebar_permissions', ['configured' => [$subject], 'subjects' => [$subject => []]]);
+ $this->post($url, $payload)->assertForbidden();
+ $this->assertSame(0, CourierAgreementSignature::query()->count());
+ Http::assertNothingSent();
+ }
+
public function test_supplier_requests_require_a_selected_supplier_before_sending(): void
{
Http::preventStrayRequests();
diff --git a/tests/Feature/SystemSettings/UserPermissionsTest.php b/tests/Feature/SystemSettings/UserPermissionsTest.php
index e4ac3717..966b5392 100644
--- a/tests/Feature/SystemSettings/UserPermissionsTest.php
+++ b/tests/Feature/SystemSettings/UserPermissionsTest.php
@@ -6,6 +6,7 @@ use App\Models\Auth\DingTalkIdentity;
use App\Models\Auth\Permission;
use App\Models\Auth\Role;
use App\Models\Auth\User;
+use App\Utilities\AgreementSigningPermissions;
use App\Utilities\BusinessNavigation;
use App\Utilities\SidebarPermissions;
use App\Utilities\SystemAccess;
@@ -13,6 +14,28 @@ use Tests\Feature\FeatureTestCase;
class UserPermissionsTest extends FeatureTestCase
{
+ public function test_administrator_can_grant_and_revoke_signing_without_changing_business_user_role(): void
+ {
+ $admin = $this->account('admin');
+ $target = $this->account('user');
+ $this->loginAs($admin)->get(route('system-settings.users.edit', $target->id))->assertOk()
+ ->assertSee('name="agreement_signing_allowed"', false);
+ foreach ([true, false] as $allowed) {
+ $this->patch(route('system-settings.users.update', $target->id),
+ $this->payload($target, 'user') + ['agreement_signing_allowed' => (int) $allowed])->assertRedirect();
+ $this->assertSame($allowed, AgreementSigningPermissions::canOperate($target->fresh()));
+ $this->assertSame(['user'], $target->roles()->pluck('name')->all());
+ }
+ }
+
+ public function test_unrelated_account_edit_preserves_existing_signing_grant(): void
+ {
+ $target = $this->account('user');
+ AgreementSigningPermissions::setGranted($target, true);
+ $this->loginAs()->patch(route('system-settings.users.update', $target->id), $this->payload($target, 'user'))->assertRedirect();
+ $this->assertTrue(AgreementSigningPermissions::canOperate($target->fresh()));
+ }
+
public function test_admin_sees_all_company_accounts_but_cannot_edit_administrators(): void
{
$admin = $this->account('admin');
--
2.47.2