90 lines
3.0 KiB
PHP
90 lines
3.0 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Business;
|
|
|
|
use App\Models\Auth\Permission;
|
|
use App\Models\Auth\Role;
|
|
use App\Models\Auth\User;
|
|
use App\Utilities\SidebarPermissions;
|
|
use Tests\Feature\FeatureTestCase;
|
|
|
|
class LaborExpensePageAccessTest extends FeatureTestCase
|
|
{
|
|
public function test_labor_expense_page_is_visible_only_to_the_named_accounts(): void
|
|
{
|
|
$chenxi = $this->account('晨曦');
|
|
$jiangling = $this->account('江陵');
|
|
$other = $this->account('其他财务');
|
|
|
|
$this->assertTrue($this->pageIsVisible($chenxi));
|
|
$this->assertTrue($this->pageIsVisible($jiangling));
|
|
$this->assertFalse($this->pageIsVisible($other));
|
|
$this->assertFalse($this->pageIsVisible($this->user));
|
|
}
|
|
|
|
public function test_explicit_page_permission_cannot_bypass_the_viewer_allowlist(): void
|
|
{
|
|
$other = $this->account('其他财务');
|
|
$subject = 'user_' . $other->id;
|
|
setting()->set('system.sidebar_permissions', [
|
|
'configured' => [$subject],
|
|
'subjects' => [
|
|
$subject => ['financial-operations/labor-expenses'],
|
|
],
|
|
]);
|
|
|
|
$this->assertFalse($this->pageIsVisible($other));
|
|
}
|
|
|
|
public function test_direct_page_and_generic_actions_use_the_same_allowlist(): void
|
|
{
|
|
$chenxi = $this->account('晨曦');
|
|
$other = $this->account('其他财务');
|
|
$routeParameters = [
|
|
'section' => 'financial-operations',
|
|
'page' => 'labor-expenses',
|
|
];
|
|
|
|
$this->loginAs($chenxi)
|
|
->get(route('business.pages.show', $routeParameters))
|
|
->assertOk();
|
|
|
|
$this->withExceptionHandling()->loginAs($other)
|
|
->get(route('business.pages.show', $routeParameters))
|
|
->assertForbidden();
|
|
$this->post(route('business.pages.store', $routeParameters), [])
|
|
->assertForbidden();
|
|
|
|
$this->withExceptionHandling()->loginAs($this->user)
|
|
->get(route('business.pages.show', $routeParameters))
|
|
->assertForbidden();
|
|
}
|
|
|
|
private function pageIsVisible(User $user): bool
|
|
{
|
|
$financialOperations = collect(SidebarPermissions::navigationFor($user))
|
|
->firstWhere('slug', 'financial-operations');
|
|
|
|
return collect($financialOperations['pages'] ?? [])
|
|
->contains('slug', 'labor-expenses');
|
|
}
|
|
|
|
private function account(string $name): User
|
|
{
|
|
$suffix = User::count();
|
|
$user = User::create([
|
|
'name' => $name,
|
|
'email' => 'labor-access-' . $suffix . '@example.test',
|
|
'password' => 'fixture-unused-password',
|
|
'enabled' => true,
|
|
'locale' => 'zh-CN',
|
|
'landing_page' => 'dashboard',
|
|
]);
|
|
$user->roles()->attach(Role::where('name', 'user')->firstOrFail()->id);
|
|
$user->permissions()->attach(Permission::where('name', 'read-admin-panel')->firstOrFail()->id);
|
|
$user->companies()->attach($this->company->id);
|
|
|
|
return $user;
|
|
}
|
|
}
|