516 lines
24 KiB
PHP
516 lines
24 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Auth;
|
|
|
|
use App\Models\Auth\DingTalkBindingRequest;
|
|
use App\Models\Auth\DingTalkIdentity;
|
|
use App\Models\Auth\DingTalkOAuthState;
|
|
use App\Models\Auth\User;
|
|
use App\Models\Common\Contact;
|
|
use App\Services\Auth\FinanceRoster;
|
|
use App\Utilities\SidebarPermissions;
|
|
use Illuminate\Http\Client\Request as ClientRequest;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Http;
|
|
use Illuminate\Support\Str;
|
|
use Tests\Feature\FeatureTestCase;
|
|
|
|
class DingTalkLoginTest extends FeatureTestCase
|
|
{
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
config([
|
|
'app.url' => 'https://caiwu.jiansuntuzhi.cn:8442',
|
|
'dingtalk.enabled' => true,
|
|
'dingtalk.client_id' => 'test-client-id',
|
|
'dingtalk.client_secret' => 'test-client-secret',
|
|
'dingtalk.redirect_uri' => 'https://caiwu.jiansuntuzhi.cn:8442/auth/dingtalk/callback',
|
|
'dingtalk.authorize_url' => 'https://login.dingtalk.test/oauth2/auth',
|
|
'dingtalk.token_url' => 'https://api.dingtalk.test/v1.0/oauth2/userAccessToken',
|
|
'dingtalk.user_url' => 'https://api.dingtalk.test/v1.0/contact/users/me',
|
|
'dingtalk.app_token_url' => 'https://oapi.dingtalk.test/gettoken',
|
|
'dingtalk.user_by_union_id_url' => 'https://oapi.dingtalk.test/topapi/user/getbyunionid',
|
|
'dingtalk.user_detail_url' => 'https://oapi.dingtalk.test/topapi/v2/user/get',
|
|
]);
|
|
app('url')->forceRootUrl(config('app.url'));
|
|
app('url')->forceScheme('https');
|
|
$this->mock(FinanceRoster::class)->shouldReceive('findEligible')->andReturn([
|
|
'roster_id' => 'fixture-1', 'display_name' => '财务测试员工', 'department_ids' => ['22848291'],
|
|
])->byDefault();
|
|
}
|
|
|
|
public function test_login_page_shows_dingtalk_entry_without_password_binding_fields(): void
|
|
{
|
|
$this->get(route('login'))
|
|
->assertOk()
|
|
->assertSeeText(trans('auth.dingtalk.login'))
|
|
->assertDontSee('name="dingtalk_binding"', false)
|
|
->assertDontSeeText('首次使用钉钉登录，请输入现有财务系统账号和密码完成绑定');
|
|
}
|
|
|
|
public function test_redirect_creates_hashed_state_and_uses_domain_callback(): void
|
|
{
|
|
$response = $this->get(route('login.dingtalk'))->assertRedirect();
|
|
parse_str((string) parse_url($response->headers->get('Location'), PHP_URL_QUERY), $query);
|
|
|
|
$this->assertSame('test-client-id', $query['client_id']);
|
|
$this->assertSame('openid', $query['scope']);
|
|
$this->assertSame(config('dingtalk.redirect_uri'), $query['redirect_uri']);
|
|
$this->assertDatabaseHas('dingtalk_oauth_states', [
|
|
'state_hash' => hash('sha256', $query['state']),
|
|
'consumed_at' => null,
|
|
]);
|
|
$this->assertDatabaseMissing('dingtalk_oauth_states', ['state_hash' => $query['state']]);
|
|
}
|
|
|
|
public function test_bound_active_enterprise_identity_logs_in_without_storing_access_tokens(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-bound', 'open-bound', email: null));
|
|
|
|
DingTalkIdentity::query()->create([
|
|
'user_id' => $this->user->id,
|
|
'union_id' => 'union-bound',
|
|
'dingtalk_user_id' => 'ding-user-1',
|
|
]);
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'authCode' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirectContains('https://caiwu.jiansuntuzhi.cn:8442');
|
|
|
|
$this->assertAuthenticatedAs($this->user);
|
|
$this->assertDatabaseHas('dingtalk_auth_audits', [
|
|
'event' => 'login_success',
|
|
'outcome' => 'success',
|
|
'user_id' => $this->user->id,
|
|
]);
|
|
$this->assertFalse(
|
|
collect(DingTalkOAuthState::query()->first()->getAttributes())
|
|
->contains(fn ($value) => is_string($value) && str_contains($value, 'access-token'))
|
|
);
|
|
Http::assertSentCount(5);
|
|
}
|
|
|
|
public function test_finance_staff_are_provisioned_without_claiming_an_existing_email_account(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-auto', 'open-auto', email: 'finance@example.test'));
|
|
$this->user->update(['email' => 'finance@example.test']);
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirectContains('https://caiwu.jiansuntuzhi.cn:8442');
|
|
|
|
$created = auth()->user();
|
|
$this->assertNotSame($this->user->id, $created->id);
|
|
$this->assertTrue($created->hasRole('user'));
|
|
$this->assertFalse($created->hasRole('super_admin'));
|
|
$this->assertNull(SidebarPermissions::allowedKeys($created));
|
|
$this->assertTrue(collect(SidebarPermissions::navigationFor($created))->contains('slug', 'store-management'));
|
|
$this->assertDatabaseHas('dingtalk_identities', [
|
|
'user_id' => $created->id,
|
|
'union_id' => 'union-auto',
|
|
'dingtalk_user_id' => 'ding-user-1',
|
|
]);
|
|
$this->assertDatabaseHas('dingtalk_binding_requests', [
|
|
'union_id' => 'union-auto',
|
|
'status' => 'approved',
|
|
'matched_user_id' => $created->id,
|
|
]);
|
|
$this->assertDatabaseHas('dingtalk_auth_audits', [
|
|
'event' => 'account_auto_created',
|
|
'outcome' => 'success',
|
|
'user_id' => $created->id,
|
|
]);
|
|
$this->get(route('dashboard', ['company_id' => $this->company->id]))->assertRedirectContains('/workspace/');
|
|
}
|
|
|
|
public function test_shared_mobile_does_not_claim_an_existing_account(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-mobile', 'open-mobile', email: null, mobile: '+86 138-0013-8000'));
|
|
Contact::query()->create([
|
|
'company_id' => $this->company->id,
|
|
'type' => Contact::EMPLOYEE_TYPE,
|
|
'name' => $this->user->name,
|
|
'email' => $this->user->email,
|
|
'user_id' => $this->user->id,
|
|
'phone' => '13800138000',
|
|
'currency_code' => default_currency(),
|
|
'enabled' => true,
|
|
'created_from' => 'test',
|
|
'created_by' => $this->user->id,
|
|
]);
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirectContains('https://caiwu.jiansuntuzhi.cn:8442');
|
|
|
|
$this->assertNotSame($this->user->id, auth()->id());
|
|
$this->assertDatabaseHas('dingtalk_identities', [
|
|
'user_id' => auth()->id(),
|
|
'union_id' => 'union-mobile',
|
|
]);
|
|
}
|
|
|
|
public function test_finance_staff_receive_api_profile_and_no_manual_registration_step(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses(
|
|
'union-pending',
|
|
'open-pending',
|
|
email: 'outsider@example.test',
|
|
mobile: '13800138000'
|
|
));
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirectContains('https://caiwu.jiansuntuzhi.cn:8442');
|
|
|
|
$this->assertAuthenticated();
|
|
$this->assertDatabaseHas('dingtalk_identities', ['union_id' => 'union-pending', 'user_id' => auth()->id()]);
|
|
$this->assertSame('outsider@example.test', auth()->user()->email);
|
|
$this->assertSame('企业员工', auth()->user()->name);
|
|
$this->assertDatabaseHas('contacts', ['user_id' => auth()->id(), 'phone' => '13800138000']);
|
|
$this->assertDatabaseHas('dingtalk_binding_requests', [
|
|
'union_id' => 'union-pending',
|
|
'status' => 'approved',
|
|
'email_hint' => 'o***@example.test',
|
|
'mobile_hint' => '*******8000',
|
|
]);
|
|
$row = (array) DB::table('dingtalk_binding_requests')->where('union_id', 'union-pending')->first();
|
|
$this->assertStringNotContainsString('outsider@example.test', json_encode($row));
|
|
$this->assertStringNotContainsString('13800138000', json_encode($row));
|
|
}
|
|
|
|
public function test_inactive_enterprise_user_is_denied_without_creating_an_account(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-inactive', 'open-inactive', active: false));
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirect('https://caiwu.jiansuntuzhi.cn:8442/auth/login');
|
|
|
|
$this->assertGuest();
|
|
$this->assertDatabaseMissing('dingtalk_identities', ['union_id' => 'union-inactive']);
|
|
$this->assertDatabaseMissing('dingtalk_binding_requests', ['union_id' => 'union-inactive']);
|
|
$this->assertDatabaseHas('dingtalk_auth_audits', [
|
|
'event' => 'login_denied',
|
|
'outcome' => 'denied',
|
|
]);
|
|
}
|
|
|
|
public function test_external_dingtalk_user_is_denied_when_enterprise_application_cannot_resolve_it(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-external', 'open-external', enterpriseMember: false));
|
|
$userCount = User::query()->count();
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirect('https://caiwu.jiansuntuzhi.cn:8442/auth/login');
|
|
|
|
$this->assertGuest();
|
|
$this->assertSame($userCount, User::query()->count());
|
|
$this->assertDatabaseMissing('dingtalk_binding_requests', ['union_id' => 'union-external']);
|
|
$this->assertDatabaseHas('dingtalk_auth_audits', [
|
|
'event' => 'login_denied',
|
|
'outcome' => 'denied',
|
|
]);
|
|
}
|
|
|
|
public function test_rejected_binding_request_cannot_be_automatically_reactivated(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-rejected', 'open-rejected', email: 'finance@example.test'));
|
|
$this->user->update(['email' => 'finance@example.test']);
|
|
DingTalkBindingRequest::query()->create([
|
|
'union_id' => 'union-rejected',
|
|
'status' => DingTalkBindingRequest::REJECTED,
|
|
'match_reason' => 'administrator_rejected',
|
|
'last_attempted_at' => now()->subMinute(),
|
|
]);
|
|
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $state,
|
|
]))->assertRedirect('https://caiwu.jiansuntuzhi.cn:8442/auth/login');
|
|
|
|
$this->assertGuest();
|
|
$this->assertDatabaseMissing('dingtalk_identities', ['union_id' => 'union-rejected']);
|
|
$this->assertDatabaseHas('dingtalk_binding_requests', [
|
|
'union_id' => 'union-rejected',
|
|
'status' => DingTalkBindingRequest::REJECTED,
|
|
]);
|
|
}
|
|
|
|
public function test_expired_or_replayed_state_never_calls_dingtalk(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
$rawState = 'expired-state';
|
|
DingTalkOAuthState::query()->create([
|
|
'state_hash' => hash('sha256', $rawState),
|
|
'expires_at' => now()->subMinute(),
|
|
]);
|
|
$this->withSession(['dingtalk_oauth_state_hash' => hash('sha256', $rawState)]);
|
|
|
|
$this->get(route('login.dingtalk.callback', [
|
|
'code' => 'authorization-code',
|
|
'state' => $rawState,
|
|
]))->assertRedirect('https://caiwu.jiansuntuzhi.cn:8442/auth/login');
|
|
|
|
Http::assertNothingSent();
|
|
$this->assertGuest();
|
|
}
|
|
|
|
public function test_callback_requires_the_browser_that_started_authorization(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
$state = $this->startAuthorization();
|
|
$this->app['session']->forget('dingtalk_oauth_state_hash');
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]))
|
|
->assertSessionHas('dingtalk_error', trans('auth.dingtalk.failed'));
|
|
Http::assertNothingSent();
|
|
$this->assertGuest();
|
|
$this->assertDatabaseHas('dingtalk_oauth_states', ['state_hash' => hash('sha256', $state), 'consumed_at' => null]);
|
|
}
|
|
|
|
public function test_consumed_state_cannot_be_used_again_with_matching_browser_state(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
$state = $this->startAuthorization();
|
|
DingTalkOAuthState::query()->update(['consumed_at' => now()]);
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]))
|
|
->assertSessionHas('dingtalk_error', trans('auth.dingtalk.failed'));
|
|
Http::assertNothingSent();
|
|
$this->assertGuest();
|
|
}
|
|
|
|
public function test_legacy_callback_returns_to_domain_before_consuming_state(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
$state = $this->startAuthorization();
|
|
$response = $this->get('http://218.93.190.75:8442/auth/dingtalk/callback?'.http_build_query([
|
|
'code' => 'fake-code', 'state' => $state, 'redirect' => 'https://untrusted.test',
|
|
]))->assertRedirect();
|
|
$this->assertStringStartsWith(config('app.url').'/auth/dingtalk/callback?', $response->headers->get('Location'));
|
|
$this->assertStringNotContainsString('untrusted', $response->headers->get('Location'));
|
|
$response->assertHeader('Referrer-Policy', 'no-referrer');
|
|
$this->assertDatabaseHas('dingtalk_oauth_states', ['state_hash' => hash('sha256', $state), 'consumed_at' => null]);
|
|
Http::assertNothingSent();
|
|
}
|
|
|
|
public function test_revoked_binding_invalidates_logged_in_session_on_next_request(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-session', 'open-session', email: null));
|
|
$identity = DingTalkIdentity::query()->create(['user_id' => $this->user->id, 'union_id' => 'union-session']);
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]))
|
|
->assertSessionHas('dingtalk_identity_id', $identity->id);
|
|
$identity->delete();
|
|
$this->getJson(route('dashboard', ['company_id' => $this->company->id]))->assertUnauthorized();
|
|
$this->assertGuest();
|
|
$this->assertFalse(session()->has('dingtalk_identity_id'));
|
|
}
|
|
|
|
public function test_non_finance_staff_cannot_create_accounts_even_with_a_matching_email(): void
|
|
{
|
|
$this->mock(FinanceRoster::class)->shouldReceive('findEligible')->andReturnNull();
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-outside', 'open-outside', email: $this->user->email));
|
|
$count = User::count();
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]))
|
|
->assertSessionHas('dingtalk_error', trans('auth.dingtalk.outside_roster'));
|
|
$this->assertGuest();
|
|
$this->assertSame($count, User::count());
|
|
}
|
|
|
|
public function test_roster_outage_does_not_create_or_authorize_an_account(): void
|
|
{
|
|
$this->mock(FinanceRoster::class)->shouldReceive('findEligible')->andThrow(new \RuntimeException('fixture outage'));
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-outage', 'open-outage'));
|
|
$count = User::count();
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]))
|
|
->assertSessionHas('dingtalk_error', trans('auth.dingtalk.roster_unavailable'));
|
|
$this->assertGuest();
|
|
$this->assertSame($count, User::count());
|
|
}
|
|
|
|
public function test_repeat_authorization_keeps_the_same_account_and_does_not_remember_login(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-repeat', 'open-repeat'));
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]))
|
|
->assertCookieExpired(auth()->guard()->getRecallerName());
|
|
$id = auth()->id();
|
|
$count = User::count();
|
|
auth()->logout();
|
|
session()->invalidate();
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'another-code', 'state' => $state]));
|
|
$this->assertSame($id, auth()->id());
|
|
$this->assertSame($count, User::count());
|
|
$this->assertSame(1, DingTalkIdentity::where('union_id', 'union-repeat')->count());
|
|
}
|
|
|
|
public function test_roster_removal_invalidates_session_at_recheck(): void
|
|
{
|
|
$identity = DingTalkIdentity::create(['user_id' => $this->user->id, 'union_id' => 'union-removed', 'dingtalk_user_id' => 'ding-removed']);
|
|
$this->mock(FinanceRoster::class)->shouldReceive('findEligible')->with('ding-removed')->andReturnNull();
|
|
$this->actingAs($this->user)->withSession([
|
|
'dingtalk_identity_id' => $identity->id,
|
|
'dingtalk_roster_checked_at' => now()->subMinutes(6)->timestamp,
|
|
])->getJson(route('dashboard', ['company_id' => $this->company->id]))->assertUnauthorized();
|
|
$this->assertGuest();
|
|
}
|
|
|
|
public function test_disabled_account_cannot_keep_using_dingtalk_session(): void
|
|
{
|
|
$identity = DingTalkIdentity::create(['user_id' => $this->user->id, 'union_id' => 'union-disabled']);
|
|
$this->user->update(['enabled' => false]);
|
|
$this->actingAs($this->user)->withSession([
|
|
'dingtalk_identity_id' => $identity->id,
|
|
'dingtalk_roster_checked_at' => now()->timestamp,
|
|
])->getJson(route('dashboard', ['company_id' => $this->company->id]))->assertUnauthorized();
|
|
$this->assertGuest();
|
|
}
|
|
|
|
public function test_bound_disabled_account_is_not_recreated(): void
|
|
{
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-disabled-login', 'open-disabled'));
|
|
DingTalkIdentity::create(['user_id' => $this->user->id, 'union_id' => 'union-disabled-login']);
|
|
$this->user->update(['enabled' => false]);
|
|
$count = User::count();
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]));
|
|
$this->assertGuest();
|
|
$this->assertSame($count, User::count());
|
|
}
|
|
|
|
public function test_password_session_for_provisioned_user_cannot_bypass_roster(): void
|
|
{
|
|
$this->user->update(['created_from' => 'dingtalk_roster']);
|
|
DingTalkIdentity::create(['user_id' => $this->user->id, 'union_id' => 'union-password', 'dingtalk_user_id' => 'ding-password']);
|
|
$this->mock(FinanceRoster::class)->shouldReceive('findEligible')->with('ding-password')->andReturnNull();
|
|
$this->actingAs($this->user)->getJson(route('dashboard', ['company_id' => $this->company->id]))->assertUnauthorized();
|
|
$this->assertGuest();
|
|
}
|
|
|
|
public function test_roster_outage_during_session_recheck_serves_no_business_data(): void
|
|
{
|
|
$identity = DingTalkIdentity::create(['user_id' => $this->user->id, 'union_id' => 'union-recheck', 'dingtalk_user_id' => 'ding-recheck']);
|
|
$this->mock(FinanceRoster::class)->shouldReceive('findEligible')->andThrow(new \RuntimeException('fixture outage'));
|
|
$this->actingAs($this->user)->withSession(['dingtalk_identity_id' => $identity->id])
|
|
->getJson(route('dashboard', ['company_id' => $this->company->id]))->assertStatus(503);
|
|
$this->assertAuthenticated();
|
|
$this->assertFalse(session()->has('dingtalk_roster_checked_at'));
|
|
}
|
|
|
|
public function test_admin_can_assign_business_access_to_the_automatically_created_user(): void
|
|
{
|
|
app('url')->defaults(['company_id' => $this->company->id]);
|
|
Http::preventStrayRequests();
|
|
Http::fake($this->dingtalkResponses('union-grant', 'open-grant'));
|
|
$state = $this->startAuthorization();
|
|
$this->get(route('login.dingtalk.callback', ['code' => 'fake-code', 'state' => $state]));
|
|
$created = auth()->user();
|
|
$this->assertNull(SidebarPermissions::allowedKeys($created));
|
|
auth()->logout(); session()->invalidate();
|
|
$this->actingAs($this->user)->get(route('system-settings.sidebar.edit', ['subject' => 'user_'.$created->id]))
|
|
->assertOk()->assertSee('value="user_'.$created->id.'"', false);
|
|
$this->patch(route('system-settings.sidebar.update'), [
|
|
'subject' => 'user_'.$created->id, 'permissions' => ['store-management/basic-information'],
|
|
])->assertRedirect(route('system-settings.sidebar.edit', ['subject' => 'user_'.$created->id]));
|
|
$this->assertSame(['store-management/basic-information'], SidebarPermissions::allowedKeys($created));
|
|
$this->actingAs($created)->withSession(['dingtalk_identity_id' => $created->dingtalkIdentity->id, 'dingtalk_roster_checked_at' => now()->timestamp])
|
|
->get(route('dashboard'))->assertRedirectContains('/workspace/store-management/basic-information');
|
|
$this->withExceptionHandling()->get(route('business.pages.show', [
|
|
'company_id' => $this->company->id, 'section' => 'company-management', 'page' => 'basic-information',
|
|
]))->assertForbidden();
|
|
}
|
|
|
|
public function test_explicit_empty_user_scope_does_not_fall_back_to_all_pages(): void
|
|
{
|
|
$this->user->roles()->sync([\App\Models\Auth\Role::where('name', 'admin')->firstOrFail()->id]);
|
|
setting()->set('system.sidebar_permissions', [
|
|
'configured' => ['user_'.$this->user->id], 'subjects' => ['user_'.$this->user->id => []],
|
|
]);
|
|
$this->assertSame([], SidebarPermissions::navigationFor($this->user));
|
|
$this->loginAs()->get(route('dashboard', ['company_id' => $this->company->id]))->assertOk()->assertSeeText('尚未分配业务权限');
|
|
}
|
|
|
|
protected function startAuthorization(): string
|
|
{
|
|
$response = $this->get(route('login.dingtalk'))->assertRedirect();
|
|
parse_str((string) parse_url($response->headers->get('Location'), PHP_URL_QUERY), $query);
|
|
|
|
return $query['state'];
|
|
}
|
|
|
|
protected function dingtalkResponses(
|
|
string $unionId,
|
|
string $openId,
|
|
?string $email = 'finance@example.test',
|
|
?string $mobile = null,
|
|
bool $active = true,
|
|
bool $enterpriseMember = true
|
|
): callable {
|
|
return function (ClientRequest $request) use ($unionId, $openId, $email, $mobile, $active, $enterpriseMember) {
|
|
$url = $request->url();
|
|
|
|
return match (true) {
|
|
$url === 'https://api.dingtalk.test/v1.0/oauth2/userAccessToken' => Http::response([
|
|
'accessToken' => 'access-token-not-persisted',
|
|
'expireIn' => 7200,
|
|
]),
|
|
$url === 'https://api.dingtalk.test/v1.0/contact/users/me' => Http::response([
|
|
'unionId' => $unionId,
|
|
'openId' => $openId,
|
|
'nick' => '企业员工',
|
|
]),
|
|
Str::startsWith($url, 'https://oapi.dingtalk.test/gettoken?') => Http::response([
|
|
'errcode' => 0,
|
|
'access_token' => 'app-access-token-not-persisted',
|
|
]),
|
|
Str::startsWith($url, 'https://oapi.dingtalk.test/topapi/user/getbyunionid?') => Http::response([
|
|
'errcode' => $enterpriseMember ? 0 : 60121,
|
|
'result' => $enterpriseMember ? ['userid' => 'ding-user-1'] : null,
|
|
]),
|
|
Str::startsWith($url, 'https://oapi.dingtalk.test/topapi/v2/user/get?') => Http::response([
|
|
'errcode' => 0,
|
|
'result' => [
|
|
'userid' => 'ding-user-1',
|
|
'name' => '企业员工',
|
|
'email' => $email,
|
|
'mobile' => $mobile,
|
|
'active' => $active,
|
|
],
|
|
]),
|
|
default => Http::response([], 404),
|
|
};
|
|
};
|
|
}
|
|
}
|