282 lines
19 KiB
PHP
282 lines
19 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Business;
|
|
|
|
use App\Models\Auth\DingTalkIdentity;
|
|
use App\Models\Auth\Permission;
|
|
use App\Models\Auth\Role;
|
|
use App\Models\Auth\User;
|
|
use App\Models\Business\CourierOnboarding;
|
|
use App\Models\Business\CourierQuoteChange;
|
|
use App\Models\Common\Company;
|
|
use App\Services\Auth\FinanceRoster;
|
|
use App\Support\CourierQuoteWorkflowPermissions;
|
|
use App\Support\CourierOnboardingService;
|
|
use App\Support\QuoteManagementSnapshot;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Tests\Feature\FeatureTestCase;
|
|
|
|
class CourierQuoteWorkflowPermissionsTest extends FeatureTestCase
|
|
{
|
|
private string $fixturePath;
|
|
private array $people;
|
|
private bool $eligible = true;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
$this->mock(FinanceRoster::class, function ($mock): void {
|
|
$mock->shouldReceive('findEligible')->andReturnUsing(fn ($id) => $this->eligible ? ['display_name' => $id, 'restricted' => false] : null);
|
|
$mock->shouldReceive('search')->andReturn([['flowerNameId' => 'review-one', 'name' => '审核一', 'flowerName' => '审核一']]);
|
|
});
|
|
$this->people = [];
|
|
foreach (['init-one', 'init-two', 'review-one', 'review-two'] as $id) {
|
|
$person = User::create(['name' => $id, 'email' => $id . '@example.test', 'password' => 'password',
|
|
'locale' => 'zh-CN', 'enabled' => true, 'landing_page' => 'dashboard', 'created_from' => 'core::test']);
|
|
$person->companies()->attach($this->company->id);
|
|
$person->roles()->attach(Role::where('name', 'user')->firstOrFail()->id);
|
|
$person->attachPermission(Permission::where('name', 'read-admin-panel')->firstOrFail());
|
|
DingTalkIdentity::create(['user_id' => $person->id, 'union_id' => 'union-' . $id, 'dingtalk_user_id' => $id, 'bound_at' => now()]);
|
|
$this->people[$id] = $person;
|
|
}
|
|
$this->fixturePath = storage_path('framework/testing/quote-permissions-' . uniqid() . '.json');
|
|
file_put_contents($this->fixturePath, json_encode(['sourcePath' => 'private/quote.xlsx', 'sheets' => [[
|
|
'index' => 0, 'name' => '测试快递报价', 'address' => 'A1:B2',
|
|
'values' => [['省份', '面单'], ['江苏', 5]], 'formulas' => [[], []],
|
|
]]], JSON_UNESCAPED_UNICODE));
|
|
app()->instance(QuoteManagementSnapshot::class, new QuoteManagementSnapshot($this->fixturePath));
|
|
$this->loginAs();
|
|
app(CourierQuoteWorkflowPermissions::class)->save($this->permissionGroups(), $this->user->name, $this->user->id);
|
|
}
|
|
|
|
protected function tearDown(): void
|
|
{
|
|
@unlink($this->fixturePath);
|
|
parent::tearDown();
|
|
}
|
|
|
|
private function permissionGroups(): array
|
|
{
|
|
return ['initiators' => ['init-one', 'init-two'], 'reviewers' => ['review-one', 'review-two']];
|
|
}
|
|
|
|
private function payload(): array
|
|
{
|
|
return ['source_quote_id' => 'QB-001', 'change_type' => '费率调整', 'effective_date' => now()->addDay()->toDateString(),
|
|
'summary' => '调整江苏面单价格', 'items' => [['source_cell' => 'B2', 'source_row' => 1, 'source_column' => 1,
|
|
'region' => '江苏', 'weight_band' => '面单', 'charge_item' => '面单', 'original_amount' => '5', 'new_amount' => '6', 'unit' => '元']]];
|
|
}
|
|
|
|
private function pending(string $initiator = 'init-one'): CourierQuoteChange
|
|
{
|
|
$this->loginAs($this->people[$initiator], $this->company)
|
|
->post(route('business.courier-quote-changes.store'), $this->payload())->assertRedirect();
|
|
$change = CourierQuoteChange::latest('id')->firstOrFail();
|
|
$this->post(route('business.courier-quote-changes.submit', $change))->assertRedirect();
|
|
|
|
return $change->fresh();
|
|
}
|
|
|
|
public function test_either_named_regular_reviewer_can_approve_named_initiators_without_admin_grants(): void
|
|
{
|
|
foreach (['review-one' => 'init-one', 'review-two' => 'init-two'] as $reviewer => $initiator) {
|
|
$change = $this->pending($initiator);
|
|
$this->loginAs($this->people[$reviewer], $this->company)
|
|
->get(route('business.courier-quote-changes.show', $change))->assertOk()->assertSeeText('指定审核')->assertSeeText('审核通过');
|
|
$this->post(route('business.courier-quote-changes.approve', $change))->assertRedirect();
|
|
$this->assertSame('approved', $change->fresh()->status);
|
|
$this->assertSame($this->people[$reviewer]->id, $change->fresh()->version->approved_by);
|
|
$this->post(route('business.courier-quote-signatures.prepare', $change->fresh()->version), ['signature_date' => now()->toDateString()])->assertRedirect();
|
|
$this->get(route('business.courier-quote-changes.show', $change))->assertOk()->assertSeeText('推送到 E 签宝')->assertDontSeeText('作废此版本');
|
|
$this->withExceptionHandling()->post(route('business.courier-quote-changes.void', $change), ['void_reason' => '不应获得作废权限'])->assertForbidden();
|
|
$this->withExceptionHandling()->post(route('business.courier-quote-changes.approve', $change))->assertSessionHasErrors('status');
|
|
$this->assertSame('user', $this->people[$reviewer]->roles()->first()->name);
|
|
}
|
|
$this->assertDatabaseCount('business_courier_quote_versions', 2);
|
|
}
|
|
|
|
public function test_admin_and_initiator_cannot_bypass_named_reviewers_or_batch_approval(): void
|
|
{
|
|
$change = $this->pending();
|
|
$this->withExceptionHandling()->post(route('business.courier-quote-changes.approve', $change))->assertForbidden();
|
|
$this->loginAs()->post(route('business.courier-quote-changes.approve', $change))->assertForbidden();
|
|
$this->get(route('business.courier-quote-changes.index'))->assertOk()->assertDontSee('name="ids[]"', false);
|
|
$this->post(route('business.courier-quote-changes.batch-approve'), ['ids' => [$change->id], 'stock_rules_confirmed' => 1])->assertRedirect();
|
|
$this->assertSame('pending_review', $change->fresh()->status);
|
|
$this->assertDatabaseCount('business_courier_quote_versions', 0);
|
|
}
|
|
|
|
public function test_unlisted_admin_cannot_create_change_and_other_initiator_cannot_edit_owners_draft(): void
|
|
{
|
|
$this->withExceptionHandling()->loginAs()->post(route('business.courier-quote-changes.store'), $this->payload())->assertForbidden();
|
|
$this->loginAs($this->people['init-one'], $this->company)->post(route('business.courier-quote-changes.store'), $this->payload())->assertRedirect();
|
|
$change = CourierQuoteChange::firstOrFail();
|
|
$this->loginAs($this->people['init-two'], $this->company)->patch(route('business.courier-quote-changes.update', $change), $this->payload())->assertForbidden();
|
|
$this->assertSame('draft', $change->fresh()->status);
|
|
}
|
|
|
|
public function test_reviewer_can_return_and_revocation_of_identity_or_configuration_is_immediate(): void
|
|
{
|
|
$change = $this->pending();
|
|
$this->loginAs($this->people['review-one'], $this->company)
|
|
->post(route('business.courier-quote-changes.return', $change), ['review_note' => '请核对面单价格'])->assertRedirect();
|
|
$this->assertSame('returned', $change->fresh()->status);
|
|
$this->loginAs($this->people['init-one'], $this->company)->post(route('business.courier-quote-changes.submit', $change))->assertRedirect();
|
|
app(CourierQuoteWorkflowPermissions::class)->save(['initiators' => ['init-one', 'init-two'], 'reviewers' => ['review-two']], 'test admin', $this->user->id);
|
|
$this->withExceptionHandling()->loginAs($this->people['review-one'], $this->company)->post(route('business.courier-quote-changes.approve', $change))->assertForbidden();
|
|
$this->people['review-two']->update(['enabled' => false]);
|
|
$this->assertFalse(app(CourierQuoteWorkflowPermissions::class)->can('reviewers', $this->people['review-two']->id));
|
|
$this->loginAs($this->people['review-two'], $this->company)->post(route('business.courier-quote-changes.approve', $change))->assertRedirect();
|
|
$this->assertDatabaseCount('business_courier_quote_versions', 0);
|
|
}
|
|
|
|
public function test_self_review_stays_blocked_even_when_both_roles_are_assigned(): void
|
|
{
|
|
app(CourierQuoteWorkflowPermissions::class)->save(['initiators' => ['init-one'], 'reviewers' => ['init-one', 'review-one']], 'test admin', $this->user->id);
|
|
$change = $this->pending();
|
|
config(['courier_onboarding.allow_same_reviewer' => true]);
|
|
$this->withExceptionHandling()->post(route('business.courier-quote-changes.approve', $change))->assertSessionHasErrors('approval');
|
|
$this->assertDatabaseCount('business_courier_quote_versions', 0);
|
|
}
|
|
|
|
public function test_only_explicit_named_reviewer_can_review_own_change_and_grant_survives_settings_save(): void
|
|
{
|
|
$permissions = app(CourierQuoteWorkflowPermissions::class);
|
|
$groups = ['initiators' => ['init-one', 'init-two'], 'reviewers' => ['init-one'], 'self_reviewers' => ['init-one']];
|
|
$permissions->save($groups, 'explicit authorization', $this->user->id);
|
|
$change = $this->pending();
|
|
$this->get(route('business.courier-quote-changes.show', $change))->assertOk()
|
|
->assertSeeText('可审核本人发起的变价')->assertSeeText('审核通过')->assertSeeText('撤回修改')->assertSeeText('导出变价明细');
|
|
$this->get(route('business.courier-quote-changes.index'))->assertOk()->assertSee('name="ids[]"', false);
|
|
$this->withExceptionHandling()->loginAs($this->people['review-one'], $this->company)
|
|
->post(route('business.courier-quote-changes.approve', $change))->assertForbidden();
|
|
$this->loginAs()->post(route('business.courier-quote-changes.approve', $change))->assertForbidden();
|
|
unset($groups['self_reviewers']);
|
|
$this->patch(route('system-settings.workflow-reviewers.quote.update'), $groups)->assertRedirect();
|
|
$this->assertTrue($permissions->allowsSelfReview($this->people['init-one']->id));
|
|
$this->loginAs($this->people['init-one'], $this->company)->post(route('business.courier-quote-changes.approve', $change))->assertRedirect();
|
|
$this->assertSame('approved', $change->fresh()->status);
|
|
$permissions->save(['initiators' => ['init-one', 'init-two'], 'reviewers' => ['review-one']], 'revoke', $this->user->id);
|
|
$this->assertFalse($permissions->allowsSelfReview($this->people['init-one']->id));
|
|
$this->assertSame([], $permissions->settings()['self_reviewers']);
|
|
}
|
|
|
|
public function test_withdraw_requires_current_initiator_and_owner_then_allows_edit_and_resubmit(): void
|
|
{
|
|
$change = $this->pending();
|
|
$this->withExceptionHandling()->loginAs($this->people['init-two'], $this->company)
|
|
->post(route('business.courier-quote-changes.withdraw', $change))->assertForbidden();
|
|
$this->loginAs($this->people['review-one'], $this->company)
|
|
->get(route('business.courier-quote-changes.show', $change))->assertOk()->assertDontSee('action="' . route('business.courier-quote-changes.withdraw', $change) . '"', false);
|
|
$this->post(route('business.courier-quote-changes.withdraw', $change))->assertForbidden();
|
|
$permissions = app(CourierQuoteWorkflowPermissions::class);
|
|
$permissions->save(['initiators' => ['init-two'], 'reviewers' => ['review-one']], 'revoke initiator', $this->user->id);
|
|
$this->loginAs($this->people['init-one'], $this->company)
|
|
->post(route('business.courier-quote-changes.withdraw', $change))->assertForbidden();
|
|
$permissions->save($this->permissionGroups(), 'restore', $this->user->id);
|
|
$this->post(route('business.courier-quote-changes.withdraw', $change))->assertRedirect(route('business.courier-quote-changes.edit', $change));
|
|
$draft = $change->fresh(['items', 'events']);
|
|
$this->assertSame('draft', $draft->status);
|
|
$this->assertNull($draft->submitted_at);
|
|
$this->assertNull($draft->submitted_by);
|
|
$this->assertSame('6.0000', $draft->items->first()->new_amount);
|
|
$this->assertSame('withdrawn', $draft->events->last()->event_type);
|
|
$this->assertSame('撤回修改', $draft->events->last()->eventLabel());
|
|
$this->post(route('business.courier-quote-changes.withdraw', $change))->assertSessionHasErrors('status');
|
|
try {
|
|
app(\App\Support\CourierQuoteChangeService::class)->approve($change, $this->people['review-one']->id);
|
|
$this->fail('Stale pending model must not approve withdrawn draft');
|
|
} catch (\Illuminate\Validation\ValidationException $exception) {
|
|
$this->assertArrayHasKey('status', $exception->errors());
|
|
}
|
|
$payload = $this->payload();
|
|
$payload['items'][0]['new_amount'] = '6.1234';
|
|
$this->patch(route('business.courier-quote-changes.update', $draft), $payload)->assertRedirect();
|
|
$this->post(route('business.courier-quote-changes.submit', $draft))->assertRedirect();
|
|
$pending = $draft->fresh();
|
|
$this->loginAs($this->people['review-one'], $this->company)
|
|
->post(route('business.courier-quote-changes.approve', $pending))->assertRedirect();
|
|
$this->loginAs($this->people['init-one'], $this->company)
|
|
->post(route('business.courier-quote-changes.withdraw', $pending))->assertSessionHasErrors('status');
|
|
$this->get(route('business.courier-quote-changes.show', $change))->assertOk()->assertDontSee('action="' . route('business.courier-quote-changes.withdraw', $change) . '"', false);
|
|
$this->assertSame('approved', $change->fresh()->status);
|
|
$this->assertSame('6.1234', $change->fresh()->items->first()->new_amount);
|
|
}
|
|
|
|
public function test_onboarded_courier_requote_entry_and_submission_use_the_same_initiator_list(): void
|
|
{
|
|
$quote = ['quote_mode' => 'waybill_rate', 'volumetric_rule' => '计泡', 'volumetric_divisor' => 6000,
|
|
'quote_effective_date' => now()->addDay()->toDateString(),
|
|
'quote_rows' => [['region' => '江苏', 'base' => '3.2', 'rates' => ['0.8']]]];
|
|
$onboarding = CourierOnboarding::create([
|
|
'company_id' => $this->company->id, 'number' => 'RZ-PERMISSIONS', 'token' => str_repeat('q', 40),
|
|
'status' => CourierOnboarding::STATUS_ACTIVATED, 'courier_name' => '权限测试快递',
|
|
...app(CourierOnboardingService::class)->quoteAttributes($quote),
|
|
]);
|
|
$quote['quote_rows'][0]['base'] = '3.5';
|
|
$quote['summary'] = '测试变价发起人员权限';
|
|
foreach (['review-one', 'review-two'] as $id) {
|
|
$this->withExceptionHandling()->loginAs($this->people[$id], $this->company)
|
|
->get(route('business.courier-onboardings.requote', $onboarding))->assertForbidden();
|
|
$this->post(route('business.courier-onboardings.requote.store', $onboarding), $quote)->assertForbidden();
|
|
}
|
|
$this->assertDatabaseCount('business_courier_quote_changes', 0);
|
|
$this->loginAs($this->people['init-two'], $this->company)
|
|
->get(route('business.courier-onboardings.requote', $onboarding))->assertOk();
|
|
$this->post(route('business.courier-onboardings.requote.store', $onboarding), $quote)->assertSessionHasNoErrors()->assertRedirect();
|
|
$change = CourierQuoteChange::firstOrFail();
|
|
$this->assertSame('pending_review', $change->status);
|
|
$this->assertSame($this->people['init-two']->id, $change->created_by);
|
|
$this->get(route('business.courier-quote-changes.export', $change))->assertOk()->assertHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
|
|
$book = app(\App\Support\CourierQuoteChangeExport::class)->build($change);
|
|
$this->assertSame('江苏', $book->getSheetByName('横向变价对比')->getCell('A9')->getValue());
|
|
$this->assertEquals(3.2, $book->getSheetByName('横向变价对比')->getCell('B9')->getValue());
|
|
$this->assertEquals(3.5, $book->getSheetByName('横向变价对比')->getCell('C9')->getValue());
|
|
$this->assertNotNull($book->getSheetByName('原报价全表'));
|
|
$this->assertNotNull($book->getSheetByName('新报价全表'));
|
|
$book->disconnectWorksheets();
|
|
$this->post(route('business.courier-quote-changes.withdraw', $change))->assertRedirect();
|
|
$this->get(route('business.courier-quote-changes.edit', $change))->assertRedirect(route('business.courier-onboardings.requote', $onboarding));
|
|
$this->get(route('business.courier-onboardings.requote', $onboarding))->assertOk()->assertSee('3.5');
|
|
$this->withExceptionHandling()->loginAs($this->people['init-one'], $this->company)
|
|
->post(route('business.courier-onboardings.requote.store', $onboarding), $quote)->assertForbidden();
|
|
$this->loginAs($this->people['init-two'], $this->company)
|
|
->post(route('business.courier-onboardings.requote.store', $onboarding), $quote)->assertSessionHasNoErrors()->assertRedirect();
|
|
$this->assertSame('pending_review', $change->fresh()->status);
|
|
$this->assertDatabaseCount('business_courier_quote_changes', 1);
|
|
}
|
|
|
|
public function test_settings_can_be_saved_and_searched_only_by_administrators_and_are_audited(): void
|
|
{
|
|
$this->loginAs()->get(route('system-settings.workflow-reviewers.index'))->assertOk()->assertSeeText('报价变价发起和审核人员');
|
|
$this->patch(route('system-settings.workflow-reviewers.quote.update'), $this->permissionGroups())->assertRedirect();
|
|
$this->assertCount(2, app(CourierQuoteWorkflowPermissions::class)->history());
|
|
$this->getJson(route('system-settings.workflow-reviewers.search', ['q' => '审核', 'workflow' => 'quote']))->assertOk()->assertJsonPath('people.0.selectable', true);
|
|
$this->withExceptionHandling()->loginAs($this->people['review-one'], $this->company)
|
|
->patch(route('system-settings.workflow-reviewers.quote.update'), $this->permissionGroups())->assertForbidden();
|
|
$this->getJson(route('system-settings.workflow-reviewers.search', ['q' => '审核', 'workflow' => 'quote']))->assertForbidden();
|
|
}
|
|
|
|
public function test_disabled_departed_unbound_and_cross_company_candidates_fail_without_writing(): void
|
|
{
|
|
$this->eligible = false;
|
|
$this->withExceptionHandling()->loginAs()->patch(route('system-settings.workflow-reviewers.quote.update'), $this->permissionGroups())->assertSessionHasErrors('initiators');
|
|
$this->eligible = true;
|
|
$this->patch(route('system-settings.workflow-reviewers.quote.update'), ['initiators' => ['init-one'], 'reviewers' => ['unbound']])->assertSessionHasErrors('reviewers');
|
|
$this->patch(route('system-settings.workflow-reviewers.quote.update'), ['initiators' => ['init-one'], 'reviewers' => ['init-one']])->assertSessionHasErrors('reviewers');
|
|
$other = Company::create(['enabled' => true]);
|
|
$other->makeCurrent();
|
|
$permissions = app(CourierQuoteWorkflowPermissions::class);
|
|
$this->assertFalse($permissions->settings()['configured']);
|
|
try {
|
|
$permissions->save($this->permissionGroups(), 'other admin', null);
|
|
$this->fail('Cross-company people must not be assigned');
|
|
} catch (\Illuminate\Validation\ValidationException $e) {
|
|
$this->assertArrayHasKey('initiators', $e->errors());
|
|
}
|
|
$this->assertCount(0, $permissions->history());
|
|
$this->company->makeCurrent();
|
|
$this->assertCount(1, $permissions->history());
|
|
}
|
|
}
|