Kevin Adametz
2cde7284a1
- 83 Komponenten: Livewire\Volt\Component → Livewire\Component
- 73 Routen (admin, auth, customer): Volt::route() → Route::livewire()
- 88 Testdateien: Volt::test/actingAs → Livewire::test/actingAs
- VoltServiceProvider gelöscht; composer remove livewire/volt
- config/livewire.php auf v4-Schlüssel (component_layout, component_placeholder,
component_locations, make_command: SFC ohne ⚡). Der alte Schlüssel layout war
wirkungslos; alle gerouteten Komponenten setzen ihr Layout selbst.
- CLAUDE.md, AGENTS.md, boost.json, .cursorrules, Skill volt-development
- Roadmap: erledigt; Larastan erfasst SFCs weiterhin nicht (Blade-Dateien)
Suite 2.325 grün, einer übersprungen; Larastan und Pint ohne Meldung;
route:cache und view:cache laufen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
124 lines
3.8 KiB
PHP
124 lines
3.8 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\Api\Legacy\LegacyPressReleaseController;
|
|
use App\Models\AppSetting;
|
|
use App\Models\Company;
|
|
use App\Models\Contact;
|
|
use App\Models\User;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Livewire\Livewire;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Regression zu Befund H2 (Audit 14.07.2026): Die Rolle `editor` behält ihre
|
|
* Content-Rechte (PMs), darf aber keine destruktiven CRM-/Billing-/Compliance-/
|
|
* Struktur-Aktionen ausführen. Gekoppelt an die neuen Seeder-Permissions
|
|
* companies:write / categories:manage / footer-codes:manage / billing:manage /
|
|
* compliance:manage.
|
|
*/
|
|
beforeEach(function () {
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
});
|
|
|
|
function editorActor(): User
|
|
{
|
|
$editor = User::factory()->create();
|
|
$editor->assignRole('editor');
|
|
|
|
return $editor;
|
|
}
|
|
|
|
test('editor is blocked from admin-only management pages', function () {
|
|
/** @var TestCase $this */
|
|
$this->actingAs(editorActor());
|
|
|
|
foreach ([
|
|
'admin/categories',
|
|
'admin/categories/create',
|
|
'admin/footer-codes',
|
|
'admin/footer-codes/create',
|
|
'admin/payments',
|
|
'admin/coupons',
|
|
'admin/invoices',
|
|
'admin/legal-requests',
|
|
'admin/contact-messages',
|
|
] as $path) {
|
|
$this->get("https://pressekonto.test/{$path}")->assertForbidden();
|
|
}
|
|
});
|
|
|
|
test('editor keeps access to content and read-only CRM pages', function () {
|
|
/** @var TestCase $this */
|
|
$this->actingAs(editorActor());
|
|
|
|
$this->get('https://pressekonto.test/admin/press-releases')->assertSuccessful();
|
|
$this->get('https://pressekonto.test/admin/companies')->assertSuccessful();
|
|
$this->get('https://pressekonto.test/admin/contacts')->assertSuccessful();
|
|
});
|
|
|
|
test('editor cannot open company write forms', function () {
|
|
/** @var TestCase $this */
|
|
$company = Company::factory()->presseecho()->create();
|
|
$this->actingAs(editorActor());
|
|
|
|
$this->get('https://pressekonto.test/admin/companies/create')->assertForbidden();
|
|
$this->get("https://pressekonto.test/admin/companies/{$company->id}/edit")->assertForbidden();
|
|
});
|
|
|
|
test('editor cannot delete a contact from the index', function () {
|
|
/** @var TestCase $this */
|
|
$company = Company::factory()->presseecho()->create();
|
|
$contact = Contact::factory()->for($company)->create();
|
|
|
|
$this->actingAs(editorActor());
|
|
|
|
Livewire::test('admin.contacts.index')
|
|
->call('deleteContactFromIndex', $contact->id)
|
|
->assertForbidden();
|
|
|
|
expect(Contact::query()->whereKey($contact->id)->exists())->toBeTrue();
|
|
});
|
|
|
|
test('editor cannot invoke admin-only livewire actions directly', function () {
|
|
/** @var TestCase $this */
|
|
$this->actingAs(editorActor());
|
|
|
|
Livewire::test('admin.categories.create')
|
|
->call('save')
|
|
->assertForbidden();
|
|
|
|
Livewire::test('admin.footer-codes.create')
|
|
->call('save')
|
|
->assertForbidden();
|
|
|
|
Livewire::test('admin.payments.index')
|
|
->call('cancelBundle', 999_999)
|
|
->assertForbidden();
|
|
|
|
Livewire::test('admin.legal-requests.index')
|
|
->call('resolveWithdrawal', 999_999)
|
|
->assertForbidden();
|
|
|
|
Livewire::test('admin.press-releases.index')
|
|
->set('legacyApiAiReview', true)
|
|
->assertForbidden();
|
|
|
|
expect(AppSetting::getBool(LegacyPressReleaseController::SETTING_AI_REVIEW))->toBeFalse();
|
|
});
|
|
|
|
test('admin retains access to all restricted management pages', function () {
|
|
/** @var TestCase $this */
|
|
$admin = User::factory()->create();
|
|
$admin->assignRole('admin');
|
|
$this->actingAs($admin);
|
|
|
|
foreach ([
|
|
'admin/categories',
|
|
'admin/footer-codes',
|
|
'admin/invoices',
|
|
'admin/legal-requests',
|
|
'admin/contact-messages',
|
|
] as $path) {
|
|
$this->get("https://pressekonto.test/{$path}")->assertSuccessful();
|
|
}
|
|
});
|