Kevin Adametz
05cf53e17d
- Fortifys sieben 2FA-Verwaltungsrouten antworten mit 404 (Middleware über fortify.middleware); die Sicherheitsseite verlangt weiter den zweiten Faktor (U09) - PressReleasePolicy/CompanyPolicy::before() bejahen nur aktive Super-Admins (7.2) - API-Update prüft bei Portalwechsel die bestehende Kategorie gegen das neue Portal (U10) - Aggregation: Zeitbudget 480 s unter dem Lock von 600 s, Marke nur unter Zeilensperre vom erwarteten Stand aus, sonst Fehler-Exit (U13) - Newsletter-Bereinigungsmigration behält je Paar die sent-Zeile (U08) - E-Mail-Wechsel stößt den Rechte-Sync sofort an; company-memberships:audit --classify zeigt vorher die Kandidaten und begrenzt mit --before (7.1) - Detailseite wählt bei Slug-Kollision wie der Melde-Resolver (7.5) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
102 lines
3.5 KiB
PHP
102 lines
3.5 KiB
PHP
<?php
|
|
|
|
use App\Models\Company;
|
|
use App\Models\PressRelease;
|
|
use App\Models\User;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use Tests\TestCase;
|
|
|
|
test('active admin and editor users can access admin area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
|
|
$editor = User::factory()->create(['is_active' => true]);
|
|
$editor->assignRole('editor');
|
|
|
|
expect($admin->canAccessAdmin())->toBeTrue();
|
|
expect($editor->canAccessAdmin())->toBeTrue();
|
|
});
|
|
|
|
test('inactive users cannot access admin area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$admin = User::factory()->create(['is_active' => false]);
|
|
$admin->assignRole('admin');
|
|
|
|
expect($admin->canAccessAdmin())->toBeFalse();
|
|
});
|
|
|
|
test('super admin can access admin area without role', function () {
|
|
$user = User::factory()->create([
|
|
'is_active' => true,
|
|
'is_super_admin' => true,
|
|
]);
|
|
|
|
expect($user->canAccessAdmin())->toBeTrue();
|
|
});
|
|
|
|
test('active customer and staff users can access customer area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$customer = User::factory()->create(['is_active' => true]);
|
|
$customer->assignRole('customer');
|
|
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
|
|
expect($customer->canAccessCustomer())->toBeTrue();
|
|
expect($admin->canAccessCustomer())->toBeTrue();
|
|
});
|
|
|
|
test('api-only and inactive users cannot access customer area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$apiOnly = User::factory()->create(['is_active' => true]);
|
|
$apiOnly->assignRole('api-only');
|
|
|
|
$inactiveCustomer = User::factory()->create(['is_active' => false]);
|
|
$inactiveCustomer->assignRole('customer');
|
|
|
|
expect($apiOnly->canAccessCustomer())->toBeFalse();
|
|
expect($inactiveCustomer->canAccessCustomer())->toBeFalse();
|
|
});
|
|
|
|
test('a deactivated super admin is locked out of both panels despite the gate shortcut (Audit F09)', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create([
|
|
'is_active' => false,
|
|
'is_super_admin' => true,
|
|
]);
|
|
|
|
expect($user->canAccessAdmin())->toBeFalse();
|
|
expect(Gate::forUser($user)->allows('access-admin'))->toBeFalse();
|
|
expect(Gate::forUser($user)->allows('access-customer'))->toBeFalse();
|
|
|
|
$this->actingAs($user)->get(route('dashboard'))->assertForbidden();
|
|
$this->actingAs($user)->get(route('me.dashboard'))->assertForbidden();
|
|
});
|
|
|
|
test('a deactivated super admin is not whitelisted by the policy shortcuts either (Audit 7.2)', function () {
|
|
$user = User::factory()->create([
|
|
'is_active' => false,
|
|
'is_super_admin' => true,
|
|
]);
|
|
$pressRelease = PressRelease::factory()->create();
|
|
$company = Company::factory()->create();
|
|
|
|
expect(Gate::forUser($user)->allows('update', $pressRelease))->toBeFalse()
|
|
->and(Gate::forUser($user)->allows('view', $pressRelease))->toBeFalse()
|
|
->and(Gate::forUser($user)->allows('update', $company))->toBeFalse()
|
|
->and(Gate::forUser($user)->allows('view', $company))->toBeFalse();
|
|
|
|
$user->forceFill(['is_active' => true])->save();
|
|
|
|
expect(Gate::forUser($user->fresh())->allows('update', $pressRelease))->toBeTrue();
|
|
});
|