presseportale/tests/Feature/Billing/BookingsPageTest.php
Kevin Adametz c7bd940f28 Optimierung Phase 0: Korrektheit & Security
Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):

0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
    Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
    statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
    Config-Block + .env.example. Fund: auth.basic.* war nie als Config
    definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
    scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
    umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
    UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
    hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
    und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
    Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
    geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
    b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
    (Unique-Index auf circle existiert bereits). CreditWalletService war
    bereits abgesichert (Unique-Index + createOrFirst).

Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-19 08:09:02 +00:00

285 lines
9.9 KiB
PHP

<?php
use App\Enums\UserPaymentOptionStatus;
use App\Models\BillingAddress;
use App\Models\Plan;
use App\Models\SinglePurchase;
use App\Models\User;
use App\Models\UserPaymentOption;
use App\Services\Billing\CreditWalletService;
use App\Services\Billing\StripeCheckoutService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Livewire\Volt\Volt as LivewireVolt;
use Tests\TestCase;
beforeEach(function (): void {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
});
function bookingsTestCustomer(): User
{
$user = User::factory()->create();
$user->assignRole('customer');
return $user;
}
test('the bookings page renders the active plans with checkout links', function () {
/** @var TestCase $this */
Plan::factory()->create([
'name' => 'Business',
'slug' => 'business',
'monthly_price_cents' => 4900,
'yearly_price_cents' => 49000,
'press_release_quota' => 10,
'daily_limit' => 2,
]);
Plan::factory()->inactive()->create(['name' => 'Versteckt']);
$user = bookingsTestCustomer();
BillingAddress::factory()->create(['user_id' => $user->id]);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Business')
->assertSee('49 €')
->assertSee('490 €')
->assertSee('Pressemitteilungen pro Monat')
->assertSee('max. 2 Veröffentlichungen pro Tag')
->assertSee('2 Monate gratis')
->assertDontSee('Versteckt')
// Buchung läuft über das Bestätigungs-Modal (selectBooking → Checkout-URL).
->call('selectBooking', 'subscription', 'business', 'monthly')
->assertSee(route('me.checkout.subscription', ['planSlug' => 'business', 'interval' => 'monthly']), false);
});
test('the plan card renders the maintained benefits list', function () {
/** @var TestCase $this */
Plan::factory()->create([
'name' => 'Business',
'slug' => 'business',
'press_release_quota' => 10,
'benefits' => ['Günstigere Extra-Pressemitteilungen', 'Boost-Platzierung vergünstigt'],
]);
$user = bookingsTestCustomer();
BillingAddress::factory()->create(['user_id' => $user->id]);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Günstigere Extra-Pressemitteilungen')
->assertSee('Boost-Platzierung vergünstigt');
});
test('the single pm block links to its checkout', function () {
/** @var TestCase $this */
config()->set('billing.single_pm_stripe_price_id', 'price_test_single_pm');
$user = bookingsTestCustomer();
BillingAddress::factory()->create(['user_id' => $user->id]);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Einzel-Pressemitteilung — ohne Abo')
->assertSee('19 €')
->call('selectBooking', 'single_pm')
->assertSee('Buchung bestätigen')
->assertSee('zzgl. 19 % USt.')
->assertSee(route('me.checkout.single-pm'), false);
});
test('without any booking the current tariff card is hidden', function () {
/** @var TestCase $this */
$this->actingAs(bookingsTestCustomer());
LivewireVolt::test('customer.bookings')
->assertDontSee('Aktueller Tarif')
->assertSee('Den passenden Tarif wählen')
->assertSee('Noch kein Buchungsverlauf');
});
test('a subscriber sees the current plan and the manage button', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
$plan = Plan::factory()->create([
'name' => 'Pro',
'press_release_quota' => 25,
'stripe_price_id_monthly' => 'price_test_m_pro',
]);
subscribeUserToPlan($user, $plan);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Ihr aktueller Tarif')
->assertSee('Abo verwalten')
->assertSee('Pressemitteilungen pro Monat')
->assertSee(route('me.checkout.billing-portal'), false);
});
test('a grandfathered legacy user sees the bestandsschutz package with portal and unlimited quota', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
UserPaymentOption::factory()->create([
'user_id' => $user->id,
'status' => UserPaymentOptionStatus::Grandfathered->value,
'current_period_end' => now()->addMonths(3),
'grandfathered_until' => now()->addYear(),
'legacy_conditions' => [
'name' => 'Presseverteiler Premium',
'legacy_portal' => 'presseecho',
'net_cents' => 100000,
'interval' => 'yearly',
],
]);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Ihr Bestandsschutz')
->assertSee('Bestandsschutz')
->assertSee('Presseverteiler Premium')
// Portal wird jetzt angezeigt.
->assertSee('Presseecho')
->assertSee('Unbegrenzte');
});
test('open and consumed single purchases appear in the card and history', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
SinglePurchase::factory()->paid()->create(['user_id' => $user->id]);
SinglePurchase::factory()->consumed()->create(['user_id' => $user->id]);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Einzel-Pressemitteilung verfügbar')
->assertSee('eingelöst am');
});
test('the billing portal redirects without an active subscription', function () {
/** @var TestCase $this */
$this->actingAs(bookingsTestCustomer())
->get(route('me.checkout.billing-portal'))
->assertRedirect(route('me.bookings.index'))
->assertSessionHas('checkout-notice');
});
test('the billing portal forwards a subscriber to stripe', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
$user->forceFill(['stripe_id' => 'cus_test_portal'])->save();
$plan = Plan::factory()->create(['stripe_price_id_monthly' => 'price_test_m_portal']);
subscribeUserToPlan($user, $plan);
$this->mock(StripeCheckoutService::class, function ($mock) {
$mock->shouldReceive('billingPortalUrl')
->once()
->andReturn('https://billing.stripe.com/p/session/test');
});
$this->actingAs($user)
->get(route('me.checkout.billing-portal'))
->assertRedirect('https://billing.stripe.com/p/session/test');
});
test('the checkout success banner is shown after returning from stripe', function () {
/** @var TestCase $this */
$this->actingAs(bookingsTestCustomer())
->get(route('me.bookings.index', ['checkout' => 'erfolg']))
->assertOk()
->assertSee('Vielen Dank für Ihre Buchung!');
});
test('the wallet block shows the balance and the credit pack topup links', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
BillingAddress::factory()->create(['user_id' => $user->id]);
app(CreditWalletService::class)->credit($user, 30);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Credit-Wallet & Add-ons')
->assertSee('30')
->assertSee('27 Credits') // Bonus-Paket
->assertSee('Preisliste')
->assertSee('Was kostet wie viel')
->assertDontSee('Prüfkontingent') // Phase 2 — vorerst ausgeblendet
// Paket-Kauf läuft über das Bestätigungs-Modal.
->call('selectBooking', 'credit_pack', 'p25')
->assertSee(route('me.checkout.credit-topup', ['pack' => 'p25']), false);
});
test('the extra pm card is hidden without credits and without a subscription', function () {
/** @var TestCase $this */
$this->actingAs(bookingsTestCustomer());
LivewireVolt::test('customer.bookings')
->assertDontSee('Aus Guthaben buchen') // Extra-PM-Karte ausgeblendet
->assertSee('Was kostet wie viel'); // Preis ergibt sich aus der Preisliste
});
test('the extra pm card appears once the wallet has credits', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
app(CreditWalletService::class)->credit($user, 20);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertSee('Aus Guthaben buchen');
});
test('a missing billing address shows the proactive banner with a profile link', function () {
/** @var TestCase $this */
$this->actingAs(bookingsTestCustomer());
LivewireVolt::test('customer.bookings')
->assertSee('Rechnungsadresse fehlt')
->assertSee(route('me.profile'), false);
});
test('with a billing address the banner is gone and the booking modal offers the stripe link', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
BillingAddress::factory()->create(['user_id' => $user->id]);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->assertDontSee('Rechnungsadresse fehlt')
->call('selectBooking', 'single_pm')
->assertSee('Kostenpflichtig buchen')
->assertSee(route('me.checkout.single-pm'), false);
});
test('buying an extra pm from the wallet succeeds with enough credits', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
app(CreditWalletService::class)->credit($user, 25);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->call('buyExtraPm')
->assertSee('Extra-Pressemitteilung gebucht');
expect($user->fresh()->creditBalance())->toBe(6); // 25 - 19 (Einzel-Tier)
expect($user->singlePurchases()->grantingSubmission()->count())->toBe(1);
});
test('buying an extra pm without enough credits shows the mini checkout hint', function () {
/** @var TestCase $this */
$user = bookingsTestCustomer();
app(CreditWalletService::class)->credit($user, 8);
$this->actingAs($user);
LivewireVolt::test('customer.bookings')
->call('buyExtraPm')
->assertSee('Bitte laden Sie mindestens 11 Credits nach');
expect($user->singlePurchases()->count())->toBe(0);
});