Kevin Adametz
1d76f5a733
Audit vom 11.09. gegen HEAD geprüft, Entwicklungsplan dazu unter dev/2026-09-11-audit/ENTWICKLUNGSPLAN.md. Dieser Commit ist Deploy A: die sechs kleinen Punkte aus Block 1 ohne Schemaänderung. F01: Der Fortify-Endpunkt PUT /user/profile-information tauschte die E-Mail sofort und setzte die Verifizierung zurück; der Login-Sync vergab danach Firmenrechte allein nach E-Mail-Treffer. Feature abgeschaltet (die Kunden-UI hat den pending_email-Prozess), und der Sync verlangt jetzt ein verifiziertes, aktives Konto – für alle Aufrufer. F02: Google-Login übergibt Konten mit bestätigtem TOTP in die Challenge, wie Passwort- und Magic-Link-Login. F03: showRecoveryCodes ist gesperrt; ein Client-Update konnte die Recovery-Codes entschlüsseln lassen. F08: Nutzer-Detailroute unter can:users:manage (persistente Livewire- Middleware), Gutschriften autorisieren zusätzlich in der Action. F09: Gate::before greift nur für aktive Super-Admins; deaktivierte fallen auf die Gates mit is_active-Prüfung zurück. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
82 lines
2.6 KiB
PHP
82 lines
2.6 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use Tests\TestCase;
|
|
|
|
test('active admin and editor users can access admin area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
|
|
$editor = User::factory()->create(['is_active' => true]);
|
|
$editor->assignRole('editor');
|
|
|
|
expect($admin->canAccessAdmin())->toBeTrue();
|
|
expect($editor->canAccessAdmin())->toBeTrue();
|
|
});
|
|
|
|
test('inactive users cannot access admin area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$admin = User::factory()->create(['is_active' => false]);
|
|
$admin->assignRole('admin');
|
|
|
|
expect($admin->canAccessAdmin())->toBeFalse();
|
|
});
|
|
|
|
test('super admin can access admin area without role', function () {
|
|
$user = User::factory()->create([
|
|
'is_active' => true,
|
|
'is_super_admin' => true,
|
|
]);
|
|
|
|
expect($user->canAccessAdmin())->toBeTrue();
|
|
});
|
|
|
|
test('active customer and staff users can access customer area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$customer = User::factory()->create(['is_active' => true]);
|
|
$customer->assignRole('customer');
|
|
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
|
|
expect($customer->canAccessCustomer())->toBeTrue();
|
|
expect($admin->canAccessCustomer())->toBeTrue();
|
|
});
|
|
|
|
test('api-only and inactive users cannot access customer area', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$apiOnly = User::factory()->create(['is_active' => true]);
|
|
$apiOnly->assignRole('api-only');
|
|
|
|
$inactiveCustomer = User::factory()->create(['is_active' => false]);
|
|
$inactiveCustomer->assignRole('customer');
|
|
|
|
expect($apiOnly->canAccessCustomer())->toBeFalse();
|
|
expect($inactiveCustomer->canAccessCustomer())->toBeFalse();
|
|
});
|
|
|
|
test('a deactivated super admin is locked out of both panels despite the gate shortcut (Audit F09)', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create([
|
|
'is_active' => false,
|
|
'is_super_admin' => true,
|
|
]);
|
|
|
|
expect($user->canAccessAdmin())->toBeFalse();
|
|
expect(Gate::forUser($user)->allows('access-admin'))->toBeFalse();
|
|
expect(Gate::forUser($user)->allows('access-customer'))->toBeFalse();
|
|
|
|
$this->actingAs($user)->get(route('dashboard'))->assertForbidden();
|
|
$this->actingAs($user)->get(route('me.dashboard'))->assertForbidden();
|
|
});
|