presseportale/tests/Feature/Legal/AdminLegalRequestExecutionTest.php

<?php

use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Enums\PressReleaseStatus;
use App\Mail\LegalRequestExecuted;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Models\User;
use App\Services\PressRelease\AnonymizationService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Mail;
use Livewire\Volt\Volt;
use Tests\TestCase;

beforeEach(function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);
});

function adminUserForLegalQueue(): User
{
    $admin = User::factory()->create(['is_active' => true]);
    $admin->assignRole('admin');

    return $admin;
}

test('an admin can preview and execute an anonymization from the queue', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create([
        'title' => 'Matvey Teplitsky im Vorstand',
    ]);
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create(['press_release_id' => $pressRelease->id]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->set('redactionTerms', "Matvey Teplitsky\nTeplitsky")
        ->set('redactionReplacement', 'der Sprecher')
        ->call('previewAnonymization')
        ->assertHasNoErrors()
        ->call('executeAnonymization')
        ->assertHasNoErrors();

    $pressRelease->refresh();
    $request->refresh();

    expect($pressRelease->title)->toBe('der Sprecher im Vorstand')
        ->and($pressRelease->isSyncLocked())->toBeTrue()
        ->and($request->status)->toBe(LegalRequestStatus::Resolved)
        ->and($request->executed_at)->not->toBeNull();
});

test('the panel prefills the replacement and shows the full content for copying terms', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create([
        'title' => 'Matvey Teplitsky im Vorstand',
        'text' => '<p>Ansprechpartner ist Matvey Teplitsky, Telefon 0123.</p>',
    ]);
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create(['press_release_id' => $pressRelease->id]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->assertSet('redactionReplacement', AnonymizationService::DEFAULT_REPLACEMENT)
        ->assertSee('Ansprechpartner ist Matvey Teplitsky')
        ->set('redactionTerms', 'Matvey Teplitsky')
        ->call('previewAnonymization')
        ->assertHasNoErrors()
        ->assertSee('Ansprechpartner ist [entfernt]')
        ->assertSee('Vorschau nach Schwärzung');

    expect($pressRelease->fresh()->title)->toBe('Matvey Teplitsky im Vorstand');
});

test('the editor is prefilled from a structured web redaction order', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create();
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create([
            'press_release_id' => $pressRelease->id,
            'payload' => [
                'source' => 'self_service',
                'concern' => 'dsgvo',
                'redaction' => [
                    'terms' => ['Max Mustermann', 'Mustermanns'],
                    'detach_contacts' => false,
                    'remove_images_requested' => true,
                    'preview_total_hits' => 3,
                ],
            ],
        ]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->assertSet('redactionTerms', "Max Mustermann\nMustermanns")
        ->assertSet('detachContacts', false)
        ->assertSee('Strukturierter Schwärzungsauftrag')
        ->assertSee('Entfernung von Bildern mit Personenbezug');
});

test('executing sends an execution confirmation to the requester', function () {
    /** @var TestCase $this */
    Mail::fake();
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create([
        'title' => 'Matvey Teplitsky im Vorstand',
    ]);
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create([
            'press_release_id' => $pressRelease->id,
            'requester_email' => 'presse@firma.example',
        ]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->set('redactionTerms', 'Matvey Teplitsky')
        ->call('previewAnonymization')
        ->call('executeAnonymization')
        ->assertHasNoErrors();

    Mail::assertQueued(LegalRequestExecuted::class, function (LegalRequestExecuted $mail) {
        return $mail->hasTo('presse@firma.example') && $mail->action === 'anonymized';
    });
});

test('execute without a prior preview is refused', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create(['title' => 'Original']);
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create(['press_release_id' => $pressRelease->id]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->set('redactionTerms', 'Original')
        ->call('executeAnonymization')
        ->assertHasErrors('redactionTerms');

    expect($pressRelease->fresh()->title)->toBe('Original')
        ->and($request->fresh()->executed_at)->toBeNull();
});

test('an admin can depublish instead of anonymizing', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create();
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create(['press_release_id' => $pressRelease->id]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->call('depublishRelease')
        ->assertHasNoErrors();

    $pressRelease->refresh();
    $request->refresh();

    expect($pressRelease->status)->toBe(PressReleaseStatus::Archived)
        ->and($pressRelease->depublished_at)->not->toBeNull()
        ->and($pressRelease->isSyncLocked())->toBeTrue()
        ->and($request->status)->toBe(LegalRequestStatus::Resolved)
        ->and($request->executed_at)->not->toBeNull();
});

test('an executed anonymization can be rolled back from the snapshot', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());

    $pressRelease = PressRelease::factory()->published()->create([
        'title' => 'Matvey Teplitsky im Vorstand',
    ]);
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create(['press_release_id' => $pressRelease->id]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->set('redactionTerms', 'Matvey Teplitsky')
        ->call('previewAnonymization')
        ->call('executeAnonymization')
        ->assertHasNoErrors()
        ->call('restoreSnapshot')
        ->assertHasNoErrors();

    $pressRelease->refresh();
    $request->refresh();

    expect($pressRelease->title)->toBe('Matvey Teplitsky im Vorstand')
        ->and($pressRelease->isSyncLocked())->toBeTrue()
        ->and($request->status)->toBe(LegalRequestStatus::InProgress)
        ->and($request->executed_at)->toBeNull();
});

test('anonymization actions are forbidden without the compliance permission', function () {
    /** @var TestCase $this */
    $customer = User::factory()->create(['is_active' => true]);
    $customer->assignRole('customer');
    $this->actingAs($customer);

    $pressRelease = PressRelease::factory()->published()->create(['title' => 'Original']);
    $request = LegalRequest::factory()
        ->type(LegalRequestType::Dsgvo)
        ->create(['press_release_id' => $pressRelease->id]);

    Volt::test('admin.legal-requests.show', ['id' => $request->id])
        ->set('redactionTerms', 'Original')
        ->call('previewAnonymization')
        ->assertForbidden();

    expect($pressRelease->fresh()->title)->toBe('Original');
});