presseportale/tests/Feature/Api/LegacyApiCompatibilityTest.php

<?php

use App\Enums\Portal;
use App\Enums\UserPaymentOptionStatus;
use App\Models\PaymentOption;
use App\Models\User;
use App\Models\UserPaymentOption;
use App\Services\Api\LegacyApiKeyImporter;
use Laravel\Sanctum\PersonalAccessToken;
use Tests\TestCase;

/**
 * Übernahme bestehender Legacy-API-Integrationen (06.07.2026): importierte
 * api_keys bleiben gültig, alte Übergabeformen (X-ApiKey/api_key) und die
 * dokumentierten /service/…-Pfade funktionieren weiter.
 */
function eligibleLegacyApiUser(int $legacyId = 4711): User
{
    $user = User::factory()->create([
        'is_active' => true,
        'portal' => Portal::Businessportal24,
        'legacy_portal' => 'businessportal24',
        'legacy_id' => $legacyId,
    ]);

    // Aktiver Zahlungsstatus → API-berechtigt (ApiAccessEligibilityService).
    UserPaymentOption::factory()->create([
        'user_id' => $user->id,
        'payment_option_id' => PaymentOption::factory()->create()->id,
        'status' => UserPaymentOptionStatus::Grandfathered->value,
        'grandfathered_until' => null,
        'current_period_start' => now()->subMonth(),
        'current_period_end' => now()->addMonths(11),
        'stripe_subscription_id' => null,
    ]);

    return $user;
}

test('the importer turns legacy api keys into sanctum tokens idempotently', function () {
    $user = eligibleLegacyApiUser();

    // Nicht berechtigter Kandidat (inaktiv) und unbekanntes Legacy-Mapping.
    $inactive = User::factory()->create([
        'is_active' => false,
        'legacy_portal' => 'businessportal24',
        'legacy_id' => 999,
    ]);

    $rows = [
        ['legacy_id' => 4711, 'api_key' => 'legacy-key-abc123'],
        ['legacy_id' => 999, 'api_key' => 'legacy-key-inactive'],
        ['legacy_id' => 123456, 'api_key' => 'legacy-key-unmapped'],
    ];

    $importer = app(LegacyApiKeyImporter::class);
    $result = $importer->import('businessportal24', $rows);

    expect($result['imported'])->toBe(1);
    expect($result['ineligible'])->toBe(1);
    expect($result['ineligible_users'])->toBe([$inactive->email]);
    expect($result['unknown_user'])->toBe(1);

    $token = PersonalAccessToken::findToken('legacy-key-abc123');
    expect($token)->not->toBeNull();
    expect($token->tokenable_id)->toBe($user->id);
    expect($token->name)->toBe(LegacyApiKeyImporter::TOKEN_NAME);
    expect($token->abilities)->toBe(LegacyApiKeyImporter::ABILITIES);

    // Re-Run legt keine Duplikate an.
    $rerun = $importer->import('businessportal24', $rows);
    expect($rerun['imported'])->toBe(0);
    expect($rerun['already_present'])->toBe(1);
    expect(PersonalAccessToken::query()->where('token', hash('sha256', 'legacy-key-abc123'))->count())->toBe(1);
});

test('an imported legacy key authenticates via the old header and query forms', function () {
    /** @var TestCase $this */
    eligibleLegacyApiUser();
    app(LegacyApiKeyImporter::class)->import('businessportal24', [
        ['legacy_id' => 4711, 'api_key' => 'legacy-key-abc123'],
    ]);

    // Dokumentierter Alt-Header der Portale: X-ApiKey.
    $this->getJson('/api/v1/categories', ['X-ApiKey' => 'legacy-key-abc123'])
        ->assertOk();

    // Verbreitete Schreibvariante + Query-Parameter.
    $this->getJson('/api/v1/categories', ['X-Api-Key' => 'legacy-key-abc123'])
        ->assertOk();
    $this->getJson('/api/v1/categories?api_key=legacy-key-abc123')
        ->assertOk();
});

test('unknown legacy keys still get the 410 migration hint', function () {
    /** @var TestCase $this */
    $this->getJson('/api/v1/categories', ['X-ApiKey' => 'gibt-es-nicht'])
        ->assertStatus(410)
        ->assertJsonStructure(['message', 'migration_url', 'docs_url']);
});

test('the documented legacy service paths keep working with an imported key', function () {
    /** @var TestCase $this */
    eligibleLegacyApiUser();
    app(LegacyApiKeyImporter::class)->import('businessportal24', [
        ['legacy_id' => 4711, 'api_key' => 'legacy-key-abc123'],
    ]);

    $this->getJson('/service/pressreleases', ['X-ApiKey' => 'legacy-key-abc123'])
        ->assertOk();

    $this->getJson('/service/users/me/companies', ['X-ApiKey' => 'legacy-key-abc123'])
        ->assertOk();
});

test('the legacy service paths require authentication', function () {
    /** @var TestCase $this */
    $this->getJson('/service/pressreleases')->assertUnauthorized();
});

test('retired legacy service endpoints answer with a helpful 410 instead of 404', function () {
    /** @var TestCase $this */
    $this->postJson('/service/users/me/companies', ['company' => ['name' => 'Test']])
        ->assertStatus(410)
        ->assertJsonStructure(['message', 'account_url', 'docs_url']);

    $this->getJson('/service/irgendwas')->assertStatus(410);
});