presseportale/tests/Feature/Auth/AutoMembershipRevocationTest.php

<?php

use App\Models\Company;
use App\Models\Contact;
use App\Models\User;
use App\Services\Auth\ContactAccessService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\DB;
use Tests\TestCase;

/**
 * Sicherheitsaudit 07.10.2026, S-03: Automatisch über eine Kontakt- oder
 * Firmenadresse vergebene Firmenrechte enden, sobald ihre Grundlage
 * wegfällt — in der laufenden Session, nicht erst beim nächsten Login.
 * Manuelle Mitgliedschaften bleiben.
 */
beforeEach(function () {
    $this->seed(RolesAndPermissionsSeeder::class);
});

/**
 * @return array{0: User, 1: Company, 2: Contact}
 */
function memberViaContact(string $email = 'ex-mitarbeiterin@firma.test'): array
{
    $user = User::factory()->create(['email' => $email, 'is_active' => true]);
    $user->assignRole('customer');

    $company = Company::factory()->presseecho()->create(['email' => 'zentrale@firma.test']);
    $contact = Contact::factory()->for($company)->create(['email' => $email, 'portal' => $company->portal->value]);

    app(ContactAccessService::class)->syncMembershipsForEmail($user);

    return [$user, $company, $contact];
}

function membershipOf(User $user, Company $company): ?object
{
    return DB::table('company_user')->where('user_id', $user->id)->where('company_id', $company->id)->first();
}

test('deleting the contact ends the automatic access within the running session', function () {
    /** @var TestCase $this */
    [$user, $company, $contact] = memberViaContact();

    expect(membershipOf($user, $company)?->granted_via)->toBe('auto');

    $this->actingAs($user)->get(route('me.press-kits.show', $company->id))->assertSuccessful();

    $contact->delete();

    expect(membershipOf($user, $company))->toBeNull();
    $this->actingAs($user->fresh())->get(route('me.press-kits.show', $company->id))->assertNotFound();
});

test('changing or moving the contact ends the automatic access', function (Closure $change) {
    [$user, $company, $contact] = memberViaContact();

    $change($contact);

    expect(membershipOf($user, $company))->toBeNull()
        ->and($user->fresh()->canAccessCompany($company->id))->toBeFalse();
})->with([
    'email changed' => fn (Contact $contact) => $contact->update(['email' => 'nachfolger@firma.test']),
    'moved to another company' => fn (Contact $contact) => $contact->update([
        'company_id' => Company::factory()->presseecho()->create()->id,
    ]),
]);

test('a contact moved into a company grants its automatic access right away', function () {
    $user = User::factory()->create(['email' => 'neu@firma.test', 'is_active' => true]);
    $user->assignRole('customer');
    $source = Company::factory()->presseecho()->create();
    $target = Company::factory()->presseecho()->create();
    $contact = Contact::factory()->for($source)->create(['email' => 'neu@firma.test', 'portal' => $source->portal->value]);

    app(ContactAccessService::class)->syncMembershipsForEmail($user);
    $contact->update(['company_id' => $target->id]);

    expect(membershipOf($user, $source))->toBeNull()
        ->and(membershipOf($user, $target)?->granted_via)->toBe('auto');
});

test('changing the company address ends access granted through it', function () {
    $user = User::factory()->create(['email' => 'zentrale@firma.test', 'is_active' => true]);
    $user->assignRole('customer');
    $company = Company::factory()->presseecho()->create(['email' => 'zentrale@firma.test']);

    app(ContactAccessService::class)->syncMembershipsForEmail($user);
    expect(membershipOf($user, $company)?->granted_via)->toBe('auto');

    $company->update(['email' => 'info@firma.test']);

    expect(membershipOf($user, $company))->toBeNull();
});

test('access stays while a second contact with the same address remains', function () {
    [$user, $company, $contact] = memberViaContact();
    Contact::factory()->for($company)->create(['email' => $user->email, 'portal' => $company->portal->value]);

    $contact->delete();

    expect(membershipOf($user, $company)?->granted_via)->toBe('auto');
});

test('manual memberships survive and upgraded ones fall back to member', function () {
    $manual = User::factory()->create(['email' => 'manuell@firma.test', 'is_active' => true]);
    $upgraded = User::factory()->create(['email' => 'team@firma.test', 'is_active' => true]);
    $company = Company::factory()->presseecho()->create();
    $manualContact = Contact::factory()->for($company)->create(['email' => 'manuell@firma.test', 'portal' => $company->portal->value]);
    $teamContact = Contact::factory()->for($company)->create(['email' => 'team@firma.test', 'portal' => $company->portal->value]);

    $manual->companies()->attach($company->id, ['role' => 'responsible', 'granted_via' => 'manual']);
    $upgraded->companies()->attach($company->id, ['role' => 'member', 'granted_via' => 'manual']);
    app(ContactAccessService::class)->syncMembershipsForEmail($upgraded);
    expect(membershipOf($upgraded, $company)->granted_via)->toBe('auto-upgrade');

    $manualContact->delete();
    $teamContact->delete();

    expect(membershipOf($manual, $company)->role)->toBe('responsible')
        ->and(membershipOf($manual, $company)->granted_via)->toBe('manual')
        ->and(membershipOf($upgraded, $company)->role)->toBe('member')
        ->and(membershipOf($upgraded, $company)->granted_via)->toBe('manual');
});

test('the resync command removes stale automatic grants left by bulk updates', function () {
    /** @var TestCase $this */
    [$user, $company, $contact] = memberViaContact();
    [$keeper, $keptCompany] = memberViaContact('bleibt@firma.test');

    // Massen-Update am Model vorbei: kein Observer.
    DB::table('contacts')->where('id', $contact->id)->update(['email' => 'anders@firma.test']);
    expect(membershipOf($user, $company))->not->toBeNull();

    $this->artisan('memberships:resync-auto')
        ->expectsOutputToContain('Automatische Rechte vorher 2, nachher 1')
        ->assertSuccessful();

    expect(membershipOf($user, $company))->toBeNull()
        ->and(membershipOf($keeper, $keptCompany)?->granted_via)->toBe('auto');
});