Kevin Adametz
c7bd940f28
Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):
0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
Config-Block + .env.example. Fund: auth.basic.* war nie als Config
definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
(Unique-Index auf circle existiert bereits). CreditWalletService war
bereits abgesichert (Unique-Index + createOrFirst).
Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
97 lines
3.7 KiB
PHP
97 lines
3.7 KiB
PHP
<?php
|
|
|
|
use App\Enums\UserPaymentOptionStatus;
|
|
use App\Models\LegacyInvoice;
|
|
use App\Models\User;
|
|
use App\Models\UserPaymentOption;
|
|
use App\Services\Api\ApiAccessEligibilityService;
|
|
|
|
function makeLegacyInvoice(User $user, string $status, string $invoiceDate): LegacyInvoice
|
|
{
|
|
return LegacyInvoice::query()->create([
|
|
'legacy_portal' => 'businessportal24',
|
|
'legacy_id' => fake()->unique()->numberBetween(1, 1_000_000),
|
|
'user_id' => $user->id,
|
|
'legacy_user_id' => $user->id,
|
|
'number' => 'LEG-'.fake()->unique()->numberBetween(1, 1_000_000),
|
|
'total_cents' => 4900,
|
|
'status' => $status,
|
|
'invoice_date' => $invoiceDate,
|
|
'paid_at' => $status === 'paid' ? $invoiceDate : null,
|
|
'imported_at' => now(),
|
|
]);
|
|
}
|
|
|
|
test('latestLegacyInvoice returns newest by invoice_date then id', function () {
|
|
$user = User::factory()->create();
|
|
makeLegacyInvoice($user, 'paid', '2024-01-01');
|
|
$newest = makeLegacyInvoice($user, 'reminder', '2024-06-01');
|
|
makeLegacyInvoice($user, 'paid', '2024-03-01');
|
|
|
|
expect($user->latestLegacyInvoice()->id)->toBe($newest->id);
|
|
});
|
|
|
|
test('token gate grants access when latest legacy invoice is paid', function () {
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
makeLegacyInvoice($user, 'paid', '2024-01-01');
|
|
|
|
expect((new ApiAccessEligibilityService)->canCreateToken($user))->toBeTrue();
|
|
});
|
|
|
|
test('token gate denies when latest legacy invoice is unpaid even if an older one was paid', function () {
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
makeLegacyInvoice($user, 'paid', '2024-01-01');
|
|
makeLegacyInvoice($user, 'reminder', '2024-06-01');
|
|
|
|
expect((new ApiAccessEligibilityService)->canCreateToken($user))->toBeFalse();
|
|
});
|
|
|
|
test('token gate denies when there is no legacy invoice and no active payment option', function () {
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
|
|
expect((new ApiAccessEligibilityService)->canCreateToken($user))->toBeFalse();
|
|
});
|
|
|
|
test('hasActivePaymentOption is period-aware for active options', function () {
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
|
|
UserPaymentOption::factory()->for($user)->create([
|
|
'status' => UserPaymentOptionStatus::Active->value,
|
|
'current_period_start' => now()->subDay(),
|
|
'current_period_end' => now()->addDay(),
|
|
]);
|
|
expect($user->hasActivePaymentOption())->toBeTrue();
|
|
|
|
$user->userPaymentOptions()->update([
|
|
'current_period_start' => now()->subMonths(2),
|
|
'current_period_end' => now()->subMonth(),
|
|
]);
|
|
expect($user->fresh()->hasActivePaymentOption())->toBeFalse();
|
|
});
|
|
|
|
test('hasActivePaymentOption is period-aware for grandfathering', function () {
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
|
|
$option = UserPaymentOption::factory()->for($user)->create([
|
|
'status' => UserPaymentOptionStatus::Grandfathered->value,
|
|
'grandfathered_until' => now()->addMonth(),
|
|
]);
|
|
expect($user->hasActivePaymentOption())->toBeTrue();
|
|
|
|
$option->update(['grandfathered_until' => now()->subDay()]);
|
|
expect($user->fresh()->hasActivePaymentOption())->toBeFalse();
|
|
});
|
|
|
|
test('booking and quota gates are period-aware when enforcement is on', function () {
|
|
config()->set('billing.enforce_booking', true);
|
|
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
UserPaymentOption::factory()->for($user)->create([
|
|
'status' => UserPaymentOptionStatus::Active->value,
|
|
'current_period_start' => now()->subMonths(2),
|
|
'current_period_end' => now()->subMonth(),
|
|
]);
|
|
|
|
expect($user->hasActiveBooking())->toBeFalse()
|
|
->and($user->hasUnlimitedPressReleaseQuota())->toBeFalse();
|
|
});
|