Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):
0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
Config-Block + .env.example. Fund: auth.basic.* war nie als Config
definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
(Unique-Index auf circle existiert bereits). CreditWalletService war
bereits abgesichert (Unique-Index + createOrFirst).
Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
119 lines
4.1 KiB
PHP
119 lines
4.1 KiB
PHP
<?php
|
|
|
|
use App\Enums\Portal;
|
|
use App\Enums\UserPaymentOptionStatus;
|
|
use App\Models\User;
|
|
use App\Models\UserPaymentOption;
|
|
use App\Services\Billing\LegacySubscriptionService;
|
|
use App\Services\CurrentPortalContext;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Livewire\Volt\Volt;
|
|
use Tests\TestCase;
|
|
|
|
afterEach(function () {
|
|
// Statischer Portal-Kontext darf nicht in andere Tests lecken.
|
|
CurrentPortalContext::clear();
|
|
});
|
|
|
|
function grandfatheredPost(User $user, string $portal, int $netCents = 100000): UserPaymentOption
|
|
{
|
|
return UserPaymentOption::factory()->create([
|
|
'user_id' => $user->id,
|
|
'status' => UserPaymentOptionStatus::Grandfathered->value,
|
|
'grandfathered_until' => now()->addYear(),
|
|
'stripe_subscription_id' => null,
|
|
'cancelled_at' => null,
|
|
'legacy_conditions' => [
|
|
'legacy_portal' => $portal,
|
|
'net_cents' => $netCents,
|
|
'name' => 'Legacy '.$portal,
|
|
'interval' => 'yearly',
|
|
],
|
|
]);
|
|
}
|
|
|
|
// ===== M1: portalübergreifend =====
|
|
|
|
test('grandfathered bestandsschutz counts as booking regardless of active portal', function () {
|
|
/** @var TestCase $this */
|
|
config()->set('billing.enforce_booking', true);
|
|
|
|
$user = User::factory()->create();
|
|
grandfatheredPost($user, Portal::Presseecho->value);
|
|
|
|
// Aktiver Portal-Kontext businessportal24 darf den presseecho-Posten nicht ausschließen.
|
|
CurrentPortalContext::set(Portal::Businessportal24);
|
|
expect($user->hasActiveBooking())->toBeTrue();
|
|
|
|
CurrentPortalContext::clear();
|
|
expect($user->fresh()->hasActiveBooking())->toBeTrue();
|
|
});
|
|
|
|
// ===== M2: gekoppelte Kündigung =====
|
|
|
|
test('cancelling a bundle cancels all grandfathered posts of the customer together', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create();
|
|
$a = grandfatheredPost($user, Portal::Presseecho->value);
|
|
$b = grandfatheredPost($user, Portal::Businessportal24->value);
|
|
|
|
$count = app(LegacySubscriptionService::class)->cancelBundleFor($user);
|
|
|
|
expect($count)->toBe(2);
|
|
expect($a->fresh()->status)->toBe(UserPaymentOptionStatus::Cancelled);
|
|
expect($b->fresh()->status)->toBe(UserPaymentOptionStatus::Cancelled);
|
|
expect($a->fresh()->cancelled_at)->not->toBeNull();
|
|
});
|
|
|
|
test('cancelling a bundle leaves other customers untouched', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create();
|
|
$other = User::factory()->create();
|
|
grandfatheredPost($user, Portal::Presseecho->value);
|
|
$otherPost = grandfatheredPost($other, Portal::Presseecho->value);
|
|
|
|
app(LegacySubscriptionService::class)->cancelBundleFor($user);
|
|
|
|
expect($otherPost->fresh()->status)->toBe(UserPaymentOptionStatus::Grandfathered);
|
|
});
|
|
|
|
test('a cancelled bundle no longer counts as an active booking', function () {
|
|
/** @var TestCase $this */
|
|
config()->set('billing.enforce_booking', true);
|
|
|
|
$user = User::factory()->create();
|
|
grandfatheredPost($user, Portal::Presseecho->value);
|
|
|
|
app(LegacySubscriptionService::class)->cancelBundleFor($user);
|
|
|
|
expect($user->fresh()->hasActiveBooking())->toBeFalse();
|
|
});
|
|
|
|
// ===== M3: Admin-Sichtbarkeit + Bündel-Kündigung über die UI =====
|
|
|
|
test('the payments page lists bestandsschutz posts and cancels a whole bundle', function () {
|
|
/** @var TestCase $this */
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
|
|
$customer = User::factory()->create(['name' => 'Bestandskunde Test', 'is_active' => true]);
|
|
grandfatheredPost($customer, Portal::Presseecho->value);
|
|
grandfatheredPost($customer, Portal::Businessportal24->value);
|
|
|
|
Volt::actingAs($admin)
|
|
->test('admin.payments.index')
|
|
->assertOk()
|
|
->assertSee('Bestandskunde Test')
|
|
->assertSee('Bestandsschutz')
|
|
->call('cancelBundle', $customer->id)
|
|
->assertHasNoErrors();
|
|
|
|
$stillOpen = UserPaymentOption::query()
|
|
->where('user_id', $customer->id)
|
|
->where('status', UserPaymentOptionStatus::Grandfathered->value)
|
|
->count();
|
|
|
|
expect($stillOpen)->toBe(0);
|
|
});
|