presseportale/tests/Feature/Billing/LegacyBundleTest.php
Kevin Adametz c7bd940f28 Optimierung Phase 0: Korrektheit & Security
Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):

0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
    Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
    statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
    Config-Block + .env.example. Fund: auth.basic.* war nie als Config
    definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
    scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
    umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
    UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
    hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
    und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
    Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
    geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
    b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
    (Unique-Index auf circle existiert bereits). CreditWalletService war
    bereits abgesichert (Unique-Index + createOrFirst).

Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-19 08:09:02 +00:00

119 lines
4.1 KiB
PHP

<?php
use App\Enums\Portal;
use App\Enums\UserPaymentOptionStatus;
use App\Models\User;
use App\Models\UserPaymentOption;
use App\Services\Billing\LegacySubscriptionService;
use App\Services\CurrentPortalContext;
use Database\Seeders\RolesAndPermissionsSeeder;
use Livewire\Volt\Volt;
use Tests\TestCase;
afterEach(function () {
// Statischer Portal-Kontext darf nicht in andere Tests lecken.
CurrentPortalContext::clear();
});
function grandfatheredPost(User $user, string $portal, int $netCents = 100000): UserPaymentOption
{
return UserPaymentOption::factory()->create([
'user_id' => $user->id,
'status' => UserPaymentOptionStatus::Grandfathered->value,
'grandfathered_until' => now()->addYear(),
'stripe_subscription_id' => null,
'cancelled_at' => null,
'legacy_conditions' => [
'legacy_portal' => $portal,
'net_cents' => $netCents,
'name' => 'Legacy '.$portal,
'interval' => 'yearly',
],
]);
}
// ===== M1: portalübergreifend =====
test('grandfathered bestandsschutz counts as booking regardless of active portal', function () {
/** @var TestCase $this */
config()->set('billing.enforce_booking', true);
$user = User::factory()->create();
grandfatheredPost($user, Portal::Presseecho->value);
// Aktiver Portal-Kontext businessportal24 darf den presseecho-Posten nicht ausschließen.
CurrentPortalContext::set(Portal::Businessportal24);
expect($user->hasActiveBooking())->toBeTrue();
CurrentPortalContext::clear();
expect($user->fresh()->hasActiveBooking())->toBeTrue();
});
// ===== M2: gekoppelte Kündigung =====
test('cancelling a bundle cancels all grandfathered posts of the customer together', function () {
/** @var TestCase $this */
$user = User::factory()->create();
$a = grandfatheredPost($user, Portal::Presseecho->value);
$b = grandfatheredPost($user, Portal::Businessportal24->value);
$count = app(LegacySubscriptionService::class)->cancelBundleFor($user);
expect($count)->toBe(2);
expect($a->fresh()->status)->toBe(UserPaymentOptionStatus::Cancelled);
expect($b->fresh()->status)->toBe(UserPaymentOptionStatus::Cancelled);
expect($a->fresh()->cancelled_at)->not->toBeNull();
});
test('cancelling a bundle leaves other customers untouched', function () {
/** @var TestCase $this */
$user = User::factory()->create();
$other = User::factory()->create();
grandfatheredPost($user, Portal::Presseecho->value);
$otherPost = grandfatheredPost($other, Portal::Presseecho->value);
app(LegacySubscriptionService::class)->cancelBundleFor($user);
expect($otherPost->fresh()->status)->toBe(UserPaymentOptionStatus::Grandfathered);
});
test('a cancelled bundle no longer counts as an active booking', function () {
/** @var TestCase $this */
config()->set('billing.enforce_booking', true);
$user = User::factory()->create();
grandfatheredPost($user, Portal::Presseecho->value);
app(LegacySubscriptionService::class)->cancelBundleFor($user);
expect($user->fresh()->hasActiveBooking())->toBeFalse();
});
// ===== M3: Admin-Sichtbarkeit + Bündel-Kündigung über die UI =====
test('the payments page lists bestandsschutz posts and cancels a whole bundle', function () {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
$admin = User::factory()->create(['is_active' => true]);
$admin->assignRole('admin');
$customer = User::factory()->create(['name' => 'Bestandskunde Test', 'is_active' => true]);
grandfatheredPost($customer, Portal::Presseecho->value);
grandfatheredPost($customer, Portal::Businessportal24->value);
Volt::actingAs($admin)
->test('admin.payments.index')
->assertOk()
->assertSee('Bestandskunde Test')
->assertSee('Bestandsschutz')
->call('cancelBundle', $customer->id)
->assertHasNoErrors();
$stillOpen = UserPaymentOption::query()
->where('user_id', $customer->id)
->where('status', UserPaymentOptionStatus::Grandfathered->value)
->count();
expect($stillOpen)->toBe(0);
});