Kevin Adametz
ccef83b952
Der Endpunkt legte Abos ohne Bestätigungsweg an, die Spezifikation versprach ein Double-Opt-in; seit dem Go-Live kein Aufruf. Antwortet jetzt mit 410, die Ability ist für neue Tokens nicht mehr wählbar (Roadmap 4.3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
97 lines
3.4 KiB
PHP
97 lines
3.4 KiB
PHP
<?php
|
|
|
|
use App\Enums\Portal;
|
|
use App\Models\Category;
|
|
use App\Models\Company;
|
|
use App\Models\NewsletterSubscription;
|
|
use App\Models\User;
|
|
use Livewire\Livewire;
|
|
use Tests\TestCase;
|
|
|
|
test('legacy api keys in query parameters are not accepted but get the migration hint', function () {
|
|
/** @var TestCase $this */
|
|
// Legacy-Keys sind nur noch in Headern zulässig; der Query-Parameter wird
|
|
// nicht für die Auth genutzt, liefert aber den 410-Migrationshinweis.
|
|
$this->getJson('/api/v1/categories?api_key=legacy-key')
|
|
->assertStatus(410)
|
|
->assertJsonStructure(['message', 'migration_url', 'docs_url']);
|
|
});
|
|
|
|
test('api user can read only own companies', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create();
|
|
$ownCompany = Company::factory()->presseecho()->create(['name' => 'Eigene Firma']);
|
|
$otherCompany = Company::factory()->businessportal24()->create(['name' => 'Fremde Firma']);
|
|
$user->companies()->attach($ownCompany->id, ['role' => 'owner']);
|
|
|
|
apiActingAs($user, ['companies:read']);
|
|
|
|
$this->getJson('/api/v1/companies')
|
|
->assertOk()
|
|
->assertSee('Eigene Firma')
|
|
->assertDontSee('Fremde Firma');
|
|
|
|
$this->getJson("/api/v1/companies/{$otherCompany->id}")
|
|
->assertForbidden();
|
|
});
|
|
|
|
test('api user can list categories with press release read ability', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create();
|
|
Category::factory()->withTranslations()->create(['portal' => Portal::Both]);
|
|
|
|
apiActingAs($user, ['press-releases:read']);
|
|
|
|
$this->getJson('/api/v1/categories')
|
|
->assertOk()
|
|
->assertJsonCount(1, 'data')
|
|
->assertJsonStructure([
|
|
'data' => [
|
|
'*' => ['id', 'portal', 'translations'],
|
|
],
|
|
]);
|
|
});
|
|
|
|
test('the newsletter subscription endpoint is discontinued and creates nothing (Roadmap 4.3)', function () {
|
|
/** @var TestCase $this */
|
|
$user = User::factory()->create();
|
|
apiActingAs($user, ['newsletter:subscribe']);
|
|
|
|
$this->postJson('/api/v1/newsletter/subscribe', [
|
|
'portal' => 'presseecho',
|
|
'email' => 'newsletter@example.com',
|
|
])->assertStatus(410);
|
|
|
|
expect(NewsletterSubscription::withoutGlobalScopes()->where('email', 'newsletter@example.com')->exists())->toBeFalse();
|
|
});
|
|
|
|
test('the discontinued endpoint leaves existing subscriptions untouched', function () {
|
|
/** @var TestCase $this */
|
|
$owner = User::factory()->create();
|
|
$subscription = NewsletterSubscription::withoutGlobalScopes()->create([
|
|
'portal' => 'presseecho',
|
|
'user_id' => $owner->id,
|
|
'email' => 'owned@example.com',
|
|
'first_name' => 'Original',
|
|
'is_confirmed' => true,
|
|
'subscribed_at' => now(),
|
|
]);
|
|
apiActingAs(User::factory()->create(), ['newsletter:subscribe']);
|
|
|
|
$this->postJson('/api/v1/newsletter/subscribe', [
|
|
'portal' => 'presseecho',
|
|
'email' => 'owned@example.com',
|
|
'first_name' => 'Übernommen',
|
|
])->assertStatus(410);
|
|
|
|
expect($subscription->fresh()->user_id)->toBe($owner->id)
|
|
->and($subscription->fresh()->first_name)->toBe('Original');
|
|
});
|
|
|
|
test('new api tokens can no longer request the newsletter ability', function () {
|
|
/** @var TestCase $this */
|
|
$this->actingAs(User::factory()->create(['is_active' => true]));
|
|
|
|
Livewire::test('customer.tokens')
|
|
->assertDontSee('Newsletter-Anmeldungen auslösen');
|
|
});
|