presseportale/tests/Feature/Admin/UserImpersonationTest.php

<?php

use App\Actions\Admin\UserImpersonation;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Livewire\Livewire;
use Tests\TestCase;

test('admin can impersonate a customer from user management', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $admin = User::factory()->create();
    $admin->assignRole('admin');

    $customer = User::factory()->create([
        'name' => 'Test Kunde',
        'email' => 'kunde@example.com',
    ]);
    $customer->assignRole('customer');

    $this->actingAs($admin);

    Livewire::test('admin.users')
        ->assertSee('Login als User')
        ->call('loginAsUser', $customer->id)
        ->assertRedirect(route('me.dashboard'));

    $this->assertAuthenticatedAs($customer);
    expect(session(UserImpersonation::SessionKey))->toBe($admin->id);

    $this->get(route('dashboard'))->assertRedirect(route('me.dashboard'));
    $this->get(route('me.dashboard'))->assertSuccessful();
});

test('users without manage permission cannot start impersonation', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $editor = User::factory()->create();
    $editor->assignRole('editor');

    $customer = User::factory()->create();
    $customer->assignRole('customer');

    $this->actingAs($editor);

    // Ohne users:manage ist die Benutzerverwaltung (und damit die
    // Impersonation) bereits auf Seiten-Ebene gesperrt.
    $this->get('https://pressekonto.test/admin/users')->assertForbidden();

    $this->assertAuthenticatedAs($editor);
    $this->assertFalse(session()->has(UserImpersonation::SessionKey));
});

test('admin can impersonate accounts with admin access', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $admin = User::factory()->create();
    $admin->assignRole('admin');

    $targetAdmin = User::factory()->create([
        'email' => 'target-admin@example.com',
    ]);
    $targetAdmin->assignRole('admin');

    $targetEditor = User::factory()->create([
        'email' => 'target-editor@example.com',
    ]);
    $targetEditor->assignRole('editor');

    $this->actingAs($admin);

    Livewire::test('admin.users')
        ->set('search', 'target-admin@example.com')
        ->call('loginAsUser', $targetAdmin->id)
        ->assertRedirect(route('me.dashboard'));

    $this->assertAuthenticatedAs($targetAdmin);
    expect(session(UserImpersonation::SessionKey))->toBe($admin->id);
    $this->get(route('dashboard'))->assertRedirect(route('me.dashboard'));

    $this->actingAs($admin);
    session()->forget(UserImpersonation::SessionKey);

    Livewire::test('admin.users')
        ->set('search', 'target-editor@example.com')
        ->call('loginAsUser', $targetEditor->id)
        ->assertRedirect(route('me.dashboard'));

    $this->assertAuthenticatedAs($targetEditor);
    expect(session(UserImpersonation::SessionKey))->toBe($admin->id);
    $this->get(route('dashboard'))->assertRedirect(route('me.dashboard'));
});

test('non super admin cannot impersonate a super admin', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $admin = User::factory()->create();
    $admin->assignRole('admin'); // users:manage, aber kein Super-Admin

    $superAdmin = User::factory()->superAdmin()->create([
        'email' => 'super@example.com',
    ]);
    $superAdmin->assignRole('admin');

    $this->actingAs($admin);

    Livewire::test('admin.users')
        ->set('search', 'super@example.com')
        ->call('loginAsUser', $superAdmin->id)
        ->assertForbidden();

    $this->assertAuthenticatedAs($admin);
    $this->assertFalse(session()->has(UserImpersonation::SessionKey));
});

test('super admin can impersonate another super admin', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $superAdmin = User::factory()->superAdmin()->create();
    $superAdmin->assignRole('admin');

    $targetSuperAdmin = User::factory()->superAdmin()->create([
        'email' => 'target-super@example.com',
    ]);
    $targetSuperAdmin->assignRole('admin');

    $this->actingAs($superAdmin);

    Livewire::test('admin.users')
        ->set('search', 'target-super@example.com')
        ->call('loginAsUser', $targetSuperAdmin->id)
        ->assertRedirect(route('me.dashboard'));

    $this->assertAuthenticatedAs($targetSuperAdmin);
    expect(session(UserImpersonation::SessionKey))->toBe($superAdmin->id);
});

test('impersonated user can return to the admin account', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $admin = User::factory()->create();
    $admin->assignRole('admin');

    $customer = User::factory()->create();
    $customer->assignRole('customer');

    $this->actingAs($customer)
        ->withSession([UserImpersonation::SessionKey => $admin->id])
        ->post(route('admin.impersonate.leave'))
        ->assertRedirect(route('admin.users.index'))
        ->assertSessionHas('status', 'Erfolgreich zurück zum Admin-Account gewechselt.')
        ->assertSessionMissing(UserImpersonation::SessionKey);

    $this->assertAuthenticatedAs($admin);
});

test('invalid impersonation session is cleared on leave', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $customer = User::factory()->create();
    $customer->assignRole('customer');

    $this->actingAs($customer)
        ->withSession([UserImpersonation::SessionKey => 999999])
        ->post(route('admin.impersonate.leave'))
        ->assertRedirect(route('me.dashboard'))
        ->assertSessionMissing(UserImpersonation::SessionKey);

    $this->assertAuthenticatedAs($customer);
});