adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-15 03:32:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed permissions for tasks endpoints

Browse Source
This commit is contained in:
Constantin Graf
2024-04-09 13:06:56 +02:00
parent b9ee79174a
commit 234fa06324
8 changed files with 163 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
tests/Unit/Endpoint/Api/V1/TaskEndpointTest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace Tests\Unit\Endpoint\Api\V1;
use App\Models\Project;
use App\Models\ProjectMember;
use App\Models\Task;
use Laravel\Passport\Passport;
@@ -25,11 +26,27 @@ class TaskEndpointTest extends ApiEndpointTestAbstract
$response->assertForbidden();
}
public function test_index_endpoint_validation_fails_if_project_id_is_not_pat(): void
{
// Arrange
$data = $this->createUserWithPermission([
]);
Task::factory()->forOrganization($data->organization)->createMany(4);
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.tasks.index', [$data->organization->getKey()]));
// Assert
$response->assertForbidden();
}
public function test_index_endpoint_returns_list_of_all_tasks_of_organization(): void
{
// Arrange
$data = $this->createUserWithPermission([
'tasks:view',
'tasks:view:all',
]);
$tasks = Task::factory()->forOrganization($data->organization)->createMany(4);
Passport::actingAs($data->user);
@@ -42,11 +59,35 @@ class TaskEndpointTest extends ApiEndpointTestAbstract
$response->assertJsonCount(4, 'data');
}
public function test_index_endpoint_returns_list_of_all_tasks_with_access_of_organization_if_user_has_no_all_permission(): void
{
// Arrange
$data = $this->createUserWithPermission([
'tasks:view',
]);
$otherProject = Project::factory()->create();
Task::factory()->forOrganization($data->organization)->forProject($otherProject)->createMany(4);
$projectPublic = Project::factory()->isPublic()->create();
Task::factory()->forOrganization($data->organization)->forProject($projectPublic)->createMany(2);
$projectAsMember = Project::factory()->isPrivate()->create();
ProjectMember::factory()->forProject($projectAsMember)->forUser($data->user)->create();
Task::factory()->forOrganization($data->organization)->forProject($projectAsMember)->createMany(2);
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.tasks.index', [$data->organization->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonCount(4, 'data');
}
public function test_index_endpoint_returns_list_of_all_tasks_of_organization_filtered_by_project(): void
{
// Arrange
$data = $this->createUserWithPermission([
'tasks:view',
'tasks:view:all',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
Task::factory()->forOrganization($data->organization)->createMany(4);
@@ -90,7 +131,53 @@ class TaskEndpointTest extends ApiEndpointTestAbstract
]);
}
public function test_store_endpoint_fails_if_user_has_no_permission_to_create_tags()
public function test_index_endpoint_validation_fails_if_project_is_not_visible_by_user_and_user_does_not_have_tasks_all_permission(): void
{
// Arrange
$data = $this->createUserWithPermission([
'tasks:view',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
Task::factory()->forOrganization($data->organization)->createMany(4);
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.tasks.index', [
$data->organization->getKey(),
'project_id' => $project->getKey(),
]));
// Assert
$response->assertStatus(422);
$response->assertInvalid([
'project_id',
]);
}
public function test_index_endpoint_returns_list_of_all_tasks_of_organization_filtered_by_project_if_user_has_access_to_project(): void
{
// Arrange
$data = $this->createUserWithPermission([
'tasks:view',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
ProjectMember::factory()->forProject($project)->forUser($data->user)->create();
Task::factory()->forOrganization($data->organization)->createMany(4);
Task::factory()->forOrganization($data->organization)->forProject($project)->createMany(2);
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.tasks.index', [
$data->organization->getKey(),
'project_id' => $project->getKey(),
]));
// Assert
$response->assertStatus(200);
$response->assertJsonCount(2, 'data');
}
public function test_store_endpoint_fails_if_user_has_no_permission_to_create_tasks()
{
// Arrange
$data = $this->createUserWithPermission([

26
tests/Unit/Model/ProjectModelTest.php
View File

@@ -9,6 +9,7 @@ use App\Models\Organization;
use App\Models\Project;
use App\Models\ProjectMember;
use App\Models\Task;
use App\Models\User;
class ProjectModelTest extends ModelTestAbstract
{
@@ -86,4 +87,29 @@ class ProjectModelTest extends ModelTestAbstract
$this->assertCount(3, $membersRel);
$this->assertTrue($membersRel->first()->is($members->first()));
}
public function test_scope_visible_by_user_filters_so_that_only_public_projects_or_projects_where_the_user_is_member_are_shown(): void
{
// Arrange
$user = User::factory()->create();
$projectPrivate = Project::factory()->isPrivate()->create();
$projectPublic = Project::factory()->isPublic()->create();
$projectPrivateButMember = Project::factory()->isPrivate()->create();
ProjectMember::factory()->forProject($projectPrivateButMember)->forUser($user)->create();
// Act
$projectsVisible = Project::query()->visibleByUser($user)->get();
$allProjects = Project::query()->get();
// Assert
$this->assertEqualsIdsOfEloquentCollection([
$projectPublic->getKey(),
$projectPrivateButMember->getKey(),
], $projectsVisible);
$this->assertEqualsIdsOfEloquentCollection([
$projectPrivate->getKey(),
$projectPublic->getKey(),
$projectPrivateButMember->getKey(),
], $allProjects);
}
}