adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-13 10:42:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Restrict roles available to invitation and member.update, fixes ST-264

Browse Source
This commit is contained in:
Constantin Graf
2024-06-18 18:48:48 +02:00
committed by Gregor Vostrak
parent 2184b3c835
commit 313cee2db0
6 changed files with 112 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
tests/Unit/Endpoint/Api/V1/InvitationEndpointTest.php
View File

@@ -57,8 +57,7 @@ class InvitationEndpointTest extends ApiEndpointTestAbstract
public function test_store_fails_if_user_has_no_permission_to_create_invitations(): void
{
// Arrange
$data = $this->createUserWithPermission([
]);
$data = $this->createUserWithPermission();
Passport::actingAs($data->user);
// Act
@@ -71,6 +70,44 @@ class InvitationEndpointTest extends ApiEndpointTestAbstract
$response->assertStatus(403);
}
public function test_store_fails_if_user_invites_with_role_owner(): void
{
// Arrange
$data = $this->createUserWithPermission([
'invitations:create',
]);
Passport::actingAs($data->user);
// Act
$response = $this->postJson(route('api.v1.invitations.store', $data->organization->getKey()), [
'email' => 'test@asdf.at',
'role' => Role::Owner->value,
]);
// Assert
$response->assertStatus(422);
$response->assertJsonPath('message', 'The selected role is invalid.');
}
public function test_store_fails_if_user_invites_with_role_placeholder(): void
{
// Arrange
$data = $this->createUserWithPermission([
'invitations:create',
]);
Passport::actingAs($data->user);
// Act
$response = $this->postJson(route('api.v1.invitations.store', $data->organization->getKey()), [
'email' => 'test@asdf.at',
'role' => Role::Placeholder->value,
]);
// Assert
$response->assertStatus(422);
$response->assertJsonPath('message', 'The selected role is invalid.');
}
public function test_store_invites_user_to_organization(): void
{
// Arrange

57
tests/Unit/Endpoint/Api/V1/MemberEndpointTest.php
View File

@@ -136,6 +136,63 @@ class MemberEndpointTest extends ApiEndpointTestAbstract
$this->assertSame(10001, $member->billable_rate);
}
public function test_update_member_can_update_role(): void
{
// Arrange
$data = $this->createUserWithPermission([
'members:update',
]);
$otherUser = User::factory()->create();
$otherMember = Member::factory()->forUser($otherUser)->forOrganization($data->organization)->role(Role::Employee)->create();
Passport::actingAs($data->user);
// Act
$response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $otherMember->getKey()]), [
'role' => Role::Admin->value,
]);
// Assert
$response->assertStatus(200);
$otherMember->refresh();
$this->assertSame(Role::Admin->value, $otherMember->role);
}
public function test_update_member_role_fails_if_role_is_owner(): void
{
// Arrange
$data = $this->createUserWithPermission([
'members:update',
]);
Passport::actingAs($data->user);
// Act
$response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $data->member->getKey()]), [
'role' => Role::Owner->value,
]);
// Assert
$response->assertStatus(422);
$response->assertJsonPath('message', 'The selected role is invalid.');
}
public function test_update_member_role_fails_if_role_is_placeholder(): void
{
// Arrange
$data = $this->createUserWithPermission([
'members:update',
]);
Passport::actingAs($data->user);
// Act
$response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $data->member->getKey()]), [
'role' => Role::Placeholder->value,
]);
// Assert
$response->assertStatus(422);
$response->assertJsonPath('message', 'The selected role is invalid.');
}
public function test_invite_placeholder_succeeds_if_data_is_valid(): void
{
$data = $this->createUserWithPermission([