adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-10-13 16:23:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Restrict roles available to invitation and member.update, fixes ST-264

Browse Source
This commit is contained in:
Constantin Graf
2024-06-18 18:48:48 +02:00
committed by Gregor Vostrak
parent 2184b3c835
commit 313cee2db0
6 changed files with 112 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
tests/Unit/Endpoint/Api/V1/InvitationEndpointTest.php
View File

@@ -57,8 +57,7 @@ class InvitationEndpointTest extends ApiEndpointTestAbstract
public function test_store_fails_if_user_has_no_permission_to_create_invitations(): void
{
// Arrange
$data = $this->createUserWithPermission([
]);
$data = $this->createUserWithPermission();
Passport::actingAs($data->user);
// Act
@@ -71,6 +70,44 @@ class InvitationEndpointTest extends ApiEndpointTestAbstract
$response->assertStatus(403);
}
public function test_store_fails_if_user_invites_with_role_owner(): void
{
// Arrange
$data = $this->createUserWithPermission([
'invitations:create',
]);
Passport::actingAs($data->user);
// Act
$response = $this->postJson(route('api.v1.invitations.store', $data->organization->getKey()), [
'email' => 'test@asdf.at',
'role' => Role::Owner->value,
]);
// Assert
$response->assertStatus(422);
$response->assertJsonPath('message', 'The selected role is invalid.');
}
public function test_store_fails_if_user_invites_with_role_placeholder(): void
{
// Arrange
$data = $this->createUserWithPermission([
'invitations:create',
]);
Passport::actingAs($data->user);
// Act
$response = $this->postJson(route('api.v1.invitations.store', $data->organization->getKey()), [
'email' => 'test@asdf.at',
'role' => Role::Placeholder->value,
]);
// Assert
$response->assertStatus(422);
$response->assertJsonPath('message', 'The selected role is invalid.');
}
public function test_store_invites_user_to_organization(): void
{
// Arrange