adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-08 00:02:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add password check to users.destroy and organizations.destroy

Browse Source
This commit is contained in:
Constantin Graf
2026-06-17 15:51:25 +02:00
committed by Constantin Graf
parent 24c94af952
commit 6a197f7f34
16 changed files with 352 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
tests/Unit/Endpoint/Api/V1/OrganizationEndpointTest.php
View File

@@ -441,7 +441,9 @@ class OrganizationEndpointTest extends ApiEndpointTestAbstract
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.organizations.destroy', [$data->organization->getKey()]));
$response = $this->deleteJson(route('api.v1.organizations.destroy', [$data->organization->getKey()]), [
'password' => 'password',
]);
// Assert
$response->assertForbidden();
@@ -456,12 +458,54 @@ class OrganizationEndpointTest extends ApiEndpointTestAbstract
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.organizations.destroy', ['not-uuid']));
$response = $this->deleteJson(route('api.v1.organizations.destroy', ['not-uuid']), [
'password' => 'password',
]);
// Assert
$response->assertNotFound();
}
public function test_delete_endpoint_fails_without_password(): void
{
// Arrange
$data = $this->createUserWithPermission([
'organizations:delete',
]);
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.organizations.destroy', [$data->organization->getKey()]));
// Assert
$response->assertUnprocessable();
$response->assertJsonValidationErrors(['password']);
$this->assertDatabaseHas(Organization::class, [
'id' => $data->organization->getKey(),
]);
}
public function test_delete_endpoint_fails_with_wrong_password(): void
{
// Arrange
$data = $this->createUserWithPermission([
'organizations:delete',
]);
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.organizations.destroy', [$data->organization->getKey()]), [
'password' => 'wrong-password',
]);
// Assert
$response->assertUnprocessable();
$response->assertJsonValidationErrors(['password']);
$this->assertDatabaseHas(Organization::class, [
'id' => $data->organization->getKey(),
]);
}
public function test_delete_endpoint_can_delete_organization(): void
{
// Arrange
@@ -472,7 +516,9 @@ class OrganizationEndpointTest extends ApiEndpointTestAbstract
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.organizations.destroy', [$data->organization->getKey()]));
$response = $this->deleteJson(route('api.v1.organizations.destroy', [$data->organization->getKey()]), [
'password' => 'password',
]);
// Assert
$response->assertNoContent();

44
tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
View File

@@ -649,7 +649,9 @@ class UserEndpointTest extends ApiEndpointTestAbstract
Passport::actingAs($otherData->user);
// Act
$response = $this->deleteJson(route('api.v1.users.destroy', $data->user->getKey()));
$response = $this->deleteJson(route('api.v1.users.destroy', $data->user->getKey()), [
'password' => 'password',
]);
// Assert
$response->assertForbidden();
@@ -674,13 +676,15 @@ class UserEndpointTest extends ApiEndpointTestAbstract
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.users.destroy', 'not-valid'));
$response = $this->deleteJson(route('api.v1.users.destroy', 'not-valid'), [
'password' => 'password',
]);
// Assert
$response->assertNotFound();
}
public function test_delete_removes_user(): void
public function test_delete_fails_without_password(): void
{
// Arrange
$data = $this->createUserWithPermission();
@@ -689,6 +693,40 @@ class UserEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->deleteJson(route('api.v1.users.destroy', $data->user->getKey()));
// Assert
$response->assertUnprocessable();
$response->assertJsonValidationErrors(['password']);
$this->assertDatabaseHas(User::class, ['id' => $data->user->getKey()]);
}
public function test_delete_fails_with_wrong_password(): void
{
// Arrange
$data = $this->createUserWithPermission();
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.users.destroy', $data->user->getKey()), [
'password' => 'wrong-password',
]);
// Assert
$response->assertUnprocessable();
$response->assertJsonValidationErrors(['password']);
$this->assertDatabaseHas(User::class, ['id' => $data->user->getKey()]);
}
public function test_delete_removes_user(): void
{
// Arrange
$data = $this->createUserWithPermission();
Passport::actingAs($data->user);
// Act
$response = $this->deleteJson(route('api.v1.users.destroy', $data->user->getKey()), [
'password' => 'password',
]);
// Assert
$response->assertNoContent();
$this->assertDatabaseMissing(User::class, ['id' => $data->user->getKey()]);

35
tests/Unit/Filament/Resources/OrganizationResourceTest.php
View File

@@ -4,12 +4,17 @@ declare(strict_types=1);
namespace Tests\Unit\Filament\Resources;
use App\Enums\Role;
use App\Events\OrganizationInvitationAdding;
use App\Filament\Resources\OrganizationResource;
use App\Mail\OrganizationInvitationMail;
use App\Models\Organization;
use App\Models\OrganizationInvitation;
use App\Models\User;
use App\Service\DeletionService;
use Illuminate\Support\Facades\Config;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\Mail;
use Livewire\Livewire;
use Mockery\MockInterface;
use PHPUnit\Framework\Attributes\UsesClass;
@@ -112,4 +117,34 @@ class OrganizationResourceTest extends FilamentTestCase
$response->assertSuccessful();
$response->assertCanSeeTableRecords($organizationInvitations);
}
public function test_can_create_related_invitation(): void
{
// Arrange
Event::fake([
OrganizationInvitationAdding::class,
]);
Mail::fake();
$organization = Organization::factory()->create();
// Act
$response = Livewire::test(OrganizationResource\RelationManagers\InvitationsRelationManager::class, [
'ownerRecord' => $organization,
'pageClass' => OrganizationResource\Pages\EditOrganization::class,
])->callTableAction('create', data: [
'email' => 'new-user@example.com',
'role' => Role::Employee->value,
]);
// Assert
$response->assertSuccessful();
$response->assertHasNoTableActionErrors();
$this->assertDatabaseHas(OrganizationInvitation::class, [
'organization_id' => $organization->getKey(),
'email' => 'new-user@example.com',
'role' => Role::Employee->value,
]);
Event::assertDispatched(OrganizationInvitationAdding::class);
Mail::assertQueued(OrganizationInvitationMail::class);
}
}