adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-10-14 00:33:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix placeholder users being resolved by authentication flows

Browse Source
This commit is contained in:
Gregor Vostrak
2026-09-16 15:14:12 +02:00
parent 70646a0dd4
commit 95ddbf9ead
12 changed files with 371 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
tests/Unit/Auth/ActiveUserProviderTest.php Normal file
View File

@@ -0,0 +1,90 @@
<?php
declare(strict_types=1);
namespace Tests\Unit\Auth;
use App\Auth\ActiveUserProvider;
use App\Models\User;
use Illuminate\Support\Facades\Auth;
use PHPUnit\Framework\Attributes\CoversClass;
use Tests\TestCaseWithDatabase;
#[CoversClass(ActiveUserProvider::class)]
class ActiveUserProviderTest extends TestCaseWithDatabase
{
public function test_password_broker_uses_the_active_user_provider(): void
{
// Act
$brokerProvider = Auth::createUserProvider(config('auth.passwords.users.provider'));
// Assert
$this->assertInstanceOf(ActiveUserProvider::class, $brokerProvider);
}
public function test_api_guard_uses_the_active_user_provider(): void
{
// Act
$guardProvider = Auth::createUserProvider(config('auth.guards.api.provider'));
// Assert
$this->assertInstanceOf(ActiveUserProvider::class, $guardProvider);
}
public function test_web_guard_uses_the_active_user_provider(): void
{
// Act
$guardProvider = Auth::createUserProvider(config('auth.guards.web.provider'));
// Assert
$this->assertInstanceOf(ActiveUserProvider::class, $guardProvider);
}
public function test_retrieve_by_credentials_ignores_placeholder_users_with_the_same_email(): void
{
// Arrange
$email = 'shared@example.com';
$placeholder = User::factory()->placeholder()->create(['email' => $email]);
$user = User::factory()->create(['email' => $email]);
$provider = Auth::createUserProvider('users');
// Act
$result = $provider->retrieveByCredentials(['email' => $email]);
// Assert
$this->assertInstanceOf(User::class, $result);
$this->assertTrue($user->is($result));
$this->assertFalse($placeholder->is($result));
}
public function test_retrieve_by_credentials_returns_null_if_only_a_placeholder_user_exists(): void
{
// Arrange
$email = 'placeholder-only@example.com';
User::factory()->placeholder()->create(['email' => $email]);
$provider = Auth::createUserProvider('users');
// Act
$result = $provider->retrieveByCredentials(['email' => $email]);
// Assert
$this->assertNull($result);
}
public function test_retrieve_by_id_returns_null_for_placeholder_users(): void
{
// Arrange
$placeholder = User::factory()->placeholder()->create();
$user = User::factory()->create();
$provider = Auth::createUserProvider('users');
// Act
$placeholderResult = $provider->retrieveById($placeholder->getKey());
$userResult = $provider->retrieveById($user->getKey());
// Assert
$this->assertNull($placeholderResult);
$this->assertInstanceOf(User::class, $userResult);
$this->assertTrue($user->is($userResult));
}
}

3
tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php
View File

@@ -105,6 +105,9 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
$this->assertDatabaseMissing(OrganizationInvitation::class, [
'id' => $invitation->getKey(),
]);
// Joining sets the organization as the current one for the user, independently of the
// placeholders that were merged into them
$this->assertSame($user->organization->getKey(), $user2->user->fresh()->current_team_id);
}
public function test_accepting_invitation_while_logged_out_redirects_to_login(): void

17
tests/Unit/Model/UserModelTest.php
View File

@@ -53,6 +53,23 @@ class UserModelTest extends ModelTestAbstract
$this->assertTrue($canAccess);
}
public function test_placeholder_user_with_a_super_admin_email_can_not_access_admin_panel(): void
{
// Arrange
Config::set('auth.super_admins', ['some@email.test', 'other@email.test']);
$user = User::factory()->placeholder()->create([
'email' => 'some@email.test',
]);
$panelProvider = new AdminPanelProvider(app());
$mainPanel = $panelProvider->panel(Panel::make());
// Act
$canAccess = $user->canAccessPanel($mainPanel);
// Assert
$this->assertFalse($canAccess);
}
public function test_scope_belongs_to_organization_returns_only_users_of_organization_including_owners(): void
{
// Arrange

5
tests/Unit/Service/DeletionServiceTest.php
View File

@@ -412,10 +412,11 @@ class DeletionServiceTest extends TestCaseWithDatabase
$this->assertDatabaseHas(Organization::class, [
'id' => $organizationOfA->getKey(),
]);
// The placeholder user should exist with current_team_id set to the org where they are a placeholder
// The placeholder user should exist and must not reference the deleted organization,
// which is what caused the foreign key violation in #989
$placeholderUser = User::query()->where('is_placeholder', true)->first();
$this->assertNotNull($placeholderUser);
$this->assertSame($organizationOfA->getKey(), $placeholderUser->current_team_id);
$this->assertNull($placeholderUser->current_team_id);
$this->assertDatabaseHas(Member::class, [
'id' => $memberBInOrgA->getKey(),
'user_id' => $placeholderUser->getKey(),

43
tests/Unit/Service/MemberServiceTest.php
View File

@@ -13,6 +13,7 @@ use App\Models\TimeEntry;
use App\Models\User;
use App\Service\MemberService;
use App\Service\UserService;
use Illuminate\Support\Facades\Hash;
use InvalidArgumentException;
use PHPUnit\Framework\Attributes\CoversClass;
use Tests\TestCaseWithDatabase;
@@ -64,6 +65,48 @@ class MemberServiceTest extends TestCaseWithDatabase
$this->assertSame(Role::Admin->value, $oldOwnerMember->refresh()->role);
}
public function test_make_member_to_placeholder_does_not_copy_the_credentials_and_account_state_of_the_user(): void
{
// Arrange
$user = User::factory()->create([
'password' => Hash::make('secret-password'),
'remember_token' => 'remember-me-token',
'two_factor_secret' => 'two-factor-secret',
'two_factor_recovery_codes' => 'two-factor-recovery-codes',
'two_factor_confirmed_at' => '2026-09-16 10:00:00',
'email_verified_at' => '2026-09-16 09:00:00',
'pending_email' => 'pending@example.com',
'profile_photo_path' => 'profile-photos/photo.png',
]);
$organization = Organization::factory()->create();
$member = Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
// Act
$this->memberService->makeMemberToPlaceholder($member);
// Assert
$member->refresh();
$placeholderUser = $member->user;
$this->assertTrue($placeholderUser->is_placeholder);
$this->assertSame($user->email, $placeholderUser->email);
$this->assertNull($placeholderUser->password);
$this->assertNull($placeholderUser->remember_token);
$this->assertNull($placeholderUser->two_factor_secret);
$this->assertNull($placeholderUser->two_factor_recovery_codes);
$this->assertNull($placeholderUser->two_factor_confirmed_at);
$this->assertNull($placeholderUser->email_verified_at);
$this->assertNull($placeholderUser->pending_email);
$this->assertNull($placeholderUser->current_team_id);
$this->assertNull($placeholderUser->profile_photo_path);
// the user the placeholder was created from keeps their own credentials and state
$user->refresh();
$this->assertTrue(Hash::check('secret-password', (string) $user->password));
$this->assertSame('two-factor-secret', $user->two_factor_secret);
$this->assertNotNull($user->email_verified_at);
$this->assertSame('pending@example.com', $user->pending_email);
$this->assertSame('profile-photos/photo.png', $user->profile_photo_path);
}
public function test_make_member_to_placeholder_creates_new_user_based_on_member_and_changes_member_to_placeholder(): void
{
// Arrange