adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-15 19:52:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add roles for project members; Restrict access to sensitive project values

Browse Source
This commit is contained in:
Constantin Graf
2024-09-30 19:03:14 +02:00
parent 32c7e55a15
commit a6e5d375a1
13 changed files with 334 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

129
tests/Unit/Endpoint/Api/V1/ProjectEndpointTest.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace Tests\Unit\Endpoint\Api\V1;
use App\Enums\ProjectMemberRole;
use App\Http\Controllers\Api\V1\ProjectController;
use App\Models\Client;
use App\Models\Organization;
@@ -159,6 +160,54 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
$response->assertJsonCount(4, 'data');
}
public function test_index_endpoint_returns_limited_visibility_flag_for_projects(): void
{
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
'projects:view:all',
]);
Project::factory()->forOrganization($data->organization)->createMany(2);
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.index', [$data->organization->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.0.limited_visibility', false);
$response->assertJsonPath('data.1.limited_visibility', false);
}
public function test_index_endpoint_returns_limit_visibility_flag_for_projects_for_user_with_restricted_permission(): void
{
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
]);
$project1 = Project::factory()->forOrganization($data->organization)->create([
'created_at' => now()->subDays(4),
]);
ProjectMember::factory()->forProject($project1)->forMember($data->member)->role(ProjectMemberRole::Normal)->create();
$project2 = Project::factory()->forOrganization($data->organization)->create([
'created_at' => now()->subDays(3),
]);
ProjectMember::factory()->forProject($project2)->forMember($data->member)->role(ProjectMemberRole::Manager)->create();
$project3 = Project::factory()->forOrganization($data->organization)->isPublic()->create([
'created_at' => now()->subDays(2),
]);
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.index', [$data->organization->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.0.limited_visibility', true);
$response->assertJsonPath('data.1.limited_visibility', false);
$response->assertJsonPath('data.2.limited_visibility', true);
}
public function test_show_endpoint_fails_if_user_is_not_part_of_project_organization(): void
{
// Arrange
@@ -190,7 +239,82 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
$response->assertForbidden();
}
public function test_show_endpoint_returns_project(): void
public function test_show_endpoint_returns_project_if_user_has_access_to_all_projects_in_organization(): void
{
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
'projects:view:all',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.id', $project->getKey());
$response->assertJsonPath('data.limited_visibility', false);
}
public function test_show_endpoint_returns_project_if_user_can_view_projects_and_project_is_public(): void
{
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
]);
$project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.id', $project->getKey());
$response->assertJsonPath('data.limited_visibility', true);
}
public function test_show_endpoint_returns_project_if_user_can_view_projects_and_user_is_member_of_project(): void
{
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
ProjectMember::factory()->forProject($project)->forMember($data->member)->create();
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.id', $project->getKey());
$response->assertJsonPath('data.limited_visibility', true);
}
public function test_show_endpoint_returns_project_with_no_limited_visibility_is_user_is_project_manager(): void
{
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
ProjectMember::factory()->forProject($project)->forMember($data->member)->role(ProjectMemberRole::Manager)->create();
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.id', $project->getKey());
$response->assertJsonPath('data.limited_visibility', false);
}
public function test_show_endpoint_fails_for_user_with_access_to_not_all_projects_for_project_that_is_private_and_the_user_is_not_a_member_of(): void
{
// Arrange
$data = $this->createUserWithPermission([
@@ -203,8 +327,7 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
// Assert
$response->assertStatus(200);
$response->assertJsonPath('data.id', $project->getKey());
$response->assertStatus(403);
}
public function test_store_endpoint_fails_if_user_has_no_permission_to_create_projects(): void

66
tests/Unit/Endpoint/Api/V1/ProjectMemberEndpointTest.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace Tests\Unit\Endpoint\Api\V1;
use App\Enums\ProjectMemberRole;
use App\Http\Controllers\Api\V1\ProjectMemberController;
use App\Models\Member;
use App\Models\Organization;
@@ -93,6 +94,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => $projectMemberFake->billable_rate,
'role' => $projectMemberFake->role->value,
'member_id' => $member->getKey(),
]);
@@ -118,6 +120,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => $projectMemberFake->billable_rate,
'role' => $projectMemberFake->role->value,
'member_id' => $member->getKey(),
]);
@@ -165,6 +168,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => $projectMemberFake->billable_rate,
'role' => $projectMemberFake->role->value,
'member_id' => $member->getKey(),
]);
@@ -179,6 +183,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
'billable_rate' => $projectMemberFake->billable_rate,
'member_id' => $member->getKey(),
'project_id' => $project->getKey(),
'role' => $projectMemberFake->role->value,
]);
}
@@ -197,6 +202,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => $projectMemberFake->billable_rate,
'role' => $projectMemberFake->role->value,
'member_id' => $member->getKey(),
]);
@@ -211,6 +217,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
'billable_rate' => $projectMemberFake->billable_rate,
'member_id' => $member->getKey(),
'project_id' => $project->getKey(),
'role' => $projectMemberFake->role->value,
]);
}
@@ -236,6 +243,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => $projectMemberFake->billable_rate,
'role' => $projectMemberFake->role->value,
'member_id' => $member->getKey(),
]);
@@ -245,6 +253,36 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
'billable_rate' => $projectMemberFake->billable_rate,
'member_id' => $member->getKey(),
'project_id' => $project->getKey(),
'role' => $projectMemberFake->role->value,
]);
}
public function test_store_endpoint_can_create_a_new_project_member_with_role_manager(): void
{
// Arrange
$data = $this->createUserWithPermission([
'project-members:create',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
$user = User::factory()->create();
$member = Member::factory()->forOrganization($data->organization)->forUser($user)->create();
$this->assertBillableRateServiceIsUnused();
Passport::actingAs($data->user);
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => null,
'role' => ProjectMemberRole::Manager->value,
'member_id' => $member->getKey(),
]);
// Assert
$response->assertStatus(201);
$this->assertDatabaseHas(ProjectMember::class, [
'billable_rate' => null,
'member_id' => $member->getKey(),
'project_id' => $project->getKey(),
'role' => ProjectMemberRole::Manager->value,
]);
}
@@ -266,6 +304,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
// Act
$response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
'billable_rate' => $projectMemberFake->billable_rate,
'role' => $projectMemberFake->role->value,
'member_id' => $member->getKey(),
]);
@@ -275,6 +314,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
'billable_rate' => null,
'member_id' => $member->getKey(),
'project_id' => $project->getKey(),
'role' => $projectMemberFake->role->value,
]);
}
@@ -374,6 +414,32 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
]);
}
public function test_update_endpoint_can_update_role(): void
{
// Arrange
$data = $this->createUserWithPermission([
'project-members:update',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
$projectMember = ProjectMember::factory()->forProject($project)->role(ProjectMemberRole::Normal)->create();
$this->assertBillableRateServiceIsUnused();
Passport::actingAs($data->user);
// Act
$response = $this->putJson(route('api.v1.project-members.update', [$data->organization->getKey(), $projectMember->getKey()]), [
'role' => ProjectMemberRole::Manager->value,
]);
// Assert
$response->assertStatus(200);
$this->assertDatabaseHas(ProjectMember::class, [
'id' => $projectMember->getKey(),
'billable_rate' => $projectMember->billable_rate,
'member_id' => $projectMember->member_id,
'role' => ProjectMemberRole::Manager->value,
]);
}
public function test_destroy_endpoint_fails_if_user_is_not_part_of_project_members_organization(): void
{
// Arrange