Initial commit device-management

2026-08-25 09:42:00 +07:00
commit 1e80be180e
1159 changed files with 149545 additions and 0 deletions
@@ -0,0 +1,81 @@
+<?php
+
+namespace Tests\Feature\Administration;
+
+use App\Models\Tenant;
+use App\Models\User;
+use App\Services\TenantProvisioningService;
+use Database\Seeders\RolePermissionSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class UserManagementTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->seed(RolePermissionSeeder::class);
+    }
+
+    public function test_tenant_owner_can_create_update_reset_and_disable_user(): void
+    {
+        [$tenant, $owner] = $this->tenantWithOwner('tenant-a');
+        $this->actingAs($owner)->post(route('administration.users.store', $tenant), [
+            'name' => 'NOC Operator', 'email' => 'noc@example.test', 'password' => 'Strong!Password123',
+            'password_confirmation' => 'Strong!Password123',
+        ])->assertRedirect(route('administration.users.index', $tenant));
+
+        $user = User::withoutGlobalScope('tenant')->where('email', 'noc@example.test')->firstOrFail();
+        $this->assertSame($tenant->id, $user->tenant_id);
+        setPermissionsTeamId($tenant->id);
+        $this->assertTrue($user->hasRole('TENANT USER'));
+
+        $this->actingAs($owner)->put(route('administration.users.password', [$tenant, $user]), [
+            'password' => 'Changed!Password123', 'password_confirmation' => 'Changed!Password123',
+        ])->assertRedirect();
+        $this->assertTrue(Hash::check('Changed!Password123', $user->fresh()->password));
+
+        $this->actingAs($owner)->patch(route('administration.users.toggle-active', [$tenant, $user]))->assertRedirect();
+        $this->assertFalse($user->fresh()->is_active);
+    }
+
+    public function test_tenant_owner_cannot_access_other_tenant_administration(): void
+    {
+        [, $ownerA] = $this->tenantWithOwner('tenant-a');
+        [$tenantB] = $this->tenantWithOwner('tenant-b');
+
+        $this->actingAs($ownerA)->get(route('administration.users.index', $tenantB))->assertForbidden();
+    }
+
+    public function test_tenant_admin_is_protected_from_deletion(): void
+    {
+        [$tenant, $owner] = $this->tenantWithOwner('tenant-a');
+
+        $this->actingAs(User::factory()->create(['is_platform_admin' => true]))
+            ->delete(route('administration.users.destroy', [$tenant, $owner]))
+            ->assertStatus(422);
+    }
+
+    public function test_tenant_admin_cannot_manage_another_tenant_admin(): void
+    {
+        [$tenant, $admin] = $this->tenantWithOwner('tenant-a');
+
+        $this->actingAs($admin)
+            ->get(route('administration.users.edit', [$tenant, $admin]))
+            ->assertForbidden();
+    }
+
+    /** @return array{Tenant, User} */
+    private function tenantWithOwner(string $slug): array
+    {
+        $tenant = app(TenantProvisioningService::class)->createWithOwner([
+            'name' => strtoupper($slug), 'slug' => $slug, 'owner_name' => 'Owner '.$slug,
+            'owner_email' => $slug.'@example.test', 'owner_password' => 'Strong!Password123',
+        ]);
+
+        return [$tenant, User::withoutGlobalScope('tenant')->where('tenant_id', $tenant->id)->firstOrFail()];
+    }
+}