feat: phase 1 — InsForge session auth, role gates, refresh middleware, auth test suites

2026-08-25 18:01:11 +07:00
parent 046cefc56c
commit aad2b5e256
15 changed files with 613 additions and 36 deletions
@@ -0,0 +1,109 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use App\Services\InsForge\InsForgeAuthService;
+use Filament\Auth\Pages\Login;
+use Illuminate\Support\Facades\Session;
+use Livewire\Livewire;
+use Tests\Support\InsForgeFake;
+use Tests\TestCase;
+
+class AuthenticationTest extends TestCase
+{
+    private function adminProfile(array $overrides = []): array
+    {
+        return array_merge([
+            'id' => '11111111-1111-1111-1111-111111111111',
+            'name' => 'Admin BerasPro',
+            'email' => 'admin@beraspro.test',
+            'password' => '$2y$04$hash',
+            'role' => 'admin',
+            'is_active' => true,
+        ], $overrides);
+    }
+
+    public function test_login_page_renders_for_guest(): void
+    {
+        $this->get('/admin/login')->assertOk();
+    }
+
+    public function test_unauthenticated_user_is_redirected_to_login(): void
+    {
+        $this->get('/admin')->assertRedirect('/admin/login');
+    }
+
+    public function test_user_can_login_with_valid_credentials(): void
+    {
+        InsForgeFake::fakeLoginSuccess($this->adminProfile());
+
+        Livewire::test(Login::class)
+            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
+            ->call('authenticate')
+            ->assertHasNoErrors();
+
+        $this->assertAuthenticated();
+
+        $this->assertSame(
+            InsForgeFake::$accessToken,
+            Session::get(InsForgeAuthService::SESSION_ACCESS_TOKEN),
+        );
+
+        $user = auth()->user();
+
+        $this->assertInstanceOf(User::class, $user);
+        $this->assertTrue($user->isAdmin());
+    }
+
+    public function test_mirror_profile_is_created_when_missing(): void
+    {
+        InsForgeFake::fakeLoginSuccess($this->adminProfile());
+        unset(InsForgeFake::$profiles['admin@beraspro.test']);
+
+        Livewire::test(Login::class)
+            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
+            ->call('authenticate');
+
+        $this->assertArrayHasKey('admin@beraspro.test', InsForgeFake::$profiles);
+        $this->assertSame('operator', InsForgeFake::$profiles['admin@beraspro.test']['role']);
+    }
+
+    public function test_invalid_credentials_do_not_authenticate(): void
+    {
+        InsForgeFake::fakeLoginFailure();
+
+        Livewire::test(Login::class)
+            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'wrong'])
+            ->call('authenticate')
+            ->assertHasErrors();
+
+        $this->assertGuest();
+    }
+
+    public function test_inactive_user_cannot_access_panel(): void
+    {
+        InsForgeFake::fakeLoginSuccess($this->adminProfile(['is_active' => false]));
+
+        Livewire::test(Login::class)
+            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
+            ->call('authenticate');
+
+        $this->get('/admin')->assertRedirect('/admin/login');
+        $this->assertGuest();
+    }
+
+    public function test_logout_clears_insforge_tokens(): void
+    {
+        InsForgeFake::fakeLoginSuccess($this->adminProfile());
+
+        Livewire::test(Login::class)
+            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
+            ->call('authenticate');
+
+        $this->post('/admin/logout');
+
+        $this->assertGuest();
+        $this->assertNull(Session::get(InsForgeAuthService::SESSION_ACCESS_TOKEN));
+    }
+}