feat: phase 1 — InsForge session auth, role gates, refresh middleware, auth test suites

2026-08-25 18:01:11 +07:00
parent 046cefc56c
commit aad2b5e256
15 changed files with 613 additions and 36 deletions
@@ -0,0 +1,66 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Gate;
+use Tests\Support\InsForgeFake;
+use Tests\TestCase;
+
+class AuthorizationTest extends TestCase
+{
+    private const ADMIN_ONLY_ABILITIES = [
+        'manage-products',
+        'manage-stock',
+        'manage-drivers',
+        'manage-users',
+        'view-reports',
+        'view-activity-logs',
+    ];
+
+    private function loginUser(array $profile): User
+    {
+        InsForgeFake::fakeLoginSuccess($profile);
+
+        $user = new User;
+        $user->forceFill([
+            'id' => $profile['id'],
+            'name' => $profile['name'],
+            'email' => $profile['email'],
+            'role' => $profile['role'],
+            'is_active' => true,
+        ]);
+
+        $this->actingAs($user);
+
+        return $user;
+    }
+
+    public function test_admin_is_granted_every_ability(): void
+    {
+        $this->loginUser([
+            'id' => '22222222-2222-2222-2222-222222222222',
+            'name' => 'Admin',
+            'email' => 'admin@beraspro.test',
+            'role' => 'admin',
+        ]);
+
+        foreach (self::ADMIN_ONLY_ABILITIES as $ability) {
+            $this->assertTrue(Gate::allows($ability), "admin should be allowed {$ability}");
+        }
+    }
+
+    public function test_operator_is_denied_admin_only_abilities(): void
+    {
+        $this->loginUser([
+            'id' => '33333333-3333-3333-3333-333333333333',
+            'name' => 'Operator',
+            'email' => 'operator@beraspro.test',
+            'role' => 'operator',
+        ]);
+
+        foreach (self::ADMIN_ONLY_ABILITIES as $ability) {
+            $this->assertTrue(Gate::denies($ability), "operator should be denied {$ability}");
+        }
+    }
+}