Complete TP7 TP8 authentication authorization and classic CSS

2026-10-21 00:48:38 +02:00
parent 4a84a17cbf
commit ffe85d5f0d
101 changed files with 7643 additions and 110 deletions
@@ -0,0 +1,84 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Client;
+use App\Models\Product;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Gate;
+use Tests\TestCase;
+
+class Tp8AuthorizationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_client_policy_permission_matrix_matches_the_tp(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $user = User::factory()->create();
+        $client = Client::create(['name' => 'Jean Client', 'email' => 'client@example.com']);
+
+        $this->assertTrue(Gate::forUser($admin)->allows('view', $client));
+        $this->assertTrue(Gate::forUser($admin)->allows('create', Client::class));
+        $this->assertTrue(Gate::forUser($admin)->allows('update', $client));
+        $this->assertTrue(Gate::forUser($admin)->allows('delete', $client));
+        $this->assertTrue(Gate::forUser($user)->allows('view', $client));
+        $this->assertTrue(Gate::forUser($user)->allows('create', Client::class));
+        $this->assertTrue(Gate::forUser($user)->allows('update', $client));
+        $this->assertFalse(Gate::forUser($user)->allows('delete', $client));
+    }
+
+    public function test_standard_user_cannot_delete_client_or_product(): void
+    {
+        $user = User::factory()->create();
+        $client = Client::create(['name' => 'Client protégé', 'email' => 'client@example.com']);
+        $product = Product::create(['name' => 'Produit protégé', 'price' => 25, 'stock' => 5]);
+
+        $this->actingAs($user)->delete(route('clients.destroy', $client))->assertForbidden();
+        $this->actingAs($user)->delete(route('products.destroy', $product))->assertForbidden();
+
+        $this->assertModelExists($client);
+        $this->assertModelExists($product);
+    }
+
+    public function test_administrator_can_delete_client_and_product(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $client = Client::create(['name' => 'Client à supprimer', 'email' => 'delete@example.com']);
+        $product = Product::create(['name' => 'Produit à supprimer', 'price' => 25, 'stock' => 5]);
+
+        $this->actingAs($admin)
+            ->delete(route('clients.destroy', $client))
+            ->assertRedirect(route('clients.index'));
+        $this->actingAs($admin)
+            ->delete(route('products.destroy', $product))
+            ->assertRedirect(route('products.index'));
+
+        $this->assertModelMissing($client);
+        $this->assertModelMissing($product);
+    }
+
+    public function test_delete_buttons_are_hidden_from_standard_user(): void
+    {
+        $user = User::factory()->create();
+        Client::create(['name' => 'Client visible', 'email' => 'visible@example.com']);
+        Product::create(['name' => 'Produit visible', 'price' => 25, 'stock' => 5]);
+
+        $this->actingAs($user)->get(route('clients.index'))
+            ->assertSee('Client visible')
+            ->assertDontSee('Supprimer');
+        $this->actingAs($user)->get(route('products.index'))
+            ->assertSee('Produit visible')
+            ->assertDontSee('Supprimer');
+    }
+
+    public function test_admin_page_is_restricted_to_administrators(): void
+    {
+        $user = User::factory()->create();
+        $admin = User::factory()->admin()->create();
+
+        $this->actingAs($user)->get(route('admin'))->assertForbidden();
+        $this->actingAs($admin)->get(route('admin'))->assertSee('Administration');
+    }
+}