85 lines
3.4 KiB
PHP
85 lines
3.4 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\Client;
|
|
use App\Models\Product;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use Tests\TestCase;
|
|
|
|
class Tp8AuthorizationTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
public function test_client_policy_permission_matrix_matches_the_tp(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$user = User::factory()->create();
|
|
$client = Client::create(['name' => 'Jean Client', 'email' => 'client@example.com']);
|
|
|
|
$this->assertTrue(Gate::forUser($admin)->allows('view', $client));
|
|
$this->assertTrue(Gate::forUser($admin)->allows('create', Client::class));
|
|
$this->assertTrue(Gate::forUser($admin)->allows('update', $client));
|
|
$this->assertTrue(Gate::forUser($admin)->allows('delete', $client));
|
|
$this->assertTrue(Gate::forUser($user)->allows('view', $client));
|
|
$this->assertTrue(Gate::forUser($user)->allows('create', Client::class));
|
|
$this->assertTrue(Gate::forUser($user)->allows('update', $client));
|
|
$this->assertFalse(Gate::forUser($user)->allows('delete', $client));
|
|
}
|
|
|
|
public function test_standard_user_cannot_delete_client_or_product(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$client = Client::create(['name' => 'Client protégé', 'email' => 'client@example.com']);
|
|
$product = Product::create(['name' => 'Produit protégé', 'price' => 25, 'stock' => 5]);
|
|
|
|
$this->actingAs($user)->delete(route('clients.destroy', $client))->assertForbidden();
|
|
$this->actingAs($user)->delete(route('products.destroy', $product))->assertForbidden();
|
|
|
|
$this->assertModelExists($client);
|
|
$this->assertModelExists($product);
|
|
}
|
|
|
|
public function test_administrator_can_delete_client_and_product(): void
|
|
{
|
|
$admin = User::factory()->admin()->create();
|
|
$client = Client::create(['name' => 'Client à supprimer', 'email' => 'delete@example.com']);
|
|
$product = Product::create(['name' => 'Produit à supprimer', 'price' => 25, 'stock' => 5]);
|
|
|
|
$this->actingAs($admin)
|
|
->delete(route('clients.destroy', $client))
|
|
->assertRedirect(route('clients.index'));
|
|
$this->actingAs($admin)
|
|
->delete(route('products.destroy', $product))
|
|
->assertRedirect(route('products.index'));
|
|
|
|
$this->assertModelMissing($client);
|
|
$this->assertModelMissing($product);
|
|
}
|
|
|
|
public function test_delete_buttons_are_hidden_from_standard_user(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
Client::create(['name' => 'Client visible', 'email' => 'visible@example.com']);
|
|
Product::create(['name' => 'Produit visible', 'price' => 25, 'stock' => 5]);
|
|
|
|
$this->actingAs($user)->get(route('clients.index'))
|
|
->assertSee('Client visible')
|
|
->assertDontSee('Supprimer');
|
|
$this->actingAs($user)->get(route('products.index'))
|
|
->assertSee('Produit visible')
|
|
->assertDontSee('Supprimer');
|
|
}
|
|
|
|
public function test_admin_page_is_restricted_to_administrators(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$admin = User::factory()->admin()->create();
|
|
|
|
$this->actingAs($user)->get(route('admin'))->assertForbidden();
|
|
$this->actingAs($admin)->get(route('admin'))->assertSee('Administration');
|
|
}
|
|
}
|