auth tests

backend/tests/Feature/Auth/AccessTierTest.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+/**
+ * Verifica la scala di accesso (tier.app / tier.admin) attraverso rotte reali:
+ * - tier.app  → user-roles index (auth + verified + setup.complete)
+ * - tier.admin→ users index      (+ admin)
+ * Copre i rami di EnsureSetupComplete, del middleware `verified` e di IsAdmin.
+ */
+class AccessTierTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private const APP_ROUTE = '/api/user-roles';
+
+    private const ADMIN_ROUTE = '/api/users';
+
+    public function test_tier_app_allows_a_fully_operational_user(): void
+    {
+        $this->actingAs($this->operationalUser(), 'sanctum');
+
+        $this->getJson(self::APP_ROUTE)->assertOk();
+    }
+
+    public function test_tier_app_requires_authentication(): void
+    {
+        $this->getJson(self::APP_ROUTE)->assertUnauthorized();
+    }
+
+    public function test_tier_app_blocks_user_who_must_change_password(): void
+    {
+        $this->actingAs($this->setupIncompleteUser(), 'sanctum');
+
+        $this->getJson(self::APP_ROUTE)
+            ->assertForbidden()
+            ->assertJsonPath('setup_status', 'password_required');
+    }
+
+    public function test_tier_app_blocks_user_without_two_factor_setup(): void
+    {
+        $user = $this->operationalUser(['two_factor_setup_completed_at' => null]);
+        $this->actingAs($user, 'sanctum');
+
+        $this->getJson(self::APP_ROUTE)
+            ->assertForbidden()
+            ->assertJsonPath('setup_status', '2fa_setup_required');
+    }
+
+    public function test_tier_app_blocks_unverified_user(): void
+    {
+        $this->actingAs($this->unverifiedUser(), 'sanctum');
+
+        $this->getJson(self::APP_ROUTE)->assertForbidden();
+    }
+
+    public function test_tier_admin_allows_admin(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+
+        $this->getJson(self::ADMIN_ROUTE)->assertOk();
+    }
+
+    public function test_tier_admin_forbids_non_admin(): void
+    {
+        $this->actingAs($this->operationalUser(), 'sanctum');
+
+        $this->getJson(self::ADMIN_ROUTE)->assertForbidden();
+    }
+}