auth tests

2026-06-22 14:31:44 +02:00
parent 34a8ebc6fb
commit cc4e174880
75 changed files with 4679 additions and 168 deletions
--- a/backend/tests/Feature/UserControllerTest.php
+++ b/backend/tests/Feature/UserControllerTest.php
@@ -0,0 +1,170 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Lists\UserRole;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Testing\TestResponse;
+use Tests\TestCase;
+
+class UserControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /** @return list<int> id presenti in data della risposta. */
+    private function idsFrom(TestResponse $response): array
+    {
+        return collect($response->json('data'))->pluck('id')->all();
+    }
+
+    // --- Gating ---------------------------------------------------------------
+
+    public function test_index_requires_authentication(): void
+    {
+        $this->getJson('/api/users')->assertUnauthorized();
+    }
+
+    public function test_index_is_forbidden_for_non_admin(): void
+    {
+        $this->actingAs($this->operationalUser(), 'sanctum');
+
+        $this->getJson('/api/users')->assertForbidden();
+    }
+
+    // --- Index ----------------------------------------------------------------
+
+    public function test_index_returns_paginated_envelope(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+
+        $this->getJson('/api/users')
+            ->assertOk()
+            ->assertJsonStructure([
+                'message',
+                'data',
+                'meta' => ['current_page', 'last_page', 'per_page', 'total'],
+            ]);
+    }
+
+    public function test_index_filters_by_search_term(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $match = $this->operationalUser(['name' => 'Zzz Unique Marker']);
+        $other = $this->operationalUser(['name' => 'Someone Else']);
+
+        $ids = $this->idsFrom($this->getJson('/api/users?search=Unique+Marker')->assertOk());
+
+        $this->assertContains($match->id, $ids);
+        $this->assertNotContains($other->id, $ids);
+    }
+
+    public function test_index_filters_by_role(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $role = UserRole::factory()->create();
+        $inRole = $this->operationalUser(['role_id' => $role->id]);
+        $outRole = $this->operationalUser();
+
+        $ids = $this->idsFrom($this->getJson("/api/users?role_id={$role->id}")->assertOk());
+
+        $this->assertContains($inRole->id, $ids);
+        $this->assertNotContains($outRole->id, $ids);
+    }
+
+    public function test_index_excludes_trashed_by_default(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $trashed = $this->operationalUser();
+        $trashed->delete();
+
+        $ids = $this->idsFrom($this->getJson('/api/users')->assertOk());
+
+        $this->assertNotContains($trashed->id, $ids);
+    }
+
+    public function test_index_can_include_trashed(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $active = $this->operationalUser();
+        $trashed = $this->operationalUser();
+        $trashed->delete();
+
+        $ids = $this->idsFrom($this->getJson('/api/users?trashed=with')->assertOk());
+
+        $this->assertContains($active->id, $ids);
+        $this->assertContains($trashed->id, $ids);
+    }
+
+    public function test_index_can_return_only_trashed(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $active = $this->operationalUser();
+        $trashed = $this->operationalUser();
+        $trashed->delete();
+
+        $ids = $this->idsFrom($this->getJson('/api/users?trashed=only')->assertOk());
+
+        $this->assertContains($trashed->id, $ids);
+        $this->assertNotContains($active->id, $ids);
+    }
+
+    public function test_index_respects_per_page(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+
+        $this->getJson('/api/users?per_page=5')
+            ->assertOk()
+            ->assertJsonPath('meta.per_page', 5);
+    }
+
+    public function test_index_rejects_an_excessive_per_page(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+
+        $this->getJson('/api/users?per_page=500')
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('per_page');
+    }
+
+    public function test_index_rejects_an_unknown_trashed_value(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+
+        $this->getJson('/api/users?trashed=garbage')
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('trashed');
+    }
+
+    // --- Show -----------------------------------------------------------------
+
+    public function test_show_returns_a_user_with_role(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $user = $this->operationalUser();
+
+        $this->getJson("/api/users/{$user->id}")
+            ->assertOk()
+            ->assertJsonPath('data.id', $user->id)
+            ->assertJsonPath('data.setup_status', 'complete');
+    }
+
+    public function test_show_can_load_a_trashed_user(): void
+    {
+        $this->actingAs($this->adminUser(), 'sanctum');
+        $user = $this->operationalUser();
+        $user->delete();
+
+        $this->getJson("/api/users/{$user->id}")
+            ->assertOk()
+            ->assertJsonPath('data.id', $user->id);
+    }
+
+    public function test_show_is_forbidden_for_non_admin(): void
+    {
+        $this->actingAs($this->operationalUser(), 'sanctum');
+        $target = User::factory()->create();
+
+        $this->getJson("/api/users/{$target->id}")->assertForbidden();
+    }
+}