74 lines
2.1 KiB
PHP
74 lines
2.1 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Auth;
|
|
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Verifica la scala di accesso (tier.app / tier.admin) attraverso rotte reali:
|
|
* - tier.app → user-roles index (auth + verified + setup.complete)
|
|
* - tier.admin→ users index (+ admin)
|
|
* Copre i rami di EnsureSetupComplete, del middleware `verified` e di IsAdmin.
|
|
*/
|
|
class AccessTierTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private const APP_ROUTE = '/api/user-roles';
|
|
|
|
private const ADMIN_ROUTE = '/api/users';
|
|
|
|
public function test_tier_app_allows_a_fully_operational_user(): void
|
|
{
|
|
$this->actingAs($this->operationalUser(), 'sanctum');
|
|
|
|
$this->getJson(self::APP_ROUTE)->assertOk();
|
|
}
|
|
|
|
public function test_tier_app_requires_authentication(): void
|
|
{
|
|
$this->getJson(self::APP_ROUTE)->assertUnauthorized();
|
|
}
|
|
|
|
public function test_tier_app_blocks_user_who_must_change_password(): void
|
|
{
|
|
$this->actingAs($this->setupIncompleteUser(), 'sanctum');
|
|
|
|
$this->getJson(self::APP_ROUTE)
|
|
->assertForbidden()
|
|
->assertJsonPath('setup_status', 'password_required');
|
|
}
|
|
|
|
public function test_tier_app_blocks_user_without_two_factor_setup(): void
|
|
{
|
|
$user = $this->operationalUser(['two_factor_setup_completed_at' => null]);
|
|
$this->actingAs($user, 'sanctum');
|
|
|
|
$this->getJson(self::APP_ROUTE)
|
|
->assertForbidden()
|
|
->assertJsonPath('setup_status', '2fa_setup_required');
|
|
}
|
|
|
|
public function test_tier_app_blocks_unverified_user(): void
|
|
{
|
|
$this->actingAs($this->unverifiedUser(), 'sanctum');
|
|
|
|
$this->getJson(self::APP_ROUTE)->assertForbidden();
|
|
}
|
|
|
|
public function test_tier_admin_allows_admin(): void
|
|
{
|
|
$this->actingAs($this->adminUser(), 'sanctum');
|
|
|
|
$this->getJson(self::ADMIN_ROUTE)->assertOk();
|
|
}
|
|
|
|
public function test_tier_admin_forbids_non_admin(): void
|
|
{
|
|
$this->actingAs($this->operationalUser(), 'sanctum');
|
|
|
|
$this->getJson(self::ADMIN_ROUTE)->assertForbidden();
|
|
}
|
|
}
|