Files
InvoiceShelf/tests/Feature/Company/ExchangeRate/ExchangeRateSsrfTest.php
T
Darko Gjorgjijoski 5ef7804e60 refactor: adopt modular domain architecture (#747)
* refactor: stabilize model identities for domain migration

* refactor: extract module platform context

* refactor: assign models to domain contexts

* refactor: extract ai platform context

* refactor: extract storage platform context

* refactor: extract mail platform context

* refactor: extract pdf platform context

* refactor: extract operations platform context

* refactor: move installation into operations platform

* refactor: extract money domain context

* refactor: extract taxation domain context

* refactor: extract catalog domain context

* refactor: extract metadata domain context

* refactor: extract reporting domain context

* refactor: extract purchases domain context

* refactor: extract receivables domain context

* refactor: extract accounts domain context

* refactor: complete reporting statement boundary

* refactor: extract contacts domain context

* refactor: extract sales domain context

* refactor: remove legacy application layers

* fix: migrate legacy bouncer role identities
2026-08-05 17:40:03 +02:00

33 lines
1.1 KiB
PHP

<?php
use App\Domains\Accounts\Models\User;
use Illuminate\Support\Facades\Artisan;
use Laravel\Sanctum\Sanctum;
use function Pest\Laravel\postJson;
/**
* The CurrencyConverter "DEDICATED" plan lets the user supply the API URL, which
* the server then fetches — it must not be allowed to target a private host.
*/
beforeEach(function () {
Artisan::call('db:seed', ['--class' => 'DatabaseSeeder', '--force' => true]);
Artisan::call('db:seed', ['--class' => 'DemoSeeder', '--force' => true]);
$user = User::find(1);
$this->withHeaders(['company' => $user->companies()->first()->id]);
Sanctum::actingAs($user, ['*']);
});
test('rejects a currency_converter DEDICATED provider whose url is private', function () {
postJson('/api/v1/exchange-rate-providers', [
'driver' => 'currency_converter',
'key' => 'test-key',
'driver_config' => [
'type' => 'DEDICATED',
'url' => 'http://169.254.169.254',
],
'active' => false,
])->assertStatus(422)->assertJsonValidationErrors('driver_config.url');
});