Files
InvoiceShelf/tests/Unit/InvoiceTest.php
Darko Gjorgjijoski 107a951126 fix(security): recompute document totals server-side (GHSA-8c69) (#665)
Invoice/estimate/recurring-invoice creation and update accepted total,
sub_total, tax and due_amount straight from the request with no server-side
recalculation, so a client could persist financial totals that don't match the
line items (and, on invoice update, corrupt the due-amount/paid-amount logic
which keyed off the client total).

- Adds App\Support\DocumentTotals which recomputes item totals (round(price *
  quantity) minus per-item discount) and document totals (sub_total, tax with
  per-item vs document and tax_included handling, total, due_amount), mirroring
  the front-end calculation. Only price/quantity/discounts/tax-line amounts are
  trusted.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals with the recomputed values; createItems recomputes each stored
  item total; Invoice::updateInvoice keys its due-amount/paid-amount logic off
  the recomputed total instead of the request total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored. Existing create/update tests no longer assert the (now
server-authoritative) derived totals.
2026-06-12 09:30:44 +02:00

190 lines
5.0 KiB
PHP

<?php
use App\Http\Requests\InvoicesRequest;
use App\Models\Invoice;
use App\Models\InvoiceItem;
use App\Models\Tax;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Artisan;
beforeEach(function () {
Artisan::call('db:seed', ['--class' => 'DatabaseSeeder', '--force' => true]);
Artisan::call('db:seed', ['--class' => 'DemoSeeder', '--force' => true]);
});
test('invoice has many invoice items', function () {
$invoice = Invoice::factory()->hasItems(5)->create();
$this->assertCount(5, $invoice->items);
$this->assertTrue($invoice->items()->exists());
});
test('invoice has many taxes', function () {
$invoice = Invoice::factory()->hasTaxes(5)->create();
$this->assertCount(5, $invoice->taxes);
$this->assertTrue($invoice->taxes()->exists());
});
test('invoice has many payments', function () {
$invoice = Invoice::factory()->hasPayments(5)->create();
$this->assertCount(5, $invoice->payments);
$this->assertTrue($invoice->payments()->exists());
});
test('invoice belongs to customer', function () {
$invoice = Invoice::factory()->forCustomer()->create();
$this->assertTrue($invoice->customer()->exists());
});
test('get previous status', function () {
$invoice = Invoice::factory()->create();
$status = $invoice->getPreviousStatus();
$this->assertEquals('DRAFT', $status);
});
test('create invoice', function () {
$invoice = Invoice::factory()->raw();
$item = InvoiceItem::factory()->raw();
$invoice['items'] = [];
array_push($invoice['items'], $item);
$invoice['taxes'] = [];
array_push($invoice['taxes'], Tax::factory()->raw());
$request = new InvoicesRequest;
$request->replace($invoice);
$invoice_number = explode('-', $invoice['invoice_number']);
$number_attributes['invoice_number'] = $invoice_number[0].'-'.sprintf('%06d', intval($invoice_number[1]));
$response = Invoice::createInvoice($request);
$this->assertDatabaseHas('invoice_items', [
'invoice_id' => $response->id,
'name' => $item['name'],
'description' => $item['description'],
'total' => $item['total'],
'quantity' => $item['quantity'],
'discount' => $item['discount'],
'price' => $item['price'],
]);
$this->assertDatabaseHas('invoices', [
'invoice_number' => $invoice['invoice_number'],
'discount' => $invoice['discount'],
'notes' => $invoice['notes'],
'customer_id' => $invoice['customer_id'],
'template_name' => $invoice['template_name'],
]);
});
test('update invoice', function () {
$invoice = Invoice::factory()->create();
$newInvoice = Invoice::factory()->raw();
$item = InvoiceItem::factory()->raw([
'invoice_id' => $invoice->id,
]);
$tax = Tax::factory()->raw([
'invoice_id' => $invoice->id,
]);
$newInvoice['items'] = [];
$newInvoice['taxes'] = [];
array_push($newInvoice['items'], $item);
array_push($newInvoice['taxes'], $tax);
$request = new InvoicesRequest;
$request->replace($newInvoice);
$invoice_number = explode('-', $newInvoice['invoice_number']);
$number_attributes['invoice_number'] = $invoice_number[0].'-'.sprintf('%06d', intval($invoice_number[1]));
$response = $invoice->updateInvoice($request);
$this->assertDatabaseHas('invoice_items', [
'invoice_id' => $response->id,
'name' => $item['name'],
'description' => $item['description'],
'total' => $item['total'],
'quantity' => $item['quantity'],
'discount' => $item['discount'],
'price' => $item['price'],
]);
$this->assertDatabaseHas('invoices', [
'invoice_number' => $newInvoice['invoice_number'],
'discount' => $newInvoice['discount'],
'notes' => $newInvoice['notes'],
'customer_id' => $newInvoice['customer_id'],
'template_name' => $newInvoice['template_name'],
]);
});
test('create items', function () {
$invoice = Invoice::factory()->create();
$items = [];
$item = InvoiceItem::factory()->raw([
'invoice_id' => $invoice->id,
]);
array_push($items, $item);
$request = new InvoicesRequest;
$request->replace(['items' => $items]);
Invoice::createItems($invoice, $request->items);
$this->assertDatabaseHas('invoice_items', [
'invoice_id' => $invoice->id,
'description' => $item['description'],
'price' => $item['price'],
'tax' => $item['tax'],
'quantity' => $item['quantity'],
'total' => $item['total'],
]);
});
test('create taxes', function () {
$invoice = Invoice::factory()->create();
$taxes = [];
$tax = Tax::factory()->raw([
'invoice_id' => $invoice->id,
]);
array_push($taxes, $tax);
$request = new Request;
$request->replace(['taxes' => $taxes]);
Invoice::createTaxes($invoice, $request->taxes);
$this->assertDatabaseHas('taxes', [
'invoice_id' => $invoice->id,
'name' => $tax['name'],
'amount' => $tax['amount'],
]);
});