Files
InvoiceShelf/tests/Unit/DocumentTotalsTest.php
Darko Gjorgjijoski 84524ce247 fix(security): recompute document totals server-side (GHSA-8c69) (#672)
v3 port. Invoice/estimate/recurring creation and update accepted total,
sub_total, tax and due_amount straight from the request with no recalculation,
letting a client persist financial totals that don't match the line items
(and corrupt the invoice update due-amount/paid-amount logic which keyed off
the client total).

- Adds App\Support\DocumentTotals (mirrors the front-end calc) trusting only
  price/quantity/discounts/tax-line amounts.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals; the shared DocumentItemService::createItems recomputes each
  item total; InvoiceService::update keys its due-amount logic off the
  recomputed total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored; existing create/update tests no longer assert the now
server-authoritative derived totals.
2026-06-12 11:02:23 +02:00

79 lines
2.4 KiB
PHP

<?php
use App\Support\DocumentTotals;
test('sums item totals from price and quantity, ignoring client-supplied item totals', function () {
$totals = DocumentTotals::compute(
[['price' => 10000, 'quantity' => 10, 'total' => 1, 'taxes' => []]],
[], 0, 'NO', false, 'NO'
);
expect($totals['sub_total'])->toBe(100000)
->and($totals['total'])->toBe(100000)
->and($totals['tax'])->toBe(0);
});
test('applies document discount and document-level tax', function () {
$totals = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 2]],
[['amount' => 150]],
500, 'NO', false, 'NO'
);
expect($totals['sub_total'])->toBe(2000)
->and($totals['tax'])->toBe(150)
->and($totals['total'])->toBe(1650);
});
test('uses per-item taxes (not document taxes) when tax_per_item is YES', function () {
$totals = DocumentTotals::compute(
[
['price' => 1000, 'quantity' => 1, 'taxes' => [['amount' => 100]]],
['price' => 2000, 'quantity' => 1, 'taxes' => [['amount' => 200]]],
],
[['amount' => 9999]],
0, 'YES', false, 'YES'
);
expect($totals['sub_total'])->toBe(3000)
->and($totals['tax'])->toBe(300)
->and($totals['total'])->toBe(3300);
});
test('excludes tax from total when tax_included', function () {
$totals = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 1]],
[['amount' => 100]],
0, 'NO', true, 'NO'
);
expect($totals['total'])->toBe(1000)->and($totals['tax'])->toBe(100);
});
test('applies per-item discount only when discount_per_item is YES', function () {
$with = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 2, 'discount_val' => 300]],
[], 0, 'NO', false, 'YES'
);
$without = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 2, 'discount_val' => 300]],
[], 0, 'NO', false, 'NO'
);
expect($with['sub_total'])->toBe(1700)
->and($without['sub_total'])->toBe(2000);
});
test('supports negative quantities', function () {
$totals = DocumentTotals::compute(
[
['price' => 100, 'quantity' => -2],
['price' => 50, 'quantity' => 1],
['price' => 75, 'quantity' => 0],
],
[], 0, 'NO', false, 'NO'
);
expect($totals['sub_total'])->toBe(-150)->and($totals['total'])->toBe(-150);
});