Files
InvoiceShelf/tests/Unit/DocumentTotalsTest.php
Darko Gjorgjijoski 107a951126 fix(security): recompute document totals server-side (GHSA-8c69) (#665)
Invoice/estimate/recurring-invoice creation and update accepted total,
sub_total, tax and due_amount straight from the request with no server-side
recalculation, so a client could persist financial totals that don't match the
line items (and, on invoice update, corrupt the due-amount/paid-amount logic
which keyed off the client total).

- Adds App\Support\DocumentTotals which recomputes item totals (round(price *
  quantity) minus per-item discount) and document totals (sub_total, tax with
  per-item vs document and tax_included handling, total, due_amount), mirroring
  the front-end calculation. Only price/quantity/discounts/tax-line amounts are
  trusted.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals with the recomputed values; createItems recomputes each stored
  item total; Invoice::updateInvoice keys its due-amount/paid-amount logic off
  the recomputed total instead of the request total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored. Existing create/update tests no longer assert the (now
server-authoritative) derived totals.
2026-06-12 09:30:44 +02:00

80 lines
2.4 KiB
PHP

<?php
use App\Support\DocumentTotals;
test('sums item totals from price and quantity, ignoring client-supplied item totals', function () {
$totals = DocumentTotals::compute(
[['price' => 10000, 'quantity' => 10, 'total' => 1, 'taxes' => []]],
[], 0, 'NO', false, 'NO'
);
expect($totals['sub_total'])->toBe(100000)
->and($totals['total'])->toBe(100000)
->and($totals['tax'])->toBe(0);
});
test('applies document discount and document-level tax', function () {
$totals = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 2]],
[['amount' => 150]],
500, 'NO', false, 'NO'
);
// 2000 - 500 + 150
expect($totals['sub_total'])->toBe(2000)
->and($totals['tax'])->toBe(150)
->and($totals['total'])->toBe(1650);
});
test('uses per-item taxes (not document taxes) when tax_per_item is YES', function () {
$totals = DocumentTotals::compute(
[
['price' => 1000, 'quantity' => 1, 'taxes' => [['amount' => 100]]],
['price' => 2000, 'quantity' => 1, 'taxes' => [['amount' => 200]]],
],
[['amount' => 9999]],
0, 'YES', false, 'YES'
);
expect($totals['sub_total'])->toBe(3000)
->and($totals['tax'])->toBe(300)
->and($totals['total'])->toBe(3300);
});
test('excludes tax from total when tax_included', function () {
$totals = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 1]],
[['amount' => 100]],
0, 'NO', true, 'NO'
);
expect($totals['total'])->toBe(1000)->and($totals['tax'])->toBe(100);
});
test('applies per-item discount only when discount_per_item is YES', function () {
$with = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 2, 'discount_val' => 300]],
[], 0, 'NO', false, 'YES'
);
$without = DocumentTotals::compute(
[['price' => 1000, 'quantity' => 2, 'discount_val' => 300]],
[], 0, 'NO', false, 'NO'
);
expect($with['sub_total'])->toBe(1700)
->and($without['sub_total'])->toBe(2000);
});
test('supports negative quantities', function () {
$totals = DocumentTotals::compute(
[
['price' => 100, 'quantity' => -2],
['price' => 50, 'quantity' => 1],
['price' => 75, 'quantity' => 0],
],
[], 0, 'NO', false, 'NO'
);
expect($totals['sub_total'])->toBe(-150)->and($totals['total'])->toBe(-150);
});