mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-17 06:15:20 +00:00
e432e4e62f
- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the Note and require hasCompany($note->company_id); NotesController passes the bound model to authorize() on show/update/destroy. - Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes 'view' on the source estimate before creating the invoice. - User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via User::whereCompany() before deletion so cross-company accounts are protected. Adds feature tests for cross-company 403s plus same-company happy paths.
108 lines
2.9 KiB
PHP
108 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\V1\Admin\Users\UsersController;
|
|
use App\Http\Requests\UserRequest;
|
|
use App\Models\Company;
|
|
use App\Models\User;
|
|
use Laravel\Sanctum\Sanctum;
|
|
|
|
use function Pest\Faker\fake;
|
|
use function Pest\Laravel\getJson;
|
|
use function Pest\Laravel\postJson;
|
|
use function Pest\Laravel\putJson;
|
|
|
|
beforeEach(function () {
|
|
Artisan::call('db:seed', ['--class' => 'DatabaseSeeder', '--force' => true]);
|
|
Artisan::call('db:seed', ['--class' => 'DemoSeeder', '--force' => true]);
|
|
|
|
$user = User::where('role', 'super admin')->first();
|
|
|
|
$this->withHeaders([
|
|
'company' => $user->companies()->first()->id,
|
|
]);
|
|
|
|
Sanctum::actingAs(
|
|
$user,
|
|
['*']
|
|
);
|
|
});
|
|
|
|
getJson('/api/v1/users')->assertOk();
|
|
|
|
test('store user using a form request', function () {
|
|
$this->assertActionUsesFormRequest(
|
|
UsersController::class,
|
|
'store',
|
|
UserRequest::class
|
|
);
|
|
});
|
|
|
|
// test('store user', function () {
|
|
// $data = [
|
|
// 'name' => fake()->name,
|
|
// 'email' => fake()->unique()->safeEmail,
|
|
// 'phone' => fake()->phoneNumber,
|
|
// 'password' => fake()->password
|
|
// ];
|
|
|
|
// postJson('/api/v1/users', $data)->assertOk();
|
|
|
|
// $this->assertDatabaseHas('users', [
|
|
// 'name' => $data['name'],
|
|
// 'email' => $data['email'],
|
|
// 'phone' => $data['phone'],
|
|
// ]);
|
|
// });
|
|
|
|
test('get user', function () {
|
|
$user = User::factory()->create();
|
|
|
|
getJson("/api/v1/users/{$user->id}")->assertOk();
|
|
});
|
|
|
|
test('update user using a form request', function () {
|
|
$this->assertActionUsesFormRequest(
|
|
UsersController::class,
|
|
'update',
|
|
UserRequest::class
|
|
);
|
|
});
|
|
|
|
// test('update user', function () {
|
|
// $user = User::factory()->create();
|
|
|
|
// $data = [
|
|
// 'name' => fake()->name,
|
|
// 'email' => fake()->unique()->safeEmail,
|
|
// 'phone' => fake()->phoneNumber,
|
|
// 'password' => fake()->password
|
|
// ];
|
|
|
|
// putJson("/api/v1/users/{$user->id}", $data)->assertOk();
|
|
|
|
// $this->assertDatabaseHas('users', [
|
|
// 'name' => $data['name'],
|
|
// 'email' => $data['email'],
|
|
// 'phone' => $data['phone'],
|
|
// ]);
|
|
// });
|
|
|
|
test('deletes a user belonging to the current company', function () {
|
|
$companyId = User::where('role', 'super admin')->first()->companies()->first()->id;
|
|
$user = User::factory()->create();
|
|
$user->companies()->attach($companyId);
|
|
|
|
postJson('/api/v1/users/delete', ['users' => [$user->id]])->assertOk();
|
|
|
|
$this->assertDatabaseMissing('users', ['id' => $user->id]);
|
|
});
|
|
|
|
test('cannot bulk delete a user belonging to another company', function () {
|
|
$user = User::factory()->create();
|
|
$user->companies()->attach(Company::factory()->create()->id);
|
|
|
|
postJson('/api/v1/users/delete', ['users' => [$user->id]])->assertOk();
|
|
|
|
$this->assertDatabaseHas('users', ['id' => $user->id]);
|
|
});
|