formatting, browser tests

2026-06-16 10:53:44 +02:00
parent 9a9a901d46
commit d44bcf6fda
15 changed files with 301 additions and 130 deletions
@@ -0,0 +1,83 @@
+<?php
+
+namespace Tests\Browser;
+
+use App\Models\User;
+use App\Models\Dynamic;
+use App\Models\Ledger;
+use App\Models\Mutation;
+use Laravel\Dusk\Browser;
+use Tests\DuskTestCase;
+
+test('access control and actions are enforced for owners and participants', function () {
+    // Create database state
+    $owner = User::factory()->create([
+        'name' => 'Owner Alice',
+        'email' => 'alice-owner@example.com',
+        'password' => bcrypt('password'),
+    ]);
+
+    $participant = User::factory()->create([
+        'name' => 'Participant Bob',
+        'email' => 'bob-sub@example.com',
+        'password' => bcrypt('password'),
+    ]);
+
+    $outsider = User::factory()->create([
+        'name' => 'Outsider Charlie',
+        'email' => 'charlie-outsider@example.com',
+        'password' => bcrypt('password'),
+    ]);
+
+    $dynamic = Dynamic::create([
+        'name' => 'Private Club',
+        'rules' => 'Strict access control.',
+    ]);
+
+    $dynamic->participants()->attach($owner->id, ['role' => 'owner']);
+    $dynamic->participants()->attach($participant->id, ['role' => 'participant']);
+
+    $ledger = Ledger::create([
+        'dynamic_id' => $dynamic->id,
+        'name' => 'Rules Compliance',
+        'rules' => 'Score rules.',
+        'score' => 100,
+        'alignment' => 'neutral',
+    ]);
+
+    $this->browse(function (Browser $sessionOwner, Browser $sessionParticipant, Browser $sessionOutsider) use ($dynamic, $ledger, $owner, $participant, $outsider) {
+        
+        // 1. Test Outsider trying to access dynamic they DO NOT belong to (should be forbidden / 403)
+        $sessionOutsider->loginAs($outsider)
+            ->visit(route('dynamics.show', $dynamic))
+            ->assertSee('403') // Laravel / Inertia forbidden page
+            ->assertDontSee('Private Club');
+
+        // 2. Test Participant accessing dynamic they DO belong to (should be allowed)
+        $sessionParticipant->loginAs($participant)
+            ->visit(route('dynamics.show', $dynamic))
+            ->waitForText('Private Club')
+            ->assertSee('Private Club')
+            ->assertSee('Participant Bob');
+
+        // 3. Test Participant adding a mutation suggestion
+        $sessionParticipant->visit(route('dynamics.ledgers.show', [$dynamic, $ledger]))
+            ->waitForText('Add Mutation')
+            ->type('amount', '20')
+            ->type('description', 'Cleaned the main room')
+            ->press('Add Mutation')
+            ->waitForText('PENDING')
+            ->assertSee('PENDING') // Mutation should show up as pending
+            ->assertDontSee('Approve'); // Standard participant should NOT see approve button!
+
+        // 4. Test Owner logging in, seeing the pending suggestion, and approving it!
+        $sessionOwner->loginAs($owner)
+            ->visit(route('dynamics.ledgers.show', [$dynamic, $ledger]))
+            ->waitForText('Cleaned the main room')
+            ->assertSee('PENDING')
+            ->assertSee('Approve') // Owner should see the Approve button!
+            ->press('Approve')
+            ->waitForText('Score: 120') // Score updated from 100 to 120 after approval!
+            ->assertDontSee('PENDING'); // No longer pending!
+    });
+});