feat: add routes, lang, tests, stubs, docs, and docker configurations

2026-05-21 16:05:16 +07:00
parent fad70d096b
commit 28a06315b8
3385 changed files with 177070 additions and 0 deletions
@@ -0,0 +1,198 @@
+<?php
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+
+function grantManageUserDirectory(User $user): void
+{
+    $perm = Permission::firstOrCreate(['name' => 'manage user directory', 'guard_name' => 'web']);
+    Permission::firstOrCreate(['name' => 'view user directory', 'guard_name' => 'web']);
+    $user->givePermissionTo($perm);
+}
+
+function defaultRole(): Role
+{
+    return Role::firstOrCreate(['name' => 'member', 'guard_name' => 'web']);
+}
+
+const STRONG_PASSWORD = 'Str0ng!Passw0rd2026';
+
+test('guest cannot access user index', function () {
+    $this->get('/users')->assertRedirect('/login');
+});
+
+test('user without permission gets 403', function () {
+    $u = User::factory()->create();
+    $this->actingAs($u)->get('/users')->assertForbidden();
+});
+
+test('store creates user, hashes password, assigns roles', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $role = defaultRole();
+
+    $response = $this->actingAs($admin)->postJson('/users', [
+        'name' => 'Jane Doe',
+        'email' => 'jane@example.com',
+        'password' => STRONG_PASSWORD,
+        'roles' => [$role->id],
+    ]);
+
+    $response->assertOk()->assertJson(['success' => true]);
+
+    $created = User::where('email', 'jane@example.com')->first();
+    expect($created)->not->toBeNull();
+    expect($created->password)->not->toBe(STRONG_PASSWORD);
+    expect($created->hasRole('member'))->toBeTrue();
+});
+
+test('store rejects weak password', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $role = defaultRole();
+
+    $this->actingAs($admin)->postJson('/users', [
+        'name' => 'Weak Pass',
+        'email' => 'weak@example.com',
+        'password' => 'short',
+        'roles' => [$role->id],
+    ])->assertStatus(422);
+});
+
+test('store rejects duplicate email', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $role = defaultRole();
+    User::factory()->create(['email' => 'taken@example.com']);
+
+    $this->actingAs($admin)->postJson('/users', [
+        'name' => 'Dup Email',
+        'email' => 'taken@example.com',
+        'password' => STRONG_PASSWORD,
+        'roles' => [$role->id],
+    ])->assertStatus(422);
+});
+
+test('store rejects name with digits', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $role = defaultRole();
+
+    $this->actingAs($admin)->postJson('/users', [
+        'name' => 'John123',
+        'email' => 'john@example.com',
+        'password' => STRONG_PASSWORD,
+        'roles' => [$role->id],
+    ])->assertStatus(422);
+});
+
+test('store requires at least one role', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+
+    $this->actingAs($admin)->postJson('/users', [
+        'name' => 'No Role',
+        'email' => 'norole@example.com',
+        'password' => STRONG_PASSWORD,
+        'roles' => [],
+    ])->assertStatus(422);
+});
+
+test('update can change name and reset roles without touching password', function () {
+    $admin = User::factory()->create(['name' => 'Admin User']);
+    grantManageUserDirectory($admin);
+    $r1 = defaultRole();
+    $r2 = Role::firstOrCreate(['name' => 'editor', 'guard_name' => 'web']);
+    $target = User::factory()->create(['name' => 'Old Name']);
+    $target->assignRole($r1);
+    $originalHash = $target->password;
+
+    $this->actingAs($admin)->putJson("/users/{$target->id}", [
+        'name' => 'Renamed User',
+        'email' => $target->email,
+        'roles' => [$r2->id],
+    ])->assertOk();
+
+    $target->refresh();
+    expect($target->name)->toBe('Renamed User');
+    expect($target->password)->toBe($originalHash);
+    expect($target->hasRole('editor'))->toBeTrue();
+    expect($target->hasRole('member'))->toBeFalse();
+});
+
+test('update changes password when provided', function () {
+    $admin = User::factory()->create(['name' => 'Admin User']);
+    grantManageUserDirectory($admin);
+    $role = defaultRole();
+    $target = User::factory()->create(['name' => 'Target User']);
+    $target->assignRole($role);
+    $original = $target->password;
+
+    $this->actingAs($admin)->putJson("/users/{$target->id}", [
+        'name' => 'Target User',
+        'email' => $target->email,
+        'password' => STRONG_PASSWORD,
+        'roles' => [$role->id],
+    ])->assertOk();
+
+    expect($target->fresh()->password)->not->toBe($original);
+});
+
+test('toggleStatus deactivates and activates user', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $target = User::factory()->create(['is_active' => 1]);
+
+    $this->actingAs($admin)
+        ->postJson('/users/toggle-status', ['id' => $target->id, 'status' => 'deactivate'])
+        ->assertOk();
+    expect((bool) $target->fresh()->is_active)->toBeFalse();
+
+    $this->actingAs($admin)
+        ->postJson('/users/toggle-status', ['id' => $target->id, 'status' => 'activate'])
+        ->assertOk();
+    expect((bool) $target->fresh()->is_active)->toBeTrue();
+});
+
+test('destroy soft deletes user', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $target = User::factory()->create();
+
+    $this->actingAs($admin)->deleteJson("/users/{$target->id}")->assertOk();
+    expect(User::withTrashed()->find($target->id)->trashed())->toBeTrue();
+});
+
+test('restore brings soft-deleted user back', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $target = User::factory()->create();
+    $target->delete();
+
+    $this->actingAs($admin)->postJson("/users/{$target->id}/restore")->assertOk();
+    expect(User::find($target->id)->trashed())->toBeFalse();
+});
+
+test('forceDelete blocks self-deletion', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $admin->delete();
+
+    $this->actingAs($admin)
+        ->deleteJson("/users/{$admin->id}/force")
+        ->assertStatus(403)
+        ->assertJson(['success' => false]);
+
+    expect(User::withTrashed()->find($admin->id))->not->toBeNull();
+});
+
+test('forceDelete permanently removes another user', function () {
+    $admin = User::factory()->create();
+    grantManageUserDirectory($admin);
+    $target = User::factory()->create();
+    $target->delete();
+
+    $this->actingAs($admin)->deleteJson("/users/{$target->id}/force")->assertOk();
+    expect(User::withTrashed()->find($target->id))->toBeNull();
+});