first commit

tests/Feature/Web/Users/SessionsControllerTest.php

@@ -0,0 +1,73 @@
+<?php
+
+use App\Models\User;
+use Carbon\Carbon;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Inertia\Testing\AssertableInertia as Assert;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['session.driver' => 'database']);
+
+    $this->artisan('db:seed');
+});
+
+test('admin can view user sessions', function () {
+    $user = User::factory()->create();
+    $sessionId = insertUserSession($user);
+
+    $this->actingAsAdmin()
+        ->get("users/{$user->id}/sessions")
+        ->assertOk()
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('users/Sessions')
+            ->where('adminView', true)
+            ->has('sessions', 1)
+            ->where('sessions.0.id', $sessionId)
+        );
+});
+
+test('admin can invalidate user session', function () {
+    $user = User::factory()->create();
+    $sessionId = insertUserSession($user);
+
+    $this->actingAsAdmin()
+        ->delete("users/{$user->id}/sessions/{$sessionId}/invalidate")
+        ->assertRedirect(route('user.sessions', $user->id));
+
+    $this->assertDatabaseMissing('sessions', ['id' => $sessionId]);
+});
+
+test('non admin cannot view user sessions', function () {
+    $admin = User::factory()->create();
+    $user = User::factory()->create();
+
+    $this->actingAs($user)
+        ->get("users/{$admin->id}/sessions")
+        ->assertStatus(403);
+});
+
+test('guest cannot access user sessions', function () {
+    $user = User::factory()->create();
+
+    $this->get("users/{$user->id}/sessions")->assertRedirect('login');
+});
+
+function insertUserSession(User $user): string
+{
+    $id = Str::random();
+
+    DB::table('sessions')->insert([
+        'id' => $id,
+        'user_id' => $user->id,
+        'ip_address' => fake()->ipv4,
+        'user_agent' => fake()->userAgent,
+        'payload' => 'foo',
+        'last_activity' => Carbon::now()->timestamp,
+    ]);
+
+    return $id;
+}