artisan('db:seed --class=RolesSeeder'); $this->artisan('db:seed --class=PermissionsSeeder'); }); test('unverified users cannot impersonate other users', function () { $user = UserFactory::withPermissions('users.manage')->unverified()->create(); User::factory()->create(); $this->actingAs($user)->get('/users')->assertRedirect('/email/verify'); }); test('a user with appropriate permission can impersonate other users from a user list page', function () { $user = UserFactory::withPermissions('users.manage')->create(); User::factory()->create(); $this->actingAs($user)->get('/users')->assertSee('Impersonate'); }); test('a user dont see impersonate button next to his name in the user list', function () { $user = UserFactory::withPermissions('users.manage')->create(); $this->actingAs($user)->get('/user')->assertDontSee('Impersonate'); }); test('clicking on impersonate button will impersonate the user', function () { $userA = UserFactory::withPermissions('users.manage')->create(); $userB = UserFactory::user()->create(); $this->actingAs($userA) ->get(route('impersonate', $userB)) ->assertRedirect('/'); $this->assertTrue(auth()->user()->is($userB)); }); test('while impersonating user can stop impersonating by clicking on the header button', function () { $userA = UserFactory::withPermissions('users.manage')->create(); $userB = UserFactory::user()->create(); $this->actingAs($userA)->get(route('impersonate', $userB)); $this->assertTrue(auth()->user()->is($userB)); $this->get('/')->assertInertia(fn (Assert $page) => $page ->where('auth.impersonating', true) ); $this->get(route('impersonate.leave')); $this->assertTrue(auth()->user()->is($userA)); }); test('while impersonating user cannot impersonate other user even if he has a permission', function () { $userA = UserFactory::withPermissions('users.manage')->create(); $userB = UserFactory::withPermissions('users.manage')->create(); $this->actingAs($userA)->get(route('impersonate', $userB)); $this->get('/user') ->assertDontSee('Impersonate'); });