artisan('db:seed'); }); test('guests cannot view role list', function () { $this->get('/roles')->assertRedirect('/login'); }); test('users without appropriate permission cannot view role list', function () { $roleA = RoleFactory::create(); $roleB = RoleFactory::withPermissions('roles.manage')->create(); $userA = UserFactory::role($roleA)->create(); $userB = UserFactory::role($roleB)->create(); $this->actingAs($userA)->get('/roles')->assertStatus(403); $this->actingAs($userB)->get('/roles')->assertOk(); }); test('roles list is displayed properly', function () { $roleA = RoleFactory::create(); $roleB = RoleFactory::create(); $this->actingAsAdmin() ->get('/roles') ->assertInertia(function (Assert $page) use ($roleA, $roleB) { // 2 default roles are created when db is seeded $page->component('roles/Index')->has('roles', 4); $names = collect($page->toArray()['props']['roles'])->pluck('name'); $this->assertTrue($names->contains($roleA->name)); $this->assertTrue($names->contains($roleB->name)); }); }); test('create role', function () { $data = Role::factory()->raw(); $this->actingAsAdmin() ->post('/roles', $data) ->assertRedirect('/roles'); $this->assertSessionHasSuccess('Role created successfully.'); $this->assertDatabaseHas('roles', $data); }); test('users without appropriate permission cannot create new roles', function () { $roleA = RoleFactory::create(); $roleB = RoleFactory::withPermissions('roles.manage')->create(); $userA = UserFactory::role($roleA)->create(); $userB = UserFactory::role($roleB)->create(); $data = Role::factory()->raw(); $this->actingAs($userA) ->post('/roles', $data) ->assertStatus(403); $this->assertDatabaseMissing('roles', $data); $this->actingAs($userB) ->post('/roles', $data) ->assertRedirect('roles'); $this->assertDatabaseHas('roles', $data); }); test('update role', function () { $role = Role::factory()->create(['name' => 'foo']); $this->actingAsAdmin() ->get("roles/{$role->id}/edit") ->assertOk() ->assertSee($role->name) ->assertSee($role->display_name) ->assertSee($role->description); $data = Role::factory()->raw(); $this->put("/roles/{$role->id}", $data); $this->assertSessionHasSuccess('Role updated successfully.'); $this->assertDatabaseHas('roles', $data + ['id' => $role->id]); }); test('users without appropriate permission cannot update role', function () { $roleA = RoleFactory::create(); $roleB = RoleFactory::withPermissions('roles.manage')->create(); $userA = UserFactory::role($roleA)->create(); $userB = UserFactory::role($roleB)->create(); $role = Role::factory()->create(['name' => 'foo']); $data = Role::factory()->raw(); $this->actingAs($userA) ->put("/roles/{$role->id}", $data) ->assertStatus(403); $this->assertEquals($role->toArray(), $role->fresh()->toArray()); $this->actingAs($userB) ->put("/roles/{$role->id}", $data) ->assertRedirect('roles'); $role->refresh(); $this->assertEquals($role->name, $data['name']); $this->assertEquals($role->display_name, $data['display_name']); $this->assertEquals($role->description, $data['description']); }); test('removable attribute cannot be changed on update', function () { $role = RoleFactory::unremovable()->create(); $data = Role::factory()->raw(['removable' => true]); $this->actingAsAdmin()->put("/roles/{$role->id}", $data); $role->refresh(); $this->assertEquals($role->name, $data['name']); $this->assertEquals($role->display_name, $data['display_name']); $this->assertEquals($role->description, $data['description']); $this->assertFalse($role->removable); }); test('delete role', function () { $role = RoleFactory::removable()->create(); $this->actingAsAdmin()->delete(route('roles.destroy', $role)); $this->assertNull($role->fresh()); }); test('users without appropriate permission cannot delete role', function () { $roleA = RoleFactory::create(); $roleB = RoleFactory::withPermissions('roles.manage')->create(); $userA = UserFactory::role($roleA)->create(); $userB = UserFactory::role($roleB)->create(); $role = Role::factory()->create(['name' => 'foo']); $this->actingAs($userA) ->delete(route('roles.destroy', $role->id)) ->assertStatus(403); $this->assertNotNull($role->fresh()); $this->actingAs($userB) ->delete(route('roles.destroy', $role->id)) ->assertRedirect('roles'); $this->assertNull($role->fresh()); }); test('users receive default role after their role is deleted', function () { $user = UserFactory::create(); $role = Role::factory()->create(['removable' => true]); $userRole = Role::where('name', 'User')->first(); $user->setRole($role); $this->assertTrue($user->fresh()->hasRole($role->name)); $this->actingAsAdmin()->delete(route('roles.destroy', $role)); $this->assertDatabaseHas('users', [ 'role_id' => $userRole->id, 'id' => $user->id, ]); $user = $user->fresh(); $this->assertFalse($user->hasRole($role->name)); $this->assertTrue($user->hasRole($userRole->name)); }); test('only removable roles can be deleted', function () { $removableRole = Role::factory()->create(['removable' => true]); $nonRemovableRole = Role::factory()->create(['removable' => false]); $this->beAdmin(); $this->delete(route('roles.destroy', $removableRole->id)); $this->assertNull($removableRole->fresh()); $this->delete(route('roles.destroy', $nonRemovableRole->id)) ->assertStatus(404); $this->assertNotNull($nonRemovableRole->fresh()); });