75 lines
2.2 KiB
PHP
75 lines
2.2 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Facades\Tests\Setup\UserFactory;
|
|
use Tests\Feature\ApiTestCase;
|
|
|
|
/**
|
|
* The seeded account config/demo.php protects by default.
|
|
*/
|
|
function apiDemoAccount(): User
|
|
{
|
|
return User::where('username', 'admin')->firstOrFail();
|
|
}
|
|
|
|
/**
|
|
* An actor who would be allowed to manage users if demo mode were off, so a
|
|
* refusal here is demo mode's doing and not the permission middleware's.
|
|
*/
|
|
function apiUserManager(): User
|
|
{
|
|
return UserFactory::withPermissions('users.manage')->create();
|
|
}
|
|
|
|
beforeEach(function () {
|
|
config(['demo.enabled' => true]);
|
|
});
|
|
|
|
test('the API refuses a blocked write with a 403 and a message', function () {
|
|
$this->actingAs(apiDemoAccount(), ApiTestCase::API_GUARD)
|
|
->putJson('api/me/2fa')
|
|
->assertForbidden()
|
|
->assertJson(['message' => 'This action is disabled in the demo.']);
|
|
});
|
|
|
|
test('the API will not let the demo account be deleted', function () {
|
|
$admin = apiDemoAccount();
|
|
|
|
$this->actingAs(apiUserManager(), ApiTestCase::API_GUARD)
|
|
->deleteJson('api/users/'.$admin->id)
|
|
->assertForbidden()
|
|
->assertJson(['message' => 'The demo account cannot be modified.']);
|
|
|
|
$this->assertDatabaseHas('users', ['username' => 'admin']);
|
|
});
|
|
|
|
test('the API will not let the demo account change its own login details', function () {
|
|
$this->actingAs(apiDemoAccount(), ApiTestCase::API_GUARD)
|
|
->patchJson('api/me/details/auth', ['email' => 'hijacked@example.com'])
|
|
->assertForbidden();
|
|
|
|
$this->assertEquals('admin@example.com', apiDemoAccount()->email);
|
|
});
|
|
|
|
test('an ordinary API consumer is unaffected', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user, ApiTestCase::API_GUARD)
|
|
->patchJson('api/me/details', ['first_name' => 'Jane'])
|
|
->assertSuccessful();
|
|
|
|
$this->assertEquals('Jane', $user->fresh()->first_name);
|
|
});
|
|
|
|
test('the API is untouched while demo mode is off', function () {
|
|
config(['demo.enabled' => false]);
|
|
|
|
$admin = apiDemoAccount();
|
|
|
|
$this->actingAs(apiUserManager(), ApiTestCase::API_GUARD)
|
|
->deleteJson('api/users/'.$admin->id)
|
|
->assertSuccessful();
|
|
|
|
$this->assertDatabaseMissing('users', ['username' => 'admin']);
|
|
});
|