feat(admin): 增加玩家密码管理与角色边界

tests/Feature/AdminPlayerManageApiTest.php

@@ -1,21 +1,28 @@
 <?php
 
-use App\Models\AgentProfile;
 use App\Models\Player;
 use App\Models\AuditLog;
 use App\Models\AdminRole;
 use App\Models\AdminUser;
+use App\Lottery\ErrorCode;
+use App\Models\AgentProfile;
 use App\Models\PlayerWallet;
 use App\Support\PlayerAuthSource;
 use App\Support\PlayerFundingMode;
+use Illuminate\Support\Facades\DB;
 use Database\Seeders\CurrencySeeder;
 use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\DB;
+use App\Services\Agent\AgentNodeService;
+use App\Services\Player\PlayerNativeAuthService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function (): void {
+    config([
+        'lottery.player_auth.native.secret' => 'test-native-jwt-secret-32bytes!!',
+        'lottery.player_auth.native.ttl_seconds' => 3600,
+    ]);
     $this->seed(CurrencySeeder::class);
     $this->artisan('lottery:admin-auth-sync')->assertExitCode(0);
 });
@@ -251,7 +258,7 @@ test('agent players list can filter direct players without including downline pl
     ]);
     grantSuperAdminRole($super);
 
-    $child = app(\App\Services\Agent\AgentNodeService::class)->createChild($super, [
+    $child = app(AgentNodeService::class)->createChild($super, [
         'parent_id' => $rootId,
         'code' => 'direct-child',
         'name' => 'Direct Child',
@@ -355,7 +362,7 @@ test('admin cannot change credit player default currency', function (): void {
             'default_currency' => 'USD',
         ])
         ->assertStatus(422)
-        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value);
 
     $this->assertDatabaseHas('players', [
         'id' => $player->id,
@@ -444,14 +451,14 @@ test('wallet player update rejects credit limit and rebate', function (): void {
             'credit_limit' => 1000,
         ])
         ->assertStatus(422)
-        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value);
 
     $this->withHeader('Authorization', 'Bearer '.$token)
         ->putJson('/api/v1/admin/players/'.$player->id, [
             'rebate_rate' => 1,
         ])
         ->assertStatus(422)
-        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value);
 });
 
 test('native player create rejects chinese username', function (): void {
@@ -467,7 +474,7 @@ test('native player create rejects chinese username', function (): void {
             'default_currency' => 'NPR',
         ])
         ->assertStatus(422)
-        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value);
 });
 
 test('partial rebate update preserves the other rebate field', function (): void {
@@ -555,3 +562,99 @@ test('partial rebate update preserves the other rebate field', function (): void
         'extra_rebate_rate' => 0.001,
     ]);
 });
+
+test('admin can reset native player password and invalidate active tokens', function (): void {
+    $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
+    $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
+    $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
+
+    $player = Player::query()->create([
+        'site_code' => $siteCode,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'native-admin-reset',
+        'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
+        'funding_mode' => PlayerFundingMode::CREDIT,
+        'username' => 'native_admin_reset',
+        'password_hash' => Hash::make('old-secret'),
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+    $oldToken = app(PlayerNativeAuthService::class)->issueToken($player);
+    $adminToken = playerManageAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$adminToken)
+        ->putJson('/api/v1/admin/players/'.$player->id.'/password', [
+            'password' => 'reset-secret',
+            'password_confirmation' => 'reset-secret',
+        ])
+        ->assertOk()
+        ->assertJsonPath('data.password_reset', true)
+        ->assertJsonPath('data.player_id', $player->id);
+
+    $player->refresh();
+    expect(Hash::check('reset-secret', (string) $player->password_hash))->toBeTrue()
+        ->and($player->native_token_version)->toBe(1);
+
+    $this->withHeader('Authorization', 'Bearer '.$oldToken)
+        ->getJson('/api/v1/player/me')
+        ->assertStatus(401)
+        ->assertJsonPath('code', ErrorCode::PlayerTokenInvalid->value);
+
+    $this->assertDatabaseHas('audit_logs', [
+        'operator_type' => 'admin',
+        'module_code' => 'player_service',
+        'action_code' => 'reset',
+        'target_id' => (string) $player->id,
+    ]);
+});
+
+test('admin cannot reset password for sso player', function (): void {
+    $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
+    $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
+
+    $player = Player::query()->create([
+        'site_code' => $siteCode,
+        'site_player_id' => 'sso-admin-reset-blocked',
+        'auth_source' => PlayerAuthSource::MAIN_SITE_SSO,
+        'funding_mode' => PlayerFundingMode::WALLET,
+        'username' => 'sso_admin_reset_blocked',
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    $this->withHeader('Authorization', 'Bearer '.playerManageAdminToken())
+        ->putJson('/api/v1/admin/players/'.$player->id.'/password', [
+            'password' => 'reset-secret',
+            'password_confirmation' => 'reset-secret',
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('msg', 'Main-site SSO players do not use a lottery password.');
+});
+
+test('player view permission cannot reset native player password', function (): void {
+    $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
+    $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
+    $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
+
+    $player = Player::query()->create([
+        'site_code' => $siteCode,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'native-view-reset-blocked',
+        'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
+        'funding_mode' => PlayerFundingMode::CREDIT,
+        'username' => 'native_view_reset_blocked',
+        'password_hash' => Hash::make('old-secret'),
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+    $viewToken = playerPermissionAdminToken('player_password_view_only', ['prd.users.view']);
+
+    playerPermissionRequest($this, $viewToken)
+        ->putJson('/api/v1/admin/players/'.$player->id.'/password', [
+            'password' => 'reset-secret',
+            'password_confirmation' => 'reset-secret',
+        ])
+        ->assertStatus(403);
+
+    expect(Hash::check('old-secret', (string) $player->fresh()->password_hash))->toBeTrue();
+});