661 lines
23 KiB
PHP
661 lines
23 KiB
PHP
<?php
|
|
|
|
use App\Models\Player;
|
|
use App\Models\AuditLog;
|
|
use App\Models\AdminRole;
|
|
use App\Models\AdminUser;
|
|
use App\Lottery\ErrorCode;
|
|
use App\Models\AgentProfile;
|
|
use App\Models\PlayerWallet;
|
|
use App\Support\PlayerAuthSource;
|
|
use App\Support\PlayerFundingMode;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Database\Seeders\CurrencySeeder;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use App\Services\Agent\AgentNodeService;
|
|
use App\Services\Player\PlayerNativeAuthService;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function (): void {
|
|
config([
|
|
'lottery.player_auth.native.secret' => 'test-native-jwt-secret-32bytes!!',
|
|
'lottery.player_auth.native.ttl_seconds' => 3600,
|
|
]);
|
|
$this->seed(CurrencySeeder::class);
|
|
$this->artisan('lottery:admin-auth-sync')->assertExitCode(0);
|
|
});
|
|
|
|
function playerManageAdminToken(): string
|
|
{
|
|
$admin = AdminUser::query()->create([
|
|
'username' => 'player_manage_admin',
|
|
'name' => 'Player Manage Admin',
|
|
'email' => null,
|
|
'password' => Hash::make('secret-strong'),
|
|
'status' => 0,
|
|
]);
|
|
grantSuperAdminRole($admin);
|
|
|
|
return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
|
|
}
|
|
|
|
function playerPermissionAdminToken(string $username, array $permissionSlugs): string
|
|
{
|
|
$admin = AdminUser::query()->create([
|
|
'username' => $username,
|
|
'name' => 'Player Permission Admin',
|
|
'email' => null,
|
|
'password' => Hash::make('secret-strong'),
|
|
'status' => 0,
|
|
]);
|
|
|
|
$role = AdminRole::query()->create([
|
|
'slug' => 'role_'.$username,
|
|
'name' => 'Role '.$username,
|
|
]);
|
|
$role->syncLegacyPermissionSlugs($permissionSlugs);
|
|
|
|
$admin->roles()->sync([
|
|
(int) $role->id => [
|
|
'site_id' => AdminUser::defaultAdminSiteId(),
|
|
'granted_at' => now(),
|
|
],
|
|
]);
|
|
|
|
return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
|
|
}
|
|
|
|
function playerPermissionRequest($test, string $token)
|
|
{
|
|
app('auth')->forgetGuards();
|
|
|
|
return $test->withHeader('Authorization', 'Bearer '.$token);
|
|
}
|
|
|
|
test('super admin can create player under site root agent', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$sitePlayerId = 'manual-create-'.uniqid('', true);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->postJson('/api/v1/admin/players', [
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => $sitePlayerId,
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
])
|
|
->assertCreated()
|
|
->assertJsonPath('data.site_code', $siteCode)
|
|
->assertJsonPath('data.site_player_id', $sitePlayerId);
|
|
|
|
$this->assertDatabaseHas('players', [
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => $sitePlayerId,
|
|
]);
|
|
});
|
|
|
|
test('platform user without agent binding cannot create player', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
|
|
$token = playerPermissionAdminToken('player_manager_no_agent', ['prd.users.manage']);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->postJson('/api/v1/admin/players', [
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => 'blocked-create',
|
|
'default_currency' => 'NPR',
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonPath('msg', fn (string $msg): bool => str_contains($msg, '代理') || str_contains($msg, 'agent'));
|
|
});
|
|
|
|
test('admin can freeze and unfreeze player with audit log', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => 'freeze-1',
|
|
'username' => 'freeze_user',
|
|
'nickname' => 'Freeze',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
PlayerWallet::query()->create([
|
|
'player_id' => $player->id,
|
|
'wallet_type' => 'lottery',
|
|
'currency_code' => 'NPR',
|
|
'balance' => 1_000,
|
|
'frozen_balance' => 0,
|
|
'status' => 0,
|
|
'version' => 0,
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->postJson('/api/v1/admin/players/'.$player->id.'/freeze')
|
|
->assertOk()
|
|
->assertJsonPath('data.status', 1);
|
|
|
|
$this->assertDatabaseHas('audit_logs', [
|
|
'module_code' => 'player_manage',
|
|
'action_code' => 'freeze',
|
|
'target_type' => 'player',
|
|
'target_id' => (string) $player->id,
|
|
]);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->postJson('/api/v1/admin/players/'.$player->id.'/unfreeze')
|
|
->assertOk()
|
|
->assertJsonPath('data.status', 0);
|
|
|
|
expect(AuditLog::query()->where('module_code', 'player_manage')->count())->toBe(2);
|
|
});
|
|
|
|
test('player manage permission gates write and freeze APIs separately from view permissions', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => 'perm-1',
|
|
'username' => 'perm_user',
|
|
'nickname' => 'Perm',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
$financeToken = playerPermissionAdminToken('player_finance_viewer', ['prd.users.view_finance']);
|
|
|
|
playerPermissionRequest($this, $financeToken)
|
|
->getJson('/api/v1/admin/players?per_page=10')
|
|
->assertOk();
|
|
|
|
playerPermissionRequest($this, $financeToken)
|
|
->getJson('/api/v1/admin/players/'.$player->id.'/wallets')
|
|
->assertOk();
|
|
|
|
playerPermissionRequest($this, $financeToken)
|
|
->getJson('/api/v1/admin/players/'.$player->id.'/ticket-items')
|
|
->assertForbidden();
|
|
|
|
playerPermissionRequest($this, $financeToken)
|
|
->postJson('/api/v1/admin/players', [
|
|
'site_code' => 'main',
|
|
'site_player_id' => 'created-by-finance',
|
|
'default_currency' => 'NPR',
|
|
])
|
|
->assertForbidden();
|
|
|
|
playerPermissionRequest($this, $financeToken)
|
|
->putJson('/api/v1/admin/players/'.$player->id, ['nickname' => 'blocked'])
|
|
->assertForbidden();
|
|
|
|
playerPermissionRequest($this, $financeToken)
|
|
->postJson('/api/v1/admin/players/'.$player->id.'/freeze')
|
|
->assertForbidden();
|
|
|
|
$csToken = playerPermissionAdminToken('player_cs_viewer', ['prd.users.view_cs']);
|
|
|
|
playerPermissionRequest($this, $csToken)
|
|
->getJson('/api/v1/admin/players?per_page=10')
|
|
->assertOk();
|
|
|
|
playerPermissionRequest($this, $csToken)
|
|
->getJson('/api/v1/admin/players/'.$player->id.'/ticket-items')
|
|
->assertOk();
|
|
|
|
playerPermissionRequest($this, $csToken)
|
|
->getJson('/api/v1/admin/players/'.$player->id.'/wallets')
|
|
->assertForbidden();
|
|
|
|
$freezeToken = playerPermissionAdminToken('player_freezer', ['prd.player_freeze.manage']);
|
|
|
|
playerPermissionRequest($this, $freezeToken)
|
|
->getJson('/api/v1/admin/players?per_page=10')
|
|
->assertForbidden();
|
|
|
|
$freezeResp = playerPermissionRequest($this, $freezeToken)
|
|
->postJson('/api/v1/admin/players/'.$player->id.'/freeze');
|
|
$freezeResp->assertOk()
|
|
->assertJsonPath('data.status', 1);
|
|
|
|
playerPermissionRequest($this, $freezeToken)
|
|
->postJson('/api/v1/admin/players/'.$player->id.'/unfreeze')
|
|
->assertOk()
|
|
->assertJsonPath('data.status', 0);
|
|
|
|
$manageToken = playerPermissionAdminToken('player_manager', ['prd.users.manage']);
|
|
|
|
playerPermissionRequest($this, $manageToken)
|
|
->getJson('/api/v1/admin/players/'.$player->id.'/wallets')
|
|
->assertOk();
|
|
|
|
playerPermissionRequest($this, $manageToken)
|
|
->getJson('/api/v1/admin/players/'.$player->id.'/ticket-items')
|
|
->assertOk();
|
|
});
|
|
|
|
test('agent players list can filter direct players without including downline players', function (): void {
|
|
$siteId = (int) DB::table('admin_sites')->where('is_default', true)->value('id');
|
|
$siteCode = (string) DB::table('admin_sites')->where('id', $siteId)->value('code');
|
|
$rootId = (int) DB::table('agent_nodes')->where('admin_site_id', $siteId)->where('depth', 0)->value('id');
|
|
|
|
$super = AdminUser::query()->create([
|
|
'username' => 'direct_player_super',
|
|
'name' => 'Direct Player Super',
|
|
'email' => null,
|
|
'password' => Hash::make('secret-strong'),
|
|
'status' => 0,
|
|
]);
|
|
grantSuperAdminRole($super);
|
|
|
|
$child = app(AgentNodeService::class)->createChild($super, [
|
|
'parent_id' => $rootId,
|
|
'code' => 'direct-child',
|
|
'name' => 'Direct Child',
|
|
]);
|
|
|
|
$rootPlayer = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $rootId,
|
|
'site_player_id' => 'direct-root-player',
|
|
'username' => 'direct_root_player',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
$childPlayer = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $child->id,
|
|
'site_player_id' => 'direct-child-player',
|
|
'username' => 'direct_child_player',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$rootResponse = $this->withHeader('Authorization', 'Bearer '.$token)
|
|
->getJson('/api/v1/admin/players?site_code='.$siteCode.'&agent_node_id='.$rootId.'&agent_scope=direct');
|
|
|
|
$rootResponse->assertOk()->assertJsonPath('data.meta.total', 1);
|
|
$rootIds = collect($rootResponse->json('data.items'))->pluck('id')->map(static fn ($id): int => (int) $id);
|
|
expect($rootIds)->toContain($rootPlayer->id)->not->toContain($childPlayer->id);
|
|
|
|
$childResponse = $this->withHeader('Authorization', 'Bearer '.$token)
|
|
->getJson('/api/v1/admin/players?site_code='.$siteCode.'&agent_node_id='.$child->id.'&agent_scope=direct');
|
|
|
|
$childResponse->assertOk()->assertJsonPath('data.meta.total', 1);
|
|
$childIds = collect($childResponse->json('data.items'))->pluck('id')->map(static fn ($id): int => (int) $id);
|
|
expect($childIds)->toContain($childPlayer->id)->not->toContain($rootPlayer->id);
|
|
});
|
|
|
|
test('admin can update player default currency and validation rejects unknown code', function (): void {
|
|
$player = Player::query()->create([
|
|
'site_code' => 'main',
|
|
'site_player_id' => 'currency-1',
|
|
'username' => 'currency_user',
|
|
'nickname' => 'Currency',
|
|
'default_currency' => 'NPR',
|
|
'funding_mode' => PlayerFundingMode::WALLET,
|
|
'status' => 0,
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'default_currency' => 'usd',
|
|
])
|
|
->assertOk()
|
|
->assertJsonPath('data.default_currency', 'USD');
|
|
|
|
$this->assertDatabaseHas('players', [
|
|
'id' => $player->id,
|
|
'default_currency' => 'USD',
|
|
]);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'default_currency' => 'ABC',
|
|
])
|
|
->assertStatus(422);
|
|
});
|
|
|
|
test('admin cannot change credit player default currency', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
$rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $rootId,
|
|
'site_player_id' => 'credit-currency-locked-1',
|
|
'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
|
|
'funding_mode' => PlayerFundingMode::CREDIT,
|
|
'username' => 'credit_currency_locked',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
DB::table('player_credit_accounts')->insert([
|
|
'player_id' => $player->id,
|
|
'credit_limit' => 500,
|
|
'used_credit' => 120,
|
|
'frozen_credit' => 0,
|
|
'created_at' => now(),
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'default_currency' => 'USD',
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonPath('code', ErrorCode::ValidationFailed->value);
|
|
|
|
$this->assertDatabaseHas('players', [
|
|
'id' => $player->id,
|
|
'default_currency' => 'NPR',
|
|
]);
|
|
});
|
|
|
|
test('admin can set player credit limit without clobbering used credit', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
$rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
|
|
|
|
AgentProfile::query()->updateOrCreate(
|
|
['agent_node_id' => $rootId],
|
|
[
|
|
'total_share_rate' => 60,
|
|
'credit_limit' => 50_000,
|
|
'allocated_credit' => 0,
|
|
'used_credit' => 0,
|
|
'rebate_limit' => 0.01,
|
|
'default_player_rebate' => 0.005,
|
|
],
|
|
);
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $rootId,
|
|
'site_player_id' => 'credit-limit-1',
|
|
'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
|
|
'funding_mode' => PlayerFundingMode::CREDIT,
|
|
'username' => 'credit_limit_user',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
DB::table('player_credit_accounts')->insert([
|
|
'player_id' => $player->id,
|
|
'credit_limit' => 500,
|
|
'used_credit' => 120,
|
|
'frozen_credit' => 0,
|
|
'created_at' => now(),
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'credit_limit' => 2000,
|
|
])
|
|
->assertOk()
|
|
->assertJsonPath('data.credit_limit', 2000)
|
|
->assertJsonPath('data.available_credit', 1880);
|
|
|
|
$this->assertDatabaseHas('player_credit_accounts', [
|
|
'player_id' => $player->id,
|
|
'credit_limit' => 2000,
|
|
'used_credit' => 120,
|
|
]);
|
|
});
|
|
|
|
test('wallet player update rejects credit limit and rebate', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => 'wallet-no-credit-1',
|
|
'auth_source' => PlayerAuthSource::MAIN_SITE_SSO,
|
|
'funding_mode' => PlayerFundingMode::WALLET,
|
|
'username' => 'wallet_user',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
PlayerWallet::query()->create([
|
|
'player_id' => $player->id,
|
|
'currency_code' => 'NPR',
|
|
'balance_minor' => 0,
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'credit_limit' => 1000,
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonPath('code', ErrorCode::ValidationFailed->value);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'rebate_rate' => 1,
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonPath('code', ErrorCode::ValidationFailed->value);
|
|
});
|
|
|
|
test('native player create rejects chinese username', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->postJson('/api/v1/admin/players', [
|
|
'site_code' => $siteCode,
|
|
'username' => '玩家账号',
|
|
'password' => 'secret-native',
|
|
'default_currency' => 'NPR',
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonPath('code', ErrorCode::ValidationFailed->value);
|
|
});
|
|
|
|
test('partial rebate update preserves the other rebate field', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
$rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
|
|
|
|
AgentProfile::query()->updateOrCreate(
|
|
['agent_node_id' => $rootId],
|
|
[
|
|
'total_share_rate' => 100,
|
|
'credit_limit' => 50_000,
|
|
'allocated_credit' => 0,
|
|
'used_credit' => 0,
|
|
'rebate_limit' => 0.02,
|
|
'default_player_rebate' => 0.005,
|
|
'can_grant_extra_rebate' => true,
|
|
],
|
|
);
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $rootId,
|
|
'site_player_id' => 'partial-rebate-1',
|
|
'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
|
|
'funding_mode' => PlayerFundingMode::CREDIT,
|
|
'username' => 'partial_rebate_user',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
DB::table('player_credit_accounts')->insert([
|
|
'player_id' => $player->id,
|
|
'credit_limit' => 0,
|
|
'used_credit' => 0,
|
|
'frozen_credit' => 0,
|
|
'created_at' => now(),
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
DB::table('player_rebate_profiles')->insert([
|
|
'player_id' => $player->id,
|
|
'game_type' => '*',
|
|
'inherit_from_agent' => false,
|
|
'rebate_rate' => 0.005,
|
|
'extra_rebate_rate' => 0.002,
|
|
'created_at' => now(),
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
$token = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'extra_rebate_rate' => 0.1,
|
|
])
|
|
->assertOk();
|
|
|
|
$this->assertDatabaseHas('player_rebate_profiles', [
|
|
'player_id' => $player->id,
|
|
'game_type' => '*',
|
|
'rebate_rate' => 0.005,
|
|
'extra_rebate_rate' => 0.001,
|
|
]);
|
|
|
|
DB::table('player_rebate_profiles')
|
|
->where('player_id', $player->id)
|
|
->where('game_type', '*')
|
|
->update([
|
|
'rebate_rate' => 0.008,
|
|
'extra_rebate_rate' => 0.001,
|
|
'updated_at' => now(),
|
|
]);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$token)
|
|
->putJson('/api/v1/admin/players/'.$player->id, [
|
|
'rebate_rate' => 0.3,
|
|
])
|
|
->assertOk();
|
|
|
|
$this->assertDatabaseHas('player_rebate_profiles', [
|
|
'player_id' => $player->id,
|
|
'game_type' => '*',
|
|
'rebate_rate' => 0.003,
|
|
'extra_rebate_rate' => 0.001,
|
|
]);
|
|
});
|
|
|
|
test('admin can reset native player password and invalidate active tokens', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
$rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $rootId,
|
|
'site_player_id' => 'native-admin-reset',
|
|
'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
|
|
'funding_mode' => PlayerFundingMode::CREDIT,
|
|
'username' => 'native_admin_reset',
|
|
'password_hash' => Hash::make('old-secret'),
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
$oldToken = app(PlayerNativeAuthService::class)->issueToken($player);
|
|
$adminToken = playerManageAdminToken();
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$adminToken)
|
|
->putJson('/api/v1/admin/players/'.$player->id.'/password', [
|
|
'password' => 'reset-secret',
|
|
'password_confirmation' => 'reset-secret',
|
|
])
|
|
->assertOk()
|
|
->assertJsonPath('data.password_reset', true)
|
|
->assertJsonPath('data.player_id', $player->id);
|
|
|
|
$player->refresh();
|
|
expect(Hash::check('reset-secret', (string) $player->password_hash))->toBeTrue()
|
|
->and($player->native_token_version)->toBe(1);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.$oldToken)
|
|
->getJson('/api/v1/player/me')
|
|
->assertStatus(401)
|
|
->assertJsonPath('code', ErrorCode::PlayerTokenInvalid->value);
|
|
|
|
$this->assertDatabaseHas('audit_logs', [
|
|
'operator_type' => 'admin',
|
|
'module_code' => 'player_service',
|
|
'action_code' => 'reset',
|
|
'target_id' => (string) $player->id,
|
|
]);
|
|
});
|
|
|
|
test('admin cannot reset password for sso player', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'site_player_id' => 'sso-admin-reset-blocked',
|
|
'auth_source' => PlayerAuthSource::MAIN_SITE_SSO,
|
|
'funding_mode' => PlayerFundingMode::WALLET,
|
|
'username' => 'sso_admin_reset_blocked',
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
|
|
$this->withHeader('Authorization', 'Bearer '.playerManageAdminToken())
|
|
->putJson('/api/v1/admin/players/'.$player->id.'/password', [
|
|
'password' => 'reset-secret',
|
|
'password_confirmation' => 'reset-secret',
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonPath('msg', 'Main-site SSO players do not use a lottery password.');
|
|
});
|
|
|
|
test('player view permission cannot reset native player password', function (): void {
|
|
$siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
|
|
$siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
|
|
$rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
|
|
|
|
$player = Player::query()->create([
|
|
'site_code' => $siteCode,
|
|
'agent_node_id' => $rootId,
|
|
'site_player_id' => 'native-view-reset-blocked',
|
|
'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
|
|
'funding_mode' => PlayerFundingMode::CREDIT,
|
|
'username' => 'native_view_reset_blocked',
|
|
'password_hash' => Hash::make('old-secret'),
|
|
'default_currency' => 'NPR',
|
|
'status' => 0,
|
|
]);
|
|
$viewToken = playerPermissionAdminToken('player_password_view_only', ['prd.users.view']);
|
|
|
|
playerPermissionRequest($this, $viewToken)
|
|
->putJson('/api/v1/admin/players/'.$player->id.'/password', [
|
|
'password' => 'reset-secret',
|
|
'password_confirmation' => 'reset-secret',
|
|
])
|
|
->assertStatus(403);
|
|
|
|
expect(Hash::check('old-secret', (string) $player->fresh()->password_hash))->toBeTrue();
|
|
});
|