235 lines
8.3 KiB
PHP
235 lines
8.3 KiB
PHP
<?php
|
|
|
|
use App\Models\AdminRole;
|
|
use App\Models\AdminSite;
|
|
use App\Models\AdminUser;
|
|
use App\Models\ReportJob;
|
|
use Laravel\Sanctum\Sanctum;
|
|
use App\Services\AuditLogger;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function (): void {
|
|
$this->artisan('lottery:admin-auth-sync')->assertExitCode(0);
|
|
});
|
|
|
|
/**
|
|
* @param list<string> $permissionCodes
|
|
*/
|
|
function makeReportScopeAdmin(string $username, int $siteId, array $permissionCodes): AdminUser
|
|
{
|
|
$admin = AdminUser::query()->create([
|
|
'username' => $username,
|
|
'name' => $username,
|
|
'email' => null,
|
|
'password' => Hash::make('secret-strong'),
|
|
'status' => 0,
|
|
]);
|
|
|
|
$role = AdminRole::query()->create([
|
|
'slug' => 'report_scope_'.$username,
|
|
'code' => 'report_scope_'.$username,
|
|
'name' => 'Report Scope '.$username,
|
|
'scope_type' => AdminRole::SCOPE_SYSTEM,
|
|
'status' => 1,
|
|
'is_system' => false,
|
|
'sort_order' => 0,
|
|
]);
|
|
|
|
$actionIds = DB::table('admin_menu_actions')
|
|
->whereIn('permission_code', $permissionCodes)
|
|
->pluck('id');
|
|
|
|
foreach ($actionIds as $actionId) {
|
|
DB::table('admin_role_menu_actions')->insert([
|
|
'role_id' => (int) $role->id,
|
|
'menu_action_id' => (int) $actionId,
|
|
]);
|
|
}
|
|
|
|
DB::table('admin_user_site_roles')->insert([
|
|
'admin_user_id' => (int) $admin->id,
|
|
'site_id' => $siteId,
|
|
'role_id' => (int) $role->id,
|
|
'granted_at' => now(),
|
|
]);
|
|
|
|
return $admin;
|
|
}
|
|
|
|
function makeReportScopeJob(AdminUser $owner, string $jobNo, string $reportType = 'daily_profit_summary'): ReportJob
|
|
{
|
|
return ReportJob::query()->create([
|
|
'job_no' => $jobNo,
|
|
'admin_user_id' => (int) $owner->id,
|
|
'report_type' => $reportType,
|
|
'export_format' => 'csv',
|
|
'filter_json' => [
|
|
'date_from' => now()->toDateString(),
|
|
'date_to' => now()->toDateString(),
|
|
],
|
|
'status' => 'completed',
|
|
'output_path' => 'reports/'.$jobNo.'.csv',
|
|
'finished_at' => now(),
|
|
]);
|
|
}
|
|
|
|
function makeReportScopeSuperAdmin(): AdminUser
|
|
{
|
|
$admin = AdminUser::query()->create([
|
|
'username' => 'report_scope_super',
|
|
'name' => 'Report Scope Super',
|
|
'email' => null,
|
|
'password' => Hash::make('secret-strong'),
|
|
'status' => 0,
|
|
]);
|
|
grantSuperAdminRole($admin);
|
|
|
|
return $admin;
|
|
}
|
|
|
|
test('report job list show and download are owner only with an explicit super admin exception', function (): void {
|
|
$siteAId = (int) DB::table('admin_sites')->where('is_default', true)->value('id');
|
|
$siteB = AdminSite::query()->create([
|
|
'code' => 'report-scope-b',
|
|
'name' => 'Report Scope B',
|
|
'currency_code' => 'NPR',
|
|
'status' => 1,
|
|
'is_default' => false,
|
|
]);
|
|
$permissions = ['service.report.view', 'service.report.export'];
|
|
$owner = makeReportScopeAdmin('report_owner', $siteAId, $permissions);
|
|
$sameSitePeer = makeReportScopeAdmin('report_same_site_peer', $siteAId, $permissions);
|
|
$crossSitePeer = makeReportScopeAdmin('report_cross_site_peer', (int) $siteB->id, $permissions);
|
|
|
|
$ownedJob = makeReportScopeJob($owner, 'RPT-SCOPE-OWN');
|
|
$sameSiteJob = makeReportScopeJob($sameSitePeer, 'RPT-SCOPE-SAME');
|
|
$crossSiteJob = makeReportScopeJob($crossSitePeer, 'RPT-SCOPE-CROSS');
|
|
|
|
$deletedCreator = makeReportScopeAdmin('report_deleted_creator', $siteAId, $permissions);
|
|
$orphanedJob = makeReportScopeJob($deletedCreator, 'RPT-SCOPE-ORPHAN');
|
|
$deletedCreator->delete();
|
|
$orphanedJob->refresh();
|
|
expect($orphanedJob->admin_user_id)->toBeNull();
|
|
|
|
Sanctum::actingAs($owner, ['*']);
|
|
$visibleIds = collect($this->getJson('/api/v1/admin/report-jobs')
|
|
->assertOk()
|
|
->json('data.items'))
|
|
->pluck('id')
|
|
->all();
|
|
|
|
expect($visibleIds)->toBe([(int) $ownedJob->id]);
|
|
|
|
$this->getJson('/api/v1/admin/report-jobs/'.$ownedJob->id)->assertOk();
|
|
$this->get('/api/v1/admin/report-jobs/'.$ownedJob->id.'/download')->assertOk();
|
|
|
|
foreach ([$sameSiteJob, $crossSiteJob, $orphanedJob] as $deniedJob) {
|
|
$this->getJson('/api/v1/admin/report-jobs/'.$deniedJob->id)->assertForbidden();
|
|
$this->get('/api/v1/admin/report-jobs/'.$deniedJob->id.'/download')->assertForbidden();
|
|
}
|
|
|
|
$super = makeReportScopeSuperAdmin();
|
|
Sanctum::actingAs($super, ['*']);
|
|
$superVisibleIds = collect($this->getJson('/api/v1/admin/report-jobs')
|
|
->assertOk()
|
|
->json('data.items'))
|
|
->pluck('id')
|
|
->all();
|
|
|
|
expect($superVisibleIds)->toContain(
|
|
(int) $ownedJob->id,
|
|
(int) $sameSiteJob->id,
|
|
(int) $crossSiteJob->id,
|
|
(int) $orphanedJob->id,
|
|
);
|
|
|
|
$this->getJson('/api/v1/admin/report-jobs/'.$orphanedJob->id)->assertOk();
|
|
$this->get('/api/v1/admin/report-jobs/'.$orphanedJob->id.'/download')->assertOk();
|
|
});
|
|
|
|
test('sensitive report types require their own capabilities and risk export is super admin only', function (): void {
|
|
$siteId = (int) DB::table('admin_sites')->where('is_default', true)->value('id');
|
|
$base = makeReportScopeAdmin('report_base_exporter', $siteId, [
|
|
'service.report.view',
|
|
'service.report.export',
|
|
]);
|
|
$auditor = makeReportScopeAdmin('report_auditor', $siteId, [
|
|
'service.report.view',
|
|
'service.report.export',
|
|
'service.audit.view',
|
|
]);
|
|
$riskViewer = makeReportScopeAdmin('report_risk_viewer', $siteId, [
|
|
'service.report.view',
|
|
'service.report.export',
|
|
'risk.monitor.view',
|
|
]);
|
|
|
|
Sanctum::actingAs($base, ['*']);
|
|
$this->postJson('/api/v1/admin/report-jobs', [
|
|
'report_type' => 'audit_operation_report',
|
|
])->assertForbidden();
|
|
$legacyAuditJob = makeReportScopeJob($base, 'RPT-SENSITIVE-AUDIT', 'audit_operation_report');
|
|
$this->get('/api/v1/admin/report-jobs/'.$legacyAuditJob->id.'/download')->assertForbidden();
|
|
|
|
Sanctum::actingAs($auditor, ['*']);
|
|
$this->postJson('/api/v1/admin/report-jobs', [
|
|
'report_type' => 'audit_operation_report',
|
|
])->assertOk();
|
|
|
|
Sanctum::actingAs($riskViewer, ['*']);
|
|
$legacyRiskJob = makeReportScopeJob($riskViewer, 'RPT-SENSITIVE-RISK', 'hot_number_risk_report');
|
|
foreach (['hot_number_risk_report', 'sold_out_number_report'] as $reportType) {
|
|
$this->postJson('/api/v1/admin/report-jobs', [
|
|
'report_type' => $reportType,
|
|
])->assertForbidden();
|
|
}
|
|
$this->get('/api/v1/admin/report-jobs/'.$legacyRiskJob->id.'/download')->assertForbidden();
|
|
|
|
$super = makeReportScopeSuperAdmin();
|
|
Sanctum::actingAs($super, ['*']);
|
|
foreach (['hot_number_risk_report', 'sold_out_number_report'] as $reportType) {
|
|
$created = $this->postJson('/api/v1/admin/report-jobs', [
|
|
'report_type' => $reportType,
|
|
])->assertOk();
|
|
$this->get('/api/v1/admin/report-jobs/'.(int) $created->json('data.id').'/download')->assertOk();
|
|
}
|
|
});
|
|
|
|
test('non super audit export is limited to the current actor', function (): void {
|
|
$siteId = (int) DB::table('admin_sites')->where('is_default', true)->value('id');
|
|
$auditor = makeReportScopeAdmin('report_audit_owner', $siteId, [
|
|
'service.report.view',
|
|
'service.report.export',
|
|
'service.audit.view',
|
|
]);
|
|
$other = makeReportScopeAdmin('report_audit_other', $siteId, [
|
|
'service.report.view',
|
|
'service.report.export',
|
|
'service.audit.view',
|
|
]);
|
|
|
|
AuditLogger::recordForAdmin($auditor, null, 'audit_scope_own', 'own_action', null, null, null, null);
|
|
AuditLogger::recordForAdmin($other, null, 'audit_scope_other', 'other_action', null, null, null, null);
|
|
|
|
Sanctum::actingAs($auditor, ['*']);
|
|
$create = $this->postJson('/api/v1/admin/report-jobs', [
|
|
'report_type' => 'audit_operation_report',
|
|
'export_format' => 'csv',
|
|
'parameters' => [
|
|
'date_from' => now()->toDateString(),
|
|
'date_to' => now()->toDateString(),
|
|
],
|
|
])->assertOk();
|
|
|
|
$content = $this->get('/api/v1/admin/report-jobs/'.(int) $create->json('data.id').'/download')
|
|
->assertOk()
|
|
->streamedContent();
|
|
|
|
expect($content)->toContain('audit_scope_own')
|
|
->not->toContain('audit_scope_other');
|
|
});
|