Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token issuance for customer channels and the FastAPI agent (with an ability-exact-match middleware to tell them apart), Filament admin panel access restricted to admin-tier roles with the navigation group order, and skeleton BookingPolicy/RoutePolicy gated on the seeded permissions ahead of their models landing in later phases.
2026-08-05 00:27:41 +07:00
parent cfa5aed15c
commit 17dd5acd23
22 changed files with 569 additions and 12 deletions
@@ -0,0 +1,46 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Modules\Identity\Enums\TokenAbility;
+
+test('customer token endpoint issues a token with the full customer ability set', function () {
+    $user = User::factory()->create([
+        'password' => Hash::make('secret-password'),
+    ]);
+
+    $response = $this->postJson('/api/v1/auth/token', [
+        'email' => $user->email,
+        'password' => 'secret-password',
+        'device_name' => 'iphone',
+    ]);
+
+    $response->assertSuccessful()->assertJsonStructure(['token']);
+
+    $accessToken = $user->tokens()->sole();
+    expect($accessToken->abilities)->toEqualCanonicalizing(TokenAbility::customerAbilities());
+});
+
+test('customer token endpoint rejects invalid credentials', function () {
+    $user = User::factory()->create([
+        'password' => Hash::make('secret-password'),
+    ]);
+
+    $response = $this->postJson('/api/v1/auth/token', [
+        'email' => $user->email,
+        'password' => 'wrong-password',
+        'device_name' => 'iphone',
+    ]);
+
+    $response->assertUnprocessable();
+    expect($user->tokens()->count())->toBe(0);
+});
+
+test('identity:issue-agent-token command provisions a token scoped to the agent ability set', function () {
+    $this->artisan('identity:issue-agent-token')->assertSuccessful();
+
+    $agent = User::where('email', 'fastapi-agent@system.internal')->sole();
+    $token = $agent->tokens()->sole();
+
+    expect($token->abilities)->toEqualCanonicalizing(TokenAbility::fastApiAgentAbilities());
+});