fix dashboard and apis

2026-08-16 23:50:39 +07:00
parent 60413bdebf
commit 8d74ac74cd
26 changed files with 638 additions and 55 deletions
@@ -0,0 +1,86 @@
+<?php
+
+use Firebase\JWT\JWT;
+use Modules\Booking\Enums\BookingChannel;
+use Modules\Booking\Models\Booking;
+use Modules\Catalog\Models\DepartureTimeSlot;
+use Modules\Routing\Models\EvRoute;
+use Modules\Routing\Models\RoutePricing;
+use Modules\Shared\Enums\VehicleOption;
+
+beforeEach(function () {
+    config(['services.fastapi_agent.jwt_secret' => 'test-fastapi-agent-secret-0123456789ABCDEF']);
+    config(['services.fastapi_agent.jwt_algorithm' => 'HS256']);
+});
+
+function fastApiAgentToken(string $openid): string
+{
+    return JWT::encode([
+        'sub' => $openid,
+        'iat' => time(),
+        'exp' => time() + 3600,
+    ], 'test-fastapi-agent-secret-0123456789ABCDEF', 'HS256');
+}
+
+test('a FastAPI JWT booking is stored against the verified openid, ignoring a spoofed body value', function () {
+    config(['booking.back_seat_enabled' => true]);
+
+    $route = EvRoute::factory()->create(['is_active' => true]);
+    $timeSlot = DepartureTimeSlot::factory()->create();
+    $route->timeSlots()->attach($timeSlot->id, ['is_active' => true]);
+    RoutePricing::factory()->create([
+        'ev_route_id' => $route->id,
+        'vehicle_option' => VehicleOption::BackSeat,
+        'price' => '15000.00',
+    ]);
+
+    $token = fastApiAgentToken('real-customer-openid');
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->withHeader('Device-Type', 'android') // the agent's own channel always wins, ignored here.
+        ->postJson('/api/v1/bookings', [
+            'ev_route_id' => $route->id,
+            'departure_time_slot_id' => $timeSlot->id,
+            'travel_date' => now()->addDay()->toDateString(),
+            'selections' => [['vehicle_option' => 'back_seat', 'passenger_count' => 1]],
+            'passenger_name' => 'Jane Doe',
+            'passenger_phone' => '+959123456789',
+            'pickup_address' => '123 Pickup St',
+            'dropoff_address' => '456 Dropoff Ave',
+            'openid' => 'spoofed-openid',
+        ])
+        ->assertCreated();
+
+    $booking = Booking::sole();
+    expect($booking->openid)->toBe('real-customer-openid')
+        ->and($booking->user_id)->toBeNull()
+        ->and($booking->created_by_channel)->toBe(BookingChannel::Agent);
+});
+
+test('a FastAPI JWT can list and show only its own openid\'s bookings', function () {
+    $mine = Booking::factory()->create(['openid' => 'agent-openid-mine']);
+    Booking::factory()->create(['openid' => 'agent-openid-someone-else']);
+
+    $token = fastApiAgentToken('agent-openid-mine');
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/api/v1/bookings')
+        ->assertSuccessful()
+        ->assertJsonCount(1, 'data')
+        ->assertJsonPath('data.0.id', $mine->id);
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson("/api/v1/bookings/{$mine->booking_ref}")
+        ->assertSuccessful()
+        ->assertJsonPath('data.id', $mine->id);
+});
+
+test('a FastAPI JWT gets a 404 for a booking belonging to a different openid', function () {
+    $someoneElses = Booking::factory()->create(['openid' => 'agent-openid-someone-else']);
+
+    $token = fastApiAgentToken('agent-openid-mine');
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson("/api/v1/bookings/{$someoneElses->booking_ref}")
+        ->assertNotFound();
+});