Nyan Lin Paing
46f9b8d5a3
- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks), applied per module route group with tighter limits on booking/payment writes and the KBZ webhook than read-only catalog/routing endpoints. - T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/ Payment/Refund status transitions and catalog/pricing admin CRUD (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing). New IdentityPlugin with a read-only AuditLogResource gated by view_audit_log. - T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/ 405/429/500 fallback), plus PaymentGatewayException (422 declined / 502 unavailable). - T6.4: feature tests proving the FastAPI agent token gets 403 on refund/cancel-not-owned and 405 (no write handler) on catalog/routing writes. - T6.5: install gboquizosanchez/filament-log-viewer with a custom Filament admin theme (required for its views' Tailwind classes to compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered under Operations in the sidebar. 252 tests passing.
83 lines
3.3 KiB
PHP
83 lines
3.3 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Modules\Booking\Enums\BookingStatus;
|
|
use Modules\Booking\Models\Booking;
|
|
use Modules\Identity\Enums\TokenAbility;
|
|
use Modules\Payment\Enums\PaymentMethod;
|
|
use Modules\Payment\Models\Payment;
|
|
|
|
/**
|
|
* T6.4 — full policy + agent-ability audit (domain.md §8). The FastAPI
|
|
* agent's token is scoped to route:read/booking:create/booking:read only;
|
|
* this proves that scope is actually enforced end-to-end (via the existing
|
|
* role/permission-based policies, not a token-ability route middleware) and
|
|
* that catalog/pricing writes have no customer-facing route at all.
|
|
*/
|
|
beforeEach(function () {
|
|
$this->agent = User::factory()->create();
|
|
$this->agentToken = $this->agent->createToken('fastapi-agent', TokenAbility::fastApiAgentAbilities())->plainTextToken;
|
|
});
|
|
|
|
test('the agent token cannot refund a confirmed booking', function () {
|
|
$booking = Booking::factory()->create(['status' => BookingStatus::Confirmed, 'price' => 15000]);
|
|
Payment::factory()->completed()->create([
|
|
'booking_id' => $booking->id,
|
|
'gateway' => PaymentMethod::KbzMiniApp,
|
|
'amount' => 15000,
|
|
'gateway_transaction_id' => 'EVB-AGENT-AUDIT-1',
|
|
]);
|
|
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->postJson("/api/v1/bookings/{$booking->booking_ref}/refund", [
|
|
'amount' => 15000,
|
|
'reason' => 'agent should never reach this',
|
|
])
|
|
->assertForbidden();
|
|
|
|
expect($booking->refresh()->status)->toBe(BookingStatus::Confirmed);
|
|
});
|
|
|
|
test('the agent token cannot cancel a booking it does not own', function () {
|
|
$owner = User::factory()->create();
|
|
$booking = Booking::factory()->create(['user_id' => $owner->id, 'status' => BookingStatus::PendingPayment]);
|
|
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->postJson("/api/v1/bookings/{$booking->booking_ref}/cancel")
|
|
->assertForbidden();
|
|
|
|
expect($booking->refresh()->status)->toBe(BookingStatus::PendingPayment);
|
|
});
|
|
|
|
test('catalog writes have no customer-facing route at all', function () {
|
|
// These paths only exist as GET (read) routes — a POST to them is
|
|
// rejected as 405 (method not allowed), not routed to any write
|
|
// handler, proving no write endpoint was ever registered.
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->postJson('/api/v1/companies', ['name' => 'Should Not Exist'])
|
|
->assertStatus(405);
|
|
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->postJson('/api/v1/destinations', ['name' => 'Should Not Exist'])
|
|
->assertStatus(405);
|
|
});
|
|
|
|
test('routing/pricing writes have no customer-facing route at all', function () {
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->postJson('/api/v1/routes', ['ev_company_id' => 1])
|
|
->assertStatus(405);
|
|
});
|
|
|
|
test('the agent token can still read routes and create/read bookings', function () {
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->getJson('/api/v1/routes')
|
|
->assertSuccessful();
|
|
|
|
$booking = Booking::factory()->create(['user_id' => $this->agent->id]);
|
|
|
|
$this->withHeader('Authorization', "Bearer {$this->agentToken}")
|
|
->getJson('/api/v1/bookings')
|
|
->assertSuccessful()
|
|
->assertJsonPath('data.0.id', $booking->id);
|
|
});
|