Nyan Lin Paing
5b68f4fa38
- Booking model with booking_vehicle_options line items (supports mixing vehicle options like front_seat + back_seat in one booking), price snapshot, status machine, and driver/car assignment fields - BookingService: front-seat max, disabled-option toggles, duplicate-option and whole-vehicle-exclusivity guards - CreateBookingAction, CancelBookingAction, AssignDriverAction - BookingRefGenerator: sequential EVB-AAAAA1-style refs via row lock - POST/GET/cancel booking API endpoints (Sanctum, ownership + admin policy) - BookingPlugin + Filament BookingResource: list, detail view, Cancel and Assign Driver actions (shared between table and detail page) - domain.md updated for multi-vehicle-option bookings (§2) and driver/ vehicle assignment (§5a)
89 lines
2.9 KiB
PHP
89 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Modules\Booking\Models\Booking;
|
|
use Modules\Booking\Policies\BookingPolicy;
|
|
use Spatie\Permission\Models\Permission;
|
|
|
|
beforeEach(function () {
|
|
foreach (['view_bookings', 'manage_bookings', 'process_refunds'] as $permission) {
|
|
Permission::findOrCreate($permission, 'web');
|
|
}
|
|
});
|
|
|
|
test('viewAny is open to any authenticated user — listing is scoped to their own bookings at the query level', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
expect($policy->viewAny(User::factory()->create()))->toBeTrue();
|
|
});
|
|
|
|
test('view allows the booking\'s owner', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$owner = User::factory()->create();
|
|
$booking = Booking::factory()->create(['user_id' => $owner->id]);
|
|
|
|
expect($policy->view($owner, $booking))->toBeTrue();
|
|
});
|
|
|
|
test('view rejects a non-owner without the view_bookings permission', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$stranger = User::factory()->create();
|
|
$booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
|
|
|
|
expect($policy->view($stranger, $booking))->toBeFalse();
|
|
});
|
|
|
|
test('view allows a non-owner with the view_bookings permission (admin/support)', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$admin = User::factory()->create()->givePermissionTo('view_bookings');
|
|
$booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
|
|
|
|
expect($policy->view($admin, $booking))->toBeTrue();
|
|
});
|
|
|
|
test('create is open to any authenticated user', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
expect($policy->create(User::factory()->create()))->toBeTrue();
|
|
});
|
|
|
|
test('cancel allows the booking\'s owner', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$owner = User::factory()->create();
|
|
$booking = Booking::factory()->create(['user_id' => $owner->id]);
|
|
|
|
expect($policy->cancel($owner, $booking))->toBeTrue();
|
|
});
|
|
|
|
test('cancel allows staff with the manage_bookings permission on someone else\'s booking', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$staff = User::factory()->create()->givePermissionTo('manage_bookings');
|
|
$booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
|
|
|
|
expect($policy->cancel($staff, $booking))->toBeTrue();
|
|
});
|
|
|
|
test('cancel rejects a non-owner without the manage_bookings permission', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$stranger = User::factory()->create();
|
|
$booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
|
|
|
|
expect($policy->cancel($stranger, $booking))->toBeFalse();
|
|
});
|
|
|
|
test('refund requires the process_refunds permission', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$withPermission = User::factory()->create()->givePermissionTo('process_refunds');
|
|
$withoutPermission = User::factory()->create();
|
|
|
|
expect($policy->refund($withPermission, null))->toBeTrue()
|
|
->and($policy->refund($withoutPermission, null))->toBeFalse();
|
|
});
|