Nyan Lin Paing
17dd5acd23
Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token issuance for customer channels and the FastAPI agent (with an ability-exact-match middleware to tell them apart), Filament admin panel access restricted to admin-tier roles with the navigation group order, and skeleton BookingPolicy/RoutePolicy gated on the seeded permissions ahead of their models landing in later phases.
50 lines
1.7 KiB
PHP
50 lines
1.7 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Modules\Booking\Policies\BookingPolicy;
|
|
use Spatie\Permission\Models\Permission;
|
|
|
|
beforeEach(function () {
|
|
foreach (['view_bookings', 'manage_bookings', 'process_refunds'] as $permission) {
|
|
Permission::findOrCreate($permission, 'web');
|
|
}
|
|
});
|
|
|
|
test('viewAny and view require the view_bookings permission', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$withPermission = User::factory()->create()->givePermissionTo('view_bookings');
|
|
$withoutPermission = User::factory()->create();
|
|
|
|
expect($policy->viewAny($withPermission))->toBeTrue()
|
|
->and($policy->view($withPermission, null))->toBeTrue()
|
|
->and($policy->viewAny($withoutPermission))->toBeFalse()
|
|
->and($policy->view($withoutPermission, null))->toBeFalse();
|
|
});
|
|
|
|
test('create is open to any authenticated user', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
expect($policy->create(User::factory()->create()))->toBeTrue();
|
|
});
|
|
|
|
test('cancel requires the manage_bookings permission', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$withPermission = User::factory()->create()->givePermissionTo('manage_bookings');
|
|
$withoutPermission = User::factory()->create();
|
|
|
|
expect($policy->cancel($withPermission, null))->toBeTrue()
|
|
->and($policy->cancel($withoutPermission, null))->toBeFalse();
|
|
});
|
|
|
|
test('refund requires the process_refunds permission', function () {
|
|
$policy = new BookingPolicy;
|
|
|
|
$withPermission = User::factory()->create()->givePermissionTo('process_refunds');
|
|
$withoutPermission = User::factory()->create();
|
|
|
|
expect($policy->refund($withPermission, null))->toBeTrue()
|
|
->and($policy->refund($withoutPermission, null))->toBeFalse();
|
|
});
|