Nyan Lin Paing
46f9b8d5a3
- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks), applied per module route group with tighter limits on booking/payment writes and the KBZ webhook than read-only catalog/routing endpoints. - T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/ Payment/Refund status transitions and catalog/pricing admin CRUD (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing). New IdentityPlugin with a read-only AuditLogResource gated by view_audit_log. - T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/ 405/429/500 fallback), plus PaymentGatewayException (422 declined / 502 unavailable). - T6.4: feature tests proving the FastAPI agent token gets 403 on refund/cancel-not-owned and 405 (no write handler) on catalog/routing writes. - T6.5: install gboquizosanchez/filament-log-viewer with a custom Filament admin theme (required for its views' Tailwind classes to compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered under Operations in the sidebar. 252 tests passing.
68 lines
2.3 KiB
PHP
68 lines
2.3 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use Modules\Booking\Enums\BookingStatus;
|
|
use Modules\Booking\Models\Booking;
|
|
use Modules\Catalog\Models\EvCompany;
|
|
use Spatie\Activitylog\Models\Activity;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\Models\Role;
|
|
|
|
/**
|
|
* T6.2 — LogsActivity is attached to Booking status transitions and to
|
|
* catalog admin CRUD; the read-only AuditLogResource (Filament) is gated by
|
|
* view_audit_log.
|
|
*/
|
|
test('a booking status transition is recorded in the audit log', function () {
|
|
$booking = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
|
|
|
|
$booking->update(['status' => BookingStatus::Confirmed]);
|
|
|
|
$activity = Activity::where('subject_type', Booking::class)
|
|
->where('subject_id', $booking->id)
|
|
->where('log_name', 'booking')
|
|
->latest('id')
|
|
->first();
|
|
|
|
expect($activity)->not->toBeNull();
|
|
expect($activity->attribute_changes->get('attributes'))->toMatchArray(['status' => BookingStatus::Confirmed->value]);
|
|
});
|
|
|
|
test('a catalog CRUD write is recorded in the audit log', function () {
|
|
$company = EvCompany::factory()->create(['name' => 'Original Name']);
|
|
|
|
$company->update(['name' => 'Renamed Company']);
|
|
|
|
$activity = Activity::where('subject_type', EvCompany::class)
|
|
->where('subject_id', $company->id)
|
|
->where('log_name', 'catalog')
|
|
->latest('id')
|
|
->first();
|
|
|
|
expect($activity)->not->toBeNull();
|
|
expect($activity->attribute_changes->get('attributes')['name'])->toBe('Renamed Company');
|
|
});
|
|
|
|
test('a user without view_audit_log cannot list the audit log via Filament', function () {
|
|
Permission::findOrCreate('view_audit_log', 'web');
|
|
$role = Role::findOrCreate('support', 'web');
|
|
$user = User::factory()->create();
|
|
$user->assignRole($role);
|
|
|
|
$this->actingAs($user)
|
|
->get('/admin/audit-logs')
|
|
->assertForbidden();
|
|
});
|
|
|
|
test('a user with view_audit_log can list the audit log via Filament', function () {
|
|
Permission::findOrCreate('view_audit_log', 'web');
|
|
$role = Role::findOrCreate('support', 'web');
|
|
$role->givePermissionTo('view_audit_log');
|
|
$user = User::factory()->create();
|
|
$user->assignRole($role);
|
|
|
|
$this->actingAs($user)
|
|
->get('/admin/audit-logs')
|
|
->assertSuccessful();
|
|
});
|