melabidi/alrahma_sunday_school_api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security fix and fix parent pages
API CI/CD / Validate (composer + pint) (push) Successful in 3m7s
Details
API CI/CD / Test (PHPUnit) (push) Failing after 5m46s
Details
API CI/CD / Build frontend assets (push) Successful in 1m2s
Details
API CI/CD / Security audit (push) Failing after 49s
Details
API CI/CD / Deploy to shared hosting (PHP) (push) Has been skipped
Details

Browse Source
This commit is contained in:
root
2026-07-06 02:14:16 -04:00
parent 39228168c8
commit 90f9857b06
43 changed files with 4323 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/Middleware/RequirePermissionMiddlewareTest.php
+78
View File
@@ -6,6 +6,7 @@ use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Route;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;
class RequirePermissionMiddlewareTest extends TestCase
@@ -27,6 +28,8 @@ class RequirePermissionMiddlewareTest extends TestCase
'zip' => '12345',
'accept_school_policy' => 1,
'status' => 'Active',
'is_verified' => 1,
'is_suspended' => 0,
'password' => 'hashed',
'semester' => 'Fall',
]);
@@ -59,6 +62,8 @@ class RequirePermissionMiddlewareTest extends TestCase
'zip' => '12345',
'accept_school_policy' => 1,
'status' => 'Active',
'is_verified' => 1,
'is_suspended' => 0,
'password' => 'hashed',
'semester' => 'Fall',
]);
@@ -81,4 +86,77 @@ class RequirePermissionMiddlewareTest extends TestCase
$response->assertOk();
$response->assertSee('ok');
}
public function test_multi_auth_blocks_suspended_sanctum_user(): void
{
Route::middleware('multi.auth')->get('/test-active-account', fn () => 'ok');
$user = $this->createUser([
'email' => 'suspended@example.com',
'is_verified' => 1,
'is_suspended' => 1,
]);
Sanctum::actingAs($user);
$this->get('/test-active-account', ['Accept' => 'application/json'])
->assertStatus(403)
->assertJsonPath('message', 'Account unavailable.');
}
public function test_permission_middleware_blocks_unverified_user_even_with_permission(): void
{
$permissionId = DB::table('permissions')->insertGetId([
'name' => 'edit_students',
'description' => 'Edit students',
]);
$roleId = DB::table('roles')->insertGetId([
'name' => 'admin',
'priority' => 1,
]);
$user = $this->createUser([
'email' => 'unverified-perm@example.com',
'is_verified' => 0,
'is_suspended' => 0,
]);
DB::table('user_roles')->insert([
'user_id' => $user->id,
'role_id' => $roleId,
]);
DB::table('role_permissions')->insert([
'role_id' => $roleId,
'permission_id' => $permissionId,
'can_read' => 1,
]);
Route::middleware('perm:edit_students')->get('/test-perm-unverified', fn () => 'ok');
$this->actingAs($user)->get('/test-perm-unverified', ['Accept' => 'application/json'])
->assertStatus(403)
->assertJsonPath('message', 'Account unavailable.');
}
private function createUser(array $overrides = []): User
{
return User::query()->create(array_merge([
'firstname' => 'Test',
'lastname' => 'User',
'email' => 'test-user@example.com',
'cellphone' => '5555555555',
'address_street' => '123 Main',
'city' => 'City',
'state' => 'CT',
'zip' => '12345',
'accept_school_policy' => 1,
'status' => 'Active',
'is_verified' => 1,
'is_suspended' => 0,
'password' => 'hashed',
'semester' => 'Fall',
], $overrides));
}
}