melabidi/alrahma_sunday_school_api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

archetecture security fix

Browse Source
This commit is contained in:
root
2026-06-11 03:22:12 -04:00
parent 6def9993da
commit 9483750161
3126 changed files with 177194 additions and 37211 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/Api/V1/Administrator/AdministratorTeacherSubmissionNotifyApiTest.php
+57
View File
@@ -5,6 +5,7 @@ namespace Tests\Feature\Api\Administrator;
use App\Models\Configuration;
use App\Models\TeacherSubmissionNotificationHistory;
use App\Models\User;
use App\Services\Administrator\AdministratorSharedService;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Mail;
@@ -217,6 +218,62 @@ class AdministratorTeacherSubmissionNotifyApiTest extends TestCase
]);
}
public function test_notify_endpoint_accepts_flat_teacher_ids_when_teacher_class_has_no_semester_column(): void
{
Mail::fake();
$shared = \Mockery::mock($this->app->make(AdministratorSharedService::class))->makePartial();
$shared->shouldReceive('teacherClassSupportsSemester')
->once()
->andReturn(false);
$this->app->instance(AdministratorSharedService::class, $shared);
$admin = $this->seedAdminUser('admin4@test.com', 903, 'Admin', 'Four');
Sanctum::actingAs($admin, [], 'api');
User::factory()->create([
'id' => 103,
'firstname' => 'Legacy',
'lastname' => 'Notify',
'email' => 'legacy.notify@test.com',
]);
DB::table('classSection')->insert([
[
'class_section_id' => 13,
'class_section_name' => 'Grade 9A',
'class_id' => 9,
'semester' => 'Fall',
'school_year' => '2025-2026',
],
]);
DB::table('teacher_class')->insert([
'class_section_id' => 13,
'teacher_id' => 103,
'position' => 'main',
'school_year' => '2025-2026',
'semester' => 'Fall',
]);
$response = $this->postJson('/api/v1/administrator/teacher-submissions/notify', [
'notify' => [103],
]);
$response->assertOk()
->assertJson([
'sent' => 1,
'failed' => 0,
]);
$this->assertDatabaseHas('teacher_submission_notification_history', [
'teacher_id' => 103,
'class_section_id' => 13,
'admin_id' => 903,
'notification_category' => 'teacher_submissions',
'status' => 'sent',
]);
}
private function seedAdminUser(string $email, ?int $id = null, string $firstname = 'Admin', string $lastname = 'User'): User
{
$roleId = DB::table('roles')->insertGetId([
tests/Feature/Api/V1/Administrator/AdministratorTeacherSubmissionReportApiTest.php
+48
View File
@@ -7,6 +7,7 @@ use App\Models\Configuration;
use App\Models\SemesterScore;
use App\Models\TeacherSubmissionNotificationHistory;
use App\Models\User;
use App\Services\Administrator\AdministratorSharedService;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Str;
@@ -242,6 +243,53 @@ class AdministratorTeacherSubmissionReportApiTest extends TestCase
$this->assertSame(0, $row['student_count']);
}
public function test_teacher_submission_report_handles_teacher_class_without_semester_column(): void
{
$shared = \Mockery::mock($this->app->make(AdministratorSharedService::class))->makePartial();
$shared->shouldReceive('teacherClassSupportsSemester')
->once()
->andReturn(false);
$this->app->instance(AdministratorSharedService::class, $shared);
$admin = $this->seedAdminUser('admin.report.legacy@test.com', 902, 'Admin', 'Legacy');
Sanctum::actingAs($admin, [], 'api');
User::factory()->create([
'id' => 210,
'firstname' => 'Legacy',
'lastname' => 'Teacher',
'email' => 'legacy.teacher@test.com',
]);
DB::table('classSection')->insert([
[
'class_section_id' => 21,
'class_section_name' => 'Grade 8A',
'class_id' => 8,
'semester' => 'Fall',
'school_year' => '2025-2026',
],
]);
DB::table('teacher_class')->insert([
[
'class_section_id' => 21,
'teacher_id' => 210,
'position' => 'main',
'school_year' => '2025-2026',
'semester' => 'Fall',
],
]);
$response = $this->getJson('/api/v1/administrator/teacher-submissions');
$response->assertOk()
->assertJsonCount(1, 'rows');
$this->assertSame('Grade 8A', $response->json('rows.0.class_section'));
$this->assertSame('Main: Legacy Teacher', $response->json('rows.0.teachers.0.label'));
}
public function test_teacher_submission_report_limits_history_to_three_entries(): void
{
$admin = $this->seedAdminUser('admin.report.two@test.com', 901, 'Admin', 'Two');