feat(desk): print authorized saved pre-dossier

2026-11-10 10:41:49 +02:00
parent 4e07557cb1
commit dcecd25102
5 changed files with 157 additions and 1 deletions
@@ -0,0 +1,63 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Http\Controllers\VirtualDeskController;
+use App\Http\Middleware\VirtualDeskInstalled;
+use App\Models\User;
+use App\Services\VirtualDesk;
+use Illuminate\Foundation\Testing\TestCase;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Mockery;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+
+class DeskPreDossierTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        DB::shouldReceive('connection')->never();
+    }
+
+    public function test_export_reuses_the_existing_case_authorisation_before_reading_any_data(): void
+    {
+        $actor = new User;
+        $actor->id = 9;
+        $id = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa';
+        $request = Request::create('/balcao-virtual/dossiers/'.$id.'/pre-dossier');
+        $request->setUserResolver(fn () => $actor);
+        $desk = Mockery::mock(VirtualDesk::class);
+        $desk->shouldReceive('case')->once()->with($actor, $id)->andThrow(new HttpException(403));
+        $this->expectException(HttpException::class);
+        app(VirtualDeskController::class)->preDossier($request, $id, $desk);
+    }
+
+    public function test_preparation_document_escapes_declared_data_and_preserves_unknowns_and_internal_status(): void
+    {
+        $html = view('desk.pre-dossier', [
+            'case' => ['id' => 'qa-case', 'title' => '<script>alert(1)</script>', 'version' => 3, 'closed_at' => null,
+                'payload' => ['profile' => ['name' => '<img src=x onerror=alert(2)>'], 'investment' => ['amount' => null]], 'simulation_id' => 'qa-existing-simulation'],
+            'requests' => collect([(object) ['protocol' => null, 'status' => 'draft', 'version' => 1]]),
+            'documents' => collect([(object) ['file_name' => '<script>document</script>', 'category' => 'licença declarada']]),
+            'states' => ['draft' => 'Rascunho'],
+        ])->render();
+        $this->assertStringNotContainsString('<script>', $html);
+        $this->assertStringContainsString('&lt;script&gt;', $html);
+        $this->assertStringContainsString('&lt;img', $html);
+        $this->assertStringContainsString('Rascunho — sem submissão', $html);
+        $this->assertStringContainsString('window.print()', $html);
+        $this->assertStringContainsString('Não constitui aprovação', $html);
+        $this->assertStringContainsString('não confirma regras, elegibilidade ou benefícios', $html);
+        $this->assertStringContainsString('null', $html);
+    }
+
+    public function test_preparation_route_keeps_the_authenticated_installed_workspace_gates(): void
+    {
+        $route = app('router')->getRoutes()->match(Request::create('/balcao-virtual/dossiers/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/pre-dossier'));
+        $middleware = $route->gatherMiddleware();
+        $this->assertContains('auth', $middleware);
+        $this->assertContains('verified', $middleware);
+        $this->assertContains(VirtualDeskInstalled::class, $middleware);
+    }
+}