283 lines
19 KiB
PHP
283 lines
19 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\Opportunity;
|
|
use App\Models\User;
|
|
use App\Services\OpportunityProfileWorkflow;
|
|
use App\Services\OpportunityPromotion;
|
|
use App\Services\PortalProfileAdministration;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Foundation\Vite;
|
|
use Illuminate\Support\Facades\Crypt;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Str;
|
|
use Inertia\Testing\AssertableInertia as Assert;
|
|
use Symfony\Component\HttpKernel\Exception\HttpException;
|
|
use Tests\TestCase;
|
|
|
|
final class PrivateOfferPreparationTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private const BASE = '/minhas-oportunidades/ofertas';
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
$this->withoutVite();
|
|
config(['portal.profile_access_enabled' => true]);
|
|
}
|
|
|
|
private function promoter(string $category = 'business_sale', ?string $organization = null): User
|
|
{
|
|
$user = User::factory()->create();
|
|
app(PortalProfileAdministration::class)->insertGrant((string) Str::uuid(), User::factory()->create(), [
|
|
'user_id' => $user->id, 'role' => 'promoter', 'organization_id' => $organization,
|
|
'opportunity_types' => [$category], 'source' => 'synthetic-test-fixture',
|
|
]);
|
|
|
|
return $user;
|
|
}
|
|
|
|
private function payload(): array
|
|
{
|
|
return ['creation_key' => (string) Str::uuid(), 'opportunity_category' => 'business_sale',
|
|
'title' => 'Empresa sintética QA', 'description' => 'Descrição sintética privada para preparação de uma oferta.',
|
|
'private_offer' => ['price_mode' => 'amount', 'amount' => '123456.78', 'currency' => 'MZN', 'contact_id' => null],
|
|
'reason' => 'Preparação sintética da oferta na base isolada QA.'];
|
|
}
|
|
|
|
private function contact(User $owner): string
|
|
{
|
|
$id = (string) Str::uuid();
|
|
DB::table('contacts')->insert(['id' => $id, 'full_name' => 'Contacto sintético QA', 'email' => 'offer-'.Str::uuid().'@example.test',
|
|
'phone' => '+258840000000', 'source_system' => 'portal-user-contact', 'external_id' => 'user:'.$owner->id]);
|
|
|
|
return $id;
|
|
}
|
|
|
|
public function test_private_creation_recovery_edit_conflict_and_idempotency_use_one_opportunity(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$payload = $this->payload();
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $payload)->assertCreated()->json('record');
|
|
$this->postJson(self::BASE.'/rascunhos', $payload)->assertCreated()->assertJsonPath('record.id', $saved['id']);
|
|
$this->assertSame(1, Opportunity::count());
|
|
$this->assertDatabaseHas('opportunities', ['id' => $saved['id'], 'owner_user_id' => $actor->id, 'status' => 'draft', 'published_at' => null, 'estimated_investment_amount' => null]);
|
|
$this->getJson(self::BASE.'/'.$saved['id'])->assertOk()->assertHeader('Cache-Control', 'no-store, private')->assertJsonPath('record.values.private_offer.amount', '123456.78');
|
|
$this->get(self::BASE.'/'.$saved['id'])->assertInertia(fn (Assert $page) => $page->component('offers/preparation')->where('record.canEdit', true));
|
|
$updated = $this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'title' => 'Título revisto QA',
|
|
'private_offer' => ['price_mode' => 'negotiable', 'amount' => null, 'currency' => null], 'reason' => $payload['reason']])->assertOk()->json('record');
|
|
$this->assertSame($saved['id'], $updated['id']);
|
|
$this->getJson(self::BASE.'/'.$saved['id'])->assertJsonPath('record.values.title', 'Título revisto QA')->assertJsonPath('record.values.private_offer.price_mode', 'negotiable');
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'title' => 'Edição concorrente', 'reason' => $payload['reason']])->assertConflict();
|
|
$this->assertDatabaseHas('opportunities', ['id' => $saved['id'], 'title' => 'Título revisto QA']);
|
|
}
|
|
|
|
public function test_incomplete_draft_is_saved_but_submission_requires_common_fields_and_authorized_contact(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', ['creation_key' => (string) Str::uuid(),
|
|
'opportunity_category' => 'business_sale', 'private_offer' => ['price_mode' => null], 'reason' => $this->payload()['reason']])->assertCreated()->json('record');
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/submeter', ['etag' => $saved['etag'], 'confirm' => true])->assertUnprocessable()->assertJsonValidationErrors(['title', 'description', 'private_offer.contact_id']);
|
|
$this->assertDatabaseHas('opportunities', ['id' => $saved['id'], 'status' => 'draft', 'published_at' => null]);
|
|
}
|
|
|
|
public function test_submit_is_private_exact_version_confirmed_and_recoverable_without_editorial_actions(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$payload = $this->payload();
|
|
$payload['private_offer']['contact_id'] = $this->contact($actor);
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $payload)->assertCreated()->json('record');
|
|
$url = self::BASE.'/'.$saved['id'].'/submeter';
|
|
$this->postJson($url, ['etag' => $saved['etag'], 'confirm' => false])->assertUnprocessable();
|
|
$this->postJson($url, ['etag' => str_repeat('0', 64), 'confirm' => true])->assertConflict();
|
|
$submitted = $this->postJson($url, ['etag' => $saved['etag'], 'confirm' => true])->assertOk()->assertJsonPath('record.state', 'submitted')->assertJsonPath('record.canEdit', false)->json('record');
|
|
$this->postJson($url, ['etag' => $submitted['etag'], 'confirm' => true])->assertOk();
|
|
$this->getJson(self::BASE.'/'.$saved['id'])->assertOk()->assertJsonPath('record.state', 'submitted');
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $submitted['etag'], 'reason' => $payload['reason']])->assertForbidden();
|
|
$record = Opportunity::findOrFail($saved['id']);
|
|
$this->assertSame([], app(OpportunityProfileWorkflow::class)->actions($actor, $record));
|
|
$this->assertFalse(app(OpportunityPromotion::class)->allowed($actor, $record));
|
|
$this->assertNull($record->published_at);
|
|
$this->assertSame('draft', $record->status);
|
|
$this->assertSame(1, DB::table('audit_events')->where('action', 'private_offer_submitted')->count());
|
|
$this->assertDatabaseCount('portal_editorial_editions', 0);
|
|
$this->assertDatabaseCount('portal_editorial_notifications', 0);
|
|
}
|
|
|
|
public function test_other_accounts_ungranted_unverified_and_revoked_actors_cannot_operate(): void
|
|
{
|
|
$this->get(self::BASE.'/criar')->assertRedirect('/login');
|
|
$ungranted = User::factory()->create();
|
|
$this->actingAs($ungranted)->postJson(self::BASE.'/rascunhos', $this->payload())->assertForbidden();
|
|
$this->actingAs(User::factory()->unverified()->create())->get(self::BASE.'/criar')->assertRedirect('/email/verify');
|
|
$actor = $this->promoter();
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $this->payload())->assertCreated()->json('record');
|
|
$other = $this->promoter();
|
|
$this->actingAs($other)->getJson(self::BASE.'/'.$saved['id'])->assertForbidden();
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag']])->assertForbidden();
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/submeter', ['etag' => $saved['etag'], 'confirm' => true])->assertForbidden();
|
|
$this->get(self::BASE)->assertInertia(fn (Assert $page) => $page->has('records.data', 0));
|
|
DB::table('portal_role_assignments')->where('user_id', $actor->id)->update(['starts_at' => now()->subHour(), 'expires_at' => now()->subMinute()]);
|
|
$this->actingAs($actor)->getJson(self::BASE.'/'.$saved['id'])->assertForbidden();
|
|
}
|
|
|
|
public function test_contact_scope_and_malicious_fields_roll_back_without_parallel_records(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$payload = $this->payload();
|
|
$payload['private_offer']['contact_id'] = $this->contact($this->promoter());
|
|
$this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $payload)->assertUnprocessable()->assertJsonValidationErrors('private_offer.contact_id');
|
|
$this->assertDatabaseCount('opportunities', 0);
|
|
$payload = $this->payload();
|
|
foreach (['status' => 'published', 'owner_user_id' => $actor->id, 'workflow_context' => ['publication' => ['visibility' => 'public']]] as $key => $value) {
|
|
$this->postJson(self::BASE.'/rascunhos', [...$payload, $key => $value])->assertUnprocessable();
|
|
}
|
|
$this->postJson(self::BASE.'/rascunhos', [...$payload, 'opportunity_category' => 'real_estate'])->assertForbidden();
|
|
$this->assertDatabaseCount('opportunities', 0);
|
|
}
|
|
|
|
public function test_price_contract_rejects_conversion_modes_precision_and_negotiable_amount(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
foreach ([['price_mode' => 'amount', 'amount' => '10.123', 'currency' => 'MZN'], ['price_mode' => 'amount', 'amount' => '100', 'currency' => 'EUR'],
|
|
['price_mode' => 'negotiable', 'amount' => '100', 'currency' => 'USD'], ['price_mode' => 'amount', 'amount' => '-1', 'currency' => 'USD'], ['price_mode' => 'amount', 'amount' => 100.01, 'currency' => 'USD']] as $price) {
|
|
$this->actingAs($actor)->postJson(self::BASE.'/rascunhos', [...$this->payload(), 'private_offer' => $price])->assertUnprocessable();
|
|
}
|
|
$this->assertDatabaseCount('opportunities', 0);
|
|
}
|
|
|
|
public function test_no_public_exposure_and_native_routes_cannot_edit_or_publish_offer(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $this->payload())->assertCreated()->json('record');
|
|
$id = $saved['id'];
|
|
$this->putJson('/minhas-oportunidades/'.$id.'/draft', ['etag' => $saved['etag'], 'title' => 'Contorno', 'reason' => $this->payload()['reason']])->assertForbidden();
|
|
foreach (['submit', 'approve', 'publish'] as $action) {
|
|
$this->postJson('/minhas-oportunidades/'.$id.'/workflow', ['etag' => $saved['etag'], 'action' => $action, 'reason' => $this->payload()['reason']])->assertForbidden();
|
|
}
|
|
$this->postJson('/minhas-oportunidades/'.$id.'/divulgacao/confirmar', [])->assertForbidden();
|
|
$this->get('/minhas-oportunidades/'.$id.'/edit')->assertRedirect(self::BASE.'/'.$id);
|
|
$record = Opportunity::findOrFail($id);
|
|
$this->assertFalse(app(OpportunityPromotion::class)->allowed($actor, $record));
|
|
$this->actingAs(User::factory()->create())->getJson('/api/v1/opportunities/'.$record->slug)->assertNotFound();
|
|
$this->get('/oportunidades/'.$record->slug)->assertNotFound();
|
|
$this->getJson('/api/v1/opportunities/search?q=Empresa')->assertOk()->assertJsonPath('total', 0);
|
|
// Defence in depth: even inconsistent data from an external writer is excluded.
|
|
DB::table('opportunities')->where('id', $id)->update(['status' => 'published', 'published_at' => now()->subMinute(),
|
|
'workflow_context' => json_encode([...$record->workflow_context, 'publication' => ['visibility' => 'public']])]);
|
|
$this->assertSame(0, Opportunity::published()->count());
|
|
$this->getJson('/api/v1/opportunities/'.$record->slug)->assertNotFound();
|
|
}
|
|
|
|
public function test_existing_opportunity_cannot_be_converted_through_offer_adapter(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$native = $this->actingAs($actor)->postJson('/minhas-oportunidades/drafts', $this->payload())->assertCreated()->json();
|
|
$this->getJson(self::BASE.'/'.$native['id'])->assertNotFound();
|
|
$this->postJson(self::BASE.'/'.$native['id'].'/guardar', ['etag' => $native['etag']])->assertNotFound();
|
|
$this->assertFalse(Opportunity::findOrFail($native['id'])->isPrivateOfferPreparation());
|
|
$publisher = User::factory()->create();
|
|
app(PortalProfileAdministration::class)->insertGrant((string) Str::uuid(), User::factory()->create(), [
|
|
'user_id' => $publisher->id, 'role' => 'publisher', 'organization_id' => null,
|
|
'opportunity_types' => ['business_sale'], 'source' => 'synthetic-test-fixture',
|
|
]);
|
|
$this->assertTrue(app(OpportunityPromotion::class)->allowed($publisher, Opportunity::findOrFail($native['id'])));
|
|
$this->assertSame(1, Opportunity::count());
|
|
}
|
|
|
|
public function test_existing_contacts_registration_still_requires_fresh_mfa_and_submission_rechecks_contact(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $this->payload())->assertCreated()->json('record');
|
|
$data = ['etag' => $saved['etag'], 'full_name' => 'Contacto de teste QA', 'email' => 'private-offer@example.test', 'phone' => '+258840000001'];
|
|
$url = '/minhas-oportunidades/'.$saved['id'].'/contacts';
|
|
$this->postJson($url, $data)->assertForbidden();
|
|
$actor->forceFill(['two_factor_secret' => Crypt::encryptString('SYNTHETIC-QA'), 'two_factor_confirmed_at' => now()])->save();
|
|
$this->withSession(['portal.mfa_actor' => $actor->id, 'portal.mfa_at' => time()]);
|
|
$contact = $this->postJson($url, $data)->assertOk()->json('contact');
|
|
$this->postJson($url, $data)->assertOk()->assertJsonPath('contact.id', $contact['id']);
|
|
$payload = $this->payload();
|
|
$payload['private_offer']['contact_id'] = $contact['id'];
|
|
$saved = $this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'private_offer' => $payload['private_offer'], 'reason' => $payload['reason']])->assertOk()->json('record');
|
|
DB::table('contacts')->where('id', $contact['id'])->update(['deleted_at' => now()]);
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/submeter', ['etag' => $saved['etag'], 'confirm' => true])->assertUnprocessable()->assertJsonValidationErrors('private_offer.contact_id');
|
|
$this->assertSame('draft', Opportunity::findOrFail($saved['id'])->workflow_context['private_offer_preparation']['state']);
|
|
}
|
|
|
|
public function test_model_cannot_publish_or_remove_private_phase_marker(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $this->payload())->assertCreated()->json('record');
|
|
foreach ([['status' => 'published', 'published_at' => now()], ['workflow_context' => []]] as $change) {
|
|
try {
|
|
Opportunity::findOrFail($saved['id'])->forceFill($change)->save();
|
|
$this->fail('A preparação privada foi exposta ou convertida.');
|
|
} catch (HttpException $exception) {
|
|
$this->assertSame(403, $exception->getStatusCode());
|
|
}
|
|
}
|
|
$this->assertDatabaseHas('opportunities', ['id' => $saved['id'], 'status' => 'draft', 'published_at' => null]);
|
|
}
|
|
|
|
public function test_location_uses_existing_hierarchy_and_invalid_selection_never_saves(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$ids = [];
|
|
foreach (['country', 'province', 'district'] as $index => $type) {
|
|
$ids[$index] = (string) Str::uuid();
|
|
DB::table('geo_locations')->insert(['id' => $ids[$index], 'code' => $ids[$index], 'name' => 'QA '.$type,
|
|
'location_type' => $type, 'parent_id' => $index ? $ids[$index - 1] : null, 'data_classification' => 'internal']);
|
|
}
|
|
$payload = [...$this->payload(), 'province_id' => $ids[1], 'district_id' => $ids[2]];
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $payload)->assertCreated()->json('record');
|
|
$this->getJson(self::BASE.'/'.$saved['id'])->assertOk()->assertJsonPath('record.territory.0.id', $ids[1])->assertJsonPath('record.territory.1.id', $ids[2]);
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'province_id' => $ids[2], 'district_id' => $ids[1], 'reason' => $payload['reason']])->assertUnprocessable();
|
|
$this->assertDatabaseHas('opportunities', ['id' => $saved['id'], 'primary_territory_id' => $ids[2]]);
|
|
}
|
|
|
|
public function test_full_html_uses_real_compiled_private_page_entries(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$directory = getenv('EDITORIAL_QA_BUILD_DIRECTORY') ?: 'build';
|
|
$manifest = json_decode(file_get_contents(public_path($directory.'/manifest.json')), true, 512, JSON_THROW_ON_ERROR);
|
|
$this->app->instance(Vite::class, (new Vite)->useBuildDirectory($directory)->useHotFile(storage_path('phpunit-offers-no-hot')));
|
|
$this->actingAs($actor);
|
|
foreach (['offers/preparation-index' => self::BASE, 'offers/preparation' => self::BASE.'/criar'] as $page => $url) {
|
|
$key = 'resources/js/pages/'.$page.'.tsx';
|
|
$this->assertArrayHasKey($key, $manifest);
|
|
$this->get($url, ['Accept' => 'text/html'])->assertOk()->assertHeader('Cache-Control', 'no-store, private')->assertSee($manifest[$key]['file'], false);
|
|
}
|
|
}
|
|
|
|
public function test_organization_representation_is_rechecked_and_other_organizations_are_not_assignable(): void
|
|
{
|
|
$organization = (string) Str::uuid();
|
|
DB::table('organizations')->insert(['id' => $organization, 'name' => 'Organização sintética QA', 'organization_type' => 'private']);
|
|
$actor = $this->promoter('business_sale', $organization);
|
|
$membership = (string) Str::uuid();
|
|
DB::table('memberships')->insert(['id' => $membership, 'user_id' => $actor->id, 'organization_id' => $organization, 'role' => 'officer']);
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', [...$this->payload(), 'organization_id' => $organization])->assertCreated()->json('record');
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'organization_id' => null, 'reason' => $this->payload()['reason']])->assertForbidden();
|
|
DB::table('memberships')->where('id', $membership)->update(['deleted_at' => now()]);
|
|
$this->getJson(self::BASE.'/'.$saved['id'])->assertForbidden();
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'reason' => $this->payload()['reason']])->assertForbidden();
|
|
$this->assertDatabaseHas('opportunities', ['id' => $saved['id'], 'organization_id' => $organization]);
|
|
}
|
|
|
|
public function test_incomplete_price_is_preserved_but_cannot_be_submitted_and_invalid_structures_return_validation_errors(): void
|
|
{
|
|
$actor = $this->promoter();
|
|
$payload = $this->payload();
|
|
$payload['private_offer'] = ['price_mode' => 'amount', 'amount' => null, 'currency' => null, 'contact_id' => $this->contact($actor)];
|
|
$saved = $this->actingAs($actor)->postJson(self::BASE.'/rascunhos', $payload)->assertCreated()->json('record');
|
|
$this->getJson(self::BASE.'/'.$saved['id'])->assertJsonPath('record.values.private_offer.price_mode', 'amount');
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/submeter', ['etag' => $saved['etag'], 'confirm' => true])->assertUnprocessable()->assertJsonValidationErrors(['private_offer.amount', 'private_offer.currency']);
|
|
$this->postJson(self::BASE.'/rascunhos', [...$this->payload(), 'private_offer' => 'invalid'])->assertUnprocessable();
|
|
$this->postJson(self::BASE.'/'.$saved['id'].'/guardar', ['etag' => $saved['etag'], 'opportunity_category' => null, 'reason' => $payload['reason']])->assertUnprocessable();
|
|
$this->assertSame(1, Opportunity::count());
|
|
}
|
|
}
|