commit5

tests/Feature/EvaluationNavigationTest.php

@@ -0,0 +1,44 @@
+<?php
+
+use App\Services\EvaluationNavigation;
+use Illuminate\Http\Request;
+
+test('local evaluation links send a guest to the existing password-free entry and retain the intended report', function () {
+    app()->instance('env', 'payable-testing');
+    $this->get('http://127.0.0.1:8005/relatorios?status=approved')->assertRedirect('/avaliar')
+        ->assertSessionHas('url.intended', 'http://127.0.0.1:8005/relatorios?status=approved');
+    $this->get('http://127.0.0.1:8005/login')->assertRedirect('/avaliar');
+});
+
+test('normal application still uses its credential login', function () {
+    $this->get('/relatorios')->assertRedirect('/login');
+    $this->get('/login')->assertOk();
+});
+
+test('evaluation navigation requires both a local client and local host', function () {
+    app()->instance('env', 'payable-testing');
+    foreach ([['http://127.0.0.1:8005/relatorios', '127.0.0.1', true], ['http://compras.tempo.co.mz/relatorios', '127.0.0.1', false], ['http://localhost:8005/relatorios', '192.0.2.1', false]] as [$url, $ip, $allowed]) {
+        $request = Request::create($url, 'GET', [], [], [], ['REMOTE_ADDR' => $ip]);
+        expect(EvaluationNavigation::local($request))->toBe($allowed);
+    }
+    app()->instance('env', 'production');
+    expect(EvaluationNavigation::local(Request::create('http://127.0.0.1:8005/relatorios', 'GET', [], [], [], ['REMOTE_ADDR' => '127.0.0.1'])))->toBeFalse();
+});
+
+test('evaluation return destination preserves local paths and filters but rejects external or malformed destinations', function ($intended, string $expected) {
+    $request = Request::create('http://127.0.0.1:8005/avaliar/entrar', 'POST');
+    expect(EvaluationNavigation::returnPath($intended, $request))->toBe($expected);
+})->with([
+    ['http://127.0.0.1:8005/relatorios?status=approved', '/relatorios?status=approved'],
+    ['/requisicoes/1/processo', '/requisicoes/1/processo'],
+    [null, '/dashboard'],
+    [['invalid'], '/dashboard'],
+    ['https://example.test/relatorios', '/dashboard'],
+    ['//example.test/relatorios', '/dashboard'],
+    ['http://127.0.0.1:8015/relatorios', '/dashboard'],
+    ['javascript:alert(1)', '/dashboard'],
+    ['/login', '/dashboard'],
+    ['/avaliar', '/dashboard'],
+    ["/relatorios\r\nLocation: https://example.test", '/dashboard'],
+    ['/\\example.test', '/dashboard'],
+]);