79 lines
4.0 KiB
PHP
79 lines
4.0 KiB
PHP
<?php
|
|
|
|
use App\Services\EvaluationAccess;
|
|
use App\Services\EvaluationNavigation;
|
|
use Illuminate\Http\Request;
|
|
|
|
test('local evaluation root opens the dashboard while other installations retain their home page', function () {
|
|
$this->get('/')->assertOk();
|
|
app()->instance('env', 'payable-testing');
|
|
$this->get('http://127.0.0.1:8005/')->assertRedirect('/dashboard');
|
|
$this->get('http://127.0.0.1:8015/')->assertOk();
|
|
$this->get('http://compras.tempo.co.mz:8005/')->assertOk();
|
|
});
|
|
|
|
test('local evaluation links send a guest to the existing password-free entry and retain the intended report', function () {
|
|
app()->instance('env', 'payable-testing');
|
|
$this->get('http://127.0.0.1:8005/relatorios?status=approved')->assertRedirect('/avaliar')
|
|
->assertSessionHas('url.intended', 'http://127.0.0.1:8005/relatorios?status=approved');
|
|
$this->get('http://127.0.0.1:8005/login')->assertRedirect('/avaliar');
|
|
});
|
|
|
|
test('normal application still uses its credential login', function () {
|
|
$this->get('/dashboard')->assertRedirect('/login');
|
|
$this->get('/relatorios')->assertRedirect('/login');
|
|
$this->get('/login')->assertOk();
|
|
});
|
|
|
|
test('automatic dashboard entry is restricted to the exact local evaluation address', function () {
|
|
app()->instance('env', 'payable-testing');
|
|
$access = new EvaluationAccess;
|
|
foreach ([
|
|
['http://127.0.0.1:8005/dashboard', 'GET', '127.0.0.1', true],
|
|
['http://127.0.0.1:8015/dashboard', 'GET', '127.0.0.1', false],
|
|
['http://localhost:8005/dashboard', 'GET', '127.0.0.1', false],
|
|
['http://127.0.0.1:8005/empresa', 'GET', '127.0.0.1', false],
|
|
['http://127.0.0.1:8005/dashboard', 'POST', '127.0.0.1', false],
|
|
['http://127.0.0.1:8005/dashboard', 'GET', '192.0.2.1', false],
|
|
['http://compras.tempo.co.mz:8005/dashboard', 'GET', '127.0.0.1', false],
|
|
] as [$url, $method, $ip, $allowed]) {
|
|
expect($access->dashboardEntry(Request::create($url, $method, [], [], [], ['REMOTE_ADDR' => $ip])))->toBe($allowed);
|
|
}
|
|
app()->instance('env', 'production');
|
|
expect($access->dashboardEntry(Request::create('http://127.0.0.1:8005/dashboard', 'GET', [], [], [], ['REMOTE_ADDR' => '127.0.0.1'])))->toBeFalse();
|
|
});
|
|
|
|
test('automatic entry fails closed outside the isolated evaluation database', function () {
|
|
app()->instance('env', 'payable-testing');
|
|
$this->get('http://127.0.0.1:8005/dashboard')->assertNotFound();
|
|
$this->assertGuest();
|
|
});
|
|
|
|
test('evaluation navigation requires both a local client and local host', function () {
|
|
app()->instance('env', 'payable-testing');
|
|
foreach ([['http://127.0.0.1:8005/relatorios', '127.0.0.1', true], ['http://compras.tempo.co.mz/relatorios', '127.0.0.1', false], ['http://localhost:8005/relatorios', '192.0.2.1', false]] as [$url, $ip, $allowed]) {
|
|
$request = Request::create($url, 'GET', [], [], [], ['REMOTE_ADDR' => $ip]);
|
|
expect(EvaluationNavigation::local($request))->toBe($allowed);
|
|
}
|
|
app()->instance('env', 'production');
|
|
expect(EvaluationNavigation::local(Request::create('http://127.0.0.1:8005/relatorios', 'GET', [], [], [], ['REMOTE_ADDR' => '127.0.0.1'])))->toBeFalse();
|
|
});
|
|
|
|
test('evaluation return destination preserves local paths and filters but rejects external or malformed destinations', function ($intended, string $expected) {
|
|
$request = Request::create('http://127.0.0.1:8005/avaliar/entrar', 'POST');
|
|
expect(EvaluationNavigation::returnPath($intended, $request))->toBe($expected);
|
|
})->with([
|
|
['http://127.0.0.1:8005/relatorios?status=approved', '/relatorios?status=approved'],
|
|
['/requisicoes/1/processo', '/requisicoes/1/processo'],
|
|
[null, '/dashboard'],
|
|
[['invalid'], '/dashboard'],
|
|
['https://example.test/relatorios', '/dashboard'],
|
|
['//example.test/relatorios', '/dashboard'],
|
|
['http://127.0.0.1:8015/relatorios', '/dashboard'],
|
|
['javascript:alert(1)', '/dashboard'],
|
|
['/login', '/dashboard'],
|
|
['/avaliar', '/dashboard'],
|
|
["/relatorios\r\nLocation: https://example.test", '/dashboard'],
|
|
['/\\example.test', '/dashboard'],
|
|
]);
|