51 lines
2.9 KiB
PHP
51 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Enums\PurchasingRole;
|
|
use App\Models\ReceiptDocument;
|
|
use App\Models\User;
|
|
use App\Services\ReceiptWorkflow;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Schema;
|
|
|
|
require_once __DIR__.'/../Support/ReceiptFixture.php';
|
|
|
|
test('receipt print block reproduces preserved facts escapes evidence and leaves business data untouched', function () {
|
|
$f = receiptFixture();
|
|
$this->actingAs($f['receiver']);
|
|
$payload = receiptPayload($f);
|
|
$payload['items'][0]['notes'] = '<script>alert(1)</script>';
|
|
$receipt = app(ReceiptWorkflow::class)->confirm($f['receiver'], $f['order'], $payload);
|
|
ReceiptDocument::query()->create(['tenant_id' => $f['tenant']->id, 'goods_receipt_id' => $receipt->id, 'uploaded_by' => $f['receiver']->id,
|
|
'document_type' => 'quality', 'original_name' => 'quality.png', 'path' => 'private-secret-path', 'mime_type' => 'image/png', 'size' => 40, 'sha256' => str_repeat('a', 64), 'created_at' => now()]);
|
|
$before = [];
|
|
foreach (['goods_receipts', 'goods_receipt_items', 'stock_movements', 'audit_logs', 'receipt_documents', 'approval_steps', 'budget_entries'] as $table) {
|
|
$before[$table] = DB::table($table)->orderBy('id')->get()->toArray();
|
|
}
|
|
$this->get('/recepcoes/'.$receipt->id.'/imprimir')->assertOk()
|
|
->assertHeader('Cache-Control', 'no-store, private')
|
|
->assertSee($receipt->number)->assertSee($f['order']->number)->assertSee('0,600')->assertSee('Conforme')
|
|
->assertSee('<script>alert(1)</script>', false)->assertDontSee('<script>alert(1)</script>', false)
|
|
->assertSee('quality.png')->assertSee(str_repeat('a', 64))->assertDontSee('private-secret-path');
|
|
foreach ($before as $table => $rows) {
|
|
expect(DB::table($table)->orderBy('id')->get()->toArray())->toEqual($rows);
|
|
}
|
|
$this->actingAs($f['issuer'])->get('/recepcoes/'.$receipt->id.'/imprimir')->assertOk();
|
|
});
|
|
|
|
test('receipt print block preserves tenant isolation and native visibility', function () {
|
|
$f = receiptFixture();
|
|
$receipt = app(ReceiptWorkflow::class)->confirm($f['receiver'], $f['order'], receiptPayload($f));
|
|
$foreign = receiptFixture();
|
|
$this->actingAs($foreign['receiver'])->get('/recepcoes/'.$receipt->id.'/imprimir')->assertNotFound();
|
|
$requester = User::factory()->create(['tenant_id' => $f['tenant']->id, 'department_id' => $f['department']->id, 'purchasing_role' => PurchasingRole::Requester]);
|
|
$this->actingAs($requester);
|
|
$this->get('/recepcoes/'.$receipt->id.'/imprimir')->assertForbidden();
|
|
});
|
|
|
|
test('receipt print block remains available without the optional document table', function () {
|
|
$f = receiptFixture();
|
|
$receipt = app(ReceiptWorkflow::class)->confirm($f['receiver'], $f['order'], receiptPayload($f));
|
|
Schema::drop('receipt_documents');
|
|
$this->actingAs($f['receiver'])->get('/recepcoes/'.$receipt->id.'/imprimir')->assertOk()->assertSee('Sem referências documentais');
|
|
});
|