jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Invoice download via API (#5926)

Browse Source
This commit is contained in:
Kevin Papst
2026-04-27 17:08:38 +02:00
committed by GitHub
parent 20c7b03bd9
commit dabd63800f
5 changed files with 115 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
tests/API/InvoiceControllerTest.php
View File

@@ -16,8 +16,10 @@ use App\Entity\User;
use App\Repository\TeamRepository;
use App\Tests\DataFixtures\InvoiceFixtures;
use App\Tests\Mocks\InvoiceTestMetaFieldSubscriberMock;
use App\Utils\FileHelper;
use PHPUnit\Framework\Attributes\Group;
use Symfony\Component\EventDispatcher\EventDispatcher;
use Symfony\Component\HttpFoundation\BinaryFileResponse;
use Symfony\Component\HttpFoundation\Response;
#[Group('integration')]
@@ -133,7 +135,7 @@ class InvoiceControllerTest extends APIControllerBaseTestCase
$this->assertEntityNotFound(User::ROLE_USER, '/api/invoices/' . PHP_INT_MAX);
}
public function testDownloadRespectsCustomerPermission(): void
public function testGetEntityRespectsCustomerPermission(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
@@ -163,6 +165,79 @@ class InvoiceControllerTest extends APIControllerBaseTestCase
$this->assertApiAccessDenied($client, '/api/invoices/' . $invoice->getId());
}
public function testDownload(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$invoice = $this->importInvoiceFixtures(1)[0];
$filename = $invoice->getInvoiceFilename() . '.pdf';
$invoice->setFilename($filename);
$em = $this->getEntityManager();
$em->persist($invoice);
$em->flush();
/** @var FileHelper $fileHelper */
$fileHelper = $this->getPrivateService(FileHelper::class);
$path = $fileHelper->getDataDirectory('invoices') . $filename;
file_put_contents($path, '%PDF-1.4 test');
try {
$this->assertAccessIsGranted($client, '/api/invoices/' . $invoice->getId() . '/download');
$response = $client->getResponse();
self::assertInstanceOf(BinaryFileResponse::class, $response);
self::assertEquals('application/pdf', $response->headers->get('Content-Type'));
self::assertStringContainsString('attachment; filename=' . $filename, $response->headers->get('Content-Disposition') ?? '');
} finally {
$fileHelper->removeFile($path);
}
}
public function testDownloadIsSecure(): void
{
$client = $this->getClientForAuthenticatedUser();
$invoices = $this->importInvoiceFixtures(1);
$this->assertApiAccessDenied($client, '/api/invoices/' . $invoices[0]->getId() . '/download');
}
public function testDownloadRespectsCustomerPermission(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
$invoice = $this->importInvoiceFixtures(1, [Invoice::STATUS_NEW])[0];
$filename = $invoice->getInvoiceFilename() . '.pdf';
$invoice->setFilename($filename);
$em = $this->getEntityManager();
$em->persist($invoice);
$em->flush();
/** @var FileHelper $fileHelper */
$fileHelper = $this->getPrivateService(FileHelper::class);
$path = $fileHelper->getDataDirectory('invoices') . $filename;
file_put_contents($path, '%PDF-1.4 test');
try {
$this->assertAccessIsGranted($client, '/api/invoices/' . $invoice->getId() . '/download');
$customer = $invoice->getCustomer();
self::assertInstanceOf(Customer::class, $customer);
$team = new Team('foo');
$team->addTeamlead($this->getUserByRole(User::ROLE_ADMIN));
$team->addCustomer($customer);
/** @var TeamRepository $repository */
$repository = $em->getRepository(Team::class);
$repository->saveTeam($team);
$this->assertApiAccessDenied($client, '/api/invoices/' . $invoice->getId() . '/download');
} finally {
$fileHelper->removeFile($path);
}
}
public function testCollectionRespectsCustomerPermission(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);