* include user teams in user entity * prevent unauthorized access via API * improve teamlead permission handling in team timesheets * add team data to user entity * add security tests * highlight menu for invoice template copy * unified handling of invoice data across all templates * access to the current users data in invoice templates * permission improvement in invoice form * allow to skip record rows * allow to add new invoice locations without overwriting the global ones * allow to order user preferences * change permission for normal users with access to view_other_timesheets * properly validate invoice template field length * allow to replace multiple variables in cell values text * upgraded office invoice template * doctrine deprecation fix * upgrade phpoffice/phpword * fix future begin check for default rounding rules * dashboard widget counter: respect visibility and teams - fixes #1161 * fix future begin check for default rounding rules * added new events for pre and post invoice rendering * fix permission issue for users without team seeing all records * prevent error in spreadsheet renderer for empty invoices
145 lines
4.7 KiB
PHP
145 lines
4.7 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Tests\API;
|
|
|
|
use App\Entity\User;
|
|
use App\Tests\DataFixtures\TagFixtures;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* @group integration
|
|
*/
|
|
class TagControllerTest extends APIControllerBaseTest
|
|
{
|
|
protected function setUp(): void
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
|
|
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
|
|
|
|
$tagList = ['Test', 'Administration', 'Support', '#2018-001', '#2018-002', '#2018-003', 'Development',
|
|
'Marketing', 'First Level Support', 'Bug Fixing'];
|
|
|
|
$fixture = new TagFixtures();
|
|
$fixture->setTagArray($tagList);
|
|
$this->importFixture($em, $fixture);
|
|
}
|
|
|
|
public function testIsSecure()
|
|
{
|
|
$this->assertUrlIsSecured('/api/tags');
|
|
}
|
|
|
|
public function testGetCollection()
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
|
|
$this->assertAccessIsGranted($client, '/api/tags');
|
|
$result = json_decode($client->getResponse()->getContent(), true);
|
|
|
|
$this->assertIsArray($result);
|
|
$this->assertNotEmpty($result);
|
|
$this->assertEquals(10, count($result));
|
|
$this->assertEquals('Test', $result[9]);
|
|
}
|
|
|
|
public function testEmptyCollection()
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
|
|
$query = ['name' => 'nothing'];
|
|
$this->assertAccessIsGranted($client, '/api/tags', 'GET', $query);
|
|
$result = json_decode($client->getResponse()->getContent(), true);
|
|
|
|
$this->assertIsArray($result);
|
|
$this->assertEmpty($result);
|
|
$this->assertEquals(0, count($result));
|
|
}
|
|
|
|
public function testPostAction()
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
|
|
$data = [
|
|
'name' => 'foo',
|
|
];
|
|
$this->request($client, '/api/tags', 'POST', [], json_encode($data));
|
|
$this->assertTrue($client->getResponse()->isSuccessful());
|
|
|
|
$result = json_decode($client->getResponse()->getContent(), true);
|
|
$this->assertIsArray($result);
|
|
$this->assertStructure($result);
|
|
$this->assertNotEmpty($result['id']);
|
|
}
|
|
|
|
public function testPostActionWithInvalidUser()
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
|
|
$data = [
|
|
'name' => 'foo',
|
|
];
|
|
$this->request($client, '/api/tags', 'POST', [], json_encode($data));
|
|
$response = $client->getResponse();
|
|
$this->assertFalse($response->isSuccessful());
|
|
$this->assertEquals(Response::HTTP_FORBIDDEN, $response->getStatusCode());
|
|
$json = json_decode($response->getContent(), true);
|
|
$this->assertEquals('User cannot create tags', $json['message']);
|
|
}
|
|
|
|
public function testPartOfEntries()
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
|
|
$query = ['name' => 'in'];
|
|
$this->assertAccessIsGranted($client, '/api/tags', 'GET', $query);
|
|
$result = json_decode($client->getResponse()->getContent(), true);
|
|
|
|
$this->assertIsArray($result);
|
|
$this->assertNotEmpty($result);
|
|
$this->assertEquals(3, count($result));
|
|
|
|
$this->assertEquals('Administration', $result[0]);
|
|
$this->assertEquals('Bug Fixing', $result[1]);
|
|
$this->assertEquals('Marketing', $result[2]);
|
|
}
|
|
|
|
public function testDeleteAction()
|
|
{
|
|
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
|
|
|
|
$this->request($client, '/api/tags/1', 'DELETE');
|
|
$this->assertTrue($client->getResponse()->isSuccessful());
|
|
$this->assertEquals(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
|
|
$this->assertEmpty($client->getResponse()->getContent());
|
|
|
|
$this->assertAccessIsGranted($client, '/api/tags');
|
|
$result = json_decode($client->getResponse()->getContent(), true);
|
|
|
|
$this->assertEquals(9, count($result));
|
|
}
|
|
|
|
public function testDeleteActionWithUnknownTimesheet()
|
|
{
|
|
$this->assertEntityNotFoundForDelete(User::ROLE_ADMIN, '/api/tags/255', []);
|
|
}
|
|
|
|
protected function assertStructure(array $result, $full = true)
|
|
{
|
|
$expectedKeys = [
|
|
'id', 'name', 'timesheets'
|
|
];
|
|
|
|
if ($full) {
|
|
$expectedKeys = array_merge($expectedKeys, []);
|
|
}
|
|
|
|
$actual = array_keys($result);
|
|
sort($actual);
|
|
sort($expectedKeys);
|
|
|
|
$this->assertEquals($expectedKeys, $actual, 'Tag structure does not match');
|
|
}
|
|
}
|