jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
c78a9dcdb1240cfa121410bc80d9c45f0a3c357b
kimai2/tests/API/CustomerControllerTest.php
Kevin Papst 31a8f887a5 Release 2.58 (#5952) 
* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile  now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore
2026-05-25 15:39:47 +02:00

924 lines
35 KiB
PHP
Raw Blame History

<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\API;
use App\DataFixtures\UserFixtures;
use App\Entity\Activity;
use App\Entity\Customer;
use App\Entity\CustomerComment;
use App\Entity\CustomerMeta;
use App\Entity\CustomerRate;
use App\Entity\Project;
use App\Entity\RateInterface;
use App\Entity\Team;
use App\Entity\User;
use App\Repository\CustomerRateRepository;
use App\Repository\CustomerRepository;
use App\Tests\Mocks\CustomerTestMetaFieldSubscriberMock;
use PHPUnit\Framework\Attributes\Group;
use Symfony\Component\EventDispatcher\EventDispatcher;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
#[Group('integration')]
class CustomerControllerTest extends APIControllerBaseTestCase
{
use RateControllerTestTrait;
protected function getRateUrlByRate(RateInterface $rate, bool $isCollection): string
{
self::assertInstanceOf(CustomerRate::class, $rate);
self::assertNotNull($rate->getCustomer());
self::assertNotNull($rate->getCustomer()->getId());
if ($isCollection) {
return $this->getRateUrl($rate->getCustomer()->getId());
}
return $this->getRateUrl($rate->getCustomer()->getId(), $rate->getId());
}
protected function getRateUrl(?int $id = 1, ?int $rateId = null): string
{
if (null !== $rateId) {
return \sprintf('/api/customers/%s/rates/%s', $id, $rateId);
}
return \sprintf('/api/customers/%s/rates', $id);
}
protected function importTestRates($id): array
{
/** @var CustomerRateRepository $rateRepository */
$rateRepository = $this->getEntityManager()->getRepository(CustomerRate::class);
/** @var CustomerRepository $repository */
$repository = $this->getEntityManager()->getRepository(Customer::class);
/** @var Customer|null $customer */
$customer = $repository->find($id);
if (null === $customer) {
$customer = new Customer('foooo');
$customer->setCountry('DE');
$customer->setTimezone('Europre/Paris');
$repository->saveCustomer($customer);
}
$rate1 = new CustomerRate();
$rate1->setCustomer($customer);
$rate1->setRate(17.45);
$rate1->setIsFixed(false);
$rateRepository->saveRate($rate1);
$rate2 = new CustomerRate();
$rate2->setCustomer($customer);
$rate2->setRate(99);
$rate2->setInternalRate(9);
$rate2->setIsFixed(true);
$rate2->setUser($this->getUserByName(UserFixtures::USERNAME_USER));
$rateRepository->saveRate($rate2);
return [$rate1, $rate2];
}
/**
* @return array{0: Customer, 1: Customer}
*/
private function loadCustomerData(): array
{
/** @var CustomerRateRepository $rateRepository */
$rateRepository = $this->getEntityManager()->getRepository(CustomerRate::class);
/** @var CustomerRepository $repository */
$repository = $this->getEntityManager()->getRepository(Customer::class);
$customer1 = new Customer('foooo');
$customer1->setCountry('DE');
$customer1->setTimezone('Europe/Paris');
$repository->saveCustomer($customer1);
$customer2 = new Customer('baaaaar');
$customer2->setCountry('RU');
$customer2->setTimezone('Europe/Moscow');
$repository->saveCustomer($customer2);
$rate1 = new CustomerRate();
$rate1->setCustomer($customer1);
$rate1->setRate(17.45);
$rate1->setIsFixed(false);
$rateRepository->saveRate($rate1);
$rate2 = new CustomerRate();
$rate2->setCustomer($customer1);
$rate2->setRate(99);
$rate2->setInternalRate(9);
$rate2->setIsFixed(true);
$rate2->setUser($this->getUserByName(UserFixtures::USERNAME_USER));
$rateRepository->saveRate($rate2);
return [$customer1, $customer2];
}
public function testIsSecure(): void
{
$this->assertUrlIsSecured('/api/customers');
}
public function testGetCollection(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$this->assertAccessIsGranted($client, '/api/customers');
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertNotEmpty($result);
self::assertEquals(1, \count($result));
self::assertIsArray($result[0]);
self::assertApiResponseTypeStructure('CustomerCollection', $result[0]);
}
public function testGetCollectionWithQuery(): void
{
$query = ['order' => 'ASC', 'orderBy' => 'name', 'visible' => 3, 'term' => 'test'];
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$this->assertAccessIsGranted($client, '/api/customers', 'GET', $query);
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertNotEmpty($result);
self::assertEquals(1, \count($result));
self::assertIsArray($result[0]);
self::assertApiResponseTypeStructure('CustomerCollection', $result[0]);
}
public function testGetEntityIsSecure(): void
{
$this->assertUrlIsSecuredForRole(User::ROLE_USER, '/api/customers/1');
}
public function testGetEntity(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertAccessIsGranted($client, '/api/customers/1');
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('CustomerEntity', $result);
}
public function testGetEntityWithFullResponse(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$em = $this->getEntityManager();
/** @var Customer $customer */
$customer = $em->getRepository(Customer::class)->find(1);
// add meta fields
$meta = new CustomerMeta();
$meta->setName('bar')->setValue('foo')->setIsVisible(false);
$customer->setMetaField($meta);
$meta = new CustomerMeta();
$meta->setName('foo')->setValue('bar')->setIsVisible(true);
$customer->setMetaField($meta);
$em->persist($customer);
// add a new project ...
$project = new Project();
$project->setName('Activity Test');
$project->setCustomer($customer);
$em->persist($project);
// ... with activity
$activity = (new Activity())->setName('first one')->setComment('1')->setProject($project);
$em->persist($activity);
// and finally a team
$team = new Team('Testing customer 1 team');
$team->addTeamlead($this->getUserByRole(User::ROLE_USER));
$team->addCustomer($customer);
$team->addProject($project);
$team->addUser($this->getUserByRole(User::ROLE_TEAMLEAD));
$em->persist($team);
$em->flush();
$this->assertAccessIsGranted($client, '/api/customers/1');
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('CustomerEntity', $result);
self::assertNotEmpty($result['id']);
self::assertIsArray($result['teams']);
self::assertCount(1, $result['teams']);
self::assertIsArray($result['teams'][0]);
self::assertEquals('Testing customer 1 team', $result['teams'][0]['name']);
self::assertIsArray($result['metaFields']);
self::assertCount(1, $result['metaFields']);
self::assertEquals([['name' => 'foo', 'value' => 'bar']], $result['metaFields']);
self::assertEquals('Test', $result['name']);
self::assertEquals(1000, $result['budget']);
self::assertEquals(100000, $result['timeBudget']);
self::assertNull($result['budgetType']);
self::assertEquals('1', $result['number']);
self::assertEquals('Test comment', $result['comment']);
self::assertEquals('Test', $result['company']);
self::assertNull($result['vatId']);
self::assertEquals('Test', $result['contact']);
self::assertEquals('Test', $result['address']);
self::assertNull($result['addressLine1']);
self::assertNull($result['addressLine2']);
self::assertNull($result['addressLine3']);
self::assertNull($result['postCode']);
self::assertNull($result['city']);
self::assertEquals('DE', $result['country']);
self::assertEquals('EUR', $result['currency']);
self::assertEquals('111', $result['phone']);
self::assertEquals('222', $result['fax']);
self::assertEquals('333', $result['mobile']);
self::assertEquals('test@example.com', $result['email']);
self::assertNull($result['homepage']);
self::assertEquals('Europe/Berlin', $result['timezone']);
self::assertNull($result['buyerReference']);
self::assertNull($result['color']);
self::assertEquals('#5319e7', $result['color-safe']);
self::assertTrue($result['visible']);
self::assertTrue($result['billable']);
}
public function testNotFound(): void
{
$this->assertEntityNotFound(User::ROLE_USER, '/api/customers/' . PHP_INT_MAX);
}
public function testPostAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'name' => 'foo',
'budget' => '999',
'timeBudget' => '10,25',
'budgetType' => 'month',
'number' => 'C-754',
'comment' => 'Awesome customer since a long time',
'company' => 'IT Professional Comp.',
'vatId' => 'DE0123456789',
'contact' => 'Mr. John Doe',
'addressLine1' => 'test address line 1',
'addressLine2' => 'foo address line 2',
'addressLine3' => 'bar address line 3',
'postCode' => '12345',
'city' => 'Acme Town',
'country' => 'DE',
'currency' => 'EUR',
'phone' => '666667787778999909087',
'fax' => '0987654321',
'mobile' => '01234534567890',
'email' => 'admin@example.com',
'homepage' => 'https://www.example.com/',
'timezone' => 'Europe/Berlin',
'invoiceText' => 'Some random text, pay fast please!',
'buyerReference' => 'REF-0123456789',
'color' => '#ff0000',
'visible' => true,
'billable' => true,
'teams' => [1],
];
$this->request($client, '/api/customers', 'POST', [], json_encode($data));
self::assertTrue($client->getResponse()->isSuccessful());
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('CustomerEntity', $result);
self::assertNotEmpty($result['id']);
self::assertIsArray($result['teams']);
self::assertEquals([['id' => 1, 'name' => 'Test team', 'color' => null, 'color-safe' => '#03A9F4']], $result['teams']);
self::assertIsArray($result['metaFields']);
self::assertEquals([], $result['metaFields']);
self::assertEquals('foo', $result['name']);
self::assertEquals('999', $result['budget']);
self::assertEquals('36900', $result['timeBudget']);
self::assertEquals('month', $result['budgetType']);
self::assertEquals('C-754', $result['number']);
self::assertEquals('Awesome customer since a long time', $result['comment']);
self::assertEquals('IT Professional Comp.', $result['company']);
self::assertEquals('DE0123456789', $result['vatId']);
self::assertEquals('Mr. John Doe', $result['contact']);
self::assertNull($result['address']);
self::assertEquals('test address line 1', $result['addressLine1']);
self::assertEquals('foo address line 2', $result['addressLine2']);
self::assertEquals('bar address line 3', $result['addressLine3']);
self::assertEquals('12345', $result['postCode']);
self::assertEquals('Acme Town', $result['city']);
self::assertEquals('DE', $result['country']);
self::assertEquals('EUR', $result['currency']);
self::assertEquals('666667787778999909087', $result['phone']);
self::assertEquals('0987654321', $result['fax']);
self::assertEquals('01234534567890', $result['mobile']);
self::assertEquals('admin@example.com', $result['email']);
self::assertEquals('https://www.example.com/', $result['homepage']);
self::assertEquals('Europe/Berlin', $result['timezone']);
self::assertEquals('REF-0123456789', $result['buyerReference']);
self::assertEquals('#ff0000', $result['color']);
self::assertTrue($result['visible']);
self::assertTrue($result['billable']);
}
public function testPostActionWithLeastFields(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'name' => 'foo',
'country' => 'DE',
'currency' => 'EUR',
'timezone' => 'Europe/Berlin',
];
$this->request($client, '/api/customers', 'POST', [], json_encode($data));
self::assertTrue($client->getResponse()->isSuccessful());
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('CustomerEntity', $result);
self::assertNotEmpty($result['id']);
}
public function testPostActionWithInvalidUser(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$data = [
'name' => 'foo',
'visible' => true,
'country' => 'DE',
'currency' => 'EUR',
'timezone' => 'Europe/Berlin',
];
$this->request($client, '/api/customers', 'POST', [], json_encode($data));
$response = $client->getResponse();
$this->assertApiResponseAccessDenied($response, 'User cannot create customers');
}
public function testPostActionWithInvalidData(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'name' => 'foo',
'visible' => true,
'country' => 'XYZ',
'currency' => '---',
'timezone' => 'foo/bar',
'unexpected' => 'field',
];
$this->request($client, '/api/customers', 'POST', [], json_encode($data));
$response = $client->getResponse();
$this->assertApiCallValidationError($response, ['country', 'currency', 'timezone'], true);
}
public function testPatchAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'name' => 'foo',
'comment' => '',
'visible' => true,
'country' => 'DE',
'currency' => 'EUR',
'timezone' => 'Europe/Berlin',
'budget' => '999',
'timeBudget' => '7200',
];
$this->request($client, '/api/customers/1', 'PATCH', [], json_encode($data));
self::assertTrue($client->getResponse()->isSuccessful());
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('CustomerEntity', $result);
self::assertNotEmpty($result['id']);
}
public function testPatchActionWithInvalidUser(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$data = [
'name' => 'foo',
'comment' => '',
'visible' => true,
'country' => 'DE',
'currency' => 'EUR',
'timezone' => 'Europe/Berlin',
];
$this->request($client, '/api/customers/1', 'PATCH', [], json_encode($data));
$response = $client->getResponse();
$this->assertApiResponseAccessDenied($response, 'User cannot update customer');
}
public function testPatchActionWithUnknownActivity(): void
{
$this->assertEntityNotFoundForPatch(User::ROLE_USER, '/api/customers/255', []);
}
public function testInvalidPatchAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'name' => 'foo',
'visible' => true,
'country' => 'DE',
'currency' => 'XXX',
'timezone' => 'Europe/Berlin',
];
$this->request($client, '/api/customers/1', 'PATCH', [], json_encode($data));
$response = $client->getResponse();
self::assertEquals(400, $response->getStatusCode());
$this->assertApiCallValidationError($response, ['currency']);
}
public function testMetaActionNotAllowed(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$this->request($client, '/api/customers/1/meta', 'PATCH', [], json_encode(['name' => 'asdasd']));
$this->assertApiResponseAccessDenied($client->getResponse(), 'You are not allowed to update this customer');
}
public function testMetaActionThrowsNotFound(): void
{
$this->assertEntityNotFoundForPatch(User::ROLE_ADMIN, '/api/customers/42/meta', []);
}
public function testMetaActionThrowsExceptionOnMissingName(): void
{
$this->assertExceptionForPatchAction(User::ROLE_ADMIN, '/api/customers/1/meta', ['value' => 'X'], [
'code' => Response::HTTP_BAD_REQUEST,
'message' => 'Bad Request'
]);
}
public function testMetaActionThrowsExceptionOnMissingValue(): void
{
$this->assertExceptionForPatchAction(User::ROLE_ADMIN, '/api/customers/1/meta', ['name' => 'X'], [
'code' => Response::HTTP_BAD_REQUEST,
'message' => 'Bad Request'
]);
}
public function testMetaActionThrowsExceptionOnMissingMetafield(): void
{
$this->assertExceptionForPatchAction(User::ROLE_ADMIN, '/api/customers/1/meta', ['name' => 'X', 'value' => 'Y'], [
'code' => Response::HTTP_NOT_FOUND,
'message' => 'Not Found'
]);
}
public function testMetaAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
/** @var EventDispatcher $dispatcher */
$dispatcher = static::getContainer()->get('event_dispatcher');
$dispatcher->addSubscriber(new CustomerTestMetaFieldSubscriberMock());
$data = [
'name' => 'metatestmock',
'value' => 'another,testing,bar'
];
$this->request($client, '/api/customers/1/meta', 'PATCH', [], json_encode($data));
self::assertTrue($client->getResponse()->isSuccessful());
$em = $this->getEntityManager();
/** @var Customer $customer */
$customer = $em->getRepository(Customer::class)->find(1);
self::assertEquals('another,testing,bar', $customer->getMetaField('metatestmock')->getValue());
}
// ------------------------------- [DELETE] -------------------------------
public function testDeleteIsSecure(): void
{
$this->assertUrlIsSecured('/api/customers/1', Request::METHOD_DELETE);
}
public function testDeleteActionWithUnknownTimesheet(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertNotFoundForDelete($client, '/api/customers/' . PHP_INT_MAX);
}
public function testDeleteEntityIsSecure(): void
{
$this->assertUrlIsSecuredForRole(User::ROLE_USER, '/api/customers/1', Request::METHOD_DELETE);
}
public function testDeleteActionWithoutAuthorization(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
$imports = $this->loadCustomerData();
$this->request($client, '/api/customers/' . $imports[1]->getId(), Request::METHOD_DELETE);
$response = $client->getResponse();
$this->assertApiResponseAccessDenied($response);
}
public function testDeleteAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$imports = $this->loadCustomerData();
$getUrl = '/api/customers/' . $imports[0]->getId();
$this->assertAccessIsGranted($client, $getUrl);
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('CustomerEntity', $result);
self::assertNotEmpty($result['id']);
self::assertIsNumeric($result['id']);
$id = $result['id'];
$this->request($client, '/api/customers/' . $id, Request::METHOD_DELETE);
self::assertTrue($client->getResponse()->isSuccessful());
self::assertEquals(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
self::assertEmpty($client->getResponse()->getContent());
$this->request($client, $getUrl);
$this->assertApiException($client->getResponse(), [
'code' => Response::HTTP_NOT_FOUND,
'message' => 'Not Found'
]);
}
// ------------------------------- [COMMENTS] -------------------------------
private function createComment(string $message = 'A customer comment', bool $pinned = false, int $customerId = 1): CustomerComment
{
/** @var CustomerRepository $repository */
$repository = $this->getEntityManager()->getRepository(Customer::class);
/** @var Customer|null $customer */
$customer = $repository->find($customerId);
self::assertInstanceOf(Customer::class, $customer);
$comment = new CustomerComment($customer);
$comment->setMessage($message);
$comment->setPinned($pinned);
$comment->setCreatedBy($this->getUserByRole(User::ROLE_ADMIN));
$repository->saveComment($comment);
return $comment;
}
public function testGetCommentsIsSecure(): void
{
$this->assertUrlIsSecured('/api/customers/1/comments');
}
public function testGetCommentsIsSecureForRole(): void
{
$this->assertUrlIsSecuredForRole(User::ROLE_USER, '/api/customers/1/comments');
}
public function testGetCommentsActionWithUnknownCustomer(): void
{
$this->assertEntityNotFound(User::ROLE_ADMIN, '/api/customers/' . PHP_INT_MAX . '/comments');
}
public function testGetCommentsAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$comment = $this->createComment('Visible comment', true);
$this->request($client, '/api/customers/1/comments');
self::assertTrue(
$client->getResponse()->isSuccessful(),
$client->getResponse()->getStatusCode() . ' ' . (string) $client->getResponse()->getContent()
);
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertCount(1, $result);
self::assertIsArray($result[0]);
self::assertApiResponseTypeStructure('Comment', $result[0]);
$first = $result[0];
self::assertSame($comment->getId(), $first['id']);
self::assertSame('Visible comment', $first['message']);
self::assertTrue($first['pinned']);
self::assertIsArray($first['createdBy']);
self::assertSame($this->getAuthenticatedUserId(User::ROLE_ADMIN), $first['createdBy']['id']);
self::assertSame(UserFixtures::USERNAME_ADMIN, $first['createdBy']['username']);
self::assertIsString($first['createdAt']);
}
public function testPostCommentIsSecure(): void
{
$this->assertUrlIsSecured('/api/customers/1/comments', Request::METHOD_POST);
}
public function testPostCommentIsSecureForRole(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$json = json_encode(['message' => 'Denied']);
self::assertIsString($json);
$this->request($client, '/api/customers/1/comments', Request::METHOD_POST, [], $json);
$this->assertApiResponseAccessDenied($client->getResponse());
}
public function testPostCommentActionWithUnknownCustomer(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertEntityNotFoundForPost($client, '/api/customers/' . PHP_INT_MAX . '/comments', ['message' => 'Missing customer']);
}
public function testPostCommentActionWithInvalidData(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'unexpected' => 'field',
];
$json = json_encode($data);
self::assertIsString($json);
$this->request($client, '/api/customers/1/comments', Request::METHOD_POST, [], $json);
$response = $client->getResponse();
self::assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
$this->assertApiCallValidationError($response, ['message'], true);
}
public function testPostCommentAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$data = [
'message' => 'Created from API',
'pinned' => true,
];
$json = json_encode($data);
self::assertIsString($json);
$this->request($client, '/api/customers/1/comments', 'POST', [], $json);
self::assertTrue(
$client->getResponse()->isSuccessful(),
$client->getResponse()->getStatusCode() . ' ' . (string) $client->getResponse()->getContent()
);
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertIsArray($result['createdBy']);
self::assertIsInt($result['id']);
self::assertNotEmpty($result['id']);
self::assertSame('Created from API', $result['message']);
self::assertTrue($result['pinned']);
self::assertSame($this->getAuthenticatedUserId(User::ROLE_ADMIN), $result['createdBy']['id']);
/** @var CustomerComment|null $comment */
$comment = $this->getEntityManager()->getRepository(CustomerComment::class)->find($result['id']);
self::assertInstanceOf(CustomerComment::class, $comment);
self::assertSame('Created from API', $comment->getMessage());
self::assertTrue($comment->isPinned());
}
public function testToggleCommentPinIsSecure(): void
{
$comment = $this->createComment('Secured pin');
self::assertNotNull($comment->getId());
self::ensureKernelShutdown();
$client = self::createClient();
$this->request($client, '/api/customers/1/comments/' . $comment->getId() . '/pin', Request::METHOD_PATCH);
$this->assertApiException($client->getResponse(), [
'code' => Response::HTTP_UNAUTHORIZED,
'message' => 'Unauthorized'
]);
}
public function testToggleCommentPinIsSecureForRole(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$comment = $this->createComment('Cannot pin');
self::assertNotNull($comment->getId());
$this->request($client, '/api/customers/1/comments/' . $comment->getId() . '/pin', Request::METHOD_PATCH);
$this->assertApiResponseAccessDenied($client->getResponse());
}
public function testToggleCommentPinActionWithUnknownCustomer(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$comment = $this->createComment('Pin me');
self::assertNotNull($comment->getId());
$this->request($client, '/api/customers/' . PHP_INT_MAX . '/comments/' . $comment->getId() . '/pin', Request::METHOD_PATCH);
$this->assertApiException($client->getResponse(), [
'code' => Response::HTTP_NOT_FOUND,
'message' => 'Not Found'
]);
}
public function testToggleCommentPinActionWithUnknownComment(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->request($client, '/api/customers/1/comments/' . PHP_INT_MAX . '/pin', Request::METHOD_PATCH);
$this->assertApiException($client->getResponse(), [
'code' => Response::HTTP_NOT_FOUND,
'message' => 'Not Found'
]);
}
public function testToggleCommentPinActionDeniesForeignComment(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
[, $customer] = $this->loadCustomerData();
$customerId = $customer->getId();
self::assertNotNull($customerId);
$comment = $this->createComment('Foreign comment', false, $customerId);
self::assertNotNull($comment->getId());
$this->request($client, '/api/customers/1/comments/' . $comment->getId() . '/pin', Request::METHOD_PATCH);
$this->assertApiResponseAccessDenied($client->getResponse());
}
public function testToggleCommentPinAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$comment = $this->createComment('Toggle me');
self::assertNotNull($comment->getId());
$this->request($client, '/api/customers/1/comments/' . $comment->getId() . '/pin', Request::METHOD_PATCH);
self::assertTrue(
$client->getResponse()->isSuccessful(),
$client->getResponse()->getStatusCode() . ' ' . (string) $client->getResponse()->getContent()
);
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertSame($comment->getId(), $result['id']);
self::assertSame('Toggle me', $result['message']);
self::assertTrue($result['pinned']);
/** @var CustomerComment|null $updated */
$updated = $this->getEntityManager()->getRepository(CustomerComment::class)->find($comment->getId());
self::assertInstanceOf(CustomerComment::class, $updated);
self::assertTrue($updated->isPinned());
}
public function testDeleteCommentIsSecure(): void
{
$comment = $this->createComment('Secured delete');
self::assertNotNull($comment->getId());
self::ensureKernelShutdown();
$client = self::createClient();
$this->request($client, '/api/customers/1/comments/' . $comment->getId(), Request::METHOD_DELETE);
$this->assertApiException($client->getResponse(), [
'code' => Response::HTTP_UNAUTHORIZED,
'message' => 'Unauthorized'
]);
}
public function testDeleteCommentIsSecureForRole(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$comment = $this->createComment('Cannot delete');
self::assertNotNull($comment->getId());
$this->request($client, '/api/customers/1/comments/' . $comment->getId(), Request::METHOD_DELETE);
$this->assertApiResponseAccessDenied($client->getResponse());
}
public function testDeleteCommentActionWithUnknownCustomer(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$comment = $this->createComment('Delete me later');
self::assertNotNull($comment->getId());
$this->assertNotFoundForDelete($client, '/api/customers/' . PHP_INT_MAX . '/comments/' . $comment->getId());
}
public function testDeleteCommentActionWithUnknownComment(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertNotFoundForDelete($client, '/api/customers/1/comments/' . PHP_INT_MAX);
}
public function testDeleteCommentActionDeniesForeignComment(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
[, $customer] = $this->loadCustomerData();
$customerId = $customer->getId();
self::assertNotNull($customerId);
$comment = $this->createComment('Foreign comment', false, $customerId);
self::assertNotNull($comment->getId());
$this->request($client, '/api/customers/1/comments/' . $comment->getId(), Request::METHOD_DELETE);
$this->assertApiResponseAccessDenied($client->getResponse());
}
public function testDeleteCommentAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$comment = $this->createComment('Delete me');
self::assertNotNull($comment->getId());
$commentId = $comment->getId();
$this->request($client, '/api/customers/1/comments/' . $commentId, Request::METHOD_DELETE);
self::assertTrue($client->getResponse()->isSuccessful());
self::assertSame(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
self::assertEmpty($client->getResponse()->getContent());
self::assertNull($this->getEntityManager()->getRepository(CustomerComment::class)->find($commentId));
}
public function testPostDefaultTeamAction(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->request($client, '/api/customers/1/team', 'POST');
self::assertTrue($client->getResponse()->isSuccessful());
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertApiResponseTypeStructure('TeamEntity', $result);
self::assertIsNumeric($result['id']);
$teamId = $result['id'];
// verify customer is bound and current user is teamlead
self::assertIsArray($result['members']);
self::assertCount(1, $result['members']);
self::assertIsArray($result['members'][0]);
self::assertArrayHasKey('teamlead', $result['members'][0]);
self::assertTrue($result['members'][0]['teamlead']);
// idempotent: calling again returns the same team without duplicate bindings or members
$this->request($client, '/api/customers/1/team', 'POST');
self::assertTrue($client->getResponse()->isSuccessful());
$content = $client->getResponse()->getContent();
self::assertIsString($content);
$result = json_decode($content, true);
self::assertIsArray($result);
self::assertSame($teamId, $result['id']);
self::assertIsArray($result['members']);
self::assertCount(1, $result['members']);
}
public function testPostDefaultTeamActionIsSecure(): void
{
$this->assertUrlIsSecuredForRole(User::ROLE_USER, '/api/customers/1/team', 'POST');
}
public function testPostDefaultTeamActionNotFound(): void
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertEntityNotFoundForPost($client, '/api/customers/' . PHP_INT_MAX . '/team');
}
}
Reference in New Issue View Git Blame Copy Permalink