42 lines
1.2 KiB
PHP
42 lines
1.2 KiB
PHP
<?php
|
|
|
|
use App\Enums\UserRole;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Gate;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('allows only administrators through production tooling gates', function (): void {
|
|
$admin = User::factory()->create([
|
|
'role' => UserRole::ADMIN,
|
|
]);
|
|
$moderator = User::factory()->create([
|
|
'role' => UserRole::MODERATOR,
|
|
]);
|
|
$user = User::factory()->create([
|
|
'role' => UserRole::USER,
|
|
]);
|
|
|
|
expect(Gate::forUser($admin)->allows('viewApiDocs'))->toBeTrue()
|
|
->and(Gate::forUser($moderator)->allows('viewApiDocs'))->toBeFalse()
|
|
->and(Gate::forUser($user)->allows('viewApiDocs'))->toBeFalse()
|
|
->and(Gate::allows('viewApiDocs'))->toBeFalse();
|
|
});
|
|
|
|
it('does not expose a queue dashboard', function (): void {
|
|
$this->get('/horizon')->assertNotFound();
|
|
});
|
|
|
|
it('protects the scramble documentation outside local environments', function (): void {
|
|
$user = User::factory()->create([
|
|
'role' => UserRole::USER,
|
|
]);
|
|
|
|
$this->get('/docs/api')->assertForbidden();
|
|
|
|
$this->actingAs($user)
|
|
->get('/docs/api')
|
|
->assertForbidden();
|
|
});
|