Critical: - Fix EnsureUserSetupIsComplete middleware route name prefixes and redirect Subscription step to subscribe page (not onboarding) - Fix MCP session pollution: Auth::setUser() instead of Auth::login() - Remove dead BillingController::addWorkspace/removeWorkspace methods - Remove broken Workspace::pendingInvites() method Security (IDOR): - MediaController: add workspace ownership verification on all endpoints - UpdatePostRequest: scope label_ids validation to current workspace - UpdatePostRequest: scope platform IDs validation to current post Security (other): - Fix open redirect in login and registration (validate internal URLs) - Add validation to API PostController store/update (was $request->all()) - Prevent Owner role assignment via updateRole endpoint - Fix API post author attribution to use workspace owner Authorization: - PostController: use createPost policy instead of view for store/update/destroy Logic: - Post Status enum labels now use translation system instead of hardcoded Portuguese - Workspace deletion cleans up current_workspace_id for all affected members - StoreWorkspaceInviteRequest: replace Portuguese validation messages with __() Rename onboarding: - Step1.vue -> Role.vue, Step2.vue -> Connect.vue - Controller methods: step1->role, storeStep1->storeRole, step2->connect, storeStep2->storeConnect All 728 tests passing.
208 lines
6.3 KiB
PHP
208 lines
6.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Enums\SocialAccount\Platform;
|
|
use App\Enums\User\Persona;
|
|
use App\Enums\User\Setup;
|
|
use App\Models\SocialAccount;
|
|
use App\Models\User;
|
|
use App\Models\Workspace;
|
|
|
|
beforeEach(function () {
|
|
$this->user = User::factory()->create(['setup' => Setup::Role]);
|
|
});
|
|
|
|
// Step 1 tests
|
|
test('step1 requires authentication', function () {
|
|
$response = $this->get(route('app.onboarding.role'));
|
|
|
|
$response->assertRedirect(route('login'));
|
|
});
|
|
|
|
test('step1 shows persona selection', function () {
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.role'));
|
|
|
|
$response->assertOk();
|
|
$response->assertInertia(fn ($page) => $page
|
|
->component('onboarding/Role', false)
|
|
->has('personas')
|
|
);
|
|
});
|
|
|
|
// Store Step 1 tests
|
|
test('store step1 requires authentication', function () {
|
|
$response = $this->post(route('app.onboarding.role.store'), [
|
|
'persona' => Persona::Founder->value,
|
|
]);
|
|
|
|
$response->assertRedirect(route('login'));
|
|
});
|
|
|
|
test('store step1 saves persona and redirects to step2', function () {
|
|
$response = $this->actingAs($this->user)->post(route('app.onboarding.role.store'), [
|
|
'persona' => Persona::Founder->value,
|
|
]);
|
|
|
|
$response->assertRedirect(route('app.onboarding.connect'));
|
|
|
|
$this->user->refresh();
|
|
expect($this->user->persona)->toBe(Persona::Founder);
|
|
expect($this->user->setup)->toBe(Setup::Connections);
|
|
});
|
|
|
|
test('store step1 validates persona is required', function () {
|
|
$response = $this->actingAs($this->user)->post(route('app.onboarding.role.store'), [
|
|
'persona' => '',
|
|
]);
|
|
|
|
$response->assertSessionHasErrors('persona');
|
|
});
|
|
|
|
test('store step1 validates persona is valid enum', function () {
|
|
$response = $this->actingAs($this->user)->post(route('app.onboarding.role.store'), [
|
|
'persona' => 'invalid',
|
|
]);
|
|
|
|
$response->assertSessionHasErrors('persona');
|
|
});
|
|
|
|
// Step 2 tests
|
|
test('step2 requires authentication', function () {
|
|
$response = $this->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertRedirect(route('login'));
|
|
});
|
|
|
|
test('step2 shows social accounts connection', function () {
|
|
$this->user->update(['setup' => Setup::Connections]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertOk();
|
|
$response->assertInertia(fn ($page) => $page
|
|
->component('onboarding/Connect', false)
|
|
->has('platforms')
|
|
->has('hasWorkspace')
|
|
);
|
|
});
|
|
|
|
test('step2 shows connected accounts for workspace', function () {
|
|
$this->user->update(['setup' => Setup::Connections]);
|
|
$workspace = Workspace::factory()->create(['user_id' => $this->user->id]);
|
|
$this->user->update(['current_workspace_id' => $workspace->id]);
|
|
|
|
SocialAccount::factory()->create([
|
|
'workspace_id' => $workspace->id,
|
|
'platform' => Platform::LinkedIn,
|
|
]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertOk();
|
|
$response->assertInertia(fn ($page) => $page
|
|
->where('hasWorkspace', true)
|
|
);
|
|
});
|
|
|
|
// Store Step 2 tests
|
|
test('store step2 requires authentication', function () {
|
|
$response = $this->post(route('app.onboarding.connect.store'));
|
|
|
|
$response->assertRedirect(route('login'));
|
|
});
|
|
|
|
test('store step2 completes setup in self-hosted mode', function () {
|
|
config(['trypost.self_hosted' => true]);
|
|
$this->user->update(['setup' => Setup::Connections]);
|
|
|
|
$response = $this->actingAs($this->user)->post(route('app.onboarding.connect.store'));
|
|
|
|
$response->assertRedirect(route('app.calendar'));
|
|
|
|
$this->user->refresh();
|
|
expect($this->user->setup)->toBe(Setup::Completed);
|
|
});
|
|
|
|
// Complete tests
|
|
test('complete requires authentication', function () {
|
|
$response = $this->get(route('app.onboarding.complete'));
|
|
|
|
$response->assertRedirect(route('login'));
|
|
});
|
|
|
|
test('complete marks setup as completed', function () {
|
|
$this->user->update(['setup' => Setup::Subscription]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.complete'));
|
|
|
|
$response->assertRedirect(route('app.calendar'));
|
|
|
|
$this->user->refresh();
|
|
expect($this->user->setup)->toBe(Setup::Completed);
|
|
});
|
|
|
|
// Step enforcement tests
|
|
test('step1 redirects to connect when user already completed role step', function () {
|
|
$this->user->update(['setup' => Setup::Connections]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.role'));
|
|
|
|
$response->assertRedirect(route('app.onboarding.connect'));
|
|
});
|
|
|
|
test('step1 redirects to subscribe when user is on subscription step', function () {
|
|
$this->user->update(['setup' => Setup::Subscription]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.role'));
|
|
|
|
$response->assertRedirect(route('app.subscribe'));
|
|
});
|
|
|
|
test('step1 redirects to calendar when setup is completed', function () {
|
|
$this->user->update(['setup' => Setup::Completed]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.role'));
|
|
|
|
$response->assertRedirect(route('app.calendar'));
|
|
});
|
|
|
|
test('step2 redirects to role when user has not completed role step', function () {
|
|
$this->user->update(['setup' => Setup::Role]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertRedirect(route('app.onboarding.role'));
|
|
});
|
|
|
|
test('step2 redirects to subscribe when user is on subscription step', function () {
|
|
$this->user->update(['setup' => Setup::Subscription]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertRedirect(route('app.subscribe'));
|
|
});
|
|
|
|
test('step2 redirects to calendar when setup is completed', function () {
|
|
$this->user->update(['setup' => Setup::Completed]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertRedirect(route('app.calendar'));
|
|
});
|
|
|
|
test('user on role step can access role page', function () {
|
|
$this->user->update(['setup' => Setup::Role]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.role'));
|
|
|
|
$response->assertOk();
|
|
});
|
|
|
|
test('user on connections step can access connect page', function () {
|
|
$this->user->update(['setup' => Setup::Connections]);
|
|
|
|
$response = $this->actingAs($this->user)->get(route('app.onboarding.connect'));
|
|
|
|
$response->assertOk();
|
|
});
|