radicall/tests/Feature/Http/Admin/SettingUserControllerTest.php

<?php

namespace Tests\Feature\Http\Admin;

use App\Models\Medium;
use App\Models\Session;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Storage;
use Inertia\Testing\AssertableInertia as Assert;
use Tests\Concerns\InteractsWithAdmin;
use Tests\TestCase;

class SettingUserControllerTest extends TestCase
{
    use InteractsWithAdmin, RefreshDatabase;

    protected function storedSession(User $user, string $id): void
    {
        Session::forceCreate(['id' => $id, 'user_id' => $user->id, 'ip_address' => '127.0.0.1', 'user_agent' => 'phpunit', 'payload' => '', 'last_activity' => now()->timestamp]);
    }

    public function test_guest_is_redirected(): void
    {
        $this->get('/admin/setting-profile')->assertRedirect(route('login'));
    }

    public function test_pages_render(): void
    {
        $admin = $this->adminWithoutPermissions();
        $this->storedSession($admin, 'sess-1');
        $this->storedSession(User::factory()->create(), 'sess-2');

        $this->actingAs($admin)->get('/admin/setting-profile')->assertOk()->assertInertia(fn (Assert $page) => $page->component('Settings/User/Profile'));
        $this->actingAs($admin)->get('/admin/setting-profile/security')->assertOk()->assertInertia(fn (Assert $page) => $page->component('Settings/User/Security'));
        $this->actingAs($admin)->get('/admin/setting-profile/sessions')->assertOk()->assertInertia(fn (Assert $page) => $page->component('Settings/User/Sessions')->has('sessions', 1)->where('sessions.0.id', 'sess-1'));
    }

    public function test_update_data_forbids_editing_another_user(): void
    {
        $admin = $this->adminWithoutPermissions();
        $other = User::factory()->create();

        $this->actingAs($admin)->post("/admin/setting-profile/update-data/{$other->id}", ['name' => 'x'])->assertForbidden();
    }

    public function test_upload_avatar_stores_file_and_replaces_previous(): void
    {
        Storage::fake('public');
        $old = Medium::factory()->public()->create(['path' => 'profile/old.png', 'url' => 'http://example.test/storage/profile/old.png']);
        Storage::disk('public')->put($old->path, 'old');
        $admin = $this->adminWithoutPermissions();
        $admin->update(['profile_url' => $old->url]);

        $response = $this->actingAs($admin)->post('/admin/setting-profile/update-avatar', ['file' => UploadedFile::fake()->image('new.png')]);

        $response->assertOk();
        $this->assertDatabaseMissing('media', ['id' => $old->id]);
        $this->assertSame($response->json('profile_url'), $admin->fresh()->profile_url);
        $this->assertStringStartsWith('profile/', Medium::first()->path);
    }

    public function test_upload_avatar_validates_type_and_size(): void
    {
        $this->actingAs($this->adminWithoutPermissions())->postJson('/admin/setting-profile/update-avatar', ['file' => UploadedFile::fake()->create('a.pdf', 10, 'application/pdf')])
            ->assertUnprocessable()
            ->assertJsonValidationErrors('file');
    }

    public function test_delete_session_removes_own_session_only(): void
    {
        $admin = $this->adminWithoutPermissions();
        $this->storedSession($admin, 'own');
        $this->storedSession(User::factory()->create(), 'foreign');

        $this->actingAs($admin)->delete('/admin/setting-profile/sessions/own')->assertOk()->assertSessionHas('success');
        $this->actingAs($admin)->delete('/admin/setting-profile/sessions/foreign')->assertStatus(400)->assertSessionHas('error');

        $this->assertDatabaseMissing('sessions', ['id' => 'own']);
        $this->assertDatabaseHas('sessions', ['id' => 'foreign']);
    }

    public function test_bulk_delete_removes_sessions(): void
    {
        $admin = $this->adminWithoutPermissions();
        $this->storedSession($admin, 'a');
        $this->storedSession($admin, 'b');

        $this->actingAs($admin)->post('/admin/setting-profile/sessions-bulk-delete', ['ids' => ['a', 'b']])->assertOk();

        $this->assertDatabaseCount('sessions', 0);
    }

    public function test_change_password_updates_password_when_current_matches(): void
    {
        $admin = $this->adminWithoutPermissions();
        $admin->update(['password' => 'oldsecret1']);

        $this->actingAs($admin)->post('/admin/setting-profile/change-password', ['password' => 'oldsecret1', 'newPassword' => 'newsecret1', 'newPassword_confirmation' => 'newsecret1'])->assertOk()->assertSessionHas('success');

        $this->assertTrue(Hash::check('newsecret1', $admin->fresh()->password));
    }

    public function test_change_password_rejects_wrong_current_password(): void
    {
        $admin = $this->adminWithoutPermissions();
        $admin->update(['password' => 'oldsecret1']);

        $this->actingAs($admin)->postJson('/admin/setting-profile/change-password', ['password' => 'wrongpass1', 'newPassword' => 'newsecret1', 'newPassword_confirmation' => 'newsecret1'])->assertUnauthorized();

        $this->assertTrue(Hash::check('oldsecret1', $admin->fresh()->password));
    }

    public function test_change_password_validates_input(): void
    {
        $this->actingAs($this->adminWithoutPermissions())->postJson('/admin/setting-profile/change-password', ['password' => 'short', 'newPassword' => 'newsecret1', 'newPassword_confirmation' => 'other'])
            ->assertUnprocessable()
            ->assertJsonValidationErrors(['password', 'newPassword']);
    }
}