crewli/api/tests/Feature/FormBuilder/Channels/SubmissionChannelAuthTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature\FormBuilder\Channels;

use App\Models\FormBuilder\FormSchema;
use App\Models\FormBuilder\FormSubmission;
use App\Models\Organisation;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Broadcast;
use Tests\TestCase;

/**
 * Per RFC-WS-6 §Q1 v1.3 addition 2.
 *
 * The submission.{submissionId} private channel authorises only the
 * submitter (user whose id matches submissions.submitted_by_user_id).
 * Org-admin access is deferred — see BACKLOG entry
 * TECH-CHANNEL-AUTH-ORG-ADMIN.
 *
 * Broadcast::auth() drives the same callback path that Laravel's
 * broadcasting auth middleware uses on a websocket subscription
 * attempt. Tests pose as authenticated users and assert the boolean
 * outcome.
 */
final class SubmissionChannelAuthTest extends TestCase
{
    use RefreshDatabase;

    private function authoriseSubscription(?User $user, FormSubmission $submission): bool
    {
        // Resolve the channel callback registered in routes/channels.php.
        // Broadcast::channel() returns the manager; Broadcast::driver()
        // exposes the channel callbacks. The cleanest contract test is
        // to call the callback directly via the registered closure
        // returned by getChannels().
        $channels = Broadcast::getChannels();
        $name = "submission.{$submission->id}";

        foreach ($channels as $pattern => $callback) {
            // Pattern is 'submission.{submissionId}'; convert to a regex
            // so we can match the concrete channel name.
            $regex = '/^'.str_replace(['{submissionId}', '.'], ['([^.]+)', '\\.'], $pattern).'$/';
            if (! preg_match($regex, $name, $matches)) {
                continue;
            }
            $result = $callback($user, $matches[1]);

            return (bool) $result;
        }

        $this->fail("No channel callback registered for {$name}");
    }

    private function makeSubmission(?User $submitter): FormSubmission
    {
        $org = Organisation::factory()->create();
        $schema = FormSchema::factory()->create(['organisation_id' => $org->id]);

        return FormSubmission::factory()->create([
            'form_schema_id' => $schema->id,
            'organisation_id' => $org->id,
            'submitted_by_user_id' => $submitter?->id,
        ]);
    }

    public function test_submitter_is_authorised(): void
    {
        $submitter = User::factory()->create();
        $submission = $this->makeSubmission($submitter);

        $this->assertTrue($this->authoriseSubscription($submitter, $submission));
    }

    public function test_other_authenticated_user_is_denied(): void
    {
        $submitter = User::factory()->create();
        $other = User::factory()->create();
        $submission = $this->makeSubmission($submitter);

        $this->assertFalse($this->authoriseSubscription($other, $submission));
    }

    public function test_subscription_is_denied_when_submission_does_not_exist(): void
    {
        $user = User::factory()->create();

        // Build a submission, then delete it so the FK lookup returns null.
        $submission = $this->makeSubmission($user);
        $submissionId = (string) $submission->id;
        $submission->forceDelete();

        // Reuse the submitter's User and a fake submission shell.
        $shell = new FormSubmission;
        $shell->id = $submissionId;

        $this->assertFalse($this->authoriseSubscription($user, $shell));
    }

    public function test_org_admin_is_currently_denied_per_backlog_entry(): void
    {
        // Locks the v1 contract: even an org admin of the submission's
        // organisation is denied because the canonical Spatie helper
        // hasn't been audited yet. See BACKLOG entry
        // TECH-CHANNEL-AUTH-ORG-ADMIN. When that lands, this test should
        // flip to expectTrue() in the same PR as the auth-callback
        // extension.
        $orgAdmin = User::factory()->create();
        $submitter = User::factory()->create();
        $submission = $this->makeSubmission($submitter);

        $this->assertFalse(
            $this->authoriseSubscription($orgAdmin, $submission),
            'V1 contract: org admins are NOT authorised. Flip with TECH-CHANNEL-AUTH-ORG-ADMIN.',
        );
    }
}