crewli/api/tests/Feature/Artist/ArtistPolicyTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature\Artist;

use App\Enums\Artist\ArtistEngagementStatus;
use App\Models\Artist;
use App\Models\ArtistEngagement;
use App\Models\Event;
use App\Models\Organisation;
use App\Models\User;
use Database\Seeders\RoleSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Gate;
use Tests\TestCase;

final class ArtistPolicyTest extends TestCase
{
    use RefreshDatabase;

    private Organisation $org;

    private Organisation $otherOrg;

    private User $orgAdmin;

    private User $programManager;

    private User $crossTenantAdmin;

    private User $superAdmin;

    private Artist $artist;

    protected function setUp(): void
    {
        parent::setUp();
        $this->seed(RoleSeeder::class);

        $this->org = Organisation::factory()->create();
        $this->otherOrg = Organisation::factory()->create();

        $this->orgAdmin = User::factory()->create();
        $this->org->users()->attach($this->orgAdmin, ['role' => 'org_admin']);

        $this->programManager = User::factory()->create();
        $this->org->users()->attach($this->programManager, ['role' => 'program_manager']);

        $this->crossTenantAdmin = User::factory()->create();
        $this->otherOrg->users()->attach($this->crossTenantAdmin, ['role' => 'org_admin']);

        $this->superAdmin = User::factory()->create();
        $this->superAdmin->assignRole('super_admin');

        $this->artist = Artist::factory()->create(['organisation_id' => $this->org->id]);
    }

    public function test_org_admin_can_create(): void
    {
        $this->assertTrue(Gate::forUser($this->orgAdmin)->allows('create', [Artist::class, $this->org]));
    }

    public function test_program_manager_can_update(): void
    {
        $this->assertTrue(Gate::forUser($this->programManager)->allows('update', $this->artist));
    }

    public function test_cross_tenant_admin_denied(): void
    {
        $this->assertFalse(Gate::forUser($this->crossTenantAdmin)->allows('view', $this->artist));
        $this->assertFalse(Gate::forUser($this->crossTenantAdmin)->allows('update', $this->artist));
        $this->assertFalse(Gate::forUser($this->crossTenantAdmin)->allows('delete', $this->artist));
    }

    public function test_super_admin_bypass(): void
    {
        $this->assertTrue(Gate::forUser($this->superAdmin)->allows('view', $this->artist));
        $this->assertTrue(Gate::forUser($this->superAdmin)->allows('update', $this->artist));
    }

    public function test_delete_blocked_with_active_engagement(): void
    {
        $event = Event::factory()->create(['organisation_id' => $this->org->id]);
        ArtistEngagement::factory()->create([
            'artist_id' => $this->artist->id,
            'event_id' => $event->id,
            'booking_status' => ArtistEngagementStatus::Confirmed,
        ]);

        $this->assertFalse(Gate::forUser($this->orgAdmin)->allows('delete', $this->artist));
    }

    public function test_delete_allowed_with_only_terminal_engagements(): void
    {
        $event = Event::factory()->create(['organisation_id' => $this->org->id]);
        ArtistEngagement::factory()->create([
            'artist_id' => $this->artist->id,
            'event_id' => $event->id,
            'booking_status' => ArtistEngagementStatus::Cancelled,
        ]);

        $this->assertTrue(Gate::forUser($this->orgAdmin)->allows('delete', $this->artist));
    }
}