bert.hausmans
cd7a804024
UserProfileTest: belongs-to user, fillable/non-fillable boundaries, settings cast, lastSubmittedAt accessor (null + max from user-subject submissions only, ignoring drafts and is_test rows). FormSchemaTest: ULID PK, OrganisationScope filtering, polymorphic owner resolution to Event, purpose enum cast, hasMany fields/submissions, and logSchemaChange() actually creates an activity-log entry. FormFieldTest: belongs-to schema, field_type stored as string (not DB enum), binding/translations array casts, hasMany values, soft-delete preserves historical values, logFieldChange() creates an entry. FormSubmissionTest: belongs-to schema, polymorphic subject resolution, status enum cast, schema_snapshot array cast, hasMany values. FormValueTest: belongs-to submission/field, value array cast, hasMany options pivot rebuilt by observer, unique-pair DB constraint enforced. MultiTenancyTest: OrganisationScope correctly filters FormSchema / FormTemplate / FormFieldLibrary by route-resolved organisation. Pins the FormSchemaWebhook un-scoped behaviour explicitly so a future scope addition is an intentional decision, not an accident. MigrationRollbackTest (group 'slow'): full migrate:fresh → rollback 14 S1 steps → assert all 13 form-builder tables dropped + legacy tables intentionally retained → re-migrate and assert table list matches snapshot. Plus a separate test exercising the populate-user-profiles migration's down(). Supporting tweaks: - UserProfile::lastSubmittedAt accessor now returns Carbon|null instead of a raw timestamp string — testable, and matches Eloquent convention. - UserProfileFactory cooperates with UserObserver via newModel override (updates the auto-created row instead of inserting a duplicate). - AppServiceProvider morph map extended with all 12 form-builder model keys so logSchemaChange/logFieldChange resolve under enforceMorphMap. Suite: 945 passed (was 911), 2671 assertions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
109 lines
4.1 KiB
PHP
109 lines
4.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\FormBuilder;
|
|
|
|
use App\Models\FormBuilder\FormSchema;
|
|
use App\Models\FormBuilder\FormSchemaWebhook;
|
|
use App\Models\FormBuilder\FormTemplate;
|
|
use App\Models\FormBuilder\FormFieldLibrary;
|
|
use App\Models\Organisation;
|
|
use App\Models\Scopes\OrganisationScope;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Routing\Route;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Verifies OrganisationScope discipline:
|
|
* - FormSchema, FormTemplate, FormFieldLibrary apply OrganisationScope and
|
|
* are filtered when an organisation route parameter is in scope.
|
|
* - FormSchemaWebhook intentionally does NOT apply OrganisationScope (its
|
|
* scope is enforced via the parent FormSchema). The docblock on the
|
|
* model warns callers; this test pins the current behaviour so a future
|
|
* refactor that adds the scope is an intentional decision.
|
|
*/
|
|
final class MultiTenancyTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private Organisation $orgA;
|
|
|
|
private Organisation $orgB;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
$this->orgA = Organisation::factory()->create();
|
|
$this->orgB = Organisation::factory()->create();
|
|
}
|
|
|
|
public function test_form_schema_filters_by_organisation_route_parameter(): void
|
|
{
|
|
FormSchema::factory()->count(3)->create(['organisation_id' => $this->orgA->id]);
|
|
FormSchema::factory()->count(2)->create(['organisation_id' => $this->orgB->id]);
|
|
|
|
$this->actingAsOrgUser($this->orgA);
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
|
|
$this->assertSame(3, FormSchema::query()->count());
|
|
|
|
$this->withRouteParameter('organisation', $this->orgB);
|
|
$this->assertSame(2, FormSchema::query()->count());
|
|
}
|
|
|
|
public function test_form_template_filters_by_organisation_route_parameter(): void
|
|
{
|
|
FormTemplate::factory()->count(2)->create(['organisation_id' => $this->orgA->id]);
|
|
FormTemplate::factory()->count(4)->create(['organisation_id' => $this->orgB->id]);
|
|
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
$this->assertSame(2, FormTemplate::query()->count());
|
|
|
|
$this->withRouteParameter('organisation', $this->orgB);
|
|
$this->assertSame(4, FormTemplate::query()->count());
|
|
}
|
|
|
|
public function test_form_field_library_filters_by_organisation_route_parameter(): void
|
|
{
|
|
FormFieldLibrary::factory()->count(1)->create(['organisation_id' => $this->orgA->id]);
|
|
FormFieldLibrary::factory()->count(3)->create(['organisation_id' => $this->orgB->id]);
|
|
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
$this->assertSame(1, FormFieldLibrary::query()->count());
|
|
}
|
|
|
|
public function test_form_schema_webhook_is_not_globally_scoped(): void
|
|
{
|
|
$schemaA = FormSchema::factory()->create(['organisation_id' => $this->orgA->id]);
|
|
$schemaB = FormSchema::factory()->create(['organisation_id' => $this->orgB->id]);
|
|
FormSchemaWebhook::factory()->count(2)->create(['form_schema_id' => $schemaA->id]);
|
|
FormSchemaWebhook::factory()->count(3)->create(['form_schema_id' => $schemaB->id]);
|
|
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
// Direct queries leak across orgs — exact reason the docblock warns
|
|
// never to query FormSchemaWebhook::query() without an eager constraint.
|
|
$this->assertSame(5, FormSchemaWebhook::query()->count());
|
|
|
|
// Going through the schema relation respects OrganisationScope on the parent.
|
|
$this->assertCount(2, $schemaA->fresh()->webhooks);
|
|
$this->assertCount(3, $schemaB->fresh()->webhooks);
|
|
}
|
|
|
|
private function actingAsOrgUser(Organisation $org): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$org->users()->attach($user, ['role' => 'org_member']);
|
|
$this->actingAs($user);
|
|
}
|
|
|
|
private function withRouteParameter(string $name, mixed $value): void
|
|
{
|
|
$route = new Route(['GET'], '/_test', static fn () => null);
|
|
$route->bind(request());
|
|
$route->setParameter($name, $value);
|
|
request()->setRouteResolver(static fn () => $route);
|
|
}
|
|
}
|