shopit-back/tests/Feature/Administrator/AdministratorControllerTest.php

<?php

namespace Tests\Feature\Administrator;

use App\Domains\Attachable\Enums\AttachmentType;
use App\Domains\Attachable\Models\Attachment;
use App\Domains\Auth\Models\ResetPasswordAttempt;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Notification\Events\PasswordResetRequested;
use App\Domains\Tenant\Models\Tenant;
use App\Domains\Tenant\Models\WebsiteType;
use Database\Seeders\AuthorizationSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Event;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;

class AdministratorControllerTest extends TestCase
{
    use RefreshDatabase;

    private Tenant $tenant;

    private User $admin;

    protected function setUp(): void
    {
        parent::setUp();

        Event::fake([PasswordResetRequested::class]);
        $this->seed(AuthorizationSeeder::class);
        WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
        $headerLogo = $this->createAttachment('header.png');
        $footerLogo = $this->createAttachment('footer.png');
        $this->tenant = Tenant::query()->create([
            'codigo' => 'acme',
            'nombre' => 'Acme',
            'dominio' => 'acme.test',
            'website_type_code' => 'onticket',
            'primary_color' => '#111111',
            'secondary_color' => '#222222',
            'danger_color' => '#cc0000',
            'success_color' => '#008800',
            'header_bg_color' => '#ffffff',
            'footer_bg_color' => '#ffffff',
            'header_logo_id' => $headerLogo->id,
            'footer_logo_id' => $footerLogo->id,
        ]);
        $this->admin = User::factory()->create([
            'rol_codigo' => RoleCode::AdminApp->value,
            'tenant_codigo' => $this->tenant->codigo,
        ]);
    }

    private const URL = '/api/v1/adminapp/tenant/administrators';

    private function payload(): array
    {
        return ['nombre_apellido' => 'Ada Lovelace', 'dni' => '12345678', 'email' => 'ada@example.test'];
    }

    public function test_crud_and_password_setup_and_token_revocation(): void
    {
        Sanctum::actingAs($this->admin);
        $response = $this->postJson(self::URL, [...$this->payload(), 'email' => ' ADA@example.test ', 'rol_codigo' => 'admin', 'tenant_codigo' => 'other'])
            ->assertCreated()->assertJsonPath('data.email', 'ada@example.test')
            ->assertJsonPath('data.rol_codigo', 'adminapp')->assertJsonMissingPath('data.password');
        $id = $response->json('data.id');
        $this->assertDatabaseHas('users', ['id' => $id, 'tenant_codigo' => $this->tenant->codigo, 'rol_codigo' => 'adminapp']);
        $this->assertDatabaseHas('reset_password_attempts', ['user_id' => $id, 'reason' => ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED, 'status' => ResetPasswordAttempt::STATUS_PENDING]);
        Event::assertDispatched(PasswordResetRequested::class, fn ($event) => $event->channel === PasswordResetRequested::CHANNEL_ADMINAPP && $event->tenantCode === $this->tenant->codigo);
        $this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(1, 'data');
        $this->putJson(self::URL."/{$id}", [...$this->payload(), 'nombre_apellido' => 'Ada Byron', 'rol_codigo' => 'scanner'])
            ->assertOk()->assertJsonPath('data.nombre_apellido', 'Ada Byron')->assertJsonPath('data.rol_codigo', 'adminapp');
        $token = User::findOrFail($id)->createToken('adminapp')->accessToken;
        $this->deleteJson(self::URL."/{$id}")->assertNoContent();
        $this->assertSoftDeleted('users', ['id' => $id]);
        $this->assertDatabaseMissing('personal_access_tokens', ['id' => $token->id]);
        $this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(0, 'data');
        $this->postJson(self::URL, $this->payload())->assertCreated();
    }

    public function test_validation_and_case_insensitive_active_email_uniqueness(): void
    {
        Sanctum::actingAs($this->admin);
        $this->postJson(self::URL, [])->assertUnprocessable()->assertJsonValidationErrors(['nombre_apellido', 'dni', 'email']);
        $this->postJson(self::URL, [...$this->payload(), 'email' => 'invalid'])->assertUnprocessable()->assertJsonValidationErrors('email');
        $this->postJson(self::URL, [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
        $target = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
        $this->putJson(self::URL."/{$target->id}", [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
    }

    public function test_other_tenants_and_roles_are_excluded(): void
    {
        Sanctum::actingAs($this->admin);
        $otherTenant = $this->tenant->replicate();
        $otherTenant->codigo = 'other';
        $otherTenant->dominio = 'other.test';
        $otherTenant->save();
        $targets = [
            User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $otherTenant->codigo]),
            User::factory()->create(['rol_codigo' => 'scanner', 'tenant_codigo' => $this->tenant->codigo]),
            User::factory()->create(['rol_codigo' => 'admin', 'tenant_codigo' => $this->tenant->codigo]),
        ];
        $this->getJson(self::URL)->assertOk()->assertJsonCount(1, 'data')->assertJsonPath('data.0.id', $this->admin->id);
        foreach ($targets as $target) {
            $this->putJson(self::URL."/{$target->id}", $this->payload())->assertNotFound();
            $this->deleteJson(self::URL."/{$target->id}")->assertNotFound();
            $this->assertNotSoftDeleted($target);
        }
    }

    public function test_cannot_delete_self_even_with_another_administrator(): void
    {
        Sanctum::actingAs($this->admin);
        $this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
        User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
        $this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable();
        $this->assertNotSoftDeleted($this->admin);
    }

    public function test_in_flight_request_from_deleted_actor_cannot_remove_last_administrator(): void
    {
        $remaining = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
        $this->admin->delete();
        Sanctum::actingAs($this->admin);
        $this->deleteJson(self::URL."/{$remaining->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
        $this->assertNotSoftDeleted($remaining);
    }

    public function test_authentication_and_role_are_required_for_all_operations(): void
    {
        $this->getJson(self::URL)->assertUnauthorized();
        foreach (['user', 'scanner', 'admin'] as $role) {
            Sanctum::actingAs(User::factory()->create(['rol_codigo' => $role, 'tenant_codigo' => $this->tenant->codigo]));
            $this->getJson(self::URL)->assertForbidden();
            $this->postJson(self::URL, $this->payload())->assertForbidden();
            $this->putJson(self::URL."/{$this->admin->id}", $this->payload())->assertForbidden();
            $this->deleteJson(self::URL."/{$this->admin->id}")->assertForbidden();
        }
    }

    private function createAttachment(string $filename): Attachment
    {
        return Attachment::query()->create(['path' => "test/{$filename}", 'filename' => $filename, 'type' => AttachmentType::Image, 'mime_type' => 'image/png']);
    }
}