feat(profile): align settings with dashboard layout

2026-07-31 03:41:51 +02:00
parent e47243f7dc
commit 73c601ddc2
18 changed files with 947 additions and 377 deletions
--- a/tests/Feature/ProfileSettingsTest.php
+++ b/tests/Feature/ProfileSettingsTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Models\User;
+use App\Notifications\PasswordChangedNotification;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Notification;
+use Inertia\Testing\AssertableInertia as Assert;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'auth-ui.features.email_verification' => false,
+        'auth-ui.features.two_factor_required' => false,
+    ]);
+});
+
+it('renders separate general and security profile pages', function () {
+    $user = User::factory()->create();
+
+    $this->actingAs($user)
+        ->get('/profile')
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('Profile/Show'));
+
+    $this->actingAs($user)
+        ->get('/profile/security')
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('Profile/Security')
+            ->where('twoFactor.requiresPassword', true));
+});
+
+it('updates profile details and requires email reverification after an email change', function () {
+    $user = User::factory()->create([
+        'email' => 'before@example.com',
+        'email_verified_at' => now(),
+    ]);
+
+    $this->actingAs($user)
+        ->patch('/profile', [
+            'first_name' => 'Updated',
+            'last_name' => 'Person',
+            'username' => 'updated-person',
+            'email' => 'after@example.com',
+        ])
+        ->assertRedirect('/profile')
+        ->assertSessionHas('success');
+
+    $user->refresh();
+
+    expect($user->first_name)->toBe('Updated')
+        ->and($user->last_name)->toBe('Person')
+        ->and($user->username)->toBe('updated-person')
+        ->and($user->email)->toBe('after@example.com')
+        ->and($user->email_verified_at)->toBeNull();
+});
+
+it('rejects a case-insensitive duplicate username on profile update', function () {
+    User::factory()->create(['username' => 'ExistingUser']);
+    $user = User::factory()->create(['username' => 'different-user']);
+
+    $this->actingAs($user)
+        ->patch('/profile', [
+            'first_name' => $user->first_name,
+            'last_name' => $user->last_name,
+            'username' => 'existinguser',
+            'email' => $user->email,
+        ])
+        ->assertSessionHasErrors('username');
+
+    expect($user->fresh()->username)->toBe('different-user');
+});
+
+it('requires the current password and revokes other sessions after a password change', function () {
+    Notification::fake();
+    config(['session.driver' => 'database']);
+    $user = User::factory()->create(['password' => 'current secure password']);
+
+    DB::table('sessions')->insert([
+        'id' => 'another-authenticated-session',
+        'user_id' => $user->id,
+        'ip_address' => '192.0.2.10',
+        'user_agent' => 'Test',
+        'payload' => 'payload',
+        'last_activity' => now()->timestamp,
+    ]);
+
+    $this->actingAs($user)
+        ->put('/profile/password', [
+            'current_password' => 'incorrect password',
+            'password' => 'a completely new secure password',
+            'password_confirmation' => 'a completely new secure password',
+        ])
+        ->assertSessionHasErrors('current_password');
+
+    $this->actingAs($user)
+        ->put('/profile/password', [
+            'current_password' => 'current secure password',
+            'password' => 'a completely new secure password',
+            'password_confirmation' => 'a completely new secure password',
+        ])
+        ->assertRedirect('/profile/security')
+        ->assertSessionHas('auth.session_version', 1);
+
+    $user->refresh();
+
+    expect(Hash::check('a completely new secure password', $user->password))->toBeTrue()
+        ->and($user->auth_session_version)->toBe(1)
+        ->and(DB::table('sessions')->where('id', 'another-authenticated-session')->exists())->toBeFalse();
+    $this->assertAuthenticatedAs($user);
+    Notification::assertSentTo($user, PasswordChangedNotification::class);
+});
+
+it('allows a social-only user to establish a password', function () {
+    Notification::fake();
+    $user = User::factory()->social()->create();
+
+    $this->actingAs($user)
+        ->put('/profile/password', [
+            'current_password' => '',
+            'password' => 'a secure password for social login',
+            'password_confirmation' => 'a secure password for social login',
+        ])
+        ->assertRedirect('/profile/security');
+
+    expect(Hash::check(
+        'a secure password for social login',
+        $user->fresh()->password
+    ))->toBeTrue();
+});