133 lines
4.4 KiB
PHP
133 lines
4.4 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use App\Notifications\PasswordChangedNotification;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Facades\Notification;
|
|
use Inertia\Testing\AssertableInertia as Assert;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
config([
|
|
'auth-ui.features.email_verification' => false,
|
|
'auth-ui.features.two_factor_required' => false,
|
|
]);
|
|
});
|
|
|
|
it('renders separate general and security profile pages', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user)
|
|
->get('/profile')
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('Profile/Show'));
|
|
|
|
$this->actingAs($user)
|
|
->get('/profile/security')
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('Profile/Security')
|
|
->where('twoFactor.requiresPassword', true));
|
|
});
|
|
|
|
it('updates profile details and requires email reverification after an email change', function () {
|
|
$user = User::factory()->create([
|
|
'email' => 'before@example.com',
|
|
'email_verified_at' => now(),
|
|
]);
|
|
|
|
$this->actingAs($user)
|
|
->patch('/profile', [
|
|
'first_name' => 'Updated',
|
|
'last_name' => 'Person',
|
|
'username' => 'updated-person',
|
|
'email' => 'after@example.com',
|
|
])
|
|
->assertRedirect('/profile')
|
|
->assertSessionHas('success');
|
|
|
|
$user->refresh();
|
|
|
|
expect($user->first_name)->toBe('Updated')
|
|
->and($user->last_name)->toBe('Person')
|
|
->and($user->username)->toBe('updated-person')
|
|
->and($user->email)->toBe('after@example.com')
|
|
->and($user->email_verified_at)->toBeNull();
|
|
});
|
|
|
|
it('rejects a case-insensitive duplicate username on profile update', function () {
|
|
User::factory()->create(['username' => 'ExistingUser']);
|
|
$user = User::factory()->create(['username' => 'different-user']);
|
|
|
|
$this->actingAs($user)
|
|
->patch('/profile', [
|
|
'first_name' => $user->first_name,
|
|
'last_name' => $user->last_name,
|
|
'username' => 'existinguser',
|
|
'email' => $user->email,
|
|
])
|
|
->assertSessionHasErrors('username');
|
|
|
|
expect($user->fresh()->username)->toBe('different-user');
|
|
});
|
|
|
|
it('requires the current password and revokes other sessions after a password change', function () {
|
|
Notification::fake();
|
|
config(['session.driver' => 'database']);
|
|
$user = User::factory()->create(['password' => 'current secure password']);
|
|
|
|
DB::table('sessions')->insert([
|
|
'id' => 'another-authenticated-session',
|
|
'user_id' => $user->id,
|
|
'ip_address' => '192.0.2.10',
|
|
'user_agent' => 'Test',
|
|
'payload' => 'payload',
|
|
'last_activity' => now()->timestamp,
|
|
]);
|
|
|
|
$this->actingAs($user)
|
|
->put('/profile/password', [
|
|
'current_password' => 'incorrect password',
|
|
'password' => 'a completely new secure password',
|
|
'password_confirmation' => 'a completely new secure password',
|
|
])
|
|
->assertSessionHasErrors('current_password');
|
|
|
|
$this->actingAs($user)
|
|
->put('/profile/password', [
|
|
'current_password' => 'current secure password',
|
|
'password' => 'a completely new secure password',
|
|
'password_confirmation' => 'a completely new secure password',
|
|
])
|
|
->assertRedirect('/profile/security')
|
|
->assertSessionHas('auth.session_version', 1);
|
|
|
|
$user->refresh();
|
|
|
|
expect(Hash::check('a completely new secure password', $user->password))->toBeTrue()
|
|
->and($user->auth_session_version)->toBe(1)
|
|
->and(DB::table('sessions')->where('id', 'another-authenticated-session')->exists())->toBeFalse();
|
|
$this->assertAuthenticatedAs($user);
|
|
Notification::assertSentTo($user, PasswordChangedNotification::class);
|
|
});
|
|
|
|
it('allows a social-only user to establish a password', function () {
|
|
Notification::fake();
|
|
$user = User::factory()->social()->create();
|
|
|
|
$this->actingAs($user)
|
|
->put('/profile/password', [
|
|
'current_password' => '',
|
|
'password' => 'a secure password for social login',
|
|
'password_confirmation' => 'a secure password for social login',
|
|
])
|
|
->assertRedirect('/profile/security');
|
|
|
|
expect(Hash::check(
|
|
'a secure password for social login',
|
|
$user->fresh()->password
|
|
))->toBeTrue();
|
|
});
|