copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Align limited backoffice permission cap tests

Browse Source
This commit is contained in:
Jeppe Bundgaard
2026-07-07 02:47:49 +02:00
parent 57bcbaf72a
commit 0b342a7780
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/tests/Api/LimitedBackofficeApiTest.php
+18 -3
View File
@@ -25,6 +25,7 @@ function limited_backoffice_all_role_permissions(): array
return [
'user',
'permissions_list_own',
'list_departments',
'list_orders',
'fetch_order',
'add_order',
@@ -71,6 +72,9 @@ function limited_backoffice_all_role_permissions(): array
'department_timebookings_entries_get',
'department_timebookings_entries_post',
'department_timebookings_entries_put',
'list_department_daily_reports',
'list_notifications',
'list_own_notifications',
'statistics_orders_new',
'statistics_bookings_new',
];
@@ -887,6 +891,7 @@ it('creates updates lists and deactivates scoped employees without exposing raw
});
foreach ([
'list_orders',
'list_departments',
'fetch_order',
'add_order',
'edit_order',
@@ -928,6 +933,9 @@ it('creates updates lists and deactivates scoped employees without exposing raw
'department_timebookings_entries_get',
'department_timebookings_entries_post',
'department_timebookings_entries_put',
'list_department_daily_reports',
'list_notifications',
'list_own_notifications',
'statistics_orders_new',
'statistics_bookings_new',
'limited_backoffice_access',
@@ -1075,7 +1083,7 @@ it('creates updates lists and deactivates scoped employees without exposing raw
});
});
it('caps limited employee permissions to the manager permissions and selected departments', function (): void {
it('caps manager-gated limited employee permissions while keeping baseline role permissions', function (): void {
api_test_covers('POST /limited-backoffice/employees', 'auth');
api_test_covers('GET /limited-backoffice/roles', 'auth');
@@ -1088,9 +1096,11 @@ it('caps limited employee permissions to the manager permissions and selected de
$rolesByKey = array_column($roles->data(), null, 'key');
$operationsLeadGroups = array_column($rolesByKey['operations_lead']['permission_groups'] ?? [], 'capabilities', 'key');
expect($operationsLeadGroups['account'] ?? null)->toBe(['sign_in', 'view_own_permissions']);
expect($operationsLeadGroups['departments'] ?? null)->toBe(['view_departments', 'view_daily_reports']);
expect($operationsLeadGroups['orders'] ?? null)->toBe(['view_orders']);
expect($operationsLeadGroups['notifications'] ?? null)->toBe(['view_notifications']);
expect($operationsLeadGroups['reports'] ?? null)->toBe(['view_order_statistics', 'view_booking_statistics']);
expect($roles->body)->not->toContain('create_orders');
expect($roles->body)->not->toContain('view_order_statistics');
$created = api_client()->post('/limited-backoffice/employees', [
'display_name' => 'Limited Capped Lead',
@@ -1122,7 +1132,13 @@ it('caps limited employee permissions to the manager permissions and selected de
->toContain('user')
->toContain('permissions_list_own')
->toContain('employee_public_data')
->toContain('list_departments')
->toContain('list_orders')
->toContain('list_department_daily_reports')
->toContain('list_notifications')
->toContain('list_own_notifications')
->toContain('statistics_orders_new')
->toContain('statistics_bookings_new')
->toContain('department_access_' . (int)$department['id'])
->not->toContain('add_order')
->not->toContain('fetch_order')
@@ -1130,7 +1146,6 @@ it('caps limited employee permissions to the manager permissions and selected de
->not->toContain('search_customers')
->not->toContain('add_bookings')
->not->toContain('delete_order')
->not->toContain('statistics_orders_new')
->not->toContain(limited_backoffice_service::PERMISSION_MANAGE_EMPLOYEES);
});