diff --git a/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php b/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php index f1d0253f..01ed883a 100644 --- a/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php +++ b/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php @@ -25,6 +25,7 @@ function limited_backoffice_all_role_permissions(): array return [ 'user', 'permissions_list_own', + 'list_departments', 'list_orders', 'fetch_order', 'add_order', @@ -71,6 +72,9 @@ function limited_backoffice_all_role_permissions(): array 'department_timebookings_entries_get', 'department_timebookings_entries_post', 'department_timebookings_entries_put', + 'list_department_daily_reports', + 'list_notifications', + 'list_own_notifications', 'statistics_orders_new', 'statistics_bookings_new', ]; @@ -887,6 +891,7 @@ it('creates updates lists and deactivates scoped employees without exposing raw }); foreach ([ 'list_orders', + 'list_departments', 'fetch_order', 'add_order', 'edit_order', @@ -928,6 +933,9 @@ it('creates updates lists and deactivates scoped employees without exposing raw 'department_timebookings_entries_get', 'department_timebookings_entries_post', 'department_timebookings_entries_put', + 'list_department_daily_reports', + 'list_notifications', + 'list_own_notifications', 'statistics_orders_new', 'statistics_bookings_new', 'limited_backoffice_access', @@ -1075,7 +1083,7 @@ it('creates updates lists and deactivates scoped employees without exposing raw }); }); -it('caps limited employee permissions to the manager permissions and selected departments', function (): void { +it('caps manager-gated limited employee permissions while keeping baseline role permissions', function (): void { api_test_covers('POST /limited-backoffice/employees', 'auth'); api_test_covers('GET /limited-backoffice/roles', 'auth'); @@ -1088,9 +1096,11 @@ it('caps limited employee permissions to the manager permissions and selected de $rolesByKey = array_column($roles->data(), null, 'key'); $operationsLeadGroups = array_column($rolesByKey['operations_lead']['permission_groups'] ?? [], 'capabilities', 'key'); expect($operationsLeadGroups['account'] ?? null)->toBe(['sign_in', 'view_own_permissions']); + expect($operationsLeadGroups['departments'] ?? null)->toBe(['view_departments', 'view_daily_reports']); expect($operationsLeadGroups['orders'] ?? null)->toBe(['view_orders']); + expect($operationsLeadGroups['notifications'] ?? null)->toBe(['view_notifications']); + expect($operationsLeadGroups['reports'] ?? null)->toBe(['view_order_statistics', 'view_booking_statistics']); expect($roles->body)->not->toContain('create_orders'); - expect($roles->body)->not->toContain('view_order_statistics'); $created = api_client()->post('/limited-backoffice/employees', [ 'display_name' => 'Limited Capped Lead', @@ -1122,7 +1132,13 @@ it('caps limited employee permissions to the manager permissions and selected de ->toContain('user') ->toContain('permissions_list_own') ->toContain('employee_public_data') + ->toContain('list_departments') ->toContain('list_orders') + ->toContain('list_department_daily_reports') + ->toContain('list_notifications') + ->toContain('list_own_notifications') + ->toContain('statistics_orders_new') + ->toContain('statistics_bookings_new') ->toContain('department_access_' . (int)$department['id']) ->not->toContain('add_order') ->not->toContain('fetch_order') @@ -1130,7 +1146,6 @@ it('caps limited employee permissions to the manager permissions and selected de ->not->toContain('search_customers') ->not->toContain('add_bookings') ->not->toContain('delete_order') - ->not->toContain('statistics_orders_new') ->not->toContain(limited_backoffice_service::PERMISSION_MANAGE_EMPLOYEES); });