copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Fix limited backoffice schema compatibility

Browse Source
This commit is contained in:
Jeppe Bundgaard
2026-07-06 09:15:55 +02:00
parent 243d68ab59
commit 18fede78f8
3 changed files with 91 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/tests/Api/LimitedBackofficeApiTest.php
+37 -2
View File
@@ -63,11 +63,37 @@ function limited_backoffice_cleanup_created_employee(int $employeeId): void
}
}
function limited_backoffice_without_users_deleted_at(callable $callback): void
{
$db = api_test_runtime()->db();
$column = $db->query("SHOW COLUMNS FROM `users` LIKE 'deleted_at'");
if ($column === false) {
throw new RuntimeException('Unable to inspect users.deleted_at test column.');
}
$hadColumn = (int)$column->num_rows > 0;
if ($hadColumn) {
$db->query('ALTER TABLE `users` DROP COLUMN `deleted_at`');
}
try {
$callback();
} finally {
if ($hadColumn) {
$db->query('ALTER TABLE `users` ADD COLUMN `deleted_at` DATETIME NULL');
}
}
}
it('lists and updates explicit prices only for assigned departments', function (): void {
api_test_covers('GET /limited-backoffice/departments', 'happy');
api_test_covers('GET /limited-backoffice/departments/{departmentId}/prices', 'happy');
api_test_covers('PUT /limited-backoffice/departments/{departmentId}/prices', 'happy');
$productDeletedAtColumn = api_test_runtime()->db()->query("SHOW COLUMNS FROM `products` LIKE 'deleted_at'");
expect($productDeletedAtColumn)->not->toBeFalse();
expect((int)$productDeletedAtColumn->num_rows)->toBe(0);
$department = api_fixtures()->createDepartment(['name' => 'Limited Prices Own']);
$otherDepartment = api_fixtures()->createDepartment(['name' => 'Limited Prices Other']);
$category = api_fixtures()->createCategory(['name' => 'Limited Washes']);
@@ -238,12 +264,17 @@ it('rejects invalid price batches and leaves existing prices unchanged', functio
});
it('creates updates lists and deactivates scoped employees without exposing raw permissions', function (): void {
limited_backoffice_without_users_deleted_at(function (): void {
api_test_covers('GET /limited-backoffice/roles', 'happy');
api_test_covers('GET /limited-backoffice/employees', 'happy');
api_test_covers('POST /limited-backoffice/employees', 'happy');
api_test_covers('PUT /limited-backoffice/employees/{employeeId}', 'happy');
api_test_covers('DELETE /limited-backoffice/employees/{employeeId}', 'happy');
$usersDeletedAtColumn = api_test_runtime()->db()->query("SHOW COLUMNS FROM `users` LIKE 'deleted_at'");
expect($usersDeletedAtColumn)->not->toBeFalse();
expect((int)$usersDeletedAtColumn->num_rows)->toBe(0);
$department = api_fixtures()->createDepartment(['name' => 'Limited Employee Department']);
$session = limited_backoffice_manager_session([(int)$department['id']]);
@@ -313,12 +344,16 @@ it('creates updates lists and deactivates scoped employees without exposing raw
->assertSuccess();
expect($deactivated->data()['active'] ?? true)->toBeFalse();
$userRow = api_test_runtime()->queryOne('SELECT `password`, `group_id`, `deleted_at` FROM `users` WHERE `id` = ' . $employeeId);
$userRow = api_test_runtime()->queryOne('SELECT `password`, `group_id` FROM `users` WHERE `id` = ' . $employeeId);
expect($userRow)->not->toBeNull();
expect(array_key_exists('password', $userRow ?? []))->toBeTrue();
expect($userRow['password'])->toBeNull();
expect((int)($userRow['group_id'] ?? -1))->toBe(0);
expect($userRow['deleted_at'] ?? null)->not->toBeNull();
$employeeRow = api_test_runtime()->queryOne(
'SELECT `deactivated_at` FROM `limited_backoffice_employees` WHERE `user_id` = ' . $employeeId . ' LIMIT 1'
);
expect($employeeRow['deactivated_at'] ?? null)->not->toBeNull();
});
});
it('rejects employee scopes roles raw permissions self edits superusers and shared groups', function (): void {