Allow customer order booking creation without booking permission

2026-07-06 16:33:31 +02:00
parent f262047476
commit 2ae1fc3fcf
5 changed files with 228 additions and 22 deletions
@@ -0,0 +1,144 @@
+<?php
+
+declare(strict_types=1);
+
+usesApiSuite();
+
+function order_booking_create_payload(array $customer, array $department, array $product, string $reference): array
+{
+    return [
+        'customer_number' => (int)$customer['customer_number'],
+        'department' => (int)$department['id'],
+        'reg_1' => $reference,
+        'datetime' => '2026-07-07 10:00:00',
+        'note' => '',
+        'reference' => $reference,
+        'po' => '',
+        'pickup' => false,
+        'items' => [
+            [
+                'id' => (int)$product['id'],
+                'quantity' => 1,
+            ],
+        ],
+    ];
+}
+
+function order_booking_create_department(string $name): array
+{
+    $branding = api_fixtures()->createBranding([
+        'name' => $name . ' Brand',
+        'address' => 'API Booking Street 1',
+    ]);
+
+    return api_fixtures()->createDepartment([
+        'name' => $name,
+        'branding' => (int)$branding['id'],
+    ]);
+}
+
+it('lets customers create their own order bookings without booking permissions', function (): void {
+    api_test_covers('POST /order-bookings', 'auth');
+
+    $session = api_fixtures()->createUserSession(['user']);
+    $department = order_booking_create_department('Own Booking Department');
+    $product = api_fixtures()->createProduct(['name' => 'Own Booking Product']);
+
+    $response = api_client()->post(
+        '/order-bookings',
+        order_booking_create_payload($session['user'], $department, $product, 'OWNBOOK1'),
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $bookingId = (int)($response->data()['id'] ?? 0);
+    expect($bookingId)->toBeGreaterThan(0);
+
+    $row = api_fixtures()->fetchRowById('order_bookings', $bookingId);
+    expect($row)->not->toBeNull();
+    expect((int)($row['customer_number'] ?? 0))->toBe((int)$session['user']['customer_number']);
+
+    api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
+});
+
+it('lets subusers create own customer order bookings without the bookings add node', function (): void {
+    api_test_covers('POST /order-bookings', 'auth');
+
+    $customer = api_fixtures()->createUser(['display_name' => 'Subuser Booking Customer']);
+    $session = api_fixtures()->createSubuserSession((int)$customer['customer_number'], []);
+    $department = order_booking_create_department('Subuser Booking Department');
+    $product = api_fixtures()->createProduct(['name' => 'Subuser Booking Product']);
+
+    $response = api_client()->post(
+        '/order-bookings',
+        order_booking_create_payload($customer, $department, $product, 'SUBBOOK1'),
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $bookingId = (int)($response->data()['id'] ?? 0);
+    expect($bookingId)->toBeGreaterThan(0);
+
+    $row = api_fixtures()->fetchRowById('order_bookings', $bookingId);
+    expect($row)->not->toBeNull();
+    expect((int)($row['customer_number'] ?? 0))->toBe((int)$customer['customer_number']);
+
+    api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
+});
+
+it('still requires elevated access for creating another customer order booking', function (): void {
+    api_test_covers('POST /order-bookings', 'auth');
+
+    $session = api_fixtures()->createUserSession(['user']);
+    $otherCustomer = api_fixtures()->createUser(['display_name' => 'Other Booking Customer']);
+    $department = api_fixtures()->createDepartment(['name' => 'Other Booking Department']);
+    $product = api_fixtures()->createProduct(['name' => 'Other Booking Product']);
+
+    $response = api_client()->post(
+        '/order-bookings',
+        order_booking_create_payload($otherCustomer, $department, $product, 'OTHBOOK1'),
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(403)
+        ->assertEnvelope()
+        ->assertSuccess(false)
+        ->assertMissingPermissions(['add_bookings']);
+});
+
+it('lets department-scoped users create order bookings for another customer', function (): void {
+    api_test_covers('POST /order-bookings', 'happy');
+
+    $customer = api_fixtures()->createUser(['display_name' => 'Department Booking Customer']);
+    $department = order_booking_create_department('Department Scoped Booking Department');
+    $product = api_fixtures()->createProduct(['name' => 'Department Scoped Booking Product']);
+    $session = api_fixtures()->createUserSession([
+        'add_bookings',
+        'department_access_' . $department['id'],
+    ]);
+
+    $response = api_client()->post(
+        '/order-bookings',
+        order_booking_create_payload($customer, $department, $product, 'DEPTBOOK'),
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $bookingId = (int)($response->data()['id'] ?? 0);
+    expect($bookingId)->toBeGreaterThan(0);
+
+    api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
+});