Allow customers to read own attributes

2026-07-07 13:05:24 +02:00
parent 08ac16e665
commit bf1d6a583e
3 changed files with 115 additions and 10 deletions
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+usesApiSuite();
+
+it('lets customer booking sessions read their own customer attributes', function (): void {
+    api_test_covers('GET /customer/attributes', 'customer-access');
+
+    $session = api_fixtures()->createUserSession(['user']);
+    api_fixtures()->addCustomerAttribute((int)$session['user']['id'], 'onlyTankCleaning');
+
+    $response = api_client()->get(
+        '/customer/attributes?customer_number=' . (int)$session['user']['customer_number'],
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $attributes = array_map(
+        static fn(array $attribute): string => (string)($attribute['attribute'] ?? ''),
+        is_array($response->data()) ? $response->data() : []
+    );
+
+    expect($attributes)->toContain('onlyTankCleaning');
+    expect($response->body)->not->toContain('list_customer_attributes');
+});
+
+it('keeps customer attribute reads scoped to the authenticated customer', function (): void {
+    api_test_covers('GET /customer/attributes', 'customer-access');
+
+    $session = api_fixtures()->createUserSession(['user']);
+    $otherCustomer = api_fixtures()->createUser(['display_name' => 'Other Attribute Customer']);
+    api_fixtures()->addCustomerAttribute((int)$otherCustomer['id'], 'onlyTankCleaning');
+
+    $response = api_client()->get(
+        '/customer/attributes?customer_number=' . (int)$otherCustomer['customer_number'],
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(403)
+        ->assertEnvelope()
+        ->assertSuccess(false)
+        ->assertMissingPermissions(['list_customer_attributes']);
+});
+
+it('still lets attribute managers read another customer attributes', function (): void {
+    api_test_covers('GET /customer/attributes', 'permissions');
+
+    $session = api_fixtures()->createUserSession(['list_customer_attributes']);
+    $customer = api_fixtures()->createUser(['display_name' => 'Managed Attribute Customer']);
+    api_fixtures()->addCustomerAttribute((int)$customer['id'], 'onlyTankCleaning');
+
+    $response = api_client()->get(
+        '/customer/attributes?customer_number=' . (int)$customer['customer_number'],
+        $session['headers']
+    );
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $attributes = array_map(
+        static fn(array $attribute): string => (string)($attribute['attribute'] ?? ''),
+        is_array($response->data()) ? $response->data() : []
+    );
+
+    expect($attributes)->toContain('onlyTankCleaning');
+});