75 lines
2.5 KiB
PHP
75 lines
2.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
usesApiSuite();
|
|
|
|
it('lets customer booking sessions read their own customer attributes', function (): void {
|
|
api_test_covers('GET /customer/attributes', 'customer-access');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
api_fixtures()->addCustomerAttribute((int)$session['user']['id'], 'onlyTankCleaning');
|
|
|
|
$response = api_client()->get(
|
|
'/customer/attributes?customer_number=' . (int)$session['user']['customer_number'],
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(200)
|
|
->assertEnvelope()
|
|
->assertSuccess();
|
|
|
|
$attributes = array_map(
|
|
static fn(array $attribute): string => (string)($attribute['attribute'] ?? ''),
|
|
is_array($response->data()) ? $response->data() : []
|
|
);
|
|
|
|
expect($attributes)->toContain('onlyTankCleaning');
|
|
expect($response->body)->not->toContain('list_customer_attributes');
|
|
});
|
|
|
|
it('keeps customer attribute reads scoped to the authenticated customer', function (): void {
|
|
api_test_covers('GET /customer/attributes', 'customer-access');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
$otherCustomer = api_fixtures()->createUser(['display_name' => 'Other Attribute Customer']);
|
|
api_fixtures()->addCustomerAttribute((int)$otherCustomer['id'], 'onlyTankCleaning');
|
|
|
|
$response = api_client()->get(
|
|
'/customer/attributes?customer_number=' . (int)$otherCustomer['customer_number'],
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(403)
|
|
->assertEnvelope()
|
|
->assertSuccess(false)
|
|
->assertMissingPermissions(['list_customer_attributes']);
|
|
});
|
|
|
|
it('still lets attribute managers read another customer attributes', function (): void {
|
|
api_test_covers('GET /customer/attributes', 'permissions');
|
|
|
|
$session = api_fixtures()->createUserSession(['list_customer_attributes']);
|
|
$customer = api_fixtures()->createUser(['display_name' => 'Managed Attribute Customer']);
|
|
api_fixtures()->addCustomerAttribute((int)$customer['id'], 'onlyTankCleaning');
|
|
|
|
$response = api_client()->get(
|
|
'/customer/attributes?customer_number=' . (int)$customer['customer_number'],
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(200)
|
|
->assertEnvelope()
|
|
->assertSuccess();
|
|
|
|
$attributes = array_map(
|
|
static fn(array $attribute): string => (string)($attribute['attribute'] ?? ''),
|
|
is_array($response->data()) ? $response->data() : []
|
|
);
|
|
|
|
expect($attributes)->toContain('onlyTankCleaning');
|
|
});
|