145 lines
4.9 KiB
PHP
145 lines
4.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
usesApiSuite();
|
|
|
|
function order_booking_create_payload(array $customer, array $department, array $product, string $reference): array
|
|
{
|
|
return [
|
|
'customer_number' => (int)$customer['customer_number'],
|
|
'department' => (int)$department['id'],
|
|
'reg_1' => $reference,
|
|
'datetime' => '2026-07-07 10:00:00',
|
|
'note' => '',
|
|
'reference' => $reference,
|
|
'po' => '',
|
|
'pickup' => false,
|
|
'items' => [
|
|
[
|
|
'id' => (int)$product['id'],
|
|
'quantity' => 1,
|
|
],
|
|
],
|
|
];
|
|
}
|
|
|
|
function order_booking_create_department(string $name): array
|
|
{
|
|
$branding = api_fixtures()->createBranding([
|
|
'name' => $name . ' Brand',
|
|
'address' => 'API Booking Street 1',
|
|
]);
|
|
|
|
return api_fixtures()->createDepartment([
|
|
'name' => $name,
|
|
'branding' => (int)$branding['id'],
|
|
]);
|
|
}
|
|
|
|
it('lets customers create their own order bookings without booking permissions', function (): void {
|
|
api_test_covers('POST /order-bookings', 'auth');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
$department = order_booking_create_department('Own Booking Department');
|
|
$product = api_fixtures()->createProduct(['name' => 'Own Booking Product']);
|
|
|
|
$response = api_client()->post(
|
|
'/order-bookings',
|
|
order_booking_create_payload($session['user'], $department, $product, 'OWNBOOK1'),
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(200)
|
|
->assertEnvelope()
|
|
->assertSuccess();
|
|
|
|
$bookingId = (int)($response->data()['id'] ?? 0);
|
|
expect($bookingId)->toBeGreaterThan(0);
|
|
|
|
$row = api_fixtures()->fetchRowById('order_bookings', $bookingId);
|
|
expect($row)->not->toBeNull();
|
|
expect((int)($row['customer_number'] ?? 0))->toBe((int)$session['user']['customer_number']);
|
|
|
|
api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
|
|
});
|
|
|
|
it('lets subusers create own customer order bookings without the bookings add node', function (): void {
|
|
api_test_covers('POST /order-bookings', 'auth');
|
|
|
|
$customer = api_fixtures()->createUser(['display_name' => 'Subuser Booking Customer']);
|
|
$session = api_fixtures()->createSubuserSession((int)$customer['customer_number'], []);
|
|
$department = order_booking_create_department('Subuser Booking Department');
|
|
$product = api_fixtures()->createProduct(['name' => 'Subuser Booking Product']);
|
|
|
|
$response = api_client()->post(
|
|
'/order-bookings',
|
|
order_booking_create_payload($customer, $department, $product, 'SUBBOOK1'),
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(200)
|
|
->assertEnvelope()
|
|
->assertSuccess();
|
|
|
|
$bookingId = (int)($response->data()['id'] ?? 0);
|
|
expect($bookingId)->toBeGreaterThan(0);
|
|
|
|
$row = api_fixtures()->fetchRowById('order_bookings', $bookingId);
|
|
expect($row)->not->toBeNull();
|
|
expect((int)($row['customer_number'] ?? 0))->toBe((int)$customer['customer_number']);
|
|
|
|
api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
|
|
});
|
|
|
|
it('still requires elevated access for creating another customer order booking', function (): void {
|
|
api_test_covers('POST /order-bookings', 'auth');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
$otherCustomer = api_fixtures()->createUser(['display_name' => 'Other Booking Customer']);
|
|
$department = api_fixtures()->createDepartment(['name' => 'Other Booking Department']);
|
|
$product = api_fixtures()->createProduct(['name' => 'Other Booking Product']);
|
|
|
|
$response = api_client()->post(
|
|
'/order-bookings',
|
|
order_booking_create_payload($otherCustomer, $department, $product, 'OTHBOOK1'),
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(403)
|
|
->assertEnvelope()
|
|
->assertSuccess(false)
|
|
->assertMissingPermissions(['add_bookings']);
|
|
});
|
|
|
|
it('lets department-scoped users create order bookings for another customer', function (): void {
|
|
api_test_covers('POST /order-bookings', 'happy');
|
|
|
|
$customer = api_fixtures()->createUser(['display_name' => 'Department Booking Customer']);
|
|
$department = order_booking_create_department('Department Scoped Booking Department');
|
|
$product = api_fixtures()->createProduct(['name' => 'Department Scoped Booking Product']);
|
|
$session = api_fixtures()->createUserSession([
|
|
'add_bookings',
|
|
'department_access_' . $department['id'],
|
|
]);
|
|
|
|
$response = api_client()->post(
|
|
'/order-bookings',
|
|
order_booking_create_payload($customer, $department, $product, 'DEPTBOOK'),
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(200)
|
|
->assertEnvelope()
|
|
->assertSuccess();
|
|
|
|
$bookingId = (int)($response->data()['id'] ?? 0);
|
|
expect($bookingId)->toBeGreaterThan(0);
|
|
|
|
api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
|
|
});
|