88 lines
3.2 KiB
PHP
88 lines
3.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
usesApiSuite();
|
|
|
|
function wash_certificate_download_legacy_booking(int $customerNumber, int $departmentId, array $attributes = []): array
|
|
{
|
|
return api_fixtures()->createLegacyBooking(array_merge([
|
|
'customer_number' => $customerNumber,
|
|
'department' => $departmentId,
|
|
'washCertificateStatus' => 'pending',
|
|
'status' => 'pending',
|
|
], $attributes));
|
|
}
|
|
|
|
it('lets customer accounts reach their own wash certificate download without the download permission', function (): void {
|
|
api_test_covers('POST /user/bookings/washcertificate/download', 'customer-access');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
$department = api_fixtures()->createDepartment(['name' => 'Wash Certificate Customer Department']);
|
|
$booking = wash_certificate_download_legacy_booking(
|
|
(int)$session['user']['customer_number'],
|
|
(int)$department['id']
|
|
);
|
|
|
|
$response = api_client()->post('/user/bookings/washcertificate/download', [
|
|
'id' => (int)$booking['id'],
|
|
], $session['headers']);
|
|
|
|
$response
|
|
->assertStatus(400)
|
|
->assertEnvelope()
|
|
->assertSuccess(false)
|
|
->assertMessage('Wash certificate has not been issued yet');
|
|
|
|
expect($response->body)->not->toContain('download_own_wash_certificate');
|
|
});
|
|
|
|
it('keeps customer wash certificate downloads scoped to their own bookings', function (): void {
|
|
api_test_covers('POST /user/bookings/washcertificate/download', 'customer-access');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
$otherCustomer = api_fixtures()->createUser(['display_name' => 'Other Wash Certificate Customer']);
|
|
$department = api_fixtures()->createDepartment(['name' => 'Other Wash Certificate Department']);
|
|
$booking = wash_certificate_download_legacy_booking(
|
|
(int)$otherCustomer['customer_number'],
|
|
(int)$department['id']
|
|
);
|
|
|
|
$response = api_client()->post('/user/bookings/washcertificate/download', [
|
|
'id' => (int)$booking['id'],
|
|
], $session['headers']);
|
|
|
|
$response
|
|
->assertStatus(400)
|
|
->assertEnvelope()
|
|
->assertSuccess(false)
|
|
->assertMessage('You are not allowed to download this wash certificate');
|
|
|
|
expect($response->body)->not->toContain('download_own_wash_certificate');
|
|
});
|
|
|
|
it('lets customer accounts reach the legacy wash certificate pdf download gate', function (): void {
|
|
api_test_covers('GET /bookings/download_pdf', 'customer-access');
|
|
|
|
$session = api_fixtures()->createUserSession(['user']);
|
|
$otherCustomer = api_fixtures()->createUser(['display_name' => 'Legacy PDF Other Customer']);
|
|
$department = api_fixtures()->createDepartment(['name' => 'Legacy PDF Department']);
|
|
$booking = wash_certificate_download_legacy_booking(
|
|
(int)$otherCustomer['customer_number'],
|
|
(int)$department['id']
|
|
);
|
|
|
|
$response = api_client()->get(
|
|
'/bookings/download_pdf?id=' . (int)$booking['id'],
|
|
$session['headers']
|
|
);
|
|
|
|
$response
|
|
->assertStatus(400)
|
|
->assertEnvelope()
|
|
->assertSuccess(false)
|
|
->assertMessage('You are not allowed to download this wash certificate');
|
|
|
|
expect($response->body)->not->toContain('download_own_wash_certificate');
|
|
});
|