104 lines
3.2 KiB
PHP
104 lines
3.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Tenant;
|
|
|
|
use App\Models\Event;
|
|
use App\Models\EventMember;
|
|
use App\Models\EventPackage;
|
|
use App\Models\MediaStorageTarget;
|
|
use App\Models\Package;
|
|
use App\Models\Photo;
|
|
use App\Models\User;
|
|
use Illuminate\Http\UploadedFile;
|
|
use Illuminate\Support\Facades\Hash;
|
|
|
|
class PhotoUploadSecurityTest extends TenantTestCase
|
|
{
|
|
public function test_photo_upload_uses_safe_extension_from_mime(): void
|
|
{
|
|
$event = Event::factory()->for($this->tenant)->create([
|
|
'slug' => 'secure-photo-upload',
|
|
]);
|
|
MediaStorageTarget::query()->create([
|
|
'key' => 'local',
|
|
'name' => 'Local Storage',
|
|
'driver' => 'local',
|
|
'is_hot' => true,
|
|
'is_default' => true,
|
|
'is_active' => true,
|
|
'priority' => 1,
|
|
]);
|
|
$package = Package::factory()->endcustomer()->create([
|
|
'max_photos' => 500,
|
|
'max_guests' => 100,
|
|
'gallery_days' => 30,
|
|
]);
|
|
EventPackage::query()->create([
|
|
'event_id' => $event->id,
|
|
'package_id' => $package->id,
|
|
'purchased_price' => 0,
|
|
'used_photos' => 0,
|
|
'used_guests' => 0,
|
|
]);
|
|
|
|
$file = UploadedFile::fake()->image('photo.jpeg', 800, 600);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->token,
|
|
'Accept' => 'application/json',
|
|
])->post("/api/v1/tenant/events/{$event->slug}/photos", [
|
|
'photo' => $file,
|
|
]);
|
|
|
|
$response->assertCreated();
|
|
|
|
$photo = Photo::query()->first();
|
|
$this->assertNotNull($photo);
|
|
$this->assertSame('jpg', strtolower(pathinfo((string) $photo->file_path, PATHINFO_EXTENSION)));
|
|
|
|
if (Photo::supportsFilenameColumn()) {
|
|
$this->assertStringEndsWith('.jpg', (string) $photo->filename);
|
|
}
|
|
}
|
|
|
|
public function test_member_without_moderation_permission_cannot_access_moderation_queue(): void
|
|
{
|
|
$event = Event::factory()->for($this->tenant)->create([
|
|
'slug' => 'no-moderation-permission',
|
|
]);
|
|
|
|
$memberUser = User::factory()->create([
|
|
'email' => 'limited.member@example.com',
|
|
'tenant_id' => $this->tenant->id,
|
|
'role' => 'member',
|
|
'password' => Hash::make('secret123'),
|
|
]);
|
|
|
|
EventMember::factory()->create([
|
|
'tenant_id' => $this->tenant->id,
|
|
'event_id' => $event->id,
|
|
'user_id' => $memberUser->id,
|
|
'email' => $memberUser->email,
|
|
'role' => 'member',
|
|
'status' => 'active',
|
|
'permissions' => [],
|
|
]);
|
|
|
|
$login = $this->postJson('/api/v1/tenant-auth/login', [
|
|
'login' => $memberUser->email,
|
|
'password' => 'secret123',
|
|
]);
|
|
|
|
$login->assertOk();
|
|
$token = $login->json('token');
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
'Accept' => 'application/json',
|
|
])->getJson("/api/v1/tenant/events/{$event->slug}/photos/moderation");
|
|
|
|
$response->assertForbidden();
|
|
$response->assertJsonPath('error.code', 'insufficient_permission');
|
|
}
|
|
}
|