rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: add authentication context to TeamPolicyTest

Browse source 
The tests were failing because User::role() depends on Auth::user() and
currentTeam() session being set. Added actingAs() and session setup to
each test to properly authenticate users before checking permissions.

This fixes the 'Attempt to read property "teams" on null' errors.
This commit is contained in:
Andras Bacsai 2025-10-15 15:08:35 +02:00
parent 336fa0c714
commit e88f50912c
1 changed files with 48 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
tests/Feature/TeamPolicyTest.php
View file

@ -21,116 +21,164 @@
describe('update permission', function () { describe('update permission', function () {
test('owner can update team', function () { test('owner can update team', function () {
$this->actingAs($this->owner);
session(['currentTeam' => $this->team]);
expect($this->owner->can('update', $this->team))->toBeTrue(); expect($this->owner->can('update', $this->team))->toBeTrue();
}); });
test('admin can update team', function () { test('admin can update team', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
expect($this->admin->can('update', $this->team))->toBeTrue(); expect($this->admin->can('update', $this->team))->toBeTrue();
}); });
test('member cannot update team', function () { test('member cannot update team', function () {
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
expect($this->member->can('update', $this->team))->toBeFalse(); expect($this->member->can('update', $this->team))->toBeFalse();
}); });
test('non-team member cannot update team', function () { test('non-team member cannot update team', function () {
$outsider = User::factory()->create(); $outsider = User::factory()->create();
$this->actingAs($outsider);
session(['currentTeam' => $this->team]);
expect($outsider->can('update', $this->team))->toBeFalse(); expect($outsider->can('update', $this->team))->toBeFalse();
}); });
}); });
describe('delete permission', function () { describe('delete permission', function () {
test('owner can delete team', function () { test('owner can delete team', function () {
$this->actingAs($this->owner);
session(['currentTeam' => $this->team]);
expect($this->owner->can('delete', $this->team))->toBeTrue(); expect($this->owner->can('delete', $this->team))->toBeTrue();
}); });
test('admin can delete team', function () { test('admin can delete team', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
expect($this->admin->can('delete', $this->team))->toBeTrue(); expect($this->admin->can('delete', $this->team))->toBeTrue();
}); });
test('member cannot delete team', function () { test('member cannot delete team', function () {
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
expect($this->member->can('delete', $this->team))->toBeFalse(); expect($this->member->can('delete', $this->team))->toBeFalse();
}); });
test('non-team member cannot delete team', function () { test('non-team member cannot delete team', function () {
$outsider = User::factory()->create(); $outsider = User::factory()->create();
$this->actingAs($outsider);
session(['currentTeam' => $this->team]);
expect($outsider->can('delete', $this->team))->toBeFalse(); expect($outsider->can('delete', $this->team))->toBeFalse();
}); });
}); });
describe('manageMembers permission', function () { describe('manageMembers permission', function () {
test('owner can manage members', function () { test('owner can manage members', function () {
$this->actingAs($this->owner);
session(['currentTeam' => $this->team]);
expect($this->owner->can('manageMembers', $this->team))->toBeTrue(); expect($this->owner->can('manageMembers', $this->team))->toBeTrue();
}); });
test('admin can manage members', function () { test('admin can manage members', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
expect($this->admin->can('manageMembers', $this->team))->toBeTrue(); expect($this->admin->can('manageMembers', $this->team))->toBeTrue();
}); });
test('member cannot manage members', function () { test('member cannot manage members', function () {
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
expect($this->member->can('manageMembers', $this->team))->toBeFalse(); expect($this->member->can('manageMembers', $this->team))->toBeFalse();
}); });
test('non-team member cannot manage members', function () { test('non-team member cannot manage members', function () {
$outsider = User::factory()->create(); $outsider = User::factory()->create();
$this->actingAs($outsider);
session(['currentTeam' => $this->team]);
expect($outsider->can('manageMembers', $this->team))->toBeFalse(); expect($outsider->can('manageMembers', $this->team))->toBeFalse();
}); });
}); });
describe('viewAdmin permission', function () { describe('viewAdmin permission', function () {
test('owner can view admin panel', function () { test('owner can view admin panel', function () {
$this->actingAs($this->owner);
session(['currentTeam' => $this->team]);
expect($this->owner->can('viewAdmin', $this->team))->toBeTrue(); expect($this->owner->can('viewAdmin', $this->team))->toBeTrue();
}); });
test('admin can view admin panel', function () { test('admin can view admin panel', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
expect($this->admin->can('viewAdmin', $this->team))->toBeTrue(); expect($this->admin->can('viewAdmin', $this->team))->toBeTrue();
}); });
test('member cannot view admin panel', function () { test('member cannot view admin panel', function () {
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
expect($this->member->can('viewAdmin', $this->team))->toBeFalse(); expect($this->member->can('viewAdmin', $this->team))->toBeFalse();
}); });
test('non-team member cannot view admin panel', function () { test('non-team member cannot view admin panel', function () {
$outsider = User::factory()->create(); $outsider = User::factory()->create();
$this->actingAs($outsider);
session(['currentTeam' => $this->team]);
expect($outsider->can('viewAdmin', $this->team))->toBeFalse(); expect($outsider->can('viewAdmin', $this->team))->toBeFalse();
}); });
}); });
describe('manageInvitations permission (privilege escalation fix)', function () { describe('manageInvitations permission (privilege escalation fix)', function () {
test('owner can manage invitations', function () { test('owner can manage invitations', function () {
$this->actingAs($this->owner);
session(['currentTeam' => $this->team]);
expect($this->owner->can('manageInvitations', $this->team))->toBeTrue(); expect($this->owner->can('manageInvitations', $this->team))->toBeTrue();
}); });
test('admin can manage invitations', function () { test('admin can manage invitations', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
expect($this->admin->can('manageInvitations', $this->team))->toBeTrue(); expect($this->admin->can('manageInvitations', $this->team))->toBeTrue();
}); });
test('member cannot manage invitations (SECURITY FIX)', function () { test('member cannot manage invitations (SECURITY FIX)', function () {
// This test verifies the privilege escalation vulnerability is fixed // This test verifies the privilege escalation vulnerability is fixed
// Previously, members could see and manage admin invitations // Previously, members could see and manage admin invitations
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
expect($this->member->can('manageInvitations', $this->team))->toBeFalse(); expect($this->member->can('manageInvitations', $this->team))->toBeFalse();
}); });
test('non-team member cannot manage invitations', function () { test('non-team member cannot manage invitations', function () {
$outsider = User::factory()->create(); $outsider = User::factory()->create();
$this->actingAs($outsider);
session(['currentTeam' => $this->team]);
expect($outsider->can('manageInvitations', $this->team))->toBeFalse(); expect($outsider->can('manageInvitations', $this->team))->toBeFalse();
}); });
}); });
describe('view permission', function () { describe('view permission', function () {
test('owner can view team', function () { test('owner can view team', function () {
$this->actingAs($this->owner);
session(['currentTeam' => $this->team]);
expect($this->owner->can('view', $this->team))->toBeTrue(); expect($this->owner->can('view', $this->team))->toBeTrue();
}); });
test('admin can view team', function () { test('admin can view team', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
expect($this->admin->can('view', $this->team))->toBeTrue(); expect($this->admin->can('view', $this->team))->toBeTrue();
}); });
test('member can view team', function () { test('member can view team', function () {
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
expect($this->member->can('view', $this->team))->toBeTrue(); expect($this->member->can('view', $this->team))->toBeTrue();
}); });
test('non-team member cannot view team', function () { test('non-team member cannot view team', function () {
$outsider = User::factory()->create(); $outsider = User::factory()->create();
$this->actingAs($outsider);
session(['currentTeam' => $this->team]);
expect($outsider->can('view', $this->team))->toBeFalse(); expect($outsider->can('view', $this->team))->toBeFalse();
}); });
}); });