misc_pterodactyl-panel/tests/Unit/Http/Middleware/API/HasPermissionToResourceTest.php
2017-12-03 14:29:14 -06:00

109 lines
3.9 KiB
PHP

<?php
namespace Tests\Unit\Http\Middleware\API;
use Mockery as m;
use Pterodactyl\Models\User;
use Pterodactyl\Models\APIKey;
use Pterodactyl\Models\APIPermission;
use Tests\Unit\Http\Middleware\MiddlewareTestCase;
use Pterodactyl\Http\Middleware\API\HasPermissionToResource;
use Pterodactyl\Contracts\Repository\ApiKeyRepositoryInterface;
class HasPermissionToResourceTest extends MiddlewareTestCase
{
/**
* @var \Pterodactyl\Contracts\Repository\ApiKeyRepositoryInterface|\Mockery\Mock
*/
private $repository;
/**
* Setup tests.
*/
public function setUp()
{
parent::setUp();
$this->repository = m::mock(ApiKeyRepositoryInterface::class);
}
/**
* Test that a non-admin user cannot access admin level routes.
*
* @expectedException \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
*/
public function testNonAdminAccessingAdminLevel()
{
$model = factory(APIKey::class)->make();
$this->setRequestAttribute('api_key', $model);
$this->setRequestUser(factory(User::class)->make(['root_admin' => false]));
$this->getMiddleware()->handle($this->request, $this->getClosureAssertions());
}
/**
* Test non-admin accessing non-admin route.
*/
public function testAccessingAllowedRoute()
{
$model = factory(APIKey::class)->make();
$model->setRelation('permissions', collect([
factory(APIPermission::class)->make(['permission' => 'user.test-route']),
]));
$this->setRequestAttribute('api_key', $model);
$this->setRequestUser(factory(User::class)->make(['root_admin' => false]));
$this->request->shouldReceive('route->getName')->withNoArgs()->once()->andReturn('api.user.test.route');
$this->repository->shouldReceive('loadPermissions')->with($model)->once()->andReturn($model);
$this->getMiddleware()->handle($this->request, $this->getClosureAssertions(), 'user');
}
/**
* Test admin accessing administrative route.
*/
public function testAccessingAllowedAdminRoute()
{
$model = factory(APIKey::class)->make();
$model->setRelation('permissions', collect([
factory(APIPermission::class)->make(['permission' => 'test-route']),
]));
$this->setRequestAttribute('api_key', $model);
$this->setRequestUser(factory(User::class)->make(['root_admin' => true]));
$this->request->shouldReceive('route->getName')->withNoArgs()->once()->andReturn('api.admin.test.route');
$this->repository->shouldReceive('loadPermissions')->with($model)->once()->andReturn($model);
$this->getMiddleware()->handle($this->request, $this->getClosureAssertions());
}
/**
* Test a user accessing a disallowed route.
*
* @expectedException \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
*/
public function testAccessingDisallowedRoute()
{
$model = factory(APIKey::class)->make();
$model->setRelation('permissions', collect([
factory(APIPermission::class)->make(['permission' => 'user.other-route']),
]));
$this->setRequestAttribute('api_key', $model);
$this->setRequestUser(factory(User::class)->make(['root_admin' => false]));
$this->request->shouldReceive('route->getName')->withNoArgs()->once()->andReturn('api.user.test.route');
$this->repository->shouldReceive('loadPermissions')->with($model)->once()->andReturn($model);
$this->getMiddleware()->handle($this->request, $this->getClosureAssertions(), 'user');
}
/**
* Return an instance of the middleware with mocked dependencies for testing.
*
* @return \Pterodactyl\Http\Middleware\API\HasPermissionToResource
*/
private function getMiddleware(): HasPermissionToResource
{
return new HasPermissionToResource($this->repository);
}
}