438 lines
15 KiB
PHP
438 lines
15 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\User;
|
|
use App\Models\App;
|
|
use App\Models\Role;
|
|
use App\Models\UserAppOverride;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Tests\TestCase;
|
|
|
|
class SecurityAndAdminTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
/**
|
|
* Test admin role middleware restrictions.
|
|
*/
|
|
public function test_admin_can_access_admin_dashboard_but_not_standard_users(): void
|
|
{
|
|
$admin = User::create([
|
|
'name' => 'Admin User',
|
|
'email' => 'admin@company.com',
|
|
'role' => 'admin',
|
|
]);
|
|
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
// Unauthenticated user is redirected to login
|
|
$this->get('/admin/dashboard')
|
|
->assertRedirect(route('login'));
|
|
|
|
// Admin can access admin dashboard
|
|
$this->actingAs($admin)
|
|
->get('/admin/dashboard')
|
|
->assertStatus(200);
|
|
|
|
// Standard user gets allowed standard user access to dashboard (our middleware handles this)
|
|
$this->actingAs($user)
|
|
->get('/admin/dashboard')
|
|
->assertRedirect(route('dashboard'));
|
|
}
|
|
|
|
/**
|
|
* Test blocked users are forced to logout and redirected.
|
|
*/
|
|
public function test_blocked_user_cannot_access_dashboard_and_gets_logged_out(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
'is_blocked' => true,
|
|
]);
|
|
|
|
// Attempting to access dashboard logs them out and redirects
|
|
$this->actingAs($user)
|
|
->get('/dashboard')
|
|
->assertRedirect(route('login'));
|
|
|
|
$this->assertFalse(auth()->check());
|
|
}
|
|
|
|
/**
|
|
* Test restricted services are hidden from specific users via deny overrides.
|
|
*/
|
|
public function test_restricted_service_is_not_displayed_to_the_restricted_user(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
$app1 = App::create([
|
|
'name' => 'Outlook',
|
|
'url' => 'https://outlook.office.com',
|
|
'color' => '#0078d4',
|
|
'tag' => 'Microsoft 365'
|
|
]);
|
|
|
|
$app2 = App::create([
|
|
'name' => 'Keka HR',
|
|
'url' => 'https://sentientgeeks.keka.com',
|
|
'color' => '#f27059',
|
|
'tag' => 'HR Portal'
|
|
]);
|
|
|
|
// Create a role and associate both apps
|
|
$role = Role::create(['name' => 'Employee']);
|
|
$role->apps()->sync([$app1->id, $app2->id]);
|
|
|
|
// Assign role to user
|
|
$user->roles()->sync([$role->id]);
|
|
|
|
// Restrict user from Keka HR using override
|
|
UserAppOverride::create([
|
|
'user_id' => $user->id,
|
|
'app_id' => $app2->id,
|
|
'type' => 'deny',
|
|
]);
|
|
|
|
$response = $this->actingAs($user)
|
|
->get('/dashboard');
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertSee('Outlook');
|
|
$response->assertDontSee('Keka HR');
|
|
}
|
|
|
|
/**
|
|
* Test additional services are displayed to specific users via allow overrides.
|
|
*/
|
|
public function test_additional_service_is_displayed_to_the_user(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
$app1 = App::create([
|
|
'name' => 'Outlook',
|
|
'url' => 'https://outlook.office.com',
|
|
'color' => '#0078d4',
|
|
'tag' => 'Microsoft 365'
|
|
]);
|
|
|
|
$app2 = App::create([
|
|
'name' => 'Keka HR',
|
|
'url' => 'https://sentientgeeks.keka.com',
|
|
'color' => '#f27059',
|
|
'tag' => 'HR Portal'
|
|
]);
|
|
|
|
// Create a role that only has Outlook
|
|
$role = Role::create(['name' => 'Intern']);
|
|
$role->apps()->sync([$app1->id]);
|
|
|
|
// Assign role to user
|
|
$user->roles()->sync([$role->id]);
|
|
|
|
// Add Keka HR as extra service using override
|
|
UserAppOverride::create([
|
|
'user_id' => $user->id,
|
|
'app_id' => $app2->id,
|
|
'type' => 'allow',
|
|
]);
|
|
|
|
$response = $this->actingAs($user)
|
|
->get('/dashboard');
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertSee('Outlook');
|
|
$response->assertSee('Keka HR');
|
|
}
|
|
|
|
/**
|
|
* Test admin user cannot authenticate via Microsoft OAuth callback.
|
|
*/
|
|
public function test_admin_cannot_authenticate_via_microsoft_oauth_callback(): void
|
|
{
|
|
$admin = User::create([
|
|
'name' => 'Admin User',
|
|
'email' => 'admin@company.com',
|
|
'role' => 'admin',
|
|
'microsoft_id' => 'admin-microsoft-id-999'
|
|
]);
|
|
|
|
$mockSocialite = \Mockery::mock('Laravel\Socialite\Contracts\Provider');
|
|
$mockUser = \Mockery::mock('Laravel\Socialite\Two\User');
|
|
|
|
$mockUser->shouldReceive('getId')->andReturn('admin-microsoft-id-999');
|
|
$mockUser->shouldReceive('getEmail')->andReturn('admin@company.com');
|
|
$mockUser->shouldReceive('getName')->andReturn('Admin User');
|
|
$mockUser->shouldReceive('getAvatar')->andReturn(null);
|
|
|
|
$mockSocialite->shouldReceive('user')->andReturn($mockUser);
|
|
\Laravel\Socialite\Facades\Socialite::shouldReceive('driver')->with('microsoft')->andReturn($mockSocialite);
|
|
|
|
$response = $this->get('/auth/microsoft/callback');
|
|
|
|
$response->assertRedirect(route('admin.login'));
|
|
$response->assertSessionHas('error', 'Security protocol: Administrators are restricted to email and password authentication only.');
|
|
$this->assertFalse(auth()->check());
|
|
}
|
|
|
|
public function test_user_logout_redirects_to_microsoft_logout_page(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
$response = $this->actingAs($user)
|
|
->get('/logout'); // supports GET for testing
|
|
|
|
$tenant = config('services.microsoft.tenant', 'common');
|
|
$expectedRedirect = "https://login.microsoftonline.com/{$tenant}/oauth2/v2.0/logout?" . http_build_query([
|
|
'post_logout_redirect_uri' => route('login'),
|
|
'logout_hint' => 'user@sentientgeeks.com',
|
|
]);
|
|
|
|
$response->assertRedirect($expectedRedirect);
|
|
$this->assertFalse(auth()->check());
|
|
}
|
|
|
|
/**
|
|
* Test Microsoft Front-channel logout callback terminates local session.
|
|
*/
|
|
public function test_microsoft_front_channel_logout_clears_session(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
$this->actingAs($user);
|
|
$this->assertTrue(auth()->check());
|
|
|
|
$response = $this->get('/auth/microsoft/logout');
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertSee('Logged out from SingleLogin');
|
|
$this->assertFalse(auth()->check());
|
|
}
|
|
|
|
/**
|
|
* Test that launching any service (like Keka) routes through Microsoft SSO flow
|
|
* if the user is Microsoft-linked.
|
|
*/
|
|
public function test_sso_launch_redirects_to_microsoft_for_all_services_if_user_is_microsoft_linked(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Standard User',
|
|
'email' => 'user@sentientgeeks.com',
|
|
'role' => 'user',
|
|
'microsoft_id' => 'user-microsoft-id-123',
|
|
]);
|
|
|
|
$app = App::create([
|
|
'name' => 'Keka HR',
|
|
'url' => 'https://sentientgeeks.keka.com',
|
|
'color' => '#f27059',
|
|
'tag' => 'HR Portal'
|
|
]);
|
|
|
|
// Assign role with the app to user
|
|
$role = Role::create(['name' => 'Employee']);
|
|
$role->apps()->sync([$app->id]);
|
|
$user->roles()->sync([$role->id]);
|
|
|
|
$mockSocialite = \Mockery::mock('Laravel\Socialite\Contracts\Provider');
|
|
$mockSocialite->shouldReceive('redirectUrl')->with(route('sso.callback'))->andReturnSelf();
|
|
$mockSocialite->shouldReceive('with')->with([
|
|
'login_hint' => $user->email,
|
|
'domain_hint' => 'organizations',
|
|
'prompt' => 'none'
|
|
])->andReturnSelf();
|
|
$mockSocialite->shouldReceive('redirect')
|
|
->andReturn(redirect('https://login.microsoftonline.com/common/oauth2/v2.0/authorize'));
|
|
|
|
\Laravel\Socialite\Facades\Socialite::shouldReceive('driver')->with('microsoft')->andReturn($mockSocialite);
|
|
|
|
$response = $this->actingAs($user)
|
|
->get(route('sso.launch', $app->id));
|
|
|
|
$response->assertRedirect('https://login.microsoftonline.com/common/oauth2/v2.0/authorize');
|
|
}
|
|
|
|
/**
|
|
* Test user with multiple roles including Admin logs in via general route,
|
|
* sees user dashboard, displays all roles, and has Go to Admin Dashboard target_blank link.
|
|
*/
|
|
public function test_user_multiple_roles_admin_link(): void
|
|
{
|
|
$user = User::create([
|
|
'name' => 'Multi Role User',
|
|
'email' => 'multi@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
$pmRole = Role::create(['name' => 'Project Manager']);
|
|
$adminRole = Role::create(['name' => 'Admin']);
|
|
|
|
$user->roles()->sync([$pmRole->id, $adminRole->id]);
|
|
|
|
// User dashboard can be accessed
|
|
$response = $this->actingAs($user)
|
|
->get('/dashboard');
|
|
|
|
$response->assertStatus(200);
|
|
// At the top they will see other role i.e. admin
|
|
$response->assertSee('Project Manager, Admin');
|
|
// And they will see a link Go to Admin Dashboard which has target="_blank"
|
|
$response->assertSee('href="' . route('admin.dashboard') . '" target="_blank" class="nav-action-btn admin"', false);
|
|
$response->assertSee('Go to Admin Dashboard');
|
|
|
|
// And they can access the Admin Dashboard
|
|
$responseAdmin = $this->actingAs($user)
|
|
->get('/admin/dashboard');
|
|
$responseAdmin->assertStatus(200);
|
|
}
|
|
|
|
/**
|
|
* Test that new user registration / login defaults to the configured role.
|
|
*/
|
|
public function test_new_user_registration_default_role(): void
|
|
{
|
|
// 1. Initially configuration fallback is Developer
|
|
$devRole = Role::create(['name' => 'Developer']);
|
|
$otherRole = Role::create(['name' => 'Team Lead']);
|
|
|
|
// Mock Socialite callback for a brand new user
|
|
$mockSocialite = \Mockery::mock('Laravel\Socialite\Contracts\Provider');
|
|
$mockUser = \Mockery::mock('Laravel\Socialite\Two\User');
|
|
|
|
$mockUser->shouldReceive('getId')->andReturn('new-microsoft-id-888');
|
|
$mockUser->shouldReceive('getEmail')->andReturn('newuser@sentientgeeks.com');
|
|
$mockUser->shouldReceive('getName')->andReturn('New User');
|
|
$mockUser->shouldReceive('getAvatar')->andReturn(null);
|
|
|
|
$mockSocialite->shouldReceive('user')->andReturn($mockUser);
|
|
\Laravel\Socialite\Facades\Socialite::shouldReceive('driver')->with('microsoft')->andReturn($mockSocialite);
|
|
|
|
// Login as new user
|
|
$response = $this->get('/auth/microsoft/callback');
|
|
$response->assertRedirect(route('dashboard'));
|
|
|
|
$newUser = User::where('email', 'newuser@sentientgeeks.com')->first();
|
|
$this->assertNotNull($newUser);
|
|
$this->assertTrue($newUser->hasRole('Developer'));
|
|
$this->assertFalse($newUser->hasRole('Team Lead'));
|
|
}
|
|
|
|
/**
|
|
* Test that new user registration / login defaults to the custom configured role.
|
|
*/
|
|
public function test_new_user_registration_custom_default_role(): void
|
|
{
|
|
$devRole = Role::create(['name' => 'Developer']);
|
|
$otherRole = Role::create(['name' => 'Team Lead']);
|
|
|
|
// Admin updates the configuration
|
|
$admin = User::create([
|
|
'name' => 'Admin User',
|
|
'email' => 'admin@company.com',
|
|
'role' => 'admin',
|
|
]);
|
|
|
|
$this->withoutMiddleware(\Illuminate\Foundation\Http\Middleware\PreventRequestForgery::class);
|
|
|
|
$this->actingAs($admin)
|
|
->post(route('admin.settings.default-role'), [
|
|
'default_role' => 'Team Lead',
|
|
])
|
|
->assertRedirect(route('admin.dashboard'));
|
|
|
|
$this->assertEquals('Team Lead', \App\Models\Setting::get('default_role'));
|
|
|
|
// Mock Socialite callback for second new user
|
|
$mockSocialite2 = \Mockery::mock('Laravel\Socialite\Contracts\Provider');
|
|
$mockUser2 = \Mockery::mock('Laravel\Socialite\Two\User');
|
|
|
|
$mockUser2->shouldReceive('getId')->andReturn('new-microsoft-id-999');
|
|
$mockUser2->shouldReceive('getEmail')->andReturn('anotheruser@sentientgeeks.com');
|
|
$mockUser2->shouldReceive('getName')->andReturn('Another User');
|
|
$mockUser2->shouldReceive('getAvatar')->andReturn(null);
|
|
|
|
$mockSocialite2->shouldReceive('user')->andReturn($mockUser2);
|
|
\Laravel\Socialite\Facades\Socialite::shouldReceive('driver')->with('microsoft')->andReturn($mockSocialite2);
|
|
|
|
// Login as second new user
|
|
$response2 = $this->get('/auth/microsoft/callback');
|
|
$response2->assertRedirect(route('dashboard'));
|
|
|
|
$anotherUser = User::where('email', 'anotheruser@sentientgeeks.com')->first();
|
|
$this->assertNotNull($anotherUser);
|
|
$this->assertTrue($anotherUser->hasRole('Team Lead'));
|
|
$this->assertFalse($anotherUser->hasRole('Developer'));
|
|
}
|
|
|
|
/**
|
|
* Test granting and revoking admin privileges to/from other users.
|
|
*/
|
|
public function test_admin_toggle_privileges(): void
|
|
{
|
|
$admin = User::create([
|
|
'name' => 'Admin User',
|
|
'email' => 'admin@company.com',
|
|
'role' => 'admin',
|
|
]);
|
|
|
|
$targetUser = User::create([
|
|
'name' => 'Regular Dev',
|
|
'email' => 'dev@sentientgeeks.com',
|
|
'role' => 'user',
|
|
]);
|
|
|
|
$this->withoutMiddleware(\Illuminate\Foundation\Http\Middleware\PreventRequestForgery::class);
|
|
|
|
// 1. Grant admin privilege
|
|
$response = $this->actingAs($admin)
|
|
->post(route('admin.users.toggle-admin', $targetUser->id));
|
|
|
|
$response->assertRedirect(route('admin.dashboard'));
|
|
|
|
$targetUser = $targetUser->fresh();
|
|
$this->assertTrue($targetUser->isAdmin());
|
|
$this->assertEquals('admin', $targetUser->role);
|
|
$this->assertTrue($targetUser->hasRole('Admin'));
|
|
|
|
// 2. Revoke admin privilege
|
|
$response2 = $this->actingAs($admin)
|
|
->post(route('admin.users.toggle-admin', $targetUser->id));
|
|
|
|
$response2->assertRedirect(route('admin.dashboard'));
|
|
|
|
$targetUser = $targetUser->fresh();
|
|
$this->assertFalse($targetUser->isAdmin());
|
|
$this->assertEquals('user', $targetUser->role);
|
|
$this->assertFalse($targetUser->hasRole('Admin'));
|
|
|
|
// 3. Security: Prevent toggling self
|
|
$response3 = $this->actingAs($admin)
|
|
->post(route('admin.users.toggle-admin', $admin->id));
|
|
|
|
$response3->assertRedirect(route('admin.dashboard'));
|
|
$this->assertTrue($admin->fresh()->isAdmin());
|
|
}
|
|
}
|