landing-api/tests/Feature/Panel/UserSessionsTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature\Panel;

use App\Filament\Resources\Users\Pages\EditUser;
use App\Filament\Resources\Users\RelationManagers\SessionsRelationManager;
use App\Models\User;
use App\Models\UserSession;
use Database\Seeders\RolePermissionSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Str;
use Livewire\Livewire;
use PHPUnit\Framework\Attributes\Test;
use Tests\FakesPireon;
use Tests\TestCase;

/**
 * Where an account is signed in from, read straight from the table Laravel's
 * own database session driver already writes to.
 *
 * Deactivating somebody here has always cut them off on their *next*
 * request; what was missing was any way to see a session already in
 * progress, or end one before that next request happened on its own. Nothing
 * here writes to `sessions` except the revoke action deleting a row — the
 * table itself is entirely Laravel's.
 */
class UserSessionsTest extends TestCase
{
    use FakesPireon, RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();

        $this->seed(RolePermissionSeeder::class);
    }

    protected function plantSession(User $user, array $attributes = []): UserSession
    {
        return UserSession::create(array_merge([
            'id' => Str::random(40),
            'user_id' => $user->id,
            'ip_address' => '203.0.113.10',
            'user_agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/605.1.15',
            'payload' => base64_encode(serialize([])),
            'last_activity' => now()->subMinutes(5)->timestamp,
        ], $attributes));
    }

    #[Test]
    public function an_admin_sees_the_accounts_open_sessions(): void
    {
        $target = $this->userWithRoles('editor');
        $this->plantSession($target);

        $this->actingAs($this->userWithRoles('admin'));

        Livewire::test(SessionsRelationManager::class, [
            'ownerRecord' => $target,
            'pageClass' => EditUser::class,
        ])
            ->assertSee('203.0.113.10')
            ->assertSee('Safari · macOS');
    }

    #[Test]
    public function revoking_a_session_deletes_the_row(): void
    {
        $target = $this->userWithRoles('editor');
        $session = $this->plantSession($target);

        $this->actingAs($this->userWithRoles('admin'));

        Livewire::test(SessionsRelationManager::class, [
            'ownerRecord' => $target,
            'pageClass' => EditUser::class,
        ])->callTableAction('revoke', $session);

        $this->assertDatabaseMissing('sessions', ['id' => $session->id]);
    }

    /**
     * The one row this screen must never offer to end: doing so would sign
     * out whoever is looking at it, mid-click.
     */
    #[Test]
    public function the_viewers_own_current_session_cannot_be_revoked_from_here(): void
    {
        $admin = $this->userWithRoles('admin');
        $this->actingAs($admin);

        // Force a request so Laravel actually starts a session and this test
        // knows the real session id, then plant a row using that same id —
        // exactly what the real session driver would have written.
        $this->get(EditUser::getUrl(['record' => $admin]));
        $currentId = session()->getId();

        $currentSession = $this->plantSession($admin, ['id' => $currentId]);
        $other = $this->plantSession($admin);

        $manager = Livewire::test(SessionsRelationManager::class, [
            'ownerRecord' => $admin,
            'pageClass' => EditUser::class,
        ]);

        $manager->assertTableActionHidden('revoke', $currentSession);
        $manager->assertTableActionVisible('revoke', $other);
    }

    #[Test]
    public function somebody_without_users_update_cannot_see_the_tab(): void
    {
        $target = $this->userWithRoles('editor');

        $this->actingAs($this->userWithRoles('viewer'));

        $this->assertFalse(SessionsRelationManager::canViewForRecord($target, EditUser::class));
    }

    #[Test]
    public function a_device_with_no_recognisable_browser_or_platform_says_so(): void
    {
        $target = $this->userWithRoles('editor');
        $this->plantSession($target, ['user_agent' => 'curl/8.4.0']);

        $this->actingAs($this->userWithRoles('admin'));

        Livewire::test(SessionsRelationManager::class, [
            'ownerRecord' => $target,
            'pageClass' => EditUser::class,
        ])->assertSee(__('panel.sessions.unknown_device'));
    }
}