new funcionality

2026-07-27 17:20:02 +02:00
parent c2b5291a74
commit c5ce8a7a36
101 changed files with 6889 additions and 176 deletions
--- a/tests/Feature/Admin/UserSessionTest.php
+++ b/tests/Feature/Admin/UserSessionTest.php
@@ -0,0 +1,136 @@
+<?php
+
+namespace Tests\Feature\Admin;
+
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Laravel\Passport\Client;
+use Laravel\Passport\Token;
+use Tests\TestCase;
+
+class UserSessionTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private User $admin;
+    private User $target;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(RolesAndPermissionsSeeder::class);
+
+        $this->admin = User::factory()->approved()->create();
+        $this->admin->assignRole('admin');
+
+        $this->target = User::factory()->approved()->create();
+    }
+
+    public function test_admin_can_list_a_users_active_sessions(): void
+    {
+        $token = $this->createActiveToken($this->target, 'Demo App');
+
+        $response = $this->actingAs($this->admin)->getJson("/web-api/admin/users/{$this->target->id}/sessions");
+
+        $response->assertOk();
+        $response->assertJsonFragment(['id' => $token->id, 'client_name' => 'Demo App']);
+    }
+
+    public function test_revoked_and_expired_tokens_are_not_listed(): void
+    {
+        $this->createActiveToken($this->target, 'Revoked App', ['revoked' => true]);
+        $this->createActiveToken($this->target, 'Expired App', ['expires_at' => now()->subDay()]);
+        $active = $this->createActiveToken($this->target, 'Active App');
+
+        $response = $this->actingAs($this->admin)->getJson("/web-api/admin/users/{$this->target->id}/sessions");
+
+        $response->assertOk()->assertJsonCount(1);
+        $response->assertJsonFragment(['id' => $active->id]);
+    }
+
+    public function test_non_admin_cannot_list_sessions(): void
+    {
+        $user = User::factory()->approved()->create();
+
+        $this->actingAs($user)
+            ->getJson("/web-api/admin/users/{$this->target->id}/sessions")
+            ->assertForbidden();
+    }
+
+    public function test_admin_can_revoke_a_single_session(): void
+    {
+        $token = $this->createActiveToken($this->target);
+
+        $response = $this->actingAs($this->admin)
+            ->deleteJson("/web-api/admin/users/{$this->target->id}/sessions/{$token->id}");
+
+        $response->assertNoContent();
+        $this->assertTrue($token->fresh()->revoked);
+        $this->assertDatabaseHas('audit_logs', [
+            'action' => 'user.session_revoked',
+            'subject_id' => (string) $this->target->id,
+        ]);
+    }
+
+    public function test_revoking_nonexistent_session_returns_404(): void
+    {
+        $this->actingAs($this->admin)
+            ->deleteJson('/web-api/admin/users/'.$this->target->id.'/sessions/'.Str::random(80))
+            ->assertNotFound();
+    }
+
+    public function test_admin_can_revoke_all_sessions(): void
+    {
+        $this->createActiveToken($this->target, 'App One');
+        $this->createActiveToken($this->target, 'App Two');
+
+        $response = $this->actingAs($this->admin)
+            ->deleteJson("/web-api/admin/users/{$this->target->id}/sessions");
+
+        $response->assertNoContent();
+        $this->assertSame(0, Token::where('user_id', $this->target->id)->where('revoked', false)->count());
+        $this->assertDatabaseHas('audit_logs', [
+            'action' => 'user.sessions_revoked_all',
+            'subject_id' => (string) $this->target->id,
+        ]);
+    }
+
+    public function test_non_admin_cannot_revoke_sessions(): void
+    {
+        $user = User::factory()->approved()->create();
+        $token = $this->createActiveToken($this->target);
+
+        $this->actingAs($user)
+            ->deleteJson("/web-api/admin/users/{$this->target->id}/sessions/{$token->id}")
+            ->assertForbidden();
+
+        $this->assertFalse($token->fresh()->revoked);
+    }
+
+    private function createActiveToken(User $user, string $clientName = 'Test Client', array $overrides = []): Token
+    {
+        $client = Client::create([
+            'name' => $clientName,
+            'secret' => null,
+            'provider' => null,
+            'redirect_uris' => [],
+            'grant_types' => ['authorization_code', 'refresh_token'],
+            'revoked' => false,
+        ]);
+
+        return Token::create(array_merge([
+            'id' => Str::random(80),
+            'user_id' => $user->id,
+            'client_id' => $client->id,
+            'name' => null,
+            'scopes' => ['users:read'],
+            'revoked' => false,
+            'created_at' => now(),
+            'updated_at' => now(),
+            'expires_at' => now()->addDays(15),
+        ], $overrides));
+    }
+}