GSB-Construction/tests/Feature/SiteOperationsCrudRestrictionTest.php

<?php

namespace Tests\Feature;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Modules\ContractorManagement\Models\Contractor;
use Modules\Equipments\Models\Equipment;
use Modules\MasterData\Models\Material;
use Spatie\Permission\Models\Role;
use Tests\TestCase;

class SiteOperationsCrudRestrictionTest extends TestCase
{
    use RefreshDatabase;

    protected User $supervisor;
    protected User $siteTech;
    protected Contractor $contractor;
    protected Equipment $equipment;
    protected Material $material;
    protected User $targetUser;

    protected function setUp(): void
    {
        parent::setUp();

        Role::firstOrCreate(['name' => 'Construction Supervisor']);
        Role::firstOrCreate(['name' => 'Site Technical']);

        $permContractors = \Spatie\Permission\Models\Permission::firstOrCreate(['name' => 'contractors.access']);
        $permUsers = \Spatie\Permission\Models\Permission::firstOrCreate(['name' => 'users.access']);
        $permMaterials = \Spatie\Permission\Models\Permission::firstOrCreate(['name' => 'materials.access']);
        $permEquipments = \Spatie\Permission\Models\Permission::firstOrCreate(['name' => 'equipments.access']);

        $this->supervisor = User::factory()->create(['user_type' => 'employee', 'email_verified_at' => now()]);
        $this->supervisor->assignRole('Construction Supervisor');
        $this->supervisor->givePermissionTo([$permContractors, $permUsers, $permMaterials, $permEquipments]);

        $this->siteTech = User::factory()->create(['user_type' => 'employee', 'email_verified_at' => now()]);
        $this->siteTech->assignRole('Site Technical');
        $this->siteTech->givePermissionTo([$permContractors, $permUsers, $permMaterials, $permEquipments]);

        $this->contractor = Contractor::create([
            'company_name' => 'Test Contractor',
            'contact_person' => 'Bob Builder',
            'email' => 'bob@builder.test',
            'status' => 'active',
        ]);

        $this->equipment = Equipment::create([
            'name' => 'Excavator 3000',
            'owner_name' => 'Apex Heavy Equipments',
            'hourly_rate' => 1200.00,
            'status' => 'active',
        ]);

        $this->material = Material::create([
            'name' => 'Portland Cement Type 1',
            'code' => 'MAT-CEM-01',
            'unit' => 'bag',
            'unit_price' => 250.00,
        ]);

        $this->targetUser = User::factory()->create(['user_type' => 'employee']);
    }

    public function test_site_operations_cannot_create_or_mutate_contractors(): void
    {
        foreach ([$this->supervisor, $this->siteTech] as $user) {
            // Store
            $response = $this->actingAs($user)->post(route('contractors.store'), [
                'company_name' => 'Unauthorized Contractor',
                'contact_person' => 'Hacker',
                'email' => 'unauth@test.com',
                'status' => 'active',
            ]);
            $response->assertForbidden();

            // Update
            $response = $this->actingAs($user)->put(route('contractors.update', $this->contractor), [
                'company_name' => 'Modified Name',
                'contact_person' => 'Bob Builder',
                'email' => 'bob@builder.test',
                'status' => 'active',
            ]);
            $response->assertForbidden();

            // Destroy
            $response = $this->actingAs($user)->delete(route('contractors.destroy', $this->contractor));
            $response->assertForbidden();
        }
    }

    public function test_site_operations_cannot_create_or_mutate_users(): void
    {
        foreach ([$this->supervisor, $this->siteTech] as $user) {
            // Store
            $response = $this->actingAs($user)->post(route('users.store'), [
                'name' => 'Unauthorized User',
                'email' => 'unauth.user@test.com',
                'user_type' => 'employee',
                'status' => 'active',
            ]);
            $response->assertForbidden();

            // Update
            $response = $this->actingAs($user)->put(route('users.update', $this->targetUser), [
                'name' => 'Modified User Name',
                'email' => $this->targetUser->email,
                'user_type' => 'employee',
                'status' => 'active',
            ]);
            $response->assertForbidden();

            // Destroy
            $response = $this->actingAs($user)->delete(route('users.destroy', $this->targetUser));
            $response->assertForbidden();
        }
    }

    public function test_site_operations_cannot_create_or_mutate_materials_catalog(): void
    {
        foreach ([$this->supervisor, $this->siteTech] as $user) {
            // Store
            $response = $this->actingAs($user)->post(route('materials-catalog.items.store'), [
                'name' => 'Unauthorized Material',
                'code' => 'MAT-UNAUTH',
                'unit' => 'pcs',
                'unit_price' => 100.00,
            ]);
            $response->assertForbidden();

            // Update
            $response = $this->actingAs($user)->put(route('materials-catalog.items.update', $this->material), [
                'name' => 'Modified Material Name',
                'code' => $this->material->code,
                'unit' => 'bag',
                'unit_price' => 300.00,
            ]);
            $response->assertForbidden();

            // Destroy
            $response = $this->actingAs($user)->delete(route('materials-catalog.items.destroy', $this->material));
            $response->assertForbidden();
        }
    }

    public function test_site_operations_cannot_create_or_mutate_equipments(): void
    {
        foreach ([$this->supervisor, $this->siteTech] as $user) {
            // Store
            $response = $this->actingAs($user)->post(route('equipments.store'), [
                'name' => 'Unauthorized Crane',
                'owner_name' => 'Apex Heavy Equipments',
                'hourly_rate' => 1500.00,
                'status' => 'active',
            ]);
            $response->assertForbidden();

            // Update
            $response = $this->actingAs($user)->put(route('equipments.update', $this->equipment), [
                'name' => 'Modified Crane Name',
                'owner_name' => 'Apex Heavy Equipments',
                'hourly_rate' => 1600.00,
                'status' => 'active',
            ]);
            $response->assertForbidden();

            // Destroy
            $response = $this->actingAs($user)->delete(route('equipments.destroy', $this->equipment));
            $response->assertForbidden();
        }
    }
}