Verde-Web/tests/Feature/Api/V1/SuperAdmin/SuperAdminUserTest.php

<?php

namespace Tests\Feature\Api\V1\SuperAdmin;

use App\Models\CityMunicipality;
use App\Models\DriverProfile;
use App\Models\Tenant;
use App\Models\User;
use Database\Seeders\RoleSeeder;
use Database\Seeders\SamplePsgcSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;
use MatanYadaev\EloquentSpatial\Objects\LineString;
use MatanYadaev\EloquentSpatial\Objects\Point;
use MatanYadaev\EloquentSpatial\Objects\Polygon;
use Tests\TestCase;

class SuperAdminUserTest extends TestCase
{
    use RefreshDatabase;

    private User $superAdmin;

    private User $admin;

    private Tenant $tenant;

    protected function setUp(): void
    {
        parent::setUp();
        $this->seed(RoleSeeder::class);
        $this->seed(SamplePsgcSeeder::class);

        $this->superAdmin = User::factory()->create([
            'role' => User::ROLE_SUPER_ADMIN,
            'status' => User::STATUS_ACTIVE,
        ]);
        $this->superAdmin->assignRole(User::ROLE_SUPER_ADMIN);

        $city = CityMunicipality::first();
        $boundary = new Polygon([
            new LineString([
                new Point(13.7915, 121.0118, 4326),
                new Point(13.8015, 121.0118, 4326),
                new Point(13.8015, 121.0218, 4326),
                new Point(13.7915, 121.0218, 4326),
                new Point(13.7915, 121.0118, 4326),
            ]),
        ], 4326);

        $this->tenant = Tenant::create([
            'name' => 'Batangas LGU',
            'short_name' => 'BATANGAS',
            'city_municipality_id' => $city->id,
            'boundary_polygon' => $boundary,
            'contact_email' => 'admin@batangas.gov.ph',
            'contact_phone' => '+639171112233',
            'status' => Tenant::STATUS_ACTIVE,
        ]);

        $this->admin = User::factory()->create([
            'tenant_id' => $this->tenant->id,
            'role' => User::ROLE_ADMIN,
            'status' => User::STATUS_ACTIVE,
        ]);
        $this->admin->assignRole(User::ROLE_ADMIN);
    }

    public function test_guests_cannot_access_super_admin_user_endpoints(): void
    {
        $this->getJson('/api/v1/super-admin/users')->assertStatus(401);
    }

    public function test_lgu_admins_cannot_access_super_admin_user_endpoints(): void
    {
        Sanctum::actingAs($this->admin);
        $this->getJson('/api/v1/super-admin/users')->assertStatus(403);
    }

    public function test_super_admin_can_list_all_users(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $response = $this->getJson('/api/v1/super-admin/users');
        $response->assertStatus(200)
            ->assertJsonFragment(['email' => $this->superAdmin->email])
            ->assertJsonFragment(['email' => $this->admin->email]);
    }

    public function test_super_admin_can_create_driver_with_tenant(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $payload = [
            'first_name' => 'Michael',
            'last_name' => 'Schumacher',
            'email' => 'michael.driver@verde.local',
            'phone' => '+639170001111',
            'role' => User::ROLE_DRIVER,
            'tenant_id' => $this->tenant->id,
            'password' => 'password123',
            'password_confirmation' => 'password123',
        ];

        $response = $this->postJson('/api/v1/super-admin/users', $payload);
        $response->assertCreated();

        $this->assertDatabaseHas('users', [
            'email' => 'michael.driver@verde.local',
            'role' => User::ROLE_DRIVER,
            'tenant_id' => $this->tenant->id,
            'status' => User::STATUS_PENDING,
        ]);

        $user = User::where('email', 'michael.driver@verde.local')->first();
        $this->assertTrue($user->hasRole(User::ROLE_DRIVER));
        $this->assertNotNull($user->driverProfile);
    }

    public function test_super_admin_cannot_create_driver_without_tenant(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $payload = [
            'first_name' => 'No',
            'last_name' => 'Tenant',
            'email' => 'notenant@verde.local',
            'phone' => '+639170002222',
            'role' => User::ROLE_DRIVER,
            'password' => 'password123',
            'password_confirmation' => 'password123',
        ];

        $response = $this->postJson('/api/v1/super-admin/users', $payload);
        $response->assertStatus(422)
            ->assertJsonValidationErrors(['tenant_id']);
    }

    public function test_super_admin_can_create_another_super_admin_without_tenant(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $payload = [
            'first_name' => 'Global',
            'last_name' => 'Boss',
            'email' => 'global.boss@verde.local',
            'phone' => '+639170003333',
            'role' => User::ROLE_SUPER_ADMIN,
            'password' => 'password123',
            'password_confirmation' => 'password123',
        ];

        $response = $this->postJson('/api/v1/super-admin/users', $payload);
        $response->assertCreated();

        $this->assertDatabaseHas('users', [
            'email' => 'global.boss@verde.local',
            'role' => User::ROLE_SUPER_ADMIN,
            'tenant_id' => null,
        ]);
    }

    public function test_super_admin_can_update_user(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $driver = User::factory()->create([
            'tenant_id' => $this->tenant->id,
            'role' => User::ROLE_DRIVER,
            'status' => User::STATUS_PENDING,
        ]);
        $driver->assignRole(User::ROLE_DRIVER);
        DriverProfile::create(['user_id' => $driver->id]);

        $payload = [
            'first_name' => 'UpdatedName',
            'last_name' => $driver->last_name,
            'email' => 'new.email@verde.local',
            'phone' => '+639170005555',
            'role' => User::ROLE_DRIVER,
            'tenant_id' => $this->tenant->id,
        ];

        $response = $this->patchJson("/api/v1/super-admin/users/{$driver->uuid}", $payload);
        $response->assertStatus(200)
            ->assertJsonPath('data.first_name', 'UpdatedName')
            ->assertJsonPath('data.email', 'new.email@verde.local');
    }

    public function test_super_admin_can_delete_other_user(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $user = User::factory()->create([
            'tenant_id' => $this->tenant->id,
            'role' => User::ROLE_HELPER,
        ]);

        $response = $this->deleteJson("/api/v1/super-admin/users/{$user->uuid}");
        $response->assertStatus(200);

        $this->assertSoftDeleted('users', [
            'id' => $user->id,
        ]);
    }

    public function test_super_admin_cannot_delete_themselves(): void
    {
        Sanctum::actingAs($this->superAdmin);

        $response = $this->deleteJson("/api/v1/super-admin/users/{$this->superAdmin->uuid}");
        $response->assertStatus(422)
            ->assertJsonPath('message', 'You cannot delete your own account.');
    }
}