vignesh/trypost
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test(linkedin-sync): cover same-workspace cross-admin isolation

Browse source 
Adds an explicit test asserting that when a workspace has multiple
LinkedIn users (e.g., the owner plus a client teammate), syncing
tokens from one user's accounts never touches accounts admin'd by a
different LinkedIn user — even though all live in the same workspace.

The behavior is already correct by virtue of the
`admin_user_id` / `platform_user_id` match in the synchronizer's
query, but the property is now part of the test contract instead of
emergent.
This commit is contained in:
Paulo Castellano 2026-05-14 11:04:04 -03:00
parent 49ccfe851e
commit 62e5d6da57
1 changed files with 56 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

56
tests/Feature/Services/Social/LinkedInTokenSynchronizerTest.php
View file

@ -212,3 +212,59 @@
// Should NOT have been synced because it's in a different workspace
expect($pageAccountOtherWorkspace->access_token)->toBe('old-access-token');
});
test('does not sync across different LinkedIn admins inside the same workspace', function () {
// Scenario: multi-user workspace. Owner connects their own LinkedIn
// (personal + page they admin); a teammate later connects their
// company's LinkedIn Page that they admin. Two distinct LinkedIn
// user identities coexist in the same workspace and must NOT share
// tokens — each token belongs to whoever authorized it at LinkedIn.
$ownerLinkedInId = 'linkedin-user-owner';
$clientLinkedInId = 'linkedin-user-client';
$ownerPersonal = SocialAccount::factory()->linkedin()->create([
'workspace_id' => $this->workspace->id,
'platform_user_id' => $ownerLinkedInId,
'access_token' => 'owner-new-access-token',
'refresh_token' => 'owner-new-refresh-token',
'token_expires_at' => now()->addDays(60),
]);
$ownerPage = SocialAccount::factory()->linkedinPage()->create([
'workspace_id' => $this->workspace->id,
'platform_user_id' => 'org-owner',
'access_token' => 'owner-old-access-token',
'refresh_token' => 'owner-old-refresh-token',
'meta' => [
'organization_id' => 'org-owner',
'admin_user_id' => $ownerLinkedInId,
'admin_name' => 'Owner',
],
]);
$clientPage = SocialAccount::factory()->linkedinPage()->create([
'workspace_id' => $this->workspace->id,
'platform_user_id' => 'org-client',
'access_token' => 'client-untouched-access-token',
'refresh_token' => 'client-untouched-refresh-token',
'meta' => [
'organization_id' => 'org-client',
'admin_user_id' => $clientLinkedInId,
'admin_name' => 'Client',
],
]);
$this->synchronizer->syncTokens($ownerPersonal);
// Owner's own page got the new token.
$ownerPage->refresh();
expect($ownerPage->access_token)->toBe('owner-new-access-token');
expect($ownerPage->refresh_token)->toBe('owner-new-refresh-token');
// Client's page (different admin_user_id) was NOT touched even
// though it lives in the same workspace.
$clientPage->refresh();
expect($clientPage->access_token)->toBe('client-untouched-access-token');
expect($clientPage->refresh_token)->toBe('client-untouched-refresh-token');
});