trypost/tests/Unit/Events/OnboardingStatusUpdatedTest.php
Paulo Castellano a1fa897106
Activation checklist + MCP OAuth authorize UX (#239) (#250)
* Wire onboarding activation into Account, observers, and shared Inertia data

Add onboarding casts/hasFinishedOnboarding, AccessToken ObservedBy,
Platform::connectableOptions, Post/SocialAccount onboarding broadcast hooks,
and lazy onboardingResidual share + SharedData types.

* Register onboarding routes and post-checkout activation redirects.

Wire billing processing and the sidebar checklist so owners land on
activation after subscribe, with locale sidebar/uk onboarding strings.

* Align MCP grant usability with onboarding activation checks

Unbound MCP tokens fall back to the user's current workspace and require
createPost so viewer/unscoped grants neither unlock the checklist nor
broadcast onboarding status.

* Require bound MCP workspace for onboarding activation.

Drop current-workspace fallback from usable MCP grants so checklist
detection and broadcasts match Passport token scoping; viewers still
cannot unlock the MCP step.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Harden onboarding review findings and tighten locale strings.

Fix Welcome/Persona/TrackPost suites broken by the activation route reuse
and PostObserver analytics side effects, restore Echo poll fallbacks,
reject unbound MCP grants in tests, and drop unused onboarding.mcp keys.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Remove unused sidebar and MCP authorization locale keys.

Drop dead sidebar menu/theme strings (including the overwritten
workspace label and api_keys nav entry) and unused MCP authorize
app_title/approving copy across all locales.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix SetLocale crashing on Passport Symfony OAuth responses.

OAuth errors return a raw Symfony Response without withCookie(); attach
the default locale cookie via headers so authorize no longer 500s.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Prompt OAuth guests to log in before rejecting unknown clients.

MCP Inspector often reuses a stale client_id; validateAuthorizationRequest
was returning invalid_client JSON before the login redirect. Guests now
hit /login first, then client validation runs after authentication.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Render Inertia OAuth authorize errors for browser logins.

After login, Inertia follows the intended authorize URL; raw invalid_client
JSON broke that visit. HTML/Inertia requests now get mcp/AuthorizeError
while API JSON clients still receive the OAuth error payload.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Detect Inertia OAuth error pages via Request::inertia().

Use the framework helper so post-login authorize failures keep returning
an Inertia page instead of raw OAuth JSON.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify OAuth authorize error page detection to expectsJson.

Drop the X-Inertia header sniff; browser and Inertia visits already do
not expectsJson, while API clients still receive the OAuth JSON payload.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Share MCP authorize layout and drop the error close button.

Keep authorize and authorize-error on the same centered card shell instead of the auth split layout.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify onboarding activation for reviewability and safety.

Use an exists-based MCP check, keep GETs read-only, move sync into
syncAndNotify, clear MCP skips on connect, restrict complete to owners,
and share Echo/poll via one composable.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Move MCP OAuth authorize UX out of the onboarding PR.

Keep the activation checklist focused; OAuth guest/error-page work now
lives on fix/mcp-oauth-authorize-ux.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix corrupted French MCP locale after OAuth key cleanup.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Restore MCP OAuth authorize UX onto the onboarding branch.

Keep authorize error page, guest login-before-client validation, and
SetLocale Symfony cookie fix in #250.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix OAuth prompt=none redirects and harden onboarding tests.

Keep login_required/consent_required as redirects instead of Inertia,
add regression coverage for owner-only activation, require invite email
confirmation, and align MCP connected apps with the sessions list UI.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify onboarding guards and dedupe viewed analytics.

Introduce isOnboardingOpen / belongsToAccount helpers, collapse
duplicated sync/dispatch paths, and capture onboarding.viewed once
per account.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify onboarding event, observers, and status helpers.

Tighten Account onboarding predicates, drop nullable broadcast/dispatch
APIs, and collapse repeated observer/controller guards.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Treat in-app users as always having an account.

Add resolveAccount(), tighten belongsToAccount to string ids, and fold
guest residual handling into ResolveOnboardingStatus.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Rename onboarding residual share test to progress.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify onboarding status and rename residual to progress.

Use accountOrFail, extract MCP onboarding scope, auto-leave the ready
screen, and send non-onboarding checkout back to accounts.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Extract HasAccount and prefer data_get in onboarding flows.

Move account helpers off User, drop nullable sidebarProgress, and
read OAuth/onboarding payloads with data_get.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify onboarding checks and extract HasOnboarding.

Use Eloquent + policies for MCP/backfill paths, and move account
onboarding helpers into a dedicated trait.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add trait tests and tidy onboarding imports.

Cover HasAccount and HasOnboarding under Models/Traits, prefer filled() for checkout session ids, and import Throwable instead of FQCN.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify checkout session_id and OAuth error props.

Read session_id via request->string(), and take OAuth error details from the League exception instead of decoding the response body.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify PostObserver onboarding notify path.

Share one otherPosts check for first-create and last-delete instead of separate callbacks.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Use post author as onboarding sync actor.

Drop Auth::user() preference in PostObserver; checklist sync attributes to $post->user.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify SocialAccountObserver and OAuth authorize flow.

Share create/delete onboarding notify, drop Auth actor fallback to owner, and inline Passport Inertia error handling.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Use lazy Inertia props for onboarding partial reloads.

Drop partial-header branching; wrap page props in closures and always redirect completed/dismissed accounts to the calendar.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Defer sidebar onboarding progress and stamp completion as owner-only.

Skip the MCP checklist work on full Inertia visits via deferred shared props,
early-exit token scans, and keep account completion stamps owner-gated.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify deferred onboarding progress share via canShowProgress.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add User firstName for shared auth and simplify onboarding page.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Move User firstName coverage into UserTest.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Use first_name directly without empty-name fallbacks.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Resolve onboarding sample prompt on the frontend via i18n.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Stamp onboarding completion via the account owner after teammate unlocks.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Count only the account owner MCP grant toward onboarding activation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix OAuth consent auth-token mismatch for mid-activation owners.

Skip deferred onboardingProgress on Passport authorize so Inertia does not
rotate the session authToken, cover happy and stale-token paths in tests,
and polish MCP setup copy plus sidebar/onboarding layout.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Keep users on onboarding after activation completes.

Stamp completion and re-render the finished checklist instead of
redirecting to the calendar so owners can review the done state.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Clarify Passport consent-view opt-out and guard app-route deferral.

Rename the authorize-only route check and assert onboardingProgress still
defers on calendar, onboarding, and MCP settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Harden onboarding completion and MCP consent workspace binding.

Reject OAuth approve without a workspace, retry auto-complete until
stamped, send dismissed complete straight to calendar, and cover the
device consent defer opt-out.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Enable activation checklist for self-hosted installs.

Remove the self-hosted onboarding redirects, keep the SaaS-only dismiss backfill, and cover subscription-less owners plus skip/complete destinations.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add GitHub, Hacker News, and directories referral sources.

Expand the welcome referral step with open-source and directory discovery channels.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Refine welcome referral sources and labels.

Split Instagram/Threads, add Founder, and shorten Google, GitHub, AI, and blog option labels.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Sort accounts platforms alphabetically and drop connect hover plus.

Reuse connectableOptions for the accounts index and remove the unused plus badge on disconnected cards.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Centralize PostHog once-capture so disabled installs don't burn dedupe keys.

Move isEnabled + Cache::add into PostHogService::captureOnce and route onboarding viewed/step events through it.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify onboarding backfill to complete every existing open account.

Drop self-hosted and subscription filters; down clears completed_at again.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Drop PostHog captureOnce and use plain capture for onboarding.

Remove cache-based event dedupe; callers rely on PostHogService::capture gating.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-07 20:34:43 -03:00

259 lines
9.4 KiB
PHP

<?php
declare(strict_types=1);
use App\Events\OnboardingStatusUpdated;
use App\Models\AccessToken;
use App\Models\Post;
use App\Models\SocialAccount;
use App\Models\User;
use App\Models\Workspace;
use Illuminate\Broadcasting\PrivateChannel;
use Illuminate\Contracts\Events\ShouldDispatchAfterCommit;
use Illuminate\Support\Carbon;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Event;
test('event broadcasts on the workspace channel', function () {
$workspaceId = fake()->uuid();
$event = new OnboardingStatusUpdated($workspaceId);
$channels = $event->broadcastOn();
expect($channels)->toHaveCount(1)
->and($channels[0])->toBeInstanceOf(PrivateChannel::class)
->and($channels[0]->name)->toBe("private-workspace.{$workspaceId}");
});
test('event broadcasts with the workspace id', function () {
$workspaceId = fake()->uuid();
$event = new OnboardingStatusUpdated($workspaceId);
expect($event->broadcastWith())->toBe(['workspace_id' => $workspaceId]);
});
test('event broadcasts as a stable name', function () {
$event = new OnboardingStatusUpdated(fake()->uuid());
expect($event->broadcastAs())->toBe('onboarding.status.updated');
});
test('event waits for the database transaction to commit', function () {
expect(new OnboardingStatusUpdated(fake()->uuid()))
->toBeInstanceOf(ShouldDispatchAfterCommit::class);
});
test('dispatchForWorkspace skips blank workspace ids', function () {
Event::fake([OnboardingStatusUpdated::class]);
OnboardingStatusUpdated::dispatchForWorkspace(null);
OnboardingStatusUpdated::dispatchForWorkspace('');
Event::assertNotDispatched(OnboardingStatusUpdated::class);
});
test('broadcastForAccount notifies every workspace even after completion', function () {
Event::fake([OnboardingStatusUpdated::class]);
$user = User::factory()->create();
$workspaceA = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$workspaceB = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$user->account->forceFill(['onboarding_completed_at' => now()])->save();
OnboardingStatusUpdated::broadcastForAccount($user->account->fresh());
Event::assertDispatchedTimes(OnboardingStatusUpdated::class, 2);
Event::assertDispatched(
OnboardingStatusUpdated::class,
fn (OnboardingStatusUpdated $event): bool => $event->workspaceId === $workspaceA->id,
);
Event::assertDispatched(
OnboardingStatusUpdated::class,
fn (OnboardingStatusUpdated $event): bool => $event->workspaceId === $workspaceB->id,
);
});
test('dispatchForWorkspace fans out Echo to sibling workspaces while onboarding is open', function () {
Event::fake([OnboardingStatusUpdated::class]);
config(['trypost.self_hosted' => false]);
$user = User::factory()->create();
$workspaceA = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$workspaceB = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$user->update(['current_workspace_id' => $workspaceA->id]);
subscribeAccount($user->account);
OnboardingStatusUpdated::dispatchForWorkspace($workspaceA->id, $user->fresh());
Event::assertDispatched(
OnboardingStatusUpdated::class,
fn (OnboardingStatusUpdated $event): bool => $event->workspaceId === $workspaceA->id,
);
Event::assertDispatched(
OnboardingStatusUpdated::class,
fn (OnboardingStatusUpdated $event): bool => $event->workspaceId === $workspaceB->id,
);
});
test('dispatchForWorkspace does not stamp when the surrounding transaction rolls back', function () {
Carbon::setTestNow('2026-07-29 12:00:00');
config(['trypost.self_hosted' => false]);
$user = User::factory()->create();
$workspace = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$user->update(['current_workspace_id' => $workspace->id]);
subscribeAccount($user->account);
AccessToken::withoutEvents(fn () => mcpAccessToken($user, mcpOauthClient(), $workspace));
SocialAccount::withoutEvents(fn () => SocialAccount::factory()->create([
'workspace_id' => $workspace->id,
]));
Post::withoutEvents(fn () => Post::factory()->create([
'workspace_id' => $workspace->id,
'user_id' => $user->id,
]));
try {
DB::transaction(function () use ($user, $workspace): void {
OnboardingStatusUpdated::dispatchForWorkspace($workspace->id, $user->fresh());
throw new RuntimeException('force rollback');
});
} catch (RuntimeException) {
// Expected — sync/analytics must stay inside afterCommit.
}
expect($user->account->fresh()->onboarding_completed_at)->toBeNull();
});
test('dispatchForWorkspace stamps completion when actor current workspace differs', function () {
Carbon::setTestNow('2026-07-29 12:00:00');
config(['trypost.self_hosted' => false]);
$user = User::factory()->create();
$readyWorkspace = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$otherWorkspace = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
// Persisted current workspace is elsewhere (API/MCP in-memory mutation case).
$user->update(['current_workspace_id' => $otherWorkspace->id]);
subscribeAccount($user->account);
AccessToken::withoutEvents(fn () => mcpAccessToken($user, mcpOauthClient(), $readyWorkspace));
SocialAccount::withoutEvents(fn () => SocialAccount::factory()->create([
'workspace_id' => $readyWorkspace->id,
]));
Post::withoutEvents(fn () => Post::factory()->create([
'workspace_id' => $readyWorkspace->id,
'user_id' => $user->id,
]));
// Align the request user to the ready workspace in memory only.
$actor = $user->fresh();
$actor->setRelation('currentWorkspace', $readyWorkspace);
$actor->current_workspace_id = $readyWorkspace->id;
OnboardingStatusUpdated::dispatchForWorkspace($readyWorkspace->id, $actor);
expect($user->account->fresh()->onboarding_completed_at?->equalTo(now()))->toBeTrue();
});
test('dispatchForWorkspace stamps when nobody is currently on the workspace', function () {
Carbon::setTestNow('2026-07-29 12:00:00');
config(['trypost.self_hosted' => false]);
$owner = User::factory()->create(['current_workspace_id' => null]);
$readyWorkspace = Workspace::factory()->create([
'account_id' => $owner->account_id,
'user_id' => $owner->id,
]);
subscribeAccount($owner->account);
$owner->account->forceFill(['onboarding_skipped_steps' => ['mcp']])->save();
SocialAccount::withoutEvents(fn () => SocialAccount::factory()->create([
'workspace_id' => $readyWorkspace->id,
]));
Post::withoutEvents(fn () => Post::factory()->create([
'workspace_id' => $readyWorkspace->id,
'user_id' => $owner->id,
]));
$actor = $owner->fresh();
$actor->setRelation('currentWorkspace', $readyWorkspace);
$actor->current_workspace_id = $readyWorkspace->id;
OnboardingStatusUpdated::dispatchForWorkspace($readyWorkspace->id, $actor);
expect($owner->account->fresh()->onboarding_completed_at?->equalTo(now()))->toBeTrue();
});
test('dispatchForWorkspace stamps completion via the account owner when the actor is null', function () {
Carbon::setTestNow('2026-07-29 12:00:00');
config(['trypost.self_hosted' => false]);
$owner = User::factory()->create(['current_workspace_id' => null]);
$readyWorkspace = Workspace::factory()->create([
'account_id' => $owner->account_id,
'user_id' => $owner->id,
]);
subscribeAccount($owner->account);
$owner->account->forceFill(['onboarding_skipped_steps' => ['mcp']])->save();
SocialAccount::withoutEvents(fn () => SocialAccount::factory()->create([
'workspace_id' => $readyWorkspace->id,
]));
Post::withoutEvents(fn () => Post::factory()->create([
'workspace_id' => $readyWorkspace->id,
'user_id' => $owner->id,
]));
// Webhook-style dispatch (e.g. Telegram connect): no authenticated actor.
OnboardingStatusUpdated::dispatchForWorkspace($readyWorkspace->id);
expect($owner->account->fresh()->onboarding_completed_at?->equalTo(now()))->toBeTrue();
});
test('completion broadcasts exactly once per workspace', function () {
Event::fake([OnboardingStatusUpdated::class]);
config(['trypost.self_hosted' => false]);
$user = User::factory()->create();
$workspace = Workspace::factory()->create([
'account_id' => $user->account_id,
'user_id' => $user->id,
]);
$user->update(['current_workspace_id' => $workspace->id]);
subscribeAccount($user->account);
AccessToken::withoutEvents(fn () => mcpAccessToken($user, mcpOauthClient(), $workspace));
SocialAccount::withoutEvents(fn () => SocialAccount::factory()->create([
'workspace_id' => $workspace->id,
]));
Post::withoutEvents(fn () => Post::factory()->create([
'workspace_id' => $workspace->id,
'user_id' => $user->id,
]));
OnboardingStatusUpdated::dispatchForWorkspace($workspace->id, $user->fresh());
Event::assertDispatchedTimes(OnboardingStatusUpdated::class, 1);
});