e4bc6f1d5c
- POST /register with ?invite query and no prior session passes the gate. - UserSeeder seeds the admin + workspace on an empty DB and skips when a user already exists. - Login page exposes selfHosted prop in both modes (proves the flag the frontend uses to hide the "Sign up" link reaches the client).
84 lines
2.2 KiB
PHP
84 lines
2.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\Str;
|
|
|
|
test('login screen can be rendered', function () {
|
|
$response = $this->get(route('login'));
|
|
|
|
$response->assertOk();
|
|
});
|
|
|
|
test('login page exposes selfHosted as false when SELF_HOSTED is off', function () {
|
|
config()->set('trypost.self_hosted', false);
|
|
|
|
$response = $this->get(route('login'));
|
|
|
|
$response->assertOk();
|
|
$page = $response->original->getData()['page'];
|
|
expect($page['props']['selfHosted'])->toBeFalse();
|
|
});
|
|
|
|
test('login page exposes selfHosted as true when SELF_HOSTED is on', function () {
|
|
config()->set('trypost.self_hosted', true);
|
|
|
|
$response = $this->get(route('login'));
|
|
|
|
$response->assertOk();
|
|
$page = $response->original->getData()['page'];
|
|
expect($page['props']['selfHosted'])->toBeTrue();
|
|
});
|
|
|
|
test('users can authenticate using the login screen', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$response = $this->post(route('login.store'), [
|
|
'email' => $user->email,
|
|
'password' => 'password',
|
|
]);
|
|
|
|
$this->assertAuthenticated();
|
|
$response->assertRedirect(route('app.calendar', absolute: false));
|
|
});
|
|
|
|
test('users can not authenticate with invalid password', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->post(route('login.store'), [
|
|
'email' => $user->email,
|
|
'password' => 'wrong-password',
|
|
]);
|
|
|
|
$this->assertGuest();
|
|
});
|
|
|
|
test('users can logout', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$response = $this->actingAs($user)->post(route('logout'));
|
|
|
|
$this->assertGuest();
|
|
$response->assertRedirect('/');
|
|
});
|
|
|
|
test('users are rate limited', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$throttleKey = Str::transliterate(Str::lower($user->email).'|127.0.0.1');
|
|
|
|
RateLimiter::hit($throttleKey, 60);
|
|
RateLimiter::hit($throttleKey, 60);
|
|
RateLimiter::hit($throttleKey, 60);
|
|
RateLimiter::hit($throttleKey, 60);
|
|
RateLimiter::hit($throttleKey, 60);
|
|
|
|
$response = $this->post(route('login.store'), [
|
|
'email' => $user->email,
|
|
'password' => 'wrong-password',
|
|
]);
|
|
|
|
$response->assertSessionHasErrors('email');
|
|
});
|