fix(User Creation): do not persist the user if invitation fails

[bookstack] / tests / User / UserManagementTest.php

diff --git a/tests/User/UserManagementTest.php b/tests/User/UserManagementTest.php
index f52a78a1353b42b3f44025cbdca9c1c5f6cdcd79..806e35ad4cf9a0751bbaa2587f6f8c93faba24b6 100644 (file)
--- a/tests/User/UserManagementTest.php
+++ b/tests/User/UserManagementTest.php
@@ -3,20 +3,22 @@
 namespace Tests\User;
 
 use BookStack\Actions\ActivityType;
+use BookStack\Auth\Access\UserInviteService;
 use BookStack\Auth\Role;
 use BookStack\Auth\User;
 use BookStack\Entities\Models\Page;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
+use Mockery\MockInterface;
+use RuntimeException;
 use Tests\TestCase;
 
 class UserManagementTest extends TestCase
 {
-
     public function test_user_creation()
     {
         /** @var User $user */
-        $user = factory(User::class)->make();
+        $user = User::factory()->make();
         $adminRole = Role::getRole('admin');
 
         $resp = $this->asAdmin()->get('/settings/users');
@@ -26,10 +28,10 @@ class UserManagementTest extends TestCase
             ->assertElementContains('form[action="' . url('/settings/users/create') . '"]', 'Save');
 
         $resp = $this->post('/settings/users/create', [
-            'name' => $user->name,
-            'email' => $user->email,
-            'password' => $user->password,
-            'password-confirm' => $user->password,
+            'name'                          => $user->name,
+            'email'                         => $user->email,
+            'password'                      => $user->password,
+            'password-confirm'              => $user->password,
             'roles[' . $adminRole->id . ']' => 'true',
         ]);
         $resp->assertRedirect('/settings/users');
@@ -48,12 +50,11 @@ class UserManagementTest extends TestCase
         $user = $this->getNormalUser();
         $password = $user->password;
 
-
         $resp = $this->asAdmin()->get('/settings/users/' . $user->id);
         $resp->assertSee($user->email);
 
         $this->put($user->getEditUrl(), [
-            'name' => 'Barry Scott'
+            'name' => 'Barry Scott',
         ])->assertRedirect('/settings/users');
 
         $this->assertDatabaseHas('users', ['id' => $user->id, 'name' => 'Barry Scott', 'password' => $password]);
@@ -70,13 +71,13 @@ class UserManagementTest extends TestCase
 
         $this->asAdmin()->get($userProfilePage);
         $this->put($userProfilePage, [
-            'password' => 'newpassword'
+            'password' => 'newpassword',
         ])->assertRedirect($userProfilePage);
 
         $this->get($userProfilePage)->assertSee('Password confirmation required');
 
         $this->put($userProfilePage, [
-            'password' => 'newpassword',
+            'password'         => 'newpassword',
             'password-confirm' => 'newpassword',
         ])->assertRedirect('/settings/users');
 
@@ -132,6 +133,21 @@ class UserManagementTest extends TestCase
         $resp->assertSee('new_owner_id');
     }
 
+    public function test_migrate_option_hidden_if_user_cannot_manage_users()
+    {
+        $editor = $this->getEditor();
+
+        $resp = $this->asEditor()->get("settings/users/{$editor->id}/delete");
+        $resp->assertDontSee('Migrate Ownership');
+        $resp->assertDontSee('new_owner_id');
+
+        $this->giveUserPermissions($editor, ['users-manage']);
+
+        $resp = $this->asEditor()->get("settings/users/{$editor->id}/delete");
+        $resp->assertSee('Migrate Ownership');
+        $resp->assertSee('new_owner_id');
+    }
+
     public function test_delete_with_new_owner_id_changes_ownership()
     {
         $page = Page::query()->first();
@@ -161,9 +177,51 @@ class UserManagementTest extends TestCase
         $resp->assertSee('Guest');
         $resp->assertElementContains('form[action$="/settings/users/' . $guestUser->id . '"] button', 'Confirm');
 
-        $resp =  $this->delete('/settings/users/' . $guestUser->id);
+        $resp = $this->delete('/settings/users/' . $guestUser->id);
         $resp->assertRedirect('/settings/users/' . $guestUser->id);
         $resp = $this->followRedirects($resp);
         $resp->assertSee('cannot delete the guest user');
     }
+
+    public function test_user_creation_is_not_performed_if_the_invitation_sending_fails()
+    {
+        /** @var User $user */
+        $user = User::factory()->make();
+        $adminRole = Role::getRole('admin');
+
+        // Simulate an invitation sending failure
+        $this->mock(UserInviteService::class, function (MockInterface $mock) {
+            $mock->shouldReceive('sendInvitation')->once()->andThrow(RuntimeException::class);
+        });
+
+        $this->asAdmin()->post('/settings/users/create', [
+            'name'                          => $user->name,
+            'email'                         => $user->email,
+            'send_invite'                   => 'true',
+            'roles[' . $adminRole->id . ']' => 'true',
+        ]);
+
+        // Since the invitation failed, the user should not exist in the database
+        $this->assertDatabaseMissing('users', $user->only('name', 'email'));
+    }
+
+    public function test_user_create_activity_is_not_persisted_if_the_invitation_sending_fails()
+    {
+        /** @var User $user */
+        $user = User::factory()->make();
+        $adminRole = Role::getRole('admin');
+
+        $this->mock(UserInviteService::class, function (MockInterface $mock) {
+            $mock->shouldReceive('sendInvitation')->once()->andThrow(RuntimeException::class);
+        });
+
+        $this->asAdmin()->post('/settings/users/create', [
+            'name'                          => $user->name,
+            'email'                         => $user->email,
+            'send_invite'                   => 'true',
+            'roles[' . $adminRole->id . ']' => 'true',
+        ]);
+
+        $this->assertDatabaseMissing('activities', ['type' => 'USER_CREATE']);
+    }
 }