BookStack Code Mirror - bookstack/blob - tests/User/UserManagementTest.php

   1 <?php
   2
   3 namespace Tests\User;
   4
   5 use BookStack\Actions\ActivityType;
   6 use BookStack\Auth\Access\UserInviteService;
   7 use BookStack\Auth\Role;
   8 use BookStack\Auth\User;
   9 use BookStack\Entities\Models\Page;
  10 use Illuminate\Support\Facades\Hash;
  11 use Illuminate\Support\Str;
  12 use Mockery\MockInterface;
  13 use RuntimeException;
  14 use Tests\TestCase;
  15
  16 class UserManagementTest extends TestCase
  17 {
  18     public function test_user_creation()
  19     {
  20         /** @var User $user */
  21         $user = User::factory()->make();
  22         $adminRole = Role::getRole('admin');
  23
  24         $resp = $this->asAdmin()->get('/settings/users');
  25         $this->withHtml($resp)->assertElementContains('a[href="' . url('/settings/users/create') . '"]', 'Add New User');
  26
  27         $resp = $this->get('/settings/users/create');
  28         $this->withHtml($resp)->assertElementContains('form[action="' . url('/settings/users/create') . '"]', 'Save');
  29
  30         $resp = $this->post('/settings/users/create', [
  31             'name'                          => $user->name,
  32             'email'                         => $user->email,
  33             'password'                      => $user->password,
  34             'password-confirm'              => $user->password,
  35             'roles[' . $adminRole->id . ']' => 'true',
  36         ]);
  37         $resp->assertRedirect('/settings/users');
  38
  39         $resp = $this->get('/settings/users');
  40         $resp->assertSee($user->name);
  41
  42         $this->assertDatabaseHas('users', $user->only('name', 'email'));
  43
  44         $user->refresh();
  45         $this->assertStringStartsWith(Str::slug($user->name), $user->slug);
  46     }
  47
  48     public function test_user_updating()
  49     {
  50         $user = $this->getNormalUser();
  51         $password = $user->password;
  52
  53         $resp = $this->asAdmin()->get('/settings/users/' . $user->id);
  54         $resp->assertSee($user->email);
  55
  56         $this->put($user->getEditUrl(), [
  57             'name' => 'Barry Scott',
  58         ])->assertRedirect('/settings/users');
  59
  60         $this->assertDatabaseHas('users', ['id' => $user->id, 'name' => 'Barry Scott', 'password' => $password]);
  61         $this->assertDatabaseMissing('users', ['name' => $user->name]);
  62
  63         $user->refresh();
  64         $this->assertStringStartsWith(Str::slug($user->name), $user->slug);
  65     }
  66
  67     public function test_user_password_update()
  68     {
  69         $user = $this->getNormalUser();
  70         $userProfilePage = '/settings/users/' . $user->id;
  71
  72         $this->asAdmin()->get($userProfilePage);
  73         $this->put($userProfilePage, [
  74             'password' => 'newpassword',
  75         ])->assertRedirect($userProfilePage);
  76
  77         $this->get($userProfilePage)->assertSee('Password confirmation required');
  78
  79         $this->put($userProfilePage, [
  80             'password'         => 'newpassword',
  81             'password-confirm' => 'newpassword',
  82         ])->assertRedirect('/settings/users');
  83
  84         $userPassword = User::query()->find($user->id)->password;
  85         $this->assertTrue(Hash::check('newpassword', $userPassword));
  86     }
  87
  88     public function test_user_cannot_be_deleted_if_last_admin()
  89     {
  90         $adminRole = Role::getRole('admin');
  91
  92         // Delete all but one admin user if there are more than one
  93         $adminUsers = $adminRole->users;
  94         if (count($adminUsers) > 1) {
  95             /** @var User $user */
  96             foreach ($adminUsers->splice(1) as $user) {
  97                 $user->delete();
  98             }
  99         }
 100
 101         // Ensure we currently only have 1 admin user
 102         $this->assertEquals(1, $adminRole->users()->count());
 103         /** @var User $user */
 104         $user = $adminRole->users->first();
 105
 106         $resp = $this->asAdmin()->delete('/settings/users/' . $user->id);
 107         $resp->assertRedirect('/settings/users/' . $user->id);
 108
 109         $resp = $this->get('/settings/users/' . $user->id);
 110         $resp->assertSee('You cannot delete the only admin');
 111
 112         $this->assertDatabaseHas('users', ['id' => $user->id]);
 113     }
 114
 115     public function test_delete()
 116     {
 117         $editor = $this->getEditor();
 118         $resp = $this->asAdmin()->delete("settings/users/{$editor->id}");
 119         $resp->assertRedirect('/settings/users');
 120         $resp = $this->followRedirects($resp);
 121
 122         $resp->assertSee('User successfully removed');
 123         $this->assertActivityExists(ActivityType::USER_DELETE);
 124
 125         $this->assertDatabaseMissing('users', ['id' => $editor->id]);
 126     }
 127
 128     public function test_delete_offers_migrate_option()
 129     {
 130         $editor = $this->getEditor();
 131         $resp = $this->asAdmin()->get("settings/users/{$editor->id}/delete");
 132         $resp->assertSee('Migrate Ownership');
 133         $resp->assertSee('new_owner_id');
 134     }
 135
 136     public function test_migrate_option_hidden_if_user_cannot_manage_users()
 137     {
 138         $editor = $this->getEditor();
 139
 140         $resp = $this->asEditor()->get("settings/users/{$editor->id}/delete");
 141         $resp->assertDontSee('Migrate Ownership');
 142         $resp->assertDontSee('new_owner_id');
 143
 144         $this->giveUserPermissions($editor, ['users-manage']);
 145
 146         $resp = $this->asEditor()->get("settings/users/{$editor->id}/delete");
 147         $resp->assertSee('Migrate Ownership');
 148         $resp->assertSee('new_owner_id');
 149     }
 150
 151     public function test_delete_with_new_owner_id_changes_ownership()
 152     {
 153         $page = Page::query()->first();
 154         $owner = $page->ownedBy;
 155         $newOwner = User::query()->where('id', '!=', $owner->id)->first();
 156
 157         $this->asAdmin()->delete("settings/users/{$owner->id}", ['new_owner_id' => $newOwner->id]);
 158         $this->assertDatabaseHas('pages', [
 159             'id'       => $page->id,
 160             'owned_by' => $newOwner->id,
 161         ]);
 162     }
 163
 164     public function test_guest_profile_shows_limited_form()
 165     {
 166         $guest = User::getDefault();
 167         $resp = $this->asAdmin()->get('/settings/users/' . $guest->id);
 168         $resp->assertSee('Guest');
 169         $this->withHtml($resp)->assertElementNotExists('#password');
 170     }
 171
 172     public function test_guest_profile_cannot_be_deleted()
 173     {
 174         $guestUser = User::getDefault();
 175         $resp = $this->asAdmin()->get('/settings/users/' . $guestUser->id . '/delete');
 176         $resp->assertSee('Delete User');
 177         $resp->assertSee('Guest');
 178         $this->withHtml($resp)->assertElementContains('form[action$="/settings/users/' . $guestUser->id . '"] button', 'Confirm');
 179
 180         $resp = $this->delete('/settings/users/' . $guestUser->id);
 181         $resp->assertRedirect('/settings/users/' . $guestUser->id);
 182         $resp = $this->followRedirects($resp);
 183         $resp->assertSee('cannot delete the guest user');
 184     }
 185
 186     public function test_user_create_language_reflects_default_system_locale()
 187     {
 188         $langs = ['en', 'fr', 'hr'];
 189         foreach ($langs as $lang) {
 190             config()->set('app.locale', $lang);
 191             $resp = $this->asAdmin()->get('/settings/users/create');
 192             $this->withHtml($resp)->assertElementExists('select[name="language"] option[value="' . $lang . '"][selected]');
 193         }
 194     }
 195
 196     public function test_user_creation_is_not_performed_if_the_invitation_sending_fails()
 197     {
 198         /** @var User $user */
 199         $user = User::factory()->make();
 200         $adminRole = Role::getRole('admin');
 201
 202         // Simulate an invitation sending failure
 203         $this->mock(UserInviteService::class, function (MockInterface $mock) {
 204             $mock->shouldReceive('sendInvitation')->once()->andThrow(RuntimeException::class);
 205         });
 206
 207         $this->asAdmin()->post('/settings/users/create', [
 208             'name'                          => $user->name,
 209             'email'                         => $user->email,
 210             'send_invite'                   => 'true',
 211             'roles[' . $adminRole->id . ']' => 'true',
 212         ]);
 213
 214         // Since the invitation failed, the user should not exist in the database
 215         $this->assertDatabaseMissing('users', $user->only('name', 'email'));
 216     }
 217
 218     public function test_user_create_activity_is_not_persisted_if_the_invitation_sending_fails()
 219     {
 220         /** @var User $user */
 221         $user = User::factory()->make();
 222         $adminRole = Role::getRole('admin');
 223
 224         $this->mock(UserInviteService::class, function (MockInterface $mock) {
 225             $mock->shouldReceive('sendInvitation')->once()->andThrow(RuntimeException::class);
 226         });
 227
 228         $this->asAdmin()->post('/settings/users/create', [
 229             'name'                          => $user->name,
 230             'email'                         => $user->email,
 231             'send_invite'                   => 'true',
 232             'roles[' . $adminRole->id . ']' => 'true',
 233         ]);
 234
 235         $this->assertDatabaseMissing('activities', ['type' => 'USER_CREATE']);
 236     }
 237
 238     public function test_user_create_update_fails_if_locale_is_invalid()
 239     {
 240         $user = $this->getEditor();
 241
 242         // Too long
 243         $resp = $this->asAdmin()->put($user->getEditUrl(), ['language' => 'this_is_too_long']);
 244         $resp->assertSessionHasErrors(['language' => 'The language may not be greater than 15 characters.']);
 245         session()->flush();
 246
 247         // Invalid characters
 248         $resp = $this->put($user->getEditUrl(), ['language' => 'en<GB']);
 249         $resp->assertSessionHasErrors(['language' => 'The language may only contain letters, numbers, dashes and underscores.']);
 250         session()->flush();
 251
 252         // Both on create
 253         $resp = $this->post('/settings/users/create', [
 254             'language' => 'en<GB_and_this_is_longer',
 255             'name'     => 'My name',
 256             'email'    => '[email protected]',
 257         ]);
 258         $resp->assertSessionHasErrors(['language' => 'The language may not be greater than 15 characters.']);
 259         $resp->assertSessionHasErrors(['language' => 'The language may only contain letters, numbers, dashes and underscores.']);
 260     }
 261 }