BookStack Code Mirror - bookstack/blob - tests/User/UserManagementTest.php

   1 <?php
   2
   3 namespace Tests\User;
   4
   5 use BookStack\Actions\ActivityType;
   6 use BookStack\Auth\Role;
   7 use BookStack\Auth\User;
   8 use BookStack\Entities\Models\Page;
   9 use Illuminate\Support\Facades\Hash;
  10 use Illuminate\Support\Str;
  11 use Tests\TestCase;
  12
  13 class UserManagementTest extends TestCase
  14 {
  15     public function test_user_creation()
  16     {
  17         /** @var User $user */
  18         $user = User::factory()->make();
  19         $adminRole = Role::getRole('admin');
  20
  21         $resp = $this->asAdmin()->get('/settings/users');
  22         $resp->assertElementContains('a[href="' . url('/settings/users/create') . '"]', 'Add New User');
  23
  24         $this->get('/settings/users/create')
  25             ->assertElementContains('form[action="' . url('/settings/users/create') . '"]', 'Save');
  26
  27         $resp = $this->post('/settings/users/create', [
  28             'name'                          => $user->name,
  29             'email'                         => $user->email,
  30             'password'                      => $user->password,
  31             'password-confirm'              => $user->password,
  32             'roles[' . $adminRole->id . ']' => 'true',
  33         ]);
  34         $resp->assertRedirect('/settings/users');
  35
  36         $resp = $this->get('/settings/users');
  37         $resp->assertSee($user->name);
  38
  39         $this->assertDatabaseHas('users', $user->only('name', 'email'));
  40
  41         $user->refresh();
  42         $this->assertStringStartsWith(Str::slug($user->name), $user->slug);
  43     }
  44
  45     public function test_user_updating()
  46     {
  47         $user = $this->getNormalUser();
  48         $password = $user->password;
  49
  50         $resp = $this->asAdmin()->get('/settings/users/' . $user->id);
  51         $resp->assertSee($user->email);
  52
  53         $this->put($user->getEditUrl(), [
  54             'name' => 'Barry Scott',
  55         ])->assertRedirect('/settings/users');
  56
  57         $this->assertDatabaseHas('users', ['id' => $user->id, 'name' => 'Barry Scott', 'password' => $password]);
  58         $this->assertDatabaseMissing('users', ['name' => $user->name]);
  59
  60         $user->refresh();
  61         $this->assertStringStartsWith(Str::slug($user->name), $user->slug);
  62     }
  63
  64     public function test_user_password_update()
  65     {
  66         $user = $this->getNormalUser();
  67         $userProfilePage = '/settings/users/' . $user->id;
  68
  69         $this->asAdmin()->get($userProfilePage);
  70         $this->put($userProfilePage, [
  71             'password' => 'newpassword',
  72         ])->assertRedirect($userProfilePage);
  73
  74         $this->get($userProfilePage)->assertSee('Password confirmation required');
  75
  76         $this->put($userProfilePage, [
  77             'password'         => 'newpassword',
  78             'password-confirm' => 'newpassword',
  79         ])->assertRedirect('/settings/users');
  80
  81         $userPassword = User::query()->find($user->id)->password;
  82         $this->assertTrue(Hash::check('newpassword', $userPassword));
  83     }
  84
  85     public function test_user_cannot_be_deleted_if_last_admin()
  86     {
  87         $adminRole = Role::getRole('admin');
  88
  89         // Delete all but one admin user if there are more than one
  90         $adminUsers = $adminRole->users;
  91         if (count($adminUsers) > 1) {
  92             /** @var User $user */
  93             foreach ($adminUsers->splice(1) as $user) {
  94                 $user->delete();
  95             }
  96         }
  97
  98         // Ensure we currently only have 1 admin user
  99         $this->assertEquals(1, $adminRole->users()->count());
 100         /** @var User $user */
 101         $user = $adminRole->users->first();
 102
 103         $resp = $this->asAdmin()->delete('/settings/users/' . $user->id);
 104         $resp->assertRedirect('/settings/users/' . $user->id);
 105
 106         $resp = $this->get('/settings/users/' . $user->id);
 107         $resp->assertSee('You cannot delete the only admin');
 108
 109         $this->assertDatabaseHas('users', ['id' => $user->id]);
 110     }
 111
 112     public function test_delete()
 113     {
 114         $editor = $this->getEditor();
 115         $resp = $this->asAdmin()->delete("settings/users/{$editor->id}");
 116         $resp->assertRedirect('/settings/users');
 117         $resp = $this->followRedirects($resp);
 118
 119         $resp->assertSee('User successfully removed');
 120         $this->assertActivityExists(ActivityType::USER_DELETE);
 121
 122         $this->assertDatabaseMissing('users', ['id' => $editor->id]);
 123     }
 124
 125     public function test_delete_offers_migrate_option()
 126     {
 127         $editor = $this->getEditor();
 128         $resp = $this->asAdmin()->get("settings/users/{$editor->id}/delete");
 129         $resp->assertSee('Migrate Ownership');
 130         $resp->assertSee('new_owner_id');
 131     }
 132
 133     public function test_delete_with_new_owner_id_changes_ownership()
 134     {
 135         $page = Page::query()->first();
 136         $owner = $page->ownedBy;
 137         $newOwner = User::query()->where('id', '!=', $owner->id)->first();
 138
 139         $this->asAdmin()->delete("settings/users/{$owner->id}", ['new_owner_id' => $newOwner->id]);
 140         $this->assertDatabaseHas('pages', [
 141             'id'       => $page->id,
 142             'owned_by' => $newOwner->id,
 143         ]);
 144     }
 145
 146     public function test_guest_profile_shows_limited_form()
 147     {
 148         $guest = User::getDefault();
 149         $resp = $this->asAdmin()->get('/settings/users/' . $guest->id);
 150         $resp->assertSee('Guest');
 151         $resp->assertElementNotExists('#password');
 152     }
 153
 154     public function test_guest_profile_cannot_be_deleted()
 155     {
 156         $guestUser = User::getDefault();
 157         $resp = $this->asAdmin()->get('/settings/users/' . $guestUser->id . '/delete');
 158         $resp->assertSee('Delete User');
 159         $resp->assertSee('Guest');
 160         $resp->assertElementContains('form[action$="/settings/users/' . $guestUser->id . '"] button', 'Confirm');
 161
 162         $resp = $this->delete('/settings/users/' . $guestUser->id);
 163         $resp->assertRedirect('/settings/users/' . $guestUser->id);
 164         $resp = $this->followRedirects($resp);
 165         $resp->assertSee('cannot delete the guest user');
 166     }
 167 }