2021-06-26 17:23:15 +02:00
|
|
|
<?php
|
|
|
|
|
|
|
|
namespace Tests\User;
|
2021-01-02 00:58:53 +01:00
|
|
|
|
2023-05-17 18:56:55 +02:00
|
|
|
use BookStack\Access\UserInviteService;
|
|
|
|
use BookStack\Activity\ActivityType;
|
2023-01-26 18:15:09 +01:00
|
|
|
use BookStack\Uploads\Image;
|
2023-05-17 18:56:55 +02:00
|
|
|
use BookStack\Users\Models\Role;
|
|
|
|
use BookStack\Users\Models\User;
|
2021-09-18 00:44:54 +02:00
|
|
|
use Illuminate\Support\Facades\Hash;
|
|
|
|
use Illuminate\Support\Str;
|
2022-01-19 20:46:38 +01:00
|
|
|
use Mockery\MockInterface;
|
|
|
|
use RuntimeException;
|
2021-01-02 00:58:53 +01:00
|
|
|
use Tests\TestCase;
|
|
|
|
|
|
|
|
class UserManagementTest extends TestCase
|
|
|
|
{
|
2021-09-18 00:44:54 +02:00
|
|
|
public function test_user_creation()
|
|
|
|
{
|
|
|
|
/** @var User $user */
|
2021-10-30 22:29:59 +02:00
|
|
|
$user = User::factory()->make();
|
2021-09-18 00:44:54 +02:00
|
|
|
$adminRole = Role::getRole('admin');
|
|
|
|
|
|
|
|
$resp = $this->asAdmin()->get('/settings/users');
|
2022-07-23 16:10:18 +02:00
|
|
|
$this->withHtml($resp)->assertElementContains('a[href="' . url('/settings/users/create') . '"]', 'Add New User');
|
2021-09-18 00:44:54 +02:00
|
|
|
|
2022-07-23 16:11:06 +02:00
|
|
|
$resp = $this->get('/settings/users/create');
|
2022-07-23 16:10:18 +02:00
|
|
|
$this->withHtml($resp)->assertElementContains('form[action="' . url('/settings/users/create') . '"]', 'Save');
|
2021-09-18 00:44:54 +02:00
|
|
|
|
|
|
|
$resp = $this->post('/settings/users/create', [
|
2021-09-18 22:21:44 +02:00
|
|
|
'name' => $user->name,
|
|
|
|
'email' => $user->email,
|
|
|
|
'password' => $user->password,
|
|
|
|
'password-confirm' => $user->password,
|
2021-09-18 00:44:54 +02:00
|
|
|
'roles[' . $adminRole->id . ']' => 'true',
|
|
|
|
]);
|
|
|
|
$resp->assertRedirect('/settings/users');
|
|
|
|
|
|
|
|
$resp = $this->get('/settings/users');
|
|
|
|
$resp->assertSee($user->name);
|
|
|
|
|
|
|
|
$this->assertDatabaseHas('users', $user->only('name', 'email'));
|
|
|
|
|
|
|
|
$user->refresh();
|
|
|
|
$this->assertStringStartsWith(Str::slug($user->name), $user->slug);
|
|
|
|
}
|
|
|
|
|
|
|
|
public function test_user_updating()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$user = $this->users->viewer();
|
2021-09-18 00:44:54 +02:00
|
|
|
$password = $user->password;
|
|
|
|
|
|
|
|
$resp = $this->asAdmin()->get('/settings/users/' . $user->id);
|
|
|
|
$resp->assertSee($user->email);
|
|
|
|
|
|
|
|
$this->put($user->getEditUrl(), [
|
2021-09-18 22:21:44 +02:00
|
|
|
'name' => 'Barry Scott',
|
2021-09-18 00:44:54 +02:00
|
|
|
])->assertRedirect('/settings/users');
|
|
|
|
|
|
|
|
$this->assertDatabaseHas('users', ['id' => $user->id, 'name' => 'Barry Scott', 'password' => $password]);
|
|
|
|
$this->assertDatabaseMissing('users', ['name' => $user->name]);
|
|
|
|
|
|
|
|
$user->refresh();
|
|
|
|
$this->assertStringStartsWith(Str::slug($user->name), $user->slug);
|
|
|
|
}
|
|
|
|
|
|
|
|
public function test_user_password_update()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$user = $this->users->viewer();
|
2021-09-18 00:44:54 +02:00
|
|
|
$userProfilePage = '/settings/users/' . $user->id;
|
|
|
|
|
|
|
|
$this->asAdmin()->get($userProfilePage);
|
|
|
|
$this->put($userProfilePage, [
|
2021-09-18 22:21:44 +02:00
|
|
|
'password' => 'newpassword',
|
2021-09-18 00:44:54 +02:00
|
|
|
])->assertRedirect($userProfilePage);
|
|
|
|
|
|
|
|
$this->get($userProfilePage)->assertSee('Password confirmation required');
|
|
|
|
|
|
|
|
$this->put($userProfilePage, [
|
2021-09-18 22:21:44 +02:00
|
|
|
'password' => 'newpassword',
|
2021-09-18 00:44:54 +02:00
|
|
|
'password-confirm' => 'newpassword',
|
|
|
|
])->assertRedirect('/settings/users');
|
|
|
|
|
|
|
|
$userPassword = User::query()->find($user->id)->password;
|
|
|
|
$this->assertTrue(Hash::check('newpassword', $userPassword));
|
|
|
|
}
|
|
|
|
|
|
|
|
public function test_user_cannot_be_deleted_if_last_admin()
|
|
|
|
{
|
|
|
|
$adminRole = Role::getRole('admin');
|
|
|
|
|
|
|
|
// Delete all but one admin user if there are more than one
|
|
|
|
$adminUsers = $adminRole->users;
|
|
|
|
if (count($adminUsers) > 1) {
|
|
|
|
/** @var User $user */
|
|
|
|
foreach ($adminUsers->splice(1) as $user) {
|
|
|
|
$user->delete();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we currently only have 1 admin user
|
|
|
|
$this->assertEquals(1, $adminRole->users()->count());
|
|
|
|
/** @var User $user */
|
|
|
|
$user = $adminRole->users->first();
|
|
|
|
|
|
|
|
$resp = $this->asAdmin()->delete('/settings/users/' . $user->id);
|
|
|
|
$resp->assertRedirect('/settings/users/' . $user->id);
|
|
|
|
|
|
|
|
$resp = $this->get('/settings/users/' . $user->id);
|
|
|
|
$resp->assertSee('You cannot delete the only admin');
|
|
|
|
|
|
|
|
$this->assertDatabaseHas('users', ['id' => $user->id]);
|
|
|
|
}
|
|
|
|
|
2021-01-02 00:58:53 +01:00
|
|
|
public function test_delete()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$editor = $this->users->editor();
|
2021-01-02 00:58:53 +01:00
|
|
|
$resp = $this->asAdmin()->delete("settings/users/{$editor->id}");
|
2021-06-26 17:23:15 +02:00
|
|
|
$resp->assertRedirect('/settings/users');
|
2021-01-02 00:58:53 +01:00
|
|
|
$resp = $this->followRedirects($resp);
|
|
|
|
|
2021-06-26 17:23:15 +02:00
|
|
|
$resp->assertSee('User successfully removed');
|
2021-01-02 00:58:53 +01:00
|
|
|
$this->assertActivityExists(ActivityType::USER_DELETE);
|
|
|
|
|
|
|
|
$this->assertDatabaseMissing('users', ['id' => $editor->id]);
|
|
|
|
}
|
|
|
|
|
|
|
|
public function test_delete_offers_migrate_option()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$editor = $this->users->editor();
|
2021-01-02 00:58:53 +01:00
|
|
|
$resp = $this->asAdmin()->get("settings/users/{$editor->id}/delete");
|
2021-06-26 17:23:15 +02:00
|
|
|
$resp->assertSee('Migrate Ownership');
|
|
|
|
$resp->assertSee('new_owner_id');
|
2021-01-02 00:58:53 +01:00
|
|
|
}
|
|
|
|
|
2021-12-14 19:47:22 +01:00
|
|
|
public function test_migrate_option_hidden_if_user_cannot_manage_users()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$editor = $this->users->editor();
|
2021-12-14 19:47:22 +01:00
|
|
|
|
|
|
|
$resp = $this->asEditor()->get("settings/users/{$editor->id}/delete");
|
|
|
|
$resp->assertDontSee('Migrate Ownership');
|
|
|
|
$resp->assertDontSee('new_owner_id');
|
|
|
|
|
2023-01-21 12:08:34 +01:00
|
|
|
$this->permissions->grantUserRolePermissions($editor, ['users-manage']);
|
2021-12-14 19:47:22 +01:00
|
|
|
|
|
|
|
$resp = $this->asEditor()->get("settings/users/{$editor->id}/delete");
|
|
|
|
$resp->assertSee('Migrate Ownership');
|
2023-03-24 15:43:48 +01:00
|
|
|
$this->withHtml($resp)->assertElementExists('form input[name="new_owner_id"]');
|
2021-12-14 19:47:22 +01:00
|
|
|
$resp->assertSee('new_owner_id');
|
|
|
|
}
|
|
|
|
|
2021-01-02 00:58:53 +01:00
|
|
|
public function test_delete_with_new_owner_id_changes_ownership()
|
|
|
|
{
|
2022-09-29 18:31:38 +02:00
|
|
|
$page = $this->entities->page();
|
2021-01-02 00:58:53 +01:00
|
|
|
$owner = $page->ownedBy;
|
2021-06-26 17:23:15 +02:00
|
|
|
$newOwner = User::query()->where('id', '!=', $owner->id)->first();
|
2021-01-02 00:58:53 +01:00
|
|
|
|
|
|
|
$this->asAdmin()->delete("settings/users/{$owner->id}", ['new_owner_id' => $newOwner->id]);
|
|
|
|
$this->assertDatabaseHas('pages', [
|
2021-06-26 17:23:15 +02:00
|
|
|
'id' => $page->id,
|
2021-01-02 00:58:53 +01:00
|
|
|
'owned_by' => $newOwner->id,
|
|
|
|
]);
|
|
|
|
}
|
2021-09-13 23:54:21 +02:00
|
|
|
|
2023-04-07 16:57:21 +02:00
|
|
|
public function test_delete_with_empty_owner_migration_id_works()
|
|
|
|
{
|
|
|
|
$user = $this->users->editor();
|
|
|
|
|
|
|
|
$resp = $this->asAdmin()->delete("settings/users/{$user->id}", ['new_owner_id' => '']);
|
|
|
|
$resp->assertRedirect('/settings/users');
|
|
|
|
$this->assertActivityExists(ActivityType::USER_DELETE);
|
|
|
|
$this->assertSessionHas('success');
|
|
|
|
}
|
|
|
|
|
2022-11-09 20:30:08 +01:00
|
|
|
public function test_delete_removes_user_preferences()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$editor = $this->users->editor();
|
2022-11-09 20:30:08 +01:00
|
|
|
setting()->putUser($editor, 'dark-mode-enabled', 'true');
|
|
|
|
|
|
|
|
$this->assertDatabaseHas('settings', [
|
|
|
|
'setting_key' => 'user:' . $editor->id . ':dark-mode-enabled',
|
|
|
|
'value' => 'true',
|
|
|
|
]);
|
|
|
|
|
|
|
|
$this->asAdmin()->delete("settings/users/{$editor->id}");
|
|
|
|
|
|
|
|
$this->assertDatabaseMissing('settings', [
|
|
|
|
'setting_key' => 'user:' . $editor->id . ':dark-mode-enabled',
|
|
|
|
]);
|
|
|
|
}
|
|
|
|
|
2021-09-13 23:54:21 +02:00
|
|
|
public function test_guest_profile_shows_limited_form()
|
|
|
|
{
|
2023-09-16 14:18:35 +02:00
|
|
|
$guest = $this->users->guest();
|
2021-09-13 23:54:21 +02:00
|
|
|
$resp = $this->asAdmin()->get('/settings/users/' . $guest->id);
|
|
|
|
$resp->assertSee('Guest');
|
2022-07-23 16:10:18 +02:00
|
|
|
$this->withHtml($resp)->assertElementNotExists('#password');
|
2021-09-13 23:54:21 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
public function test_guest_profile_cannot_be_deleted()
|
|
|
|
{
|
2023-09-16 14:18:35 +02:00
|
|
|
$guestUser = $this->users->guest();
|
2021-09-13 23:54:21 +02:00
|
|
|
$resp = $this->asAdmin()->get('/settings/users/' . $guestUser->id . '/delete');
|
|
|
|
$resp->assertSee('Delete User');
|
|
|
|
$resp->assertSee('Guest');
|
2022-07-23 16:10:18 +02:00
|
|
|
$this->withHtml($resp)->assertElementContains('form[action$="/settings/users/' . $guestUser->id . '"] button', 'Confirm');
|
2021-09-13 23:54:21 +02:00
|
|
|
|
2021-09-18 22:21:44 +02:00
|
|
|
$resp = $this->delete('/settings/users/' . $guestUser->id);
|
2021-09-13 23:54:21 +02:00
|
|
|
$resp->assertRedirect('/settings/users/' . $guestUser->id);
|
|
|
|
$resp = $this->followRedirects($resp);
|
|
|
|
$resp->assertSee('cannot delete the guest user');
|
|
|
|
}
|
2022-01-19 20:46:38 +01:00
|
|
|
|
2022-01-31 23:15:21 +01:00
|
|
|
public function test_user_create_language_reflects_default_system_locale()
|
|
|
|
{
|
|
|
|
$langs = ['en', 'fr', 'hr'];
|
|
|
|
foreach ($langs as $lang) {
|
|
|
|
config()->set('app.locale', $lang);
|
|
|
|
$resp = $this->asAdmin()->get('/settings/users/create');
|
2022-07-23 16:10:18 +02:00
|
|
|
$this->withHtml($resp)->assertElementExists('select[name="language"] option[value="' . $lang . '"][selected]');
|
2022-01-31 23:15:21 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-01-19 20:46:38 +01:00
|
|
|
public function test_user_creation_is_not_performed_if_the_invitation_sending_fails()
|
|
|
|
{
|
|
|
|
/** @var User $user */
|
|
|
|
$user = User::factory()->make();
|
|
|
|
$adminRole = Role::getRole('admin');
|
|
|
|
|
|
|
|
// Simulate an invitation sending failure
|
|
|
|
$this->mock(UserInviteService::class, function (MockInterface $mock) {
|
|
|
|
$mock->shouldReceive('sendInvitation')->once()->andThrow(RuntimeException::class);
|
|
|
|
});
|
|
|
|
|
|
|
|
$this->asAdmin()->post('/settings/users/create', [
|
|
|
|
'name' => $user->name,
|
|
|
|
'email' => $user->email,
|
|
|
|
'send_invite' => 'true',
|
|
|
|
'roles[' . $adminRole->id . ']' => 'true',
|
|
|
|
]);
|
|
|
|
|
|
|
|
// Since the invitation failed, the user should not exist in the database
|
|
|
|
$this->assertDatabaseMissing('users', $user->only('name', 'email'));
|
|
|
|
}
|
|
|
|
|
|
|
|
public function test_user_create_activity_is_not_persisted_if_the_invitation_sending_fails()
|
|
|
|
{
|
|
|
|
/** @var User $user */
|
|
|
|
$user = User::factory()->make();
|
|
|
|
$adminRole = Role::getRole('admin');
|
|
|
|
|
|
|
|
$this->mock(UserInviteService::class, function (MockInterface $mock) {
|
|
|
|
$mock->shouldReceive('sendInvitation')->once()->andThrow(RuntimeException::class);
|
|
|
|
});
|
|
|
|
|
|
|
|
$this->asAdmin()->post('/settings/users/create', [
|
|
|
|
'name' => $user->name,
|
|
|
|
'email' => $user->email,
|
|
|
|
'send_invite' => 'true',
|
|
|
|
'roles[' . $adminRole->id . ']' => 'true',
|
|
|
|
]);
|
|
|
|
|
|
|
|
$this->assertDatabaseMissing('activities', ['type' => 'USER_CREATE']);
|
|
|
|
}
|
2022-08-04 18:24:04 +02:00
|
|
|
|
|
|
|
public function test_user_create_update_fails_if_locale_is_invalid()
|
|
|
|
{
|
2023-01-21 12:08:34 +01:00
|
|
|
$user = $this->users->editor();
|
2022-08-04 18:24:04 +02:00
|
|
|
|
|
|
|
// Too long
|
|
|
|
$resp = $this->asAdmin()->put($user->getEditUrl(), ['language' => 'this_is_too_long']);
|
|
|
|
$resp->assertSessionHasErrors(['language' => 'The language may not be greater than 15 characters.']);
|
|
|
|
session()->flush();
|
|
|
|
|
|
|
|
// Invalid characters
|
|
|
|
$resp = $this->put($user->getEditUrl(), ['language' => 'en<GB']);
|
|
|
|
$resp->assertSessionHasErrors(['language' => 'The language may only contain letters, numbers, dashes and underscores.']);
|
|
|
|
session()->flush();
|
|
|
|
|
|
|
|
// Both on create
|
|
|
|
$resp = $this->post('/settings/users/create', [
|
|
|
|
'language' => 'en<GB_and_this_is_longer',
|
2022-08-09 14:26:45 +02:00
|
|
|
'name' => 'My name',
|
|
|
|
'email' => 'jimmy@example.com',
|
2022-08-04 18:24:04 +02:00
|
|
|
]);
|
|
|
|
$resp->assertSessionHasErrors(['language' => 'The language may not be greater than 15 characters.']);
|
|
|
|
$resp->assertSessionHasErrors(['language' => 'The language may only contain letters, numbers, dashes and underscores.']);
|
|
|
|
}
|
2023-01-26 18:15:09 +01:00
|
|
|
|
|
|
|
public function test_user_avatar_update_and_reset()
|
|
|
|
{
|
|
|
|
$user = $this->users->viewer();
|
2023-02-08 15:39:13 +01:00
|
|
|
$avatarFile = $this->files->uploadedImage('avatar-icon.png');
|
2023-01-26 18:15:09 +01:00
|
|
|
|
|
|
|
$this->assertEquals(0, $user->image_id);
|
|
|
|
|
|
|
|
$upload = $this->asAdmin()->call('PUT', "/settings/users/{$user->id}", [
|
|
|
|
'name' => 'Barry Scott',
|
|
|
|
], [], ['profile_image' => $avatarFile], []);
|
|
|
|
$upload->assertRedirect('/settings/users');
|
|
|
|
|
|
|
|
$user->refresh();
|
|
|
|
$this->assertNotEquals(0, $user->image_id);
|
|
|
|
/** @var Image $image */
|
|
|
|
$image = Image::query()->findOrFail($user->image_id);
|
|
|
|
$this->assertFileExists(public_path($image->path));
|
|
|
|
|
|
|
|
$reset = $this->put("/settings/users/{$user->id}", [
|
|
|
|
'name' => 'Barry Scott',
|
|
|
|
'profile_image_reset' => 'true',
|
|
|
|
]);
|
|
|
|
$upload->assertRedirect('/settings/users');
|
|
|
|
|
|
|
|
$user->refresh();
|
|
|
|
$this->assertFileDoesNotExist(public_path($image->path));
|
|
|
|
$this->assertEquals(0, $user->image_id);
|
|
|
|
}
|
2021-06-26 17:23:15 +02:00
|
|
|
}
|