test: add auth and permissions tests

tests/PermissionsTest.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace Bazaar\Tests;
+
+use Bazaar\Core\Session;
+use Bazaar\Repositories\UserRepository;
+use Bazaar\Services\Auth;
+use Bazaar\Support\Permissions;
+use Bazaar\Support\Role;
+
+final class PermissionsTest extends DatabaseTestCase
+{
+    private UserRepository $users;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->users = new UserRepository($this->db);
+    }
+
+    private function authFor(int $userId): Auth
+    {
+        $_SESSION = [];
+        $auth = new Auth(new Session(), $this->users);
+        $auth->login($this->users->findById($userId));
+        return $auth;
+    }
+
+    public function testManagerIsStaffButNotAdmin(): void
+    {
+        $id = $this->users->create('m@bazaar.test', 'hash', 'Manager', false, Role::manager);
+        $auth = $this->authFor($id);
+
+        $this->assertTrue($auth->isStaff());
+        $this->assertFalse($auth->isAdmin());
+        $this->assertSame(Role::manager, $auth->role());
+    }
+
+    public function testManagerCanRunCatalogButNotCouponsOrUsers(): void
+    {
+        $id = $this->users->create('m@bazaar.test', 'hash', 'Manager', false, Role::manager);
+        $auth = $this->authFor($id);
+
+        $this->assertTrue($auth->can(Permissions::catalogManage));
+        $this->assertTrue($auth->can(Permissions::ordersManage));
+        $this->assertTrue($auth->can(Permissions::reviewsModerate));
+        $this->assertFalse($auth->can(Permissions::couponsManage));
+        $this->assertFalse($auth->can(Permissions::usersManage));
+    }
+
+    public function testAdminCanDoEverything(): void
+    {
+        $id = $this->users->create('admin@bazaar.test', 'hash', 'Admin', true);
+        $auth = $this->authFor($id);
+
+        $this->assertTrue($auth->isAdmin());
+        $this->assertTrue($auth->isStaff());
+        $this->assertTrue($auth->can(Permissions::couponsManage));
+        $this->assertTrue($auth->can(Permissions::usersManage));
+    }
+
+    public function testCustomerHasNoStaffAccess(): void
+    {
+        $id = $this->users->create('c@bazaar.test', 'hash', 'Customer');
+        $auth = $this->authFor($id);
+
+        $this->assertFalse($auth->isStaff());
+        $this->assertFalse($auth->can(Permissions::catalogManage));
+    }
+
+    public function testSetRolePromotesAndDemotes(): void
+    {
+        $id = $this->users->create('u@bazaar.test', 'hash', 'User');
+
+        $this->users->setRole($id, Role::admin);
+        $this->assertTrue($this->authFor($id)->isAdmin());
+
+        $this->users->setRole($id, Role::manager);
+        $promoted = $this->authFor($id);
+        $this->assertFalse($promoted->isAdmin());
+        $this->assertTrue($promoted->isStaff());
+    }
+}