Skip to content

Commit f72ff0d

Browse files
mubbimubbi
committed
test: removed useless test
1 parent 7b38684 commit f72ff0d

12 files changed

+128
-32
lines changed

‎app/Http/Controllers/Api/V1/Admin/User/BanUserController.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ public function __invoke(int $id, BanUserRequest $request): JsonResponse
3535
new UserDetailResource($user),
3636
__('common.user_banned_successfully')
3737
);
38+
} catch (\Illuminate\Auth\Access\AuthorizationException $e) {
39+
/**
40+
* Forbidden - Cannot ban self
41+
*
42+
* @status 403
43+
*
44+
* @body array{status: false, message: string, data: null, error: null}
45+
*/
46+
return response()->apiError(
47+
$e->getMessage(),
48+
Response::HTTP_FORBIDDEN
49+
);
3850
} catch (\Illuminate\Database\Eloquent\ModelNotFoundException $e) {
3951
/**
4052
* User not found

‎app/Http/Controllers/Api/V1/Admin/User/BlockUserController.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ public function __invoke(int $id, BlockUserRequest $request): JsonResponse
3535
new UserDetailResource($user),
3636
__('common.user_blocked_successfully')
3737
);
38+
} catch (\Illuminate\Auth\Access\AuthorizationException $e) {
39+
/**
40+
* Forbidden - Cannot block self
41+
*
42+
* @status 403
43+
*
44+
* @body array{status: false, message: string, data: null, error: null}
45+
*/
46+
return response()->apiError(
47+
$e->getMessage(),
48+
Response::HTTP_FORBIDDEN
49+
);
3850
} catch (\Illuminate\Database\Eloquent\ModelNotFoundException $e) {
3951
/**
4052
* User not found

‎app/Http/Controllers/Api/V1/Admin/User/DeleteUserController.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,18 @@ public function __invoke(DeleteUserRequest $request, int $id): JsonResponse
3434
null,
3535
__('common.user_deleted_successfully')
3636
);
37+
} catch (\Illuminate\Auth\Access\AuthorizationException $e) {
38+
/**
39+
* Forbidden - Cannot delete self
40+
*
41+
* @status 403
42+
*
43+
* @body array{status: false, message: string, data: null, error: null}
44+
*/
45+
return response()->apiError(
46+
$e->getMessage(),
47+
Response::HTTP_FORBIDDEN
48+
);
3749
} catch (\Illuminate\Database\Eloquent\ModelNotFoundException $e) {
3850
/**
3951
* User not found

‎app/Http/Controllers/Api/V1/Admin/User/UnbanUserController.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ public function __invoke(UnbanUserRequest $request, int $id): JsonResponse
3535
new UserDetailResource($user),
3636
__('common.user_unbanned_successfully')
3737
);
38+
} catch (\Illuminate\Auth\Access\AuthorizationException $e) {
39+
/**
40+
* Forbidden - Cannot unban self
41+
*
42+
* @status 403
43+
*
44+
* @body array{status: false, message: string, data: null, error: null}
45+
*/
46+
return response()->apiError(
47+
$e->getMessage(),
48+
Response::HTTP_FORBIDDEN
49+
);
3850
} catch (\Illuminate\Database\Eloquent\ModelNotFoundException $e) {
3951
/**
4052
* User not found

‎app/Http/Controllers/Api/V1/Admin/User/UnblockUserController.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ public function __invoke(int $id, UnblockUserRequest $request): JsonResponse
3535
new UserDetailResource($user),
3636
__('common.user_unblocked_successfully')
3737
);
38+
} catch (\Illuminate\Auth\Access\AuthorizationException $e) {
39+
/**
40+
* Forbidden - Cannot unblock self
41+
*
42+
* @status 403
43+
*
44+
* @body array{status: false, message: string, data: null, error: null}
45+
*/
46+
return response()->apiError(
47+
$e->getMessage(),
48+
Response::HTTP_FORBIDDEN
49+
);
3850
} catch (\Illuminate\Database\Eloquent\ModelNotFoundException $e) {
3951
/**
4052
* User not found

‎app/Services/UserService.php

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,9 +125,13 @@ public function updateUser(int $id, array $data): User
125125

126126
/**
127127
* Delete a user
128+
*
129+
* @throws \Illuminate\Auth\Access\AuthorizationException
128130
*/
129131
public function deleteUser(int $id): bool
130132
{
133+
$this->preventSelfAction($id, 'cannot_delete_self');
134+
131135
$user = User::findOrFail($id);
132136

133137
/** @var bool $deleted */
@@ -138,9 +142,13 @@ public function deleteUser(int $id): bool
138142

139143
/**
140144
* Ban a user
145+
*
146+
* @throws \Illuminate\Auth\Access\AuthorizationException
141147
*/
142148
public function banUser(int $id): User
143149
{
150+
$this->preventSelfAction($id, 'cannot_ban_self');
151+
144152
$user = User::findOrFail($id);
145153
$user->update(['banned_at' => now()]);
146154

@@ -149,9 +157,13 @@ public function banUser(int $id): User
149157

150158
/**
151159
* Unban a user
160+
*
161+
* @throws \Illuminate\Auth\Access\AuthorizationException
152162
*/
153163
public function unbanUser(int $id): User
154164
{
165+
$this->preventSelfAction($id, 'cannot_unban_self');
166+
155167
$user = User::findOrFail($id);
156168
$user->update(['banned_at' => null]);
157169

@@ -160,9 +172,13 @@ public function unbanUser(int $id): User
160172

161173
/**
162174
* Block a user
175+
*
176+
* @throws \Illuminate\Auth\Access\AuthorizationException
163177
*/
164178
public function blockUser(int $id): User
165179
{
180+
$this->preventSelfAction($id, 'cannot_block_self');
181+
166182
$user = User::findOrFail($id);
167183
$user->update(['blocked_at' => now()]);
168184

@@ -171,9 +187,13 @@ public function blockUser(int $id): User
171187

172188
/**
173189
* Unblock a user
190+
*
191+
* @throws \Illuminate\Auth\Access\AuthorizationException
174192
*/
175193
public function unblockUser(int $id): User
176194
{
195+
$this->preventSelfAction($id, 'cannot_unblock_self');
196+
177197
$user = User::findOrFail($id);
178198
$user->update(['blocked_at' => null]);
179199

@@ -213,6 +233,20 @@ public function assignRoles(int $userId, array $roleIds): User
213233
return $user->load(['roles:id,name,slug']);
214234
}
215235

236+
/**
237+
* Prevent users from performing actions on themselves
238+
*
239+
* @throws \Illuminate\Auth\Access\AuthorizationException
240+
*/
241+
private function preventSelfAction(int $id, string $errorKey): void
242+
{
243+
$currentUser = auth()->user();
244+
245+
if ($currentUser && $id === $currentUser->id) {
246+
throw new \Illuminate\Auth\Access\AuthorizationException(__("common.{$errorKey}"));
247+
}
248+
}
249+
216250
/**
217251
* Apply filters to the query
218252
*

‎lang/en/common.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@
3030
'user_blocked_successfully' => 'User blocked successfully.',
3131
'user_unblocked_successfully' => 'User unblocked successfully.',
3232
'profile_updated_successfully' => 'Profile updated successfully.',
33+
'cannot_delete_self' => 'You cannot delete your own account.',
34+
'cannot_ban_self' => 'You cannot ban your own account.',
35+
'cannot_unban_self' => 'You cannot unban your own account.',
36+
'cannot_block_self' => 'You cannot block your own account.',
37+
'cannot_unblock_self' => 'You cannot unblock your own account.',
3338

3439
// Article Management
3540
'article_not_found' => 'Article not found.',

‎tests/Feature/API/V1/Admin/User/BanUserControllerTest.php

Lines changed: 5 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -63,26 +63,6 @@
6363
expect($userToBan->blocked_at)->not->toBeNull();
6464
});
6565

66-
it('can ban an already banned user (updates timestamp)', function () {
67-
// Arrange
68-
$admin = User::factory()->create();
69-
$adminRole = Role::where('name', UserRole::ADMINISTRATOR->value)->first();
70-
$admin->roles()->attach($adminRole->id);
71-
72-
$oldBanTime = now()->subDays(5);
73-
$userToBan = User::factory()->create(['banned_at' => $oldBanTime]);
74-
75-
// Act
76-
$response = $this->actingAs($admin)
77-
->postJson(route('api.v1.admin.users.ban', $userToBan->id));
78-
79-
// Assert
80-
$response->assertStatus(200);
81-
82-
$userToBan->refresh();
83-
expect($userToBan->banned_at->toDateTimeString())->toBe(now()->toDateTimeString());
84-
});
85-
8666
it('returns 404 when user does not exist', function () {
8767
// Arrange
8868
$admin = User::factory()->create();
@@ -139,7 +119,10 @@
139119
->postJson(route('api.v1.admin.users.ban', $admin->id));
140120

141121
// Assert
142-
$response->assertStatus(200); // This is allowed in current implementation
143-
// Note: In a real application, you might want to prevent self-banning
122+
$response->assertStatus(403)
123+
->assertJson([
124+
'status' => false,
125+
'message' => __('common.cannot_ban_self'),
126+
]);
144127
});
145128
});

‎tests/Feature/API/V1/Admin/User/BlockUserControllerTest.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,11 @@
118118
->postJson(route('api.v1.admin.users.block', $admin->id));
119119

120120
// Assert
121-
$response->assertStatus(200); // This is allowed in current implementation
122-
// Note: In a real application, you might want to prevent self-blocking
121+
$response->assertStatus(403)
122+
->assertJson([
123+
'status' => false,
124+
'message' => __('common.cannot_block_self'),
125+
]);
123126
});
124127

125128
it('maintains other user properties when blocking', function () {

‎tests/Feature/API/V1/Admin/User/DeleteUserControllerTest.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,11 @@
154154
->deleteJson(route('api.v1.admin.users.destroy', $admin->id));
155155

156156
// Assert
157-
$response->assertStatus(200); // This is allowed in current implementation
158-
// Note: In a real application, you might want to prevent self-deletion
157+
$response->assertStatus(403)
158+
->assertJson([
159+
'status' => false,
160+
'message' => __('common.cannot_delete_self'),
161+
]);
159162
});
160163

161164
it('deletes user with verified email', function () {

0 commit comments

Comments
 (0)