Repo rebuild

2026-09-15 12:33:28 +01:00
commit be28c4feec
5629 changed files with 317074 additions and 0 deletions
@@ -0,0 +1,96 @@
+<?php
+
+namespace Tests\Feature\InternalApi;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Modules\Company\Models\Company;
+use Modules\Platform\app\Models\LicenseKey;
+use Modules\Warehouse\app\Models\Warehouse;
+use Tests\TestCase;
+
+/**
+ * Covers CompanySummaryController and VerifyInternalApiSignature.
+ */
+class InternalApiCoverageTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure the internal API rejects empty configuration.
+     */
+    public function test_internal_api_rejects_when_secret_is_missing(): void
+    {
+        config(['platform.internal_api_key' => '']);
+
+        $this->getJson('/api/internal/companies')->assertUnauthorized();
+    }
+
+    /**
+     * Ensure invalid timestamps are rejected.
+     */
+    public function test_internal_api_rejects_invalid_timestamp(): void
+    {
+        config(['platform.internal_api_key' => 'testing-secret']);
+
+        $this->withHeaders([
+            'X-WMS-Timestamp' => 'not-a-date',
+            'X-WMS-Signature' => 'bad',
+        ])->getJson('/api/internal/companies')->assertUnauthorized();
+    }
+
+    /**
+     * Ensure expired timestamps are rejected.
+     */
+    public function test_internal_api_rejects_expired_timestamp(): void
+    {
+        config(['platform.internal_api_key' => 'testing-secret']);
+        $timestamp = now()->subMinutes(10)->toIso8601String();
+        $signature = hash_hmac('sha256', $timestamp . '.', 'testing-secret');
+
+        $this->withHeaders([
+            'X-WMS-Timestamp' => $timestamp,
+            'X-WMS-Signature' => $signature,
+        ])->getJson('/api/internal/companies')->assertUnauthorized();
+    }
+
+    /**
+     * Ensure incorrect HMAC signatures are rejected.
+     */
+    public function test_internal_api_rejects_invalid_signature(): void
+    {
+        config(['platform.internal_api_key' => 'testing-secret']);
+        $timestamp = now()->toIso8601String();
+
+        $this->withHeaders([
+            'X-WMS-Timestamp' => $timestamp,
+            'X-WMS-Signature' => hash_hmac('sha256', $timestamp . '.', 'wrong-secret'),
+        ])->getJson('/api/internal/companies')->assertUnauthorized();
+    }
+
+    /**
+     * Ensure valid signatures return company summaries and relationship counts.
+     */
+    public function test_internal_api_returns_company_summary_counts(): void
+    {
+        config(['platform.internal_api_key' => 'testing-secret']);
+
+        $company = Company::create(['name' => 'Summary Tenant', 'slug' => 'summary-tenant']);
+        User::factory()->create(['company_id' => $company->id]);
+        LicenseKey::issueFor($company, 'Summary licence');
+        Warehouse::create(['company_id' => $company->id, 'code' => 'SUM', 'name' => 'Summary Warehouse']);
+
+        $timestamp = now()->toIso8601String();
+        $signature = hash_hmac('sha256', $timestamp . '.', 'testing-secret');
+
+        $this->withHeaders([
+            'X-WMS-Timestamp' => $timestamp,
+            'X-WMS-Signature' => $signature,
+        ])->getJson('/api/internal/companies')
+            ->assertOk()
+            ->assertJsonPath('companies.0.name', 'Summary Tenant')
+            ->assertJsonPath('companies.0.users_count', 1)
+            ->assertJsonPath('companies.0.warehouses_count', 1)
+            ->assertJsonPath('companies.0.license_keys_count', 1);
+    }
+}