mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-09-30 08:23:12 +00:00
Stamp WorkOrder.AccountId on all create paths and filter board/list/search/detail by server-derived account claims so scoped callers cannot cross accounts. Co-authored-by: Cursor <cursoragent@cursor.com>
78 lines
2.7 KiB
C#
78 lines
2.7 KiB
C#
using Api.SeaHavenIndustries.Controllers;
|
|
using Data.SeaHavenIndustries;
|
|
using FluentAssertions;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Moq;
|
|
using SeaHaven.DataServices.Implementation;
|
|
using SeaHaven.DataServices.Interfaces;
|
|
using SeaHaven.Services.DTOs;
|
|
using SeaHaven.Services.Helpers;
|
|
using SeaHaven.Services.Implementation;
|
|
using SeaHaven.Services.Interfaces;
|
|
using Xunit;
|
|
|
|
namespace Api.SeaHavenIndustries.Tests;
|
|
|
|
public class WorkOrderControllerSearchTests
|
|
{
|
|
private static WorkOrderBoardController NewController(IWorkOrderAdvancedSearchService advancedSearch)
|
|
{
|
|
var controller = new WorkOrderBoardController(
|
|
Mock.Of<IWorkOrderBoardService>(),
|
|
Mock.Of<IWorkOrderBoardUpdateService>(),
|
|
Mock.Of<IWorkOrderBoardCreateService>(),
|
|
Mock.Of<IWorkOrderBoardCancelService>(),
|
|
advancedSearch);
|
|
|
|
controller.ControllerContext = new ControllerContext
|
|
{
|
|
HttpContext = new DefaultHttpContext
|
|
{
|
|
User = new System.Security.Claims.ClaimsPrincipal(
|
|
new System.Security.Claims.ClaimsIdentity(
|
|
new[]
|
|
{
|
|
new System.Security.Claims.Claim(
|
|
System.Security.Claims.ClaimTypes.NameIdentifier,
|
|
"test-user")
|
|
},
|
|
"Test"))
|
|
}
|
|
};
|
|
|
|
return controller;
|
|
}
|
|
|
|
[Fact]
|
|
public async Task SearchBoard_WhenCustomPresetMissingDates_ReturnsBadRequest()
|
|
{
|
|
var advancedSearch = new WorkOrderAdvancedSearchService(
|
|
Mock.Of<IWorkOrderAdvancedSearchDataService>(),
|
|
Mock.Of<IWorkOrderAccountResolver>());
|
|
var controller = NewController(advancedSearch);
|
|
|
|
var result = await controller.SearchBoard(new WorkOrderAdvancedSearchQueryDto
|
|
{
|
|
DatePreset = WorkOrderAdvancedSearchDatePreset.Custom
|
|
});
|
|
|
|
var badRequest = result.Should().BeOfType<BadRequestObjectResult>().Subject;
|
|
var body = badRequest.Value.Should().BeOfType<Response>().Subject;
|
|
body.Status.Should().Be("Error");
|
|
body.Message.Should().Contain("dateFrom");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetBoard_WhenWeekEndBeforeWeekStart_ReturnsBadRequest()
|
|
{
|
|
var controller = NewController(Mock.Of<IWorkOrderAdvancedSearchService>());
|
|
|
|
var result = await controller.GetBoard(
|
|
new DateOnly(2026, 6, 22),
|
|
new DateOnly(2026, 6, 15));
|
|
|
|
var badRequest = result.Should().BeOfType<BadRequestObjectResult>().Subject;
|
|
badRequest.Value.Should().BeOfType<string>().Which.Should().Contain("weekEnd");
|
|
}
|
|
}
|