Web app: new entities (Image, RenderedAsset, SharedImage, Token, DeviceImageHistory), enums, repositories, controllers, message handlers, migrations, tests, frontend upload/library/sticker UI, Vue components. Firmware: EPD background screen binaries + gen scripts, setup_bg header. Infra: ddev config, test bundle, gitignore coverage dir. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,284 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Functional\Controller;
|
||||
|
||||
use App\Entity\Device;
|
||||
use App\Entity\Image;
|
||||
use App\Entity\SharedImage;
|
||||
use App\Entity\Token;
|
||||
use App\Enum\SharedImageStatus;
|
||||
use App\Enum\TokenType;
|
||||
use App\Tests\Functional\AppWebTestCase;
|
||||
|
||||
/**
|
||||
* Tests for TokenActionController — token-based share approve/decline flows.
|
||||
*
|
||||
* TK-01: Valid share_approve token → page renders (GET) / action performed (POST)
|
||||
* TK-02: Expired/missing token → invalid page rendered
|
||||
* TK-03: Already-used token → same invalid page (repo returns null for used tokens)
|
||||
*/
|
||||
class TokenActionControllerTest extends AppWebTestCase
|
||||
{
|
||||
private function makeImage($user): Image
|
||||
{
|
||||
$image = (new Image())->setUser($user)->setOriginalFilename('x.jpg')->setStoragePath('x');
|
||||
$this->em()->persist($image);
|
||||
return $image;
|
||||
}
|
||||
|
||||
private function issueToken(Image $image, TokenType $type, int $ttlDays = 7): Token
|
||||
{
|
||||
$token = new Token($type, $image, null, 'recipient@example.com', $ttlDays);
|
||||
$this->em()->persist($token);
|
||||
return $token;
|
||||
}
|
||||
|
||||
/**
|
||||
* TK-01a: GET /token/{uuid}/approve with a valid token renders the approve page.
|
||||
*/
|
||||
public function test_approve_show_valid_token_renders_page(): void
|
||||
{
|
||||
$sender = $this->createUser('tk01a_sender@example.com');
|
||||
$recipient = $this->createUser('tk01a_recip@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
$this->em()->flush();
|
||||
|
||||
$client = $this->loginAs($recipient);
|
||||
$client->request('GET', '/token/' . $token->getUuid() . '/approve');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
// The valid approve page shows "Someone shared a photo" — NOT the invalid page
|
||||
$this->assertSelectorTextContains('h1', 'Someone shared a photo');
|
||||
}
|
||||
|
||||
/**
|
||||
* TK-01b: POST /token/{uuid}/approve with a valid token marks SharedImage as approved and consumes the token.
|
||||
*/
|
||||
public function test_approve_submit_valid_token_marks_approved_and_consumes(): void
|
||||
{
|
||||
$sender = $this->createUser('tk01b_sender@example.com');
|
||||
$recipient = $this->createUser('tk01b_recip@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
|
||||
// Also create a SharedImage so the controller can update its status
|
||||
$shared = new SharedImage($image, $recipient, $sender);
|
||||
$this->em()->persist($shared);
|
||||
$this->em()->flush();
|
||||
|
||||
$tokenUuid = $token->getUuid();
|
||||
$sharedId = $shared->getId();
|
||||
|
||||
$client = $this->loginAs($recipient);
|
||||
$client->request('POST', '/token/' . $tokenUuid . '/approve', [
|
||||
'device_ids' => [],
|
||||
]);
|
||||
|
||||
// Controller renders approved.html.twig on success (200)
|
||||
$this->assertResponseIsSuccessful();
|
||||
|
||||
// Token should now be marked used
|
||||
$this->em()->clear();
|
||||
$reloaded = $this->em()->find(Token::class, $tokenUuid);
|
||||
$this->assertNotNull($reloaded->getUsedAt(), 'Token should be consumed after successful submit');
|
||||
|
||||
// SharedImage status should be Approved
|
||||
$sharedReloaded = $this->em()->find(SharedImage::class, $sharedId);
|
||||
$this->assertSame(SharedImageStatus::Approved, $sharedReloaded->getStatus());
|
||||
$this->assertSame($recipient->getId(), $sharedReloaded->getRecipientUser()->getId());
|
||||
}
|
||||
|
||||
/**
|
||||
* TK-02: GET /token/{uuid}/approve with a missing UUID renders the invalid page.
|
||||
*/
|
||||
public function test_approve_show_missing_token_renders_invalid_page(): void
|
||||
{
|
||||
$user = $this->createUser('tk02@example.com');
|
||||
$this->em()->flush();
|
||||
|
||||
$client = $this->loginAs($user);
|
||||
$client->request('GET', '/token/00000000-0000-0000-0000-000000000000/approve');
|
||||
|
||||
$this->assertResponseIsSuccessful(); // controller returns 200 with invalid.html.twig
|
||||
$this->assertSelectorTextContains('body', 'expired');
|
||||
}
|
||||
|
||||
/**
|
||||
* TK-03: GET /token/{uuid}/approve with an already-used token renders the invalid page.
|
||||
*
|
||||
* TokenRepository::findValidToken() filters usedAt IS NULL, so a used token
|
||||
* is indistinguishable from a missing one — both return null → invalid page.
|
||||
*/
|
||||
public function test_approve_show_used_token_renders_invalid_page(): void
|
||||
{
|
||||
$sender = $this->createUser('tk03_sender@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
// Consume the token before the test
|
||||
$token->consume();
|
||||
$this->em()->flush();
|
||||
|
||||
$recipient = $this->createUser('tk03_recip@example.com');
|
||||
$client = $this->loginAs($recipient);
|
||||
$client->request('GET', '/token/' . $token->getUuid() . '/approve');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
$this->assertSelectorTextContains('body', 'expired');
|
||||
}
|
||||
|
||||
// TK-04: GET /token/{uuid}/approve without login renders the approve page (anonymous)
|
||||
public function test_approve_show_anonymous_shows_page(): void
|
||||
{
|
||||
$sender = $this->createUser('tk04_sender@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
$this->em()->flush();
|
||||
|
||||
$this->client->request('GET', '/token/' . $token->getUuid() . '/approve');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
$this->assertSelectorTextContains('h1', 'Someone shared a photo');
|
||||
}
|
||||
|
||||
// TK-05: POST /token/{uuid}/approve unauthenticated → redirects to /login
|
||||
public function test_approve_submit_unauthenticated_redirects_to_login(): void
|
||||
{
|
||||
$sender = $this->createUser('tk05_sender@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
$this->em()->flush();
|
||||
|
||||
$this->client->request('POST', '/token/' . $token->getUuid() . '/approve', [
|
||||
'device_ids' => [],
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects('/login');
|
||||
}
|
||||
|
||||
// TK-06: POST /token/{invalid}/approve → renders invalid page
|
||||
public function test_approve_submit_invalid_token_renders_invalid(): void
|
||||
{
|
||||
$user = $this->createUser('tk06@example.com');
|
||||
$client = $this->loginAs($user);
|
||||
|
||||
$client->request('POST', '/token/00000000-0000-0000-0000-000000000000/approve', [
|
||||
'device_ids' => [],
|
||||
]);
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
$this->assertSelectorTextContains('body', 'expired');
|
||||
}
|
||||
|
||||
// TK-07: GET /token/{uuid}/decline with valid token renders decline page
|
||||
public function test_decline_show_valid_token_renders_page(): void
|
||||
{
|
||||
$sender = $this->createUser('tk07_sender@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareDecline);
|
||||
$this->em()->flush();
|
||||
|
||||
$this->client->request('GET', '/token/' . $token->getUuid() . '/decline');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
|
||||
// TK-08: GET /token/{invalid}/decline → renders invalid page
|
||||
public function test_decline_show_invalid_token_renders_invalid_page(): void
|
||||
{
|
||||
$this->client->request('GET', '/token/00000000-0000-0000-0000-000000000000/decline');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
$this->assertSelectorTextContains('body', 'expired');
|
||||
}
|
||||
|
||||
// TK-09: POST /token/{uuid}/decline → sets SharedImage status to Declined
|
||||
public function test_decline_submit_updates_shared_image_to_declined(): void
|
||||
{
|
||||
$sender = $this->createUser('tk09_sender@example.com');
|
||||
$recipient = $this->createUser('tk09_recip@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareDecline);
|
||||
|
||||
$shared = new SharedImage($image, $recipient, $sender);
|
||||
$this->em()->persist($shared);
|
||||
$this->em()->flush();
|
||||
|
||||
$sharedId = $shared->getId();
|
||||
$client = $this->loginAs($recipient);
|
||||
$client->request('POST', '/token/' . $token->getUuid() . '/decline');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
|
||||
$this->em()->clear();
|
||||
$reloaded = $this->em()->find(SharedImage::class, $sharedId);
|
||||
$this->assertSame(\App\Enum\SharedImageStatus::Declined, $reloaded->getStatus());
|
||||
}
|
||||
|
||||
// TK-10: POST /token/{uuid}/decline without a matching SharedImage → succeeds
|
||||
public function test_decline_submit_without_shared_image_succeeds(): void
|
||||
{
|
||||
$sender = $this->createUser('tk10_sender@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareDecline);
|
||||
$this->em()->flush();
|
||||
|
||||
$user = $this->createUser('tk10_user@example.com');
|
||||
$client = $this->loginAs($user);
|
||||
$client->request('POST', '/token/' . $token->getUuid() . '/decline');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
|
||||
// TK-12: POST /token/{uuid}/approve with recipient's own device → approveForDevice is called
|
||||
public function test_approve_submit_with_owned_device_calls_approve_for_device(): void
|
||||
{
|
||||
$sender = $this->createUser('tk12_sender@example.com');
|
||||
$recipient = $this->createUser('tk12_recip@example.com');
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
|
||||
$ownDevice = new Device();
|
||||
$ownDevice->setMac('AA:BB:CC:00:55:66')->setName('My Frame');
|
||||
$ownDevice->setUser($recipient);
|
||||
$this->em()->persist($ownDevice);
|
||||
|
||||
$shared = new SharedImage($image, $recipient, $sender);
|
||||
$this->em()->persist($shared);
|
||||
$this->em()->flush();
|
||||
|
||||
$client = $this->loginAs($recipient);
|
||||
$client->request('POST', '/token/' . $token->getUuid() . '/approve', [
|
||||
'device_ids' => [$ownDevice->getId()],
|
||||
]);
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
|
||||
// TK-11: POST /token/{uuid}/approve with a device_id not owned by the user → device skipped (continue branch)
|
||||
public function test_approve_submit_with_unowned_device_id_is_skipped(): void
|
||||
{
|
||||
$sender = $this->createUser('tk11_sender@example.com');
|
||||
$recipient = $this->createUser('tk11_recip@example.com');
|
||||
$other = $this->createUser('tk11_other@example.com');
|
||||
|
||||
$image = $this->makeImage($sender);
|
||||
$token = $this->issueToken($image, TokenType::ShareApprove);
|
||||
|
||||
$otherDevice = new Device();
|
||||
$otherDevice->setMac('AA:BB:CC:00:44:55')->setName('Other Frame');
|
||||
$otherDevice->setUser($other);
|
||||
$this->em()->persist($otherDevice);
|
||||
|
||||
$this->em()->flush();
|
||||
|
||||
$client = $this->loginAs($recipient);
|
||||
$client->request('POST', '/token/' . $token->getUuid() . '/approve', [
|
||||
'device_ids' => [$otherDevice->getId()],
|
||||
]);
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user