24 lines
917 B
PHP
24 lines
917 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Services\Auth\RoleCapabilityMap;
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\TenantRole;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Gate;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('removes the acknowledged findings capability alias from shared RBAC truth', function (): void {
|
|
expect(Capabilities::isKnown('tenant_findings.acknowledge'))->toBeFalse();
|
|
expect(RoleCapabilityMap::rolesWithCapability('tenant_findings.acknowledge'))->toBe([]);
|
|
});
|
|
|
|
it('keeps the canonical findings triage capability available to operators', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'operator');
|
|
|
|
expect(RoleCapabilityMap::hasCapability(TenantRole::Operator, Capabilities::TENANT_FINDINGS_TRIAGE))->toBeTrue();
|
|
expect(Gate::forUser($user)->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeTrue();
|
|
});
|