ad2a78a989
Sharing certificates now creates a Share: a public page behind an
unguessable token where the recipient views and downloads the selected
certificates individually or as a ZIP, instead of receiving links or
attachments by email.
- Share model + certificate_share pivot; expiration (1/7/30 days),
optional password (encrypted so the owner can re-view it), revocation,
and open tracking
- Public routes under shared/{token}: password unlock gate (throttled,
session-scoped), per-certificate download, on-the-fly ZIP that is
AES-256 encrypted when the share has a password, friendly 410 page
for expired/revoked links
- Share modal on the certificates index now creates the page and
reveals a copyable link + password; optional transactional email
(ShareCreatedMail) still sends the link to a recipient
- New Shares page in the sidebar to copy links, look up passwords,
revoke, and delete shares
- Old signed-URL controller and both attachment/link mailables removed;
Dutch translations updated; Pest coverage for the full lifecycle
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
64 lines
1.8 KiB
PHP
64 lines
1.8 KiB
PHP
<?php
|
|
|
|
use App\Models\Share;
|
|
use App\Models\User;
|
|
use Illuminate\Database\Eloquent\ModelNotFoundException;
|
|
use Livewire\Livewire;
|
|
|
|
test('the shares page lists the owner shares', function () {
|
|
$user = User::factory()->create();
|
|
$share = Share::factory()->for($user)->create(['recipient_email' => 'client@example.com']);
|
|
|
|
$this->actingAs($user)
|
|
->get(route('shares.index'))
|
|
->assertOk()
|
|
->assertSee('client@example.com');
|
|
});
|
|
|
|
test('shares from other users are hidden', function () {
|
|
Share::factory()->create(['recipient_email' => 'client@example.com']);
|
|
|
|
$this->actingAs(User::factory()->create())
|
|
->get(route('shares.index'))
|
|
->assertOk()
|
|
->assertDontSee('client@example.com');
|
|
});
|
|
|
|
test('a share can be revoked', function () {
|
|
$user = User::factory()->create();
|
|
$share = Share::factory()->for($user)->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
Livewire::test('pages::shares.index')
|
|
->call('revoke', $share->id);
|
|
|
|
expect($share->refresh()->revoked_at)->not->toBeNull();
|
|
});
|
|
|
|
test('a share can be deleted', function () {
|
|
$user = User::factory()->create();
|
|
$share = Share::factory()->for($user)->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
Livewire::test('pages::shares.index')
|
|
->call('delete', $share->id);
|
|
|
|
expect(Share::withoutGlobalScopes()->count())->toBe(0);
|
|
});
|
|
|
|
test('another user cannot revoke a share they do not own', function () {
|
|
$share = Share::factory()->create();
|
|
|
|
$this->actingAs(User::factory()->create());
|
|
|
|
expect(fn () => Livewire::test('pages::shares.index')->call('revoke', $share->id))
|
|
->toThrow(ModelNotFoundException::class);
|
|
|
|
expect($share->refresh()->revoked_at)->toBeNull();
|
|
});
|
|
|
|
test('guests are redirected to login', function () {
|
|
$this->get(route('shares.index'))->assertRedirect(route('login'));
|
|
});
|