famous-ly4-ev/app-modules/booking/tests/Feature/BookingPolicyTest.php

<?php

use App\Models\User;
use Modules\Booking\Models\Booking;
use Modules\Booking\Policies\BookingPolicy;
use Spatie\Permission\Models\Permission;

beforeEach(function () {
    foreach (['view_bookings', 'manage_bookings', 'process_refunds'] as $permission) {
        Permission::findOrCreate($permission, 'web');
    }
});

test('viewAny is open to any authenticated user — listing is scoped to their own bookings at the query level', function () {
    $policy = new BookingPolicy;

    expect($policy->viewAny(User::factory()->create()))->toBeTrue();
});

test('view allows the booking\'s owner', function () {
    $policy = new BookingPolicy;

    $owner = User::factory()->create();
    $booking = Booking::factory()->create(['user_id' => $owner->id]);

    expect($policy->view($owner, $booking))->toBeTrue();
});

test('view rejects a non-owner without the view_bookings permission', function () {
    $policy = new BookingPolicy;

    $stranger = User::factory()->create();
    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);

    expect($policy->view($stranger, $booking))->toBeFalse();
});

test('view allows a non-owner with the view_bookings permission (admin/support)', function () {
    $policy = new BookingPolicy;

    $admin = User::factory()->create()->givePermissionTo('view_bookings');
    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);

    expect($policy->view($admin, $booking))->toBeTrue();
});

test('create is open to any authenticated user', function () {
    $policy = new BookingPolicy;

    expect($policy->create(User::factory()->create()))->toBeTrue();
});

test('cancel allows the booking\'s owner', function () {
    $policy = new BookingPolicy;

    $owner = User::factory()->create();
    $booking = Booking::factory()->create(['user_id' => $owner->id]);

    expect($policy->cancel($owner, $booking))->toBeTrue();
});

test('cancel allows staff with the manage_bookings permission on someone else\'s booking', function () {
    $policy = new BookingPolicy;

    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);

    expect($policy->cancel($staff, $booking))->toBeTrue();
});

test('cancel rejects a non-owner without the manage_bookings permission', function () {
    $policy = new BookingPolicy;

    $stranger = User::factory()->create();
    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);

    expect($policy->cancel($stranger, $booking))->toBeFalse();
});

test('refund requires the process_refunds permission', function () {
    $policy = new BookingPolicy;

    $withPermission = User::factory()->create()->givePermissionTo('process_refunds');
    $withoutPermission = User::factory()->create();

    expect($policy->refund($withPermission, null))->toBeTrue()
        ->and($policy->refund($withoutPermission, null))->toBeFalse();
});