diff --git a/tests/Feature/AdminSiteSubscriptionShowCreateRenewalOrderLinkShouldUseSelfBackWhenOuterBackUnsafeTest.php b/tests/Feature/AdminSiteSubscriptionShowCreateRenewalOrderLinkShouldUseSelfBackWhenOuterBackUnsafeTest.php new file mode 100644 index 0000000..b8ce1d0 --- /dev/null +++ b/tests/Feature/AdminSiteSubscriptionShowCreateRenewalOrderLinkShouldUseSelfBackWhenOuterBackUnsafeTest.php @@ -0,0 +1,67 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_subscription_show_page_create_renewal_order_link_should_still_use_subscription_show_self_back_when_outer_back_is_unsafe(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'sub_show_create_renewal_unsafe_back_test', + 'name' => '订阅详情创建续费订单 unsafe back 测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $sub = SiteSubscription::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'status' => 'activated', + 'source' => 'manual', + 'subscription_no' => 'SUB_SHOW_CREATE_RENEWAL_UNSAFE_BACK_0001', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'amount' => 10, + 'starts_at' => now()->subDay(), + 'ends_at' => now()->addMonth(), + 'activated_at' => now()->subDay(), + ]); + + $unsafeBack = '/admin/site-subscriptions?status=activated&back=/admin/platform-orders/create'; + $res = $this->get('/admin/site-subscriptions/' . $sub->id . '?back=' . urlencode($unsafeBack)); + $res->assertOk(); + + $expectedBack = urlencode('/admin/site-subscriptions/' . $sub->id); + + $res->assertSee('/admin/platform-orders/create?merchant_id=' . $merchant->id . '&plan_id=' . $plan->id . '&site_subscription_id=' . $sub->id . '&order_type=renewal&require_subscription=1&quantity=1', false); + $res->assertSee('back=' . $expectedBack, false); + $res->assertDontSee(urlencode($unsafeBack), false); + $res->assertDontSee('back%3D', false); + } +}