diff --git a/tests/Feature/AdminPlatformOrderShowBatchRunIdLinksShouldUseOrderShowSelfBackWhenOuterBackSafeTest.php b/tests/Feature/AdminPlatformOrderShowBatchRunIdLinksShouldUseOrderShowSelfBackWhenOuterBackSafeTest.php new file mode 100644 index 0000000..d507708 --- /dev/null +++ b/tests/Feature/AdminPlatformOrderShowBatchRunIdLinksShouldUseOrderShowSelfBackWhenOuterBackSafeTest.php @@ -0,0 +1,91 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_batch_run_id_links_should_use_order_show_self_back_when_outer_back_safe(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'po_show_batch_run_id_safe_back_plan', + 'name' => '订单详情批次回链安全测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $order = PlatformOrder::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'order_no' => 'PO_SHOW_BATCH_SAFE_BACK_0001', + 'order_type' => 'new_purchase', + 'status' => 'pending', + 'payment_status' => 'paid', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'quantity' => 1, + 'payable_amount' => 10, + 'paid_amount' => 10, + 'placed_at' => now(), + 'paid_at' => now(), + 'meta' => [ + 'batch_activation' => ['run_id' => 'RUN_BAS_ORDER_SAFE_0001'], + 'batch_mark_paid_and_activate' => ['run_id' => 'RUN_BMPA_ORDER_SAFE_0001'], + ], + ]); + + $safeBack = '/admin/platform-orders?' . Arr::query([ + 'status' => 'pending', + 'keyword' => '批次详情', + ]); + + $res = $this->get('/admin/platform-orders/' . $order->id . '?back=' . urlencode($safeBack)); + $res->assertOk(); + + $orderShowSelf = '/admin/platform-orders/' . $order->id; + $expectedBasUrl = '/admin/platform-batches/show?' . Arr::query([ + 'type' => 'bas', + 'run_id' => 'RUN_BAS_ORDER_SAFE_0001', + 'back' => $orderShowSelf, + ]); + $expectedBmpaUrl = '/admin/platform-batches/show?' . Arr::query([ + 'type' => 'bmpa', + 'run_id' => 'RUN_BMPA_ORDER_SAFE_0001', + 'back' => $orderShowSelf, + ]); + + $res->assertSee('href="' . $safeBack . '"', false); + $res->assertSee('返回上一页(保留上下文)'); + $res->assertSee($expectedBasUrl, false); + $res->assertSee($expectedBmpaUrl, false); + $res->assertDontSee('run_id=RUN_BAS_ORDER_SAFE_0001&back=' . $safeBack, false); + $res->assertDontSee('run_id=RUN_BMPA_ORDER_SAFE_0001&back=' . $safeBack, false); + $res->assertDontSee('back%3D', false); + } +} diff --git a/tests/Feature/AdminSiteSubscriptionShowBatchRunIdLinksShouldUseSubscriptionShowSelfBackWhenOuterBackSafeTest.php b/tests/Feature/AdminSiteSubscriptionShowBatchRunIdLinksShouldUseSubscriptionShowSelfBackWhenOuterBackSafeTest.php new file mode 100644 index 0000000..eb17f8f --- /dev/null +++ b/tests/Feature/AdminSiteSubscriptionShowBatchRunIdLinksShouldUseSubscriptionShowSelfBackWhenOuterBackSafeTest.php @@ -0,0 +1,109 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_batch_run_id_links_should_use_subscription_show_self_back_when_outer_back_safe(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'sub_show_batch_run_id_safe_back_plan', + 'name' => '订阅详情批次回链安全测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $subscription = SiteSubscription::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'subscription_no' => 'SUB_SHOW_BATCH_SAFE_BACK_0001', + 'status' => 'activated', + 'source' => 'manual', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'amount' => 10, + 'starts_at' => now()->subDay(), + 'ends_at' => now()->addMonth(), + 'activated_at' => now()->subDay(), + ]); + + PlatformOrder::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'site_subscription_id' => $subscription->id, + 'order_no' => 'PO_SUB_SHOW_BATCH_SAFE_BACK_0001', + 'order_type' => 'renewal', + 'status' => 'activated', + 'payment_status' => 'paid', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'quantity' => 1, + 'payable_amount' => 10, + 'paid_amount' => 10, + 'placed_at' => now(), + 'paid_at' => now(), + 'activated_at' => now(), + 'meta' => [ + 'batch_activation' => ['run_id' => 'RUN_BAS_SUB_SAFE_0001'], + 'batch_mark_paid_and_activate' => ['run_id' => 'RUN_BMPA_SUB_SAFE_0001'], + ], + ]); + + $safeBack = '/admin/site-subscriptions?' . Arr::query([ + 'status' => 'activated', + 'keyword' => '批次详情', + ]); + + $res = $this->get('/admin/site-subscriptions/' . $subscription->id . '?back=' . urlencode($safeBack)); + $res->assertOk(); + + $subscriptionShowSelf = '/admin/site-subscriptions/' . $subscription->id; + $expectedBasUrl = '/admin/platform-batches/show?' . Arr::query([ + 'type' => 'bas', + 'run_id' => 'RUN_BAS_SUB_SAFE_0001', + 'back' => $subscriptionShowSelf, + ]); + $expectedBmpaUrl = '/admin/platform-batches/show?' . Arr::query([ + 'type' => 'bmpa', + 'run_id' => 'RUN_BMPA_SUB_SAFE_0001', + 'back' => $subscriptionShowSelf, + ]); + + $res->assertSee('href="' . $safeBack . '"', false); + $res->assertSee('返回上一页(保留上下文)'); + $res->assertSee($expectedBasUrl, false); + $res->assertSee($expectedBmpaUrl, false); + $res->assertDontSee('run_id=RUN_BAS_SUB_SAFE_0001&back=' . $safeBack, false); + $res->assertDontSee('run_id=RUN_BMPA_SUB_SAFE_0001&back=' . $safeBack, false); + $res->assertDontSee('back%3D', false); + } +}