customer(['lan_id' => 42, 'name' => 'Erik Olsson']); $this->getJson('/api/swish/lookup?lan_id=42') ->assertOk() ->assertJson([ 'customer_id' => $customer->id, 'name' => 'Erik O.', 'member_name' => null, ]); } public function test_the_endpoint_never_hands_out_a_full_name(): void { // Anyone can call this without logging in, and lan_id is easy to guess, // so a surname must not be readable in the answer $this->customer(['lan_id' => 42, 'name' => 'Erik Olsson']); $response = $this->getJson('/api/swish/lookup?lan_id=42'); $response->assertOk(); $this->assertStringNotContainsString('Olsson', $response->getContent()); } public function test_a_name_with_several_surnames_is_masked_all_the_way(): void { $this->customer(['lan_id' => 42, 'name' => 'Anna Maria Svensson Berg']); $this->getJson('/api/swish/lookup?lan_id=42') ->assertOk() ->assertJson(['name' => 'Anna M. S. B.']); } public function test_a_group_member_is_resolved_to_the_group_account(): void { $group = $this->customer([ 'lan_id' => 10, 'name' => 'Klanen', 'is_in_group' => 0, 'customer_group_id' => 7, ]); $this->customer([ 'lan_id' => 11, 'name' => 'Anna Svensson', 'is_in_group' => 1, 'customer_group_id' => 7, ]); // The payment goes to the group, but the page should greet Anna — and the // group's own name is a chosen label, so it is shown in full $this->getJson('/api/swish/lookup?lan_id=11') ->assertOk() ->assertJson([ 'customer_id' => $group->id, 'name' => 'Klanen', 'member_name' => 'Anna S.', ]); } public function test_an_unknown_lan_id_gives_404(): void { $this->getJson('/api/swish/lookup?lan_id=999')->assertStatus(404); } public function test_a_member_without_a_group_account_gives_404(): void { $this->customer(['lan_id' => 11, 'is_in_group' => 1, 'customer_group_id' => 7]); $this->getJson('/api/swish/lookup?lan_id=11')->assertStatus(404); } public function test_the_status_endpoint_reports_the_payment(): void { $customer = $this->customer(); $this->transaction(['customer_id' => $customer->id, 'status' => 'PAID', 'expected_amount' => 120]); $this->getJson('/api/swish/status?reference=LAN-TEST0001') ->assertOk() ->assertJson(['status' => 'PAID', 'amount' => 120]); } public function test_the_status_endpoint_never_exposes_the_callback_identifier(): void { $customer = $this->customer(); $this->transaction(['customer_id' => $customer->id]); $response = $this->getJson('/api/swish/status?reference=LAN-TEST0001'); $response->assertOk(); $this->assertStringNotContainsString('aaaaaaaa-bbbb', $response->getContent()); } public function test_an_unknown_reference_gives_404(): void { $this->getJson('/api/swish/status?reference=LAN-NOSUCHREF')->assertStatus(404); } public function test_stale_transactions_are_expired_rather_than_deleted(): void { $customer = $this->customer(); $this->transaction(['customer_id' => $customer->id, 'payment_reference' => 'LAN-OLD00001']) ->forceFill(['created_at' => now()->subHours(3)])->save(); $this->transaction(['customer_id' => $customer->id, 'payment_reference' => 'LAN-NEW00001']); $this->artisan('app:prune-stale-transactions')->assertSuccessful(); $this->assertSame('expired', Transaction::firstWhere('payment_reference', 'LAN-OLD00001')->status); $this->assertSame('pending', Transaction::firstWhere('payment_reference', 'LAN-NEW00001')->status); $this->assertSame(2, Transaction::count()); } }