lan_kiosk/tests/Feature/SwishLookupAndStatusTest.php

<?php

namespace Tests\Feature;

use App\Models\Transaction;

class SwishLookupAndStatusTest extends SwishTestCase
{
    public function test_it_finds_a_customer_by_lan_id(): void
    {
        $customer = $this->customer(['lan_id' => 42, 'name' => 'Erik Olsson']);

        $this->getJson('/api/swish/lookup?lan_id=42')
            ->assertOk()
            ->assertJson([
                'customer_id' => $customer->id,
                'name'        => 'Erik O.',
                'member_name' => null,
            ]);
    }

    public function test_the_endpoint_never_hands_out_a_full_name(): void
    {
        // Anyone can call this without logging in, and lan_id is easy to guess,
        // so a surname must not be readable in the answer
        $this->customer(['lan_id' => 42, 'name' => 'Erik Olsson']);

        $response = $this->getJson('/api/swish/lookup?lan_id=42');

        $response->assertOk();
        $this->assertStringNotContainsString('Olsson', $response->getContent());
    }

    public function test_a_name_with_several_surnames_is_masked_all_the_way(): void
    {
        $this->customer(['lan_id' => 42, 'name' => 'Anna Maria Svensson Berg']);

        $this->getJson('/api/swish/lookup?lan_id=42')
            ->assertOk()
            ->assertJson(['name' => 'Anna M. S. B.']);
    }

    public function test_a_group_member_is_resolved_to_the_group_account(): void
    {
        $group = $this->customer([
            'lan_id' => 10, 'name' => 'Klanen', 'is_in_group' => 0, 'customer_group_id' => 7,
        ]);
        $this->customer([
            'lan_id' => 11, 'name' => 'Anna Svensson', 'is_in_group' => 1, 'customer_group_id' => 7,
        ]);

        // The payment goes to the group, but the page should greet Anna — and the
        // group's own name is a chosen label, so it is shown in full
        $this->getJson('/api/swish/lookup?lan_id=11')
            ->assertOk()
            ->assertJson([
                'customer_id' => $group->id,
                'name'        => 'Klanen',
                'member_name' => 'Anna S.',
            ]);
    }

    public function test_an_unknown_lan_id_gives_404(): void
    {
        $this->getJson('/api/swish/lookup?lan_id=999')->assertStatus(404);
    }

    public function test_a_member_without_a_group_account_gives_404(): void
    {
        $this->customer(['lan_id' => 11, 'is_in_group' => 1, 'customer_group_id' => 7]);

        $this->getJson('/api/swish/lookup?lan_id=11')->assertStatus(404);
    }

    public function test_the_status_endpoint_reports_the_payment(): void
    {
        $customer = $this->customer();
        $this->transaction(['customer_id' => $customer->id, 'status' => 'PAID', 'expected_amount' => 120]);

        $this->getJson('/api/swish/status?reference=LAN-TEST0001')
            ->assertOk()
            ->assertJson(['status' => 'PAID', 'amount' => 120]);
    }

    public function test_the_status_endpoint_never_exposes_the_callback_identifier(): void
    {
        $customer = $this->customer();
        $this->transaction(['customer_id' => $customer->id]);

        $response = $this->getJson('/api/swish/status?reference=LAN-TEST0001');

        $response->assertOk();
        $this->assertStringNotContainsString('aaaaaaaa-bbbb', $response->getContent());
    }

    public function test_an_unknown_reference_gives_404(): void
    {
        $this->getJson('/api/swish/status?reference=LAN-NOSUCHREF')->assertStatus(404);
    }

    public function test_stale_transactions_are_expired_rather_than_deleted(): void
    {
        $customer = $this->customer();
        $this->transaction(['customer_id' => $customer->id, 'payment_reference' => 'LAN-OLD00001'])
            ->forceFill(['created_at' => now()->subHours(3)])->save();
        $this->transaction(['customer_id' => $customer->id, 'payment_reference' => 'LAN-NEW00001']);

        $this->artisan('app:prune-stale-transactions')->assertSuccessful();

        $this->assertSame('expired', Transaction::firstWhere('payment_reference', 'LAN-OLD00001')->status);
        $this->assertSame('pending', Transaction::firstWhere('payment_reference', 'LAN-NEW00001')->status);
        $this->assertSame(2, Transaction::count());
    }
}