85 lines
3.3 KiB
PHP
85 lines
3.3 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace Tests\Feature;
|
||
|
|
|
||
|
|
use App\Models\Investigation;
|
||
|
|
use App\Models\User;
|
||
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||
|
|
use Tests\TestCase;
|
||
|
|
|
||
|
|
class InvestigationReportTest extends TestCase
|
||
|
|
{
|
||
|
|
use RefreshDatabase;
|
||
|
|
|
||
|
|
public function test_owner_can_view_printable_report(): void
|
||
|
|
{
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$investigation = Investigation::factory()->for($user, 'owner')->create();
|
||
|
|
|
||
|
|
$this->actingAs($user)
|
||
|
|
->get(route('investigations.report', $investigation))
|
||
|
|
->assertOk()
|
||
|
|
->assertSee($investigation->name);
|
||
|
|
}
|
||
|
|
|
||
|
|
public function test_unrelated_user_cannot_view_report(): void
|
||
|
|
{
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$stranger = User::factory()->create();
|
||
|
|
$investigation = Investigation::factory()->for($user, 'owner')->create();
|
||
|
|
|
||
|
|
$this->actingAs($stranger)
|
||
|
|
->get(route('investigations.report', $investigation))
|
||
|
|
->assertForbidden();
|
||
|
|
}
|
||
|
|
|
||
|
|
public function test_csv_export_contains_finding_rows(): void
|
||
|
|
{
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$investigation = Investigation::factory()->for($user, 'owner')->create();
|
||
|
|
$target = $investigation->targets()->create(['type' => 'username', 'value' => 'someone', 'created_by' => $user->id]);
|
||
|
|
$source = \App\Models\Source::create([
|
||
|
|
'key' => 'test-source', 'name' => 'Test Source', 'target_types' => ['username'], 'enabled' => true,
|
||
|
|
]);
|
||
|
|
$target->findings()->create([
|
||
|
|
'source_id' => $source->id, 'status' => 'completed', 'summary' => 'Found it',
|
||
|
|
]);
|
||
|
|
|
||
|
|
$response = $this->actingAs($user)->get(route('investigations.export.csv', $investigation));
|
||
|
|
|
||
|
|
$response->assertOk();
|
||
|
|
$response->assertHeader('Content-Type', 'text/csv; charset=UTF-8');
|
||
|
|
$this->assertStringContainsString('Test Source', $response->getContent());
|
||
|
|
$this->assertStringContainsString('Found it', $response->getContent());
|
||
|
|
}
|
||
|
|
|
||
|
|
public function test_csv_export_neutralizes_formula_injection_in_target_value(): void
|
||
|
|
{
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$investigation = Investigation::factory()->for($user, 'owner')->create();
|
||
|
|
$target = $investigation->targets()->create(['type' => 'person', 'value' => 'safe name', 'created_by' => $user->id]);
|
||
|
|
$source = \App\Models\Source::create([
|
||
|
|
'key' => 'test-source', 'name' => 'Test Source', 'target_types' => ['person'], 'enabled' => true,
|
||
|
|
]);
|
||
|
|
$target->findings()->create([
|
||
|
|
'source_id' => $source->id, 'status' => 'completed', 'summary' => '=cmd|"/c calc"!A1',
|
||
|
|
]);
|
||
|
|
|
||
|
|
$response = $this->actingAs($user)->get(route('investigations.export.csv', $investigation));
|
||
|
|
|
||
|
|
$this->assertStringContainsString("'=cmd", $response->getContent());
|
||
|
|
}
|
||
|
|
|
||
|
|
public function test_json_export_includes_targets_and_findings(): void
|
||
|
|
{
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$investigation = Investigation::factory()->for($user, 'owner')->create();
|
||
|
|
$investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $user->id]);
|
||
|
|
|
||
|
|
$response = $this->actingAs($user)->get(route('investigations.export.json', $investigation));
|
||
|
|
|
||
|
|
$response->assertOk();
|
||
|
|
$response->assertJsonPath('targets.0.value', 'example.com');
|
||
|
|
}
|
||
|
|
}
|