osint/tests/Feature/TargetManagementTest.php

<?php

namespace Tests\Feature;

use App\Models\Investigation;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class TargetManagementTest extends TestCase
{
    use RefreshDatabase;

    public function test_editor_can_add_a_valid_target(): void
    {
        $owner = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.targets.store', $investigation), [
                'type' => 'username',
                'value' => 'valid_user.name',
            ])
            ->assertRedirect(route('investigations.show', $investigation));

        $this->assertDatabaseHas('targets', [
            'investigation_id' => $investigation->id,
            'type' => 'username',
            'value' => 'valid_user.name',
        ]);
    }

    public function test_username_target_rejects_unsafe_characters(): void
    {
        $owner = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.targets.store', $investigation), [
                'type' => 'username',
                'value' => '../../etc/passwd',
            ])
            ->assertSessionHasErrors('value');

        $this->assertDatabaseCount('targets', 0);
    }

    public function test_email_target_requires_valid_email_format(): void
    {
        $owner = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.targets.store', $investigation), [
                'type' => 'email',
                'value' => 'not-an-email',
            ])
            ->assertSessionHasErrors('value');
    }

    public function test_ip_target_requires_valid_ip_format(): void
    {
        $owner = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.targets.store', $investigation), [
                'type' => 'ip',
                'value' => 'not-an-ip',
            ])
            ->assertSessionHasErrors('value');
    }

    public function test_viewer_cannot_add_targets(): void
    {
        $owner = User::factory()->create();
        $viewer = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();
        $investigation->users()->attach($viewer, ['role' => 'viewer']);

        $this->actingAs($viewer)
            ->post(route('investigations.targets.store', $investigation), [
                'type' => 'username',
                'value' => 'someone',
            ])
            ->assertForbidden();
    }

    public function test_editor_can_delete_a_target(): void
    {
        $owner = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();
        $target = $investigation->targets()->create([
            'type' => 'username',
            'value' => 'someone',
            'created_by' => $owner->id,
        ]);

        $this->actingAs($owner)
            ->delete(route('investigations.targets.destroy', [$investigation, $target]))
            ->assertRedirect(route('investigations.show', $investigation));

        $this->assertDatabaseMissing('targets', ['id' => $target->id]);
    }
}