fix(security): make commission_percent & active admin-only on PATCH representation

A representation editing its own record could raise its own commission or self-activate (privilege escalation). Restrict both fields to ROLE_ADMIN and range-check commission (0–100). Owner can still edit name/city/bank. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-28 17:36:48 +03:30
parent e456809b55
commit 6bd49c2d3e
3 changed files with 112 additions and 6 deletions
@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Tests\Representation;
+
+use App\Representation\Entity\Representation;
+use App\Tests\ApiTestCase;
+
+/**
+ * commission_percent / active are admin-only on PATCH representation, and the
+ * commission value is range-checked. Guards against a representative raising
+ * their own commission or self-activating.
+ */
+class RepresentationCommissionTest extends ApiTestCase
+{
+    private function makeRep(): array
+    {
+        $owner = $this->createUser(['ROLE_USER', 'ROLE_REPRESENTATION']);
+        $rep = new Representation($owner, 'نماینده تست');
+        $rep->setCommissionPercent('10');
+        $this->em->persist($rep);
+        $this->em->flush();
+
+        return [$owner, $rep];
+    }
+
+    public function testOwnerCannotChangeOwnCommission(): void
+    {
+        [$owner, $rep] = $this->makeRep();
+        $this->authJson('PATCH', '/api/v1/representation/' . $rep->getUuid(), $owner, [
+            'commission_percent' => 90,
+        ]);
+        $this->assertSame(403, $this->responseCode());
+
+        $this->em->clear();
+        $fresh = $this->em->getRepository(Representation::class)->find($rep->getId());
+        $this->assertSame(10.0, (float) $fresh->getCommissionPercent());
+    }
+
+    public function testOwnerCannotSelfActivate(): void
+    {
+        [$owner, $rep] = $this->makeRep();
+        $this->authJson('PATCH', '/api/v1/representation/' . $rep->getUuid(), $owner, [
+            'active' => true,
+        ]);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testAdminCanChangeCommission(): void
+    {
+        [, $rep] = $this->makeRep();
+        $admin = $this->createUser(['ROLE_ADMIN']);
+        $this->authJson('PATCH', '/api/v1/representation/' . $rep->getUuid(), $admin, [
+            'commission_percent' => 25,
+        ]);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testAdminRejectedOnOutOfRangeCommission(): void
+    {
+        [, $rep] = $this->makeRep();
+        $admin = $this->createUser(['ROLE_ADMIN']);
+        $this->authJson('PATCH', '/api/v1/representation/' . $rep->getUuid(), $admin, [
+            'commission_percent' => 150,
+        ]);
+        $this->assertSame(422, $this->responseCode());
+    }
+
+    public function testOwnerCanStillEditOwnName(): void
+    {
+        [$owner, $rep] = $this->makeRep();
+        $this->authJson('PATCH', '/api/v1/representation/' . $rep->getUuid(), $owner, [
+            'full_name' => 'نام جدید',
+        ]);
+        $this->assertSame(200, $this->responseCode());
+    }
+}