whisper-money/tests/Feature/Settings/AccountTest.php

<?php

use App\Enums\AccountType;
use App\Models\Account;
use App\Models\Bank;
use App\Models\Transaction;
use App\Models\User;

use function Pest\Laravel\actingAs;
use function Pest\Laravel\assertDatabaseHas;

beforeEach(function () {
    $this->user = User::factory()->create();
    $this->bank = Bank::factory()->create();
});

it('displays user accounts on index page', function () {
    actingAs($this->user);

    $account = Account::factory()->create([
        'user_id' => $this->user->id,
        'bank_id' => $this->bank->id,
    ]);

    $response = $this->get(route('accounts.index'));

    $response->assertSuccessful();
    $response->assertInertia(fn ($page) => $page
        ->component('settings/accounts')
        ->has('accounts', 1));
});

it('can create a new account with plaintext name', function () {
    actingAs($this->user);

    $data = [
        'name' => 'My Checking Account',
        'bank_id' => $this->bank->id,
        'currency_code' => 'USD',
        'type' => AccountType::Checking->value,
    ];

    $response = $this->post(route('accounts.store'), $data);

    $response->assertRedirect(route('accounts.index'));
    assertDatabaseHas('accounts', [
        'user_id' => $this->user->id,
        'bank_id' => $this->bank->id,
        'name' => 'My Checking Account',
        'name_iv' => null,
        'encrypted' => false,
        'currency_code' => 'USD',
        'type' => AccountType::Checking->value,
    ]);
});

it('validates required fields when creating account', function () {
    actingAs($this->user);

    $response = $this->post(route('accounts.store'), []);

    $response->assertSessionHasErrors(['name', 'bank_id', 'currency_code', 'type']);
});

it('validates currency_code must be in allowed list', function () {
    actingAs($this->user);

    $response = $this->post(route('accounts.store'), [
        'name' => 'My Account',
        'bank_id' => $this->bank->id,
        'currency_code' => 'INVALID',
        'type' => AccountType::Checking->value,
    ]);

    $response->assertSessionHasErrors(['currency_code']);
});

it('validates type must be valid AccountType', function () {
    actingAs($this->user);

    $response = $this->post(route('accounts.store'), [
        'name' => 'My Account',
        'bank_id' => $this->bank->id,
        'currency_code' => 'USD',
        'type' => 'invalid_type',
    ]);

    $response->assertSessionHasErrors(['type']);
});

it('can update an account', function () {
    actingAs($this->user);

    $account = Account::factory()->create([
        'user_id' => $this->user->id,
        'bank_id' => $this->bank->id,
    ]);

    $newBank = Bank::factory()->create();

    $data = [
        'name' => 'Updated Account Name',
        'bank_id' => $newBank->id,
        'currency_code' => 'EUR',
        'type' => AccountType::Savings->value,
    ];

    $response = $this->patch(route('accounts.update', $account), $data);

    $response->assertRedirect(route('accounts.index'));
    assertDatabaseHas('accounts', [
        'id' => $account->id,
        'name' => 'Updated Account Name',
        'encrypted' => false,
        'name_iv' => null,
        'bank_id' => $newBank->id,
        'currency_code' => 'EUR',
        'type' => AccountType::Savings->value,
    ]);
});

it('prevents updating another users account', function () {
    $otherUser = User::factory()->create();
    $account = Account::factory()->create([
        'user_id' => $otherUser->id,
        'bank_id' => $this->bank->id,
    ]);

    actingAs($this->user);

    $response = $this->patch(route('accounts.update', $account), [
        'name' => 'hacked_name',
        'bank_id' => $this->bank->id,
        'currency_code' => 'USD',
        'type' => AccountType::Checking->value,
    ]);

    $response->assertForbidden();
});

it('can delete an account', function () {
    actingAs($this->user);

    $account = Account::factory()->create([
        'user_id' => $this->user->id,
        'bank_id' => $this->bank->id,
    ]);

    $response = $this->delete(route('accounts.destroy', $account));

    $response->assertRedirect(route('accounts.index'));
    expect(Account::withTrashed()->find($account->id))->not->toBeNull();
    expect(Account::withTrashed()->find($account->id)->deleted_at)->not->toBeNull();
    expect(Account::find($account->id))->toBeNull();
});

it('deletes all transactions when deleting account', function () {
    actingAs($this->user);

    $account = Account::factory()->create([
        'user_id' => $this->user->id,
        'bank_id' => $this->bank->id,
    ]);

    $transaction1 = Transaction::factory()->create([
        'user_id' => $this->user->id,
        'account_id' => $account->id,
    ]);

    $transaction2 = Transaction::factory()->create([
        'user_id' => $this->user->id,
        'account_id' => $account->id,
    ]);

    $response = $this->delete(route('accounts.destroy', $account));

    $response->assertRedirect(route('accounts.index'));
    expect(Account::find($account->id))->toBeNull();
    expect(Account::withTrashed()->find($account->id))->not->toBeNull();
    expect(Transaction::find($transaction1->id))->toBeNull();
    expect(Transaction::find($transaction2->id))->toBeNull();
});

it('prevents deleting another users account', function () {
    $otherUser = User::factory()->create();
    $account = Account::factory()->create([
        'user_id' => $otherUser->id,
        'bank_id' => $this->bank->id,
    ]);

    actingAs($this->user);

    $response = $this->delete(route('accounts.destroy', $account));

    $response->assertForbidden();
    assertDatabaseHas('accounts', ['id' => $account->id]);
});