test(supplier-webhook): assert JSON 422 for non-JSON Accept clients (failing)

Reproduces 302-redirect bug observed on prod 2026-05-25 — when supplier crm.bp-gr.ru POSTs without Accept: application/json, Laravel renders ValidationException as redirect to /, losing body. Test calls webhook without Accept header and asserts JSON 422 response. Will fail until bootstrap/app.php has render(ValidationException) for api/webhook/supplier/*.
2026-05-25 16:29:01 +03:00
parent 58784b182d
commit b92d9b3bfc
1 changed files with 65 additions and 0 deletions
@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\SystemSetting;
+use Illuminate\Foundation\Testing\DatabaseTransactions;
+
+uses(DatabaseTransactions::class);
+
+beforeEach(function () {
+    SystemSetting::query()
+        ->where('key', 'supplier_webhook_secret')
+        ->update(['value' => 'test-secret-32chars-aaaaaaaaaaaaaa']);
+    SystemSetting::query()
+        ->where('key', 'supplier_ip_allowlist')
+        ->update(['value' => '[]']);
+});
+
+it('returns 422 JSON when supplier posts invalid payload WITHOUT Accept: application/json header', function () {
+    // Воспроизводит реальное поведение crm.bp-gr.ru: POST без Accept-JSON.
+    // До фикса (302→422) Laravel редиректил на / с Set-Cookie, поставщик
+    // терял тело запроса. После фикса всегда JSON.
+    $response = $this->call(
+        'POST',
+        '/api/webhook/supplier/test-secret-32chars-aaaaaaaaaaaaaa',
+        [], // params
+        [], // cookies
+        [], // files
+        ['HTTP_CONTENT_TYPE' => 'application/x-www-form-urlencoded'], // server: НЕТ Accept JSON
+        http_build_query([
+            'vid' => 1,
+            'project' => 'invalid_no_b_prefix',
+            'phone' => '79991234567',
+            'time' => time(),
+        ])
+    );
+
+    $response->assertStatus(422);
+    expect($response->headers->get('Content-Type'))->toContain('application/json');
+    $response->assertJsonStructure(['message', 'errors' => ['project']]);
+});
+
+it('still works correctly for postJson clients (regression)', function () {
+    $response = $this->postJson('/api/webhook/supplier/test-secret-32chars-aaaaaaaaaaaaaa', [
+        'vid' => 1,
+        'project' => 'invalid_no_b_prefix',
+        'phone' => '79991234567',
+        'time' => time(),
+    ]);
+
+    $response->assertStatus(422)->assertJsonValidationErrors('project');
+});
+
+it('non-webhook routes still use default render (no JSON forced)', function () {
+    // Регрессионный тест: дефолтный render остальных routes не сломан
+    // (например /login — должен возвращать redirect, а не JSON).
+    $response = $this->call(
+        'POST',
+        '/login',
+        ['email' => 'bad', 'password' => ''],
+        [], [], [],
+    );
+    // Любой не-200 кроме 422-JSON допустим — главное чтобы наш fix не перехватил
+    expect($response->headers->get('Content-Type'))->not->toContain('application/json');
+});