portal/app/tests/Feature/DealTransitionTest.php

<?php

declare(strict_types=1);

use App\Models\ActivityLog;
use App\Models\Deal;
use App\Models\Project;
use App\Models\Tenant;
use Illuminate\Foundation\Testing\DatabaseTransactions;
use Illuminate\Support\Facades\DB;

/**
 * Тесты POST /api/deals/transition — bulk status-update для DealsView bulk-actions.
 *
 * Покрывает: validation (422 на missing/неизвестный slug), RLS+app-фильтр
 * (чужие сделки НЕ обновляются), ActivityLog event=deal.status_changed,
 * 404 unknown tenant, NO-OP не пишет audit entry, partial update (несколько id
 * принадлежат tenant'у, один — нет → updated < requested).
 */
uses(DatabaseTransactions::class);

beforeEach(function () {
    $this->tenant = Tenant::factory()->create();
    $this->otherTenant = Tenant::factory()->create();

    DB::statement('SET app.current_tenant_id = '.$this->tenant->id);
    $this->project = Project::factory()->for($this->tenant)->create();
});

test('POST /api/deals/transition — 422 без обязательных полей', function () {
    $this->postJson('/api/deals/transition', [])->assertStatus(422);
});

test('POST /api/deals/transition — 404 на unknown tenant', function () {
    $r = $this->postJson('/api/deals/transition', [
        'tenant_id' => 999999,
        'ids' => [1],
        'status' => 'paid',
    ]);
    $r->assertStatus(404);
});

test('POST /api/deals/transition — 422 на неизвестный status slug', function () {
    $deal = Deal::factory()->for($this->tenant)->for($this->project)->create(['status' => 'new']);

    $r = $this->postJson('/api/deals/transition', [
        'tenant_id' => $this->tenant->id,
        'ids' => [$deal->id],
        'status' => 'not_a_real_slug',
    ]);

    $r->assertStatus(422);
    expect($r->json('errors.status.0'))->toContain('lead_statuses');

    // Сделка осталась в исходном статусе.
    $deal->refresh();
    expect($deal->status)->toBe('new');
});

test('POST /api/deals/transition — обновляет статус и пишет ActivityLog', function () {
    $deals = Deal::factory()->count(3)->for($this->tenant)->for($this->project)->create(['status' => 'new']);

    $r = $this->postJson('/api/deals/transition', [
        'tenant_id' => $this->tenant->id,
        'ids' => $deals->pluck('id')->all(),
        'status' => 'paid',
    ]);

    $r->assertStatus(200)->assertJson([
        'updated' => 3,
        'requested' => 3,
        'status' => 'paid',
    ]);

    foreach ($deals as $d) {
        $d->refresh();
        expect($d->status)->toBe('paid');
    }

    $activity = ActivityLog::where('tenant_id', $this->tenant->id)
        ->where('event', ActivityLog::EVENT_DEAL_STATUS_CHANGED)
        ->get();
    expect($activity)->toHaveCount(3);
    expect($activity->first()->context)->toMatchArray([
        'from' => 'new',
        'to' => 'paid',
        'source' => 'bulk',
    ]);
});

test('POST /api/deals/transition — NO-OP не пишет ActivityLog', function () {
    $deal = Deal::factory()->for($this->tenant)->for($this->project)->create(['status' => 'paid']);

    $r = $this->postJson('/api/deals/transition', [
        'tenant_id' => $this->tenant->id,
        'ids' => [$deal->id],
        'status' => 'paid',
    ]);

    $r->assertStatus(200)->assertJson(['updated' => 0, 'requested' => 1]);

    expect(ActivityLog::where('deal_id', $deal->id)
        ->where('event', ActivityLog::EVENT_DEAL_STATUS_CHANGED)
        ->count())->toBe(0);
});

test('POST /api/deals/transition — defense-in-depth не апдейтит чужие сделки', function () {
    $own = Deal::factory()->for($this->tenant)->for($this->project)->create(['status' => 'new']);

    DB::statement('SET app.current_tenant_id = '.$this->otherTenant->id);
    $foreignProject = Project::factory()->for($this->otherTenant)->create();
    $foreign = Deal::factory()->for($this->otherTenant)->for($foreignProject)->create(['status' => 'new']);

    // Передаём оба id, но tenant_id указываем наш — чужой не должен обновиться.
    $r = $this->postJson('/api/deals/transition', [
        'tenant_id' => $this->tenant->id,
        'ids' => [$own->id, $foreign->id],
        'status' => 'paid',
    ]);

    $r->assertStatus(200)->assertJson([
        'updated' => 1,
        'requested' => 2,
    ]);

    DB::statement('SET app.current_tenant_id = '.$this->tenant->id);
    $own->refresh();
    expect($own->status)->toBe('paid');

    DB::statement('SET app.current_tenant_id = '.$this->otherTenant->id);
    $foreign->refresh();
    expect($foreign->status)->toBe('new');
});

test('POST /api/deals/transition — 422 если ids пустой массив', function () {
    $this->postJson('/api/deals/transition', [
        'tenant_id' => $this->tenant->id,
        'ids' => [],
        'status' => 'paid',
    ])->assertStatus(422);
});