base commit

tests/Feature/Policies/DepartmentPolicyTest.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Department;
+
+beforeEach(function (): void {
+    seedRoles();
+});
+
+it('allows viewers to read departments but not modify them', function (): void {
+    $viewer = createUserWithRole('viewer');
+    $department = Department::factory()->create();
+
+    expect($viewer->can('viewAny', Department::class))->toBeTrue()
+        ->and($viewer->can('view', $department))->toBeTrue()
+        ->and($viewer->can('create', Department::class))->toBeFalse()
+        ->and($viewer->can('update', $department))->toBeFalse()
+        ->and($viewer->can('delete', $department))->toBeFalse();
+});
+
+it('grants administrators full department access', function (): void {
+    $admin = createUserWithRole('administrator');
+    $department = Department::factory()->create();
+
+    expect($admin->can('viewAny', Department::class))->toBeTrue()
+        ->and($admin->can('view', $department))->toBeTrue()
+        ->and($admin->can('create', Department::class))->toBeTrue()
+        ->and($admin->can('update', $department))->toBeTrue()
+        ->and($admin->can('delete', $department))->toBeTrue();
+});
+
+it('grants super admin full department access', function (): void {
+    $superAdmin = createAdminUser();
+    $department = Department::factory()->create();
+
+    expect($superAdmin->can('viewAny', Department::class))->toBeTrue()
+        ->and($superAdmin->can('create', Department::class))->toBeTrue()
+        ->and($superAdmin->can('update', $department))->toBeTrue()
+        ->and($superAdmin->can('delete', $department))->toBeTrue();
+});

tests/Feature/Policies/EmployeePolicyTest.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Department;
+use App\Models\Employee;
+
+beforeEach(function (): void {
+    seedRoles();
+});
+
+it('allows department managers to manage employees in their own department', function (): void {
+    $department = Department::factory()->create();
+    $otherDepartment = Department::factory()->create();
+
+    $manager = createUserWithRole('department_manager', [
+        'department_id' => $department->id,
+    ]);
+
+    $ownEmployee = Employee::factory()->create([
+        'department_id' => $department->id,
+    ]);
+
+    $otherEmployee = Employee::factory()->create([
+        'department_id' => $otherDepartment->id,
+    ]);
+
+    expect($manager->can('view', $ownEmployee))->toBeTrue()
+        ->and($manager->can('update', $ownEmployee))->toBeTrue()
+        ->and($manager->can('delete', $ownEmployee))->toBeTrue()
+        ->and($manager->can('view', $otherEmployee))->toBeFalse()
+        ->and($manager->can('update', $otherEmployee))->toBeFalse()
+        ->and($manager->can('delete', $otherEmployee))->toBeFalse();
+});
+
+it('allows department managers to create employees', function (): void {
+    $department = Department::factory()->create();
+    $manager = createUserWithRole('department_manager', [
+        'department_id' => $department->id,
+    ]);
+
+    expect($manager->can('create', Employee::class))->toBeTrue();
+});
+
+it('denies department managers access to employees without a matching department', function (): void {
+    $department = Department::factory()->create();
+    $manager = createUserWithRole('department_manager', [
+        'department_id' => $department->id,
+    ]);
+
+    $unassignedEmployee = Employee::factory()->create([
+        'department_id' => $otherDepartment = Department::factory()->create()->id,
+    ]);
+
+    expect($manager->can('view', $unassignedEmployee))->toBeFalse();
+});
+
+it('allows hr managers to access employees across departments', function (): void {
+    $hrManager = createUserWithRole('hr_manager');
+    $employee = Employee::factory()->create();
+
+    expect($hrManager->can('viewAny', Employee::class))->toBeTrue()
+        ->and($hrManager->can('view', $employee))->toBeTrue()
+        ->and($hrManager->can('update', $employee))->toBeTrue()
+        ->and($hrManager->can('delete', $employee))->toBeTrue();
+});