feat: single session per akun — login kedua ditolak jika sesi aktif, middleware SingleSession menendang sesi lain, logout membersihkan token, tombol Paksa Logout di manajemen user; 5 feature test

2026-08-03 10:29:26 +07:00
parent 64863456ee
commit 0aa8beee83
9 changed files with 241 additions and 2 deletions
@@ -0,0 +1,97 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class SingleSessionTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->admin = User::factory()->create(['roles' => ['admin']]);
+    }
+
+    protected function makeUser(): User
+    {
+        return User::factory()->create([
+            'roles' => ['bk'],
+            'username' => 'bksession',
+            'password' => 'rahasia123',
+        ]);
+    }
+
+    public function test_login_menyimpan_token_sesi_aktif(): void
+    {
+        $user = $this->makeUser();
+
+        $this->post('/login', [
+            'username' => 'bksession',
+            'password' => 'rahasia123',
+        ])->assertRedirect();
+
+        $this->assertNotNull($user->refresh()->active_session_token);
+    }
+
+    public function test_login_kedua_ditolak_saat_akun_masih_aktif(): void
+    {
+        $user = $this->makeUser();
+        // Simulasikan sudah login di perangkat lain (token sesi aktif)
+        $user->forceFill(['active_session_token' => 'sesi-perangkat-lain'])->save();
+
+        $this->post('/login', [
+            'username' => 'bksession',
+            'password' => 'rahasia123',
+        ])->assertSessionHasErrors('username');
+
+        $this->assertGuest();
+        $this->assertSame('sesi-perangkat-lain', $user->refresh()->active_session_token);
+    }
+
+    public function test_middleware_mengeluarkan_sesi_yang_bukan_pemilik_token(): void
+    {
+        $user = $this->makeUser();
+        $user->forceFill(['active_session_token' => 'sesi-perangkat-lain'])->save();
+
+        // User ini "login" dengan sesi berbeda → harus ditendang ke halaman login
+        $this->actingAs($user)
+            ->get('/dashboard')
+            ->assertRedirect(route('login'));
+
+        $this->assertGuest();
+    }
+
+    public function test_logout_menghapus_token_sesi(): void
+    {
+        $user = $this->makeUser();
+        $sessionId = str_repeat('a', 40); // id sesi valid (format 40 char)
+        $user->forceFill(['active_session_token' => $sessionId])->save();
+
+        // Uji logika controller logout langsung (session id = token)
+        $request = \Illuminate\Http\Request::create('/logout', 'POST');
+        $request->setLaravelSession($this->app['session.store']);
+        $this->app['session.store']->setId($sessionId);
+        $this->actingAs($user);
+
+        (new \App\Http\Controllers\Auth\LoginController())->logout($request);
+
+        $this->assertNull($user->refresh()->active_session_token);
+    }
+
+    public function test_force_logout_membersihkan_token(): void
+    {
+        $user = $this->makeUser();
+        $user->forceFill(['active_session_token' => 'sesi-lama'])->save();
+
+        $this->actingAs($this->admin)
+            ->post("/users/{$user->id}/force-logout")
+            ->assertRedirect()
+            ->assertSessionHas('success');
+
+        $this->assertNull($user->refresh()->active_session_token);
+    }
+}