[verified] Harden Etsy MCP validation and scheduled token refresh

2026-11-07 21:54:33 +00:00
parent 960189d14b
commit c8c5822166
13 changed files with 455 additions and 89 deletions
@@ -70,6 +70,29 @@ class ScheduleSettingsTest extends TestCase
        $this->assertFileExists(DashboardSchedule::runtimeSettingsPath());
    }

+    public function test_partial_settings_updates_preserve_other_jobs(): void
+    {
+        DashboardSchedule::persistRuntimeFrequencies(['alerts_scan' => 'hourly']);
+        DashboardSchedule::persistRuntimeFrequencies(['etsy_sync' => 'disabled']);
+
+        $this->assertSame('hourly', DashboardSchedule::frequencyFor('alerts_scan'));
+        $this->assertSame('disabled', DashboardSchedule::frequencyFor('etsy_sync'));
+    }
+
+    public function test_admin_cannot_save_unknown_jobs(): void
+    {
+        $this->actingAs(User::factory()->create(['role' => 'admin']))
+            ->put(route('settings.schedules.update'), ['schedules' => ['unknown' => 'hourly']])
+            ->assertSessionHasErrors('schedules');
+        $this->assertFileDoesNotExist(DashboardSchedule::runtimeSettingsPath());
+    }
+
+    public function test_non_admin_cannot_run_jobs(): void
+    {
+        $this->actingAs(User::factory()->create())
+            ->post(route('settings.schedules.run', 'etsy_sync'))->assertForbidden();
+    }
+
    public function test_admin_can_manually_run_a_job(): void
    {
        $response = $this