Refactor: Enforce type safety, fix close deadlock, implement assignee restrictions and notify admin fallbacks

tests/Feature/ClosingPermissionTest.php

@@ -187,3 +187,157 @@ test('manager cannot close ticket from department they do not manage', function
 
     expect($feedback->fresh()->status)->toBe('resolved');
 });
+
+// ─── Scenario 2d: Staff with close permission cannot close ticket from other department ──
+test('staff with close permission cannot close ticket from other department', function () {
+    $staffRole = Role::create(['name' => 'staff']);
+    $staffRole->givePermissionTo(['close-ticket', 'view-feedback', 'update-feedback']);
+
+    // Staff belongs to Department A
+    $deptA = Department::create(['name' => 'CSKH']);
+    $staff = User::factory()->create(['department_id' => $deptA->id]);
+    $staff->assignRole('staff');
+
+    // Ticket belongs to Department B
+    $deptB = Department::create(['name' => 'Ky Thuat']);
+
+    $channel = FeedbackChannel::create(['name' => 'Phone', 'slug' => 'phone-staff-close']);
+    $customer = Customer::create(['name' => 'Test Customer Staff', 'email' => 'staff@test.com']);
+
+    $feedback = Feedback::create([
+        'customer_id' => $customer->id,
+        'feedback_channel_id' => $channel->id,
+        'title' => 'Test Feedback Staff',
+        'content' => 'Test content',
+        'status' => 'resolved',
+        'current_department_id' => $deptB->id,
+    ]);
+
+    FeedbackAttachment::create([
+        'uuid' => 'test-uuid-staff-1',
+        'feedback_id' => $feedback->id,
+        'user_id' => $staff->id,
+        'name' => 'proof.pdf',
+        'path' => 'feedback-attachments/proof_staff.pdf',
+        'disk' => 'local',
+        'collection' => 'proof_of_resolution',
+        'mime_type' => 'application/pdf',
+        'size' => 1024,
+    ]);
+
+    $this->actingAs($staff);
+
+    $closingService = app(ClosingService::class);
+
+    try {
+        $closingService->close($feedback, $staff);
+        $this->fail('Expected HttpException (403) but none thrown.');
+    } catch (\Symfony\Component\HttpKernel\Exception\HttpException $e) {
+        expect($e->getStatusCode())->toBe(403);
+        expect($e->getMessage())->toBe('Bạn chỉ có thể đóng phiếu thuộc phòng ban mình quản lý.');
+    }
+
+    expect($feedback->fresh()->status)->toBe('resolved');
+});
+
+// ─── Scenario 2e: Staff with close permission can close ticket from same department ────
+test('staff with close permission can close ticket from same department', function () {
+    $staffRole = Role::create(['name' => 'staff']);
+    $staffRole->givePermissionTo(['close-ticket', 'view-feedback', 'update-feedback']);
+
+    // Staff belongs to Department A
+    $deptA = Department::create(['name' => 'CSKH']);
+    $staff = User::factory()->create(['department_id' => $deptA->id]);
+    $staff->assignRole('staff');
+
+    $channel = FeedbackChannel::create(['name' => 'Phone', 'slug' => 'phone-staff-close-success']);
+    $customer = Customer::create(['name' => 'Test Customer Staff Success', 'email' => 'staff_success@test.com']);
+
+    $feedback = Feedback::create([
+        'customer_id' => $customer->id,
+        'feedback_channel_id' => $channel->id,
+        'title' => 'Test Feedback Staff Success',
+        'content' => 'Test content',
+        'status' => 'resolved',
+        'current_department_id' => $deptA->id,
+    ]);
+
+    FeedbackAttachment::create([
+        'uuid' => 'test-uuid-staff-2',
+        'feedback_id' => $feedback->id,
+        'user_id' => $staff->id,
+        'name' => 'proof.pdf',
+        'path' => 'feedback-attachments/proof_staff2.pdf',
+        'disk' => 'local',
+        'collection' => 'proof_of_resolution',
+        'mime_type' => 'application/pdf',
+        'size' => 1024,
+    ]);
+
+    $this->actingAs($staff);
+
+    $closingService = app(ClosingService::class);
+    $closingService->close($feedback, $staff);
+
+    expect($feedback->fresh()->status)->toBe('closed');
+});
+
+// ─── Scenario 2f: Notify admin when closing a department ticket with no manager ────────
+test('admin notification is sent when closing department ticket with no manager', function () {
+    \Illuminate\Support\Facades\Notification::fake();
+
+    // Create admin role and user
+    $adminRole = Role::create(['name' => 'admin']);
+    $admin = User::factory()->create();
+    $admin->assignRole('admin');
+
+    $managerRole = Role::create(['name' => 'manager']);
+    $managerRole->givePermissionTo(['close-ticket', 'view-feedback', 'update-feedback']);
+
+    // Department with no manager
+    $dept = Department::create(['name' => 'Unmanaged Dept', 'manager_id' => null]);
+
+    $manager = User::factory()->create(['department_id' => $dept->id]);
+    $manager->assignRole('manager');
+
+    $channel = FeedbackChannel::create(['name' => 'Phone', 'slug' => 'phone-no-manager']);
+    $customer = Customer::create(['name' => 'Customer', 'email' => 'no_manager@test.com']);
+
+    $feedback = Feedback::create([
+        'customer_id' => $customer->id,
+        'feedback_channel_id' => $channel->id,
+        'title' => 'Ticket',
+        'content' => 'Content',
+        'status' => 'resolved',
+        'current_department_id' => $dept->id,
+    ]);
+
+    FeedbackAttachment::create([
+        'uuid' => 'test-uuid-no-manager',
+        'feedback_id' => $feedback->id,
+        'user_id' => $manager->id,
+        'name' => 'proof.pdf',
+        'path' => 'feedback-attachments/proof3.pdf',
+        'disk' => 'local',
+        'collection' => 'proof_of_resolution',
+        'mime_type' => 'application/pdf',
+        'size' => 1024,
+    ]);
+
+    $this->actingAs($manager);
+
+    $closingService = app(ClosingService::class);
+    $closingService->close($feedback, $manager);
+
+    expect($feedback->fresh()->status)->toBe('closed');
+
+    // Assert notification sent to admin
+    \Illuminate\Support\Facades\Notification::assertSentTo(
+        $admin,
+        \App\Notifications\TicketClosed::class,
+        function ($notification) use ($feedback, $manager) {
+            return $notification->feedback->id === $feedback->id
+                && $notification->actor->id === $manager->id;
+        }
+    );
+});