Split CustomerViewModelService and the customer edit tabs into one service and controller per tab

src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerAddressControllerTests.cs

@@ -0,0 +1,91 @@
+using Grand.Business.Core.Interfaces.Common.Addresses;
+using Grand.Business.Core.Interfaces.Customers;
+using Grand.Domain.Common;
+using Grand.Domain.Customers;
+using Grand.Web.AdminShared.Controllers;
+using Grand.Web.AdminShared.Interfaces;
+using Grand.Web.AdminShared.Models.Common;
+using Grand.Web.AdminShared.Models.Customers;
+using Grand.Web.Common.DataSource;
+using Grand.Web.Common.Localization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class BaseCustomerAddressControllerTests
+    : CustomerControllerTestsBase<BaseCustomerAddressControllerTests.TestCustomerAddressController>
+{
+    public class TestCustomerAddressController(
+        ICustomerService customerService,
+        ICustomerAddressViewModelService customerAddressViewModelService,
+        IAddressAttributeParser addressAttributeParser,
+        IAddressAttributeService addressAttributeService,
+        IRequestTranslationService translationService,
+        IAdminDataScope<Customer> scope)
+        : BaseCustomerAddressController(customerService, customerAddressViewModelService, addressAttributeParser,
+            addressAttributeService, translationService, scope);
+
+    protected override TestCustomerAddressController CreateController() => new(
+        CustomerServiceMock.Object,
+        CustomerAddressViewModelServiceMock.Object,
+        AddressAttributeParserMock.Object,
+        AddressAttributeServiceMock.Object,
+        TranslationServiceMock.Object,
+        ScopeMock.Object);
+
+    [TestMethod]
+    public async Task AddressesSelect_Denied_ThrowsArgumentException()
+    {
+        CustomerServiceMock.Setup(s => s.GetCustomerById("missing")).ReturnsAsync((Customer)null);
+
+        await Assert.ThrowsAsync<ArgumentException>(() =>
+            Controller.AddressesSelect("missing", new DataSourceRequest()));
+    }
+
+    [TestMethod]
+    public async Task AddressCreatePost_Authorized_InsertsAndRedirectsToAddressEdit()
+    {
+        var customer = SetupAuthorizedCustomer("c1");
+        var model = new CustomerAddressModel { CustomerId = "c1", Address = new AddressModel() };
+        CustomerAddressViewModelServiceMock
+            .Setup(v => v.InsertAddressModel(customer, model, It.IsAny<List<CustomAttribute>>()))
+            .ReturnsAsync(new Address { Id = "a1" });
+
+        var result = await Controller.AddressCreate(model);
+
+        var redirect = result as RedirectToActionResult;
+        Assert.IsNotNull(redirect);
+        Assert.AreEqual("AddressEdit", redirect.ActionName);
+        Assert.IsNull(redirect.ControllerName);
+    }
+
+    [TestMethod]
+    public async Task AddressCreateGet_Denied_RedirectsToCustomerList()
+    {
+        CustomerServiceMock.Setup(s => s.GetCustomerById("missing")).ReturnsAsync((Customer)null);
+
+        var result = await Controller.AddressCreate("missing");
+
+        var redirect = result as RedirectToActionResult;
+        Assert.IsNotNull(redirect);
+        Assert.AreEqual("List", redirect.ActionName);
+        Assert.AreEqual("Customer", redirect.ControllerName);
+    }
+
+    [TestMethod]
+    public async Task AddressEditGet_UnknownAddress_RedirectsToCustomerEdit()
+    {
+        SetupAuthorizedCustomer("c1");
+
+        var result = await Controller.AddressEdit("missing-address", "c1");
+
+        var redirect = result as RedirectToActionResult;
+        Assert.IsNotNull(redirect);
+        Assert.AreEqual("Edit", redirect.ActionName);
+        Assert.AreEqual("Customer", redirect.ControllerName);
+        Assert.AreEqual("c1", redirect.RouteValues!["id"]);
+    }
+}

src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerLoyaltyPointsControllerTests.cs

@@ -0,0 +1,62 @@
+using Grand.Business.Core.Interfaces.Customers;
+using Grand.Domain.Customers;
+using Grand.Domain.Orders;
+using Grand.Web.AdminShared.Controllers;
+using Grand.Web.AdminShared.Interfaces;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class BaseCustomerLoyaltyPointsControllerTests
+    : CustomerControllerTestsBase<BaseCustomerLoyaltyPointsControllerTests.TestCustomerLoyaltyPointsController>
+{
+    public class TestCustomerLoyaltyPointsController(
+        ICustomerService customerService,
+        ICustomerLoyaltyPointsViewModelService customerLoyaltyPointsViewModelService,
+        IAdminDataScope<Customer> scope)
+        : BaseCustomerLoyaltyPointsController(customerService, customerLoyaltyPointsViewModelService, scope);
+
+    protected override TestCustomerLoyaltyPointsController CreateController() => new(
+        CustomerServiceMock.Object,
+        CustomerLoyaltyPointsViewModelServiceMock.Object,
+        ScopeMock.Object);
+
+    [TestMethod]
+    public async Task LoyaltyPointsHistoryAdd_StoreScope_ForcesStaffStoreId_IgnoringSubmittedStoreId()
+    {
+        var customer = SetupAuthorizedCustomer("c1");
+        ScopeMock.Setup(s => s.DefaultStoreId).Returns("store-1");
+        CustomerLoyaltyPointsViewModelServiceMock
+            .Setup(v => v.InsertLoyaltyPointsHistory(customer, "store-1", 10, "msg"))
+            .ReturnsAsync(new LoyaltyPointsHistory());
+
+        // Caller submits a different, attacker-controlled storeId — must be ignored under Store scope.
+        await Controller.LoyaltyPointsHistoryAdd("c1", "attacker-store", 10, "msg");
+
+        CustomerLoyaltyPointsViewModelServiceMock.Verify(v => v.InsertLoyaltyPointsHistory(customer, "store-1", 10, "msg"), Times.Once);
+    }
+
+    [TestMethod]
+    public async Task LoyaltyPointsHistoryAdd_GlobalScope_UsesSubmittedStoreId()
+    {
+        var customer = SetupAuthorizedCustomer("c1");
+        CustomerLoyaltyPointsViewModelServiceMock
+            .Setup(v => v.InsertLoyaltyPointsHistory(customer, "admin-submitted-store", 10, "msg"))
+            .ReturnsAsync(new LoyaltyPointsHistory());
+
+        await Controller.LoyaltyPointsHistoryAdd("c1", "admin-submitted-store", 10, "msg");
+
+        CustomerLoyaltyPointsViewModelServiceMock.Verify(v => v.InsertLoyaltyPointsHistory(customer, "admin-submitted-store", 10, "msg"), Times.Once);
+    }
+
+    [TestMethod]
+    public async Task LoyaltyPointsHistorySelect_Denied_ThrowsArgumentException()
+    {
+        CustomerServiceMock.Setup(s => s.GetCustomerById("missing")).ReturnsAsync((Customer)null);
+
+        await Assert.ThrowsAsync<ArgumentException>(() => Controller.LoyaltyPointsHistorySelect("missing"));
+        CustomerLoyaltyPointsViewModelServiceMock.Verify(v => v.PrepareLoyaltyPointsHistoryModel(It.IsAny<string>()), Times.Never);
+    }
+}

src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerManagementControllerTests.cs

@@ -1,9 +1,6 @@
-using Grand.Business.Core.Interfaces.Catalog.Products;
-using Grand.Business.Core.Interfaces.Common.Addresses;
 using Grand.Business.Core.Interfaces.Common.Directory;
 using Grand.Business.Core.Interfaces.Customers;
 using Grand.Business.Core.Interfaces.ExportImport;
-using Grand.Business.Core.Interfaces.Marketing.Customers;
 using Grand.Business.Core.Interfaces.Messages;
 using Grand.Domain.Customers;
 using Grand.Domain.Permissions;
@@ -29,19 +26,14 @@ public class BaseCustomerManagementControllerTests
 {
     private class TestManagementController(
         ICustomerService customerService, ICustomerViewModelService customerViewModelService,
-        ICustomerManagerService customerManagerService, ICustomerProductService customerProductService,
-        IProductReviewService productReviewService, IProductReviewViewModelService productReviewViewModelService,
-        IProductViewModelService productViewModelService, ICustomerAttributeParser customerAttributeParser,
-        ICustomerAttributeService customerAttributeService, IAddressAttributeParser addressAttributeParser,
-        IAddressAttributeService addressAttributeService, IMessageProviderService messageProviderService,
+        ICustomerManagerService customerManagerService, ICustomerAttributeParser customerAttributeParser,
+        ICustomerAttributeService customerAttributeService, IMessageProviderService messageProviderService,
         IGroupService groupService, IRequestTranslationService translationService, IContextAccessor contextAccessor,
         CustomerSettings customerSettings, IAdminDataScope<Customer> scope,
         IRequestPermissionService permissionService, IExportManager<Customer> exportManager)
         : BaseCustomerManagementController(customerService, customerViewModelService, customerManagerService,
-            customerProductService, productReviewService, productReviewViewModelService, productViewModelService,
-            customerAttributeParser, customerAttributeService, addressAttributeParser, addressAttributeService,
-            messageProviderService, groupService, translationService, contextAccessor, customerSettings, scope,
-            permissionService, exportManager)
+            customerAttributeParser, customerAttributeService, messageProviderService, groupService,
+            translationService, contextAccessor, customerSettings, scope, permissionService, exportManager)
     {
         public void CheckTwoFactorEnabledWarningPublic(Customer existingCustomer, CustomerModel model) =>
             CheckTwoFactorEnabledWarning(existingCustomer, model);
@@ -71,10 +63,7 @@ public void Setup()
 
         _controller = new TestManagementController(_customerServiceMock.Object,
             new Mock<ICustomerViewModelService>().Object, new Mock<ICustomerManagerService>().Object,
-            new Mock<ICustomerProductService>().Object, new Mock<IProductReviewService>().Object,
-            new Mock<IProductReviewViewModelService>().Object, new Mock<IProductViewModelService>().Object,
             new Mock<ICustomerAttributeParser>().Object, new Mock<ICustomerAttributeService>().Object,
-            new Mock<IAddressAttributeParser>().Object, new Mock<IAddressAttributeService>().Object,
             new Mock<IMessageProviderService>().Object, _groupServiceMock.Object, translationServiceMock.Object,
             _contextAccessorMock.Object, new CustomerSettings(), scopeMock.Object,
             _permissionServiceMock.Object, new Mock<IExportManager<Customer>>().Object);

src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerOrderControllerTests.cs

@@ -0,0 +1,69 @@
+using Grand.Business.Core.Interfaces.Checkout.Orders;
+using Grand.Business.Core.Interfaces.Customers;
+using Grand.Domain.Customers;
+using Grand.Domain.Orders;
+using Grand.Domain.Permissions;
+using Grand.Web.AdminShared.Controllers;
+using Grand.Web.AdminShared.Interfaces;
+using Grand.Web.AdminShared.Models.Orders;
+using Grand.Web.Common.DataSource;
+using Grand.Web.Common.Security.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class BaseCustomerOrderControllerTests
+    : CustomerControllerTestsBase<BaseCustomerOrderControllerTests.TestCustomerOrderController>
+{
+    public class TestCustomerOrderController(
+        ICustomerService customerService,
+        IOrderService orderService,
+        IOrderViewModelService orderViewModelService,
+        IRequestPermissionService permissionService,
+        IAdminDataScope<Customer> scope)
+        : BaseCustomerOrderController(customerService, orderService, orderViewModelService, permissionService, scope);
+
+    protected override TestCustomerOrderController CreateController() => new(
+        CustomerServiceMock.Object,
+        OrderServiceMock.Object,
+        OrderViewModelServiceMock.Object,
+        PermissionServiceMock.Object,
+        ScopeMock.Object);
+
+    [TestMethod]
+    public async Task OrderDetails_StoreScope_MismatchedStore_ReturnsEmptyNotException()
+    {
+        ScopeMock.Setup(s => s.DefaultStoreId).Returns("store-1");
+        OrderServiceMock.Setup(s => s.GetOrderById("o1")).ReturnsAsync(new Order { Id = "o1", StoreId = "store-2" });
+
+        var result = await Controller.OrderDetails("o1");
+
+        var data = (DataSourceResult)((JsonResult)result).Value!;
+        Assert.AreEqual(0, data.Total);
+    }
+
+    [TestMethod]
+    public async Task OrderDetails_GlobalScope_NotFound_ThrowsArgumentException()
+    {
+        PermissionServiceMock.Setup(p => p.Authorize(StandardPermission.ManageOrders)).ReturnsAsync(true);
+        OrderServiceMock.Setup(s => s.GetOrderById("missing")).ReturnsAsync((Order)null);
+
+        await Assert.ThrowsAsync<ArgumentException>(() => Controller.OrderDetails("missing"));
+    }
+
+    [TestMethod]
+    public async Task OrderList_GlobalScope_WithoutManageOrders_ReturnsEmpty()
+    {
+        PermissionServiceMock.Setup(p => p.Authorize(StandardPermission.ManageOrders)).ReturnsAsync(false);
+
+        var result = await Controller.OrderList("c1", new DataSourceRequest { Page = 1, PageSize = 10 });
+
+        var data = (DataSourceResult)((JsonResult)result).Value!;
+        Assert.AreEqual(0, data.Total);
+        OrderViewModelServiceMock.Verify(
+            v => v.PrepareOrderModel(It.IsAny<OrderListModel>(), It.IsAny<int>(), It.IsAny<int>()), Times.Never);
+    }
+}

src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerOutOfStockSubscriptionControllerTests.cs

@@ -0,0 +1,55 @@
+using Grand.Business.Core.Interfaces.Customers;
+using Grand.Domain.Customers;
+using Grand.Web.AdminShared.Controllers;
+using Grand.Web.AdminShared.Interfaces;
+using Grand.Web.AdminShared.Models.Customers;
+using Grand.Web.Common.DataSource;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class BaseCustomerOutOfStockSubscriptionControllerTests
+    : CustomerControllerTestsBase<BaseCustomerOutOfStockSubscriptionControllerTests.TestCustomerOutOfStockSubscriptionController>
+{
+    public class TestCustomerOutOfStockSubscriptionController(
+        ICustomerService customerService,
+        ICustomerOutOfStockSubscriptionViewModelService customerOutOfStockSubscriptionViewModelService,
+        IAdminDataScope<Customer> scope)
+        : BaseCustomerOutOfStockSubscriptionController(customerService, customerOutOfStockSubscriptionViewModelService,
+            scope);
+
+    protected override TestCustomerOutOfStockSubscriptionController CreateController() => new(
+        CustomerServiceMock.Object,
+        CustomerOutOfStockSubscriptionViewModelServiceMock.Object,
+        ScopeMock.Object);
+
+    [TestMethod]
+    public async Task OutOfStockSubscriptionList_GlobalScope_NoOwnershipCheck()
+    {
+        CustomerOutOfStockSubscriptionViewModelServiceMock
+            .Setup(v => v.PrepareOutOfStockSubscriptionModel("c1", 1, 10))
+            .ReturnsAsync((Enumerable.Empty<CustomerModel.OutOfStockSubscriptionModel>(), 0));
+
+        var result = await Controller.OutOfStockSubscriptionList(new DataSourceRequest { Page = 1, PageSize = 10 }, "c1");
+
+        Assert.IsInstanceOfType(result, typeof(JsonResult));
+        CustomerServiceMock.Verify(s => s.GetCustomerById(It.IsAny<string>()), Times.Never);
+    }
+
+    [TestMethod]
+    public async Task OutOfStockSubscriptionList_StoreScope_DeniedOwnership_ReturnsEmpty()
+    {
+        ScopeMock.Setup(s => s.DefaultStoreId).Returns("store-1");
+        CustomerServiceMock.Setup(s => s.GetCustomerById("c1")).ReturnsAsync((Customer)null);
+
+        var result = await Controller.OutOfStockSubscriptionList(new DataSourceRequest { Page = 1, PageSize = 10 }, "c1");
+
+        var data = (DataSourceResult)((JsonResult)result).Value!;
+        Assert.AreEqual(0, data.Total);
+        CustomerOutOfStockSubscriptionViewModelServiceMock.Verify(
+            v => v.PrepareOutOfStockSubscriptionModel(It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>()), Times.Never);
+    }
+}