svc-admin01/snipe-it
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don’t strip comany association if company_id is passed to the user (old integrations)

Browse Source
This commit is contained in:
snipe
2026-06-03 12:30:08 +01:00
parent 371d44b2a7
commit 00d4d6c7a8
4 changed files with 97 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/Checkouts/Ui/AssetCheckoutTest.php
+24
View File
@@ -119,6 +119,30 @@ class AssetCheckoutTest extends TestCase
Event::assertNotDispatched(CheckoutableCheckedOut::class);
}
public function test_can_checkout_to_user_with_multiple_companies_via_pivot_when_fmcs_enabled()
{
$this->settings->enableMultipleFullCompanySupport();
$companyA = Company::factory()->create();
$companyB = Company::factory()->create();
// User's primary company is A but is also assigned to B via pivot
$user = User::factory()->for($companyA)->create();
$user->companies()->sync([$companyA->id, $companyB->id]);
// Asset belongs to company B
$asset = Asset::factory()->for($companyB)->create();
$this->actingAs(User::factory()->superuser()->create())
->post(route('hardware.checkout.store', $asset), [
'checkout_to_type' => 'user',
'assigned_user' => $user->id,
])
->assertRedirect();
Event::assertDispatched(CheckoutableCheckedOut::class);
}
public function test_page_renders()
{
$this->actingAs(User::factory()->superuser()->create())
tests/Feature/Users/Api/UserCompanyMembershipTest.php
+52
View File
@@ -214,6 +214,58 @@ class UserCompanyMembershipTest extends TestCase
$this->assertTrue($user->companies->contains($company));
}
public function test_legacy_company_id_on_update_adds_without_removing_other_associations()
{
// An older integration that hasn't been updated still sends company_id (scalar).
// If the user already belongs to multiple companies via the pivot, the legacy
// company_id should be added (if not already present) without stripping others.
[$companyA, $companyB, $companyC] = Company::factory()->count(3)->create();
$user = User::factory()->create();
$user->companies()->sync([$companyA->id, $companyB->id]);
$actor = User::factory()->superuser()->create();
$this->actingAsForApi($actor)
->patchJson(route('api.users.update', $user), [
'first_name' => $user->first_name,
'last_name' => $user->last_name,
'username' => $user->username,
'company_id' => $companyC->id,
])
->assertOk()
->assertStatusMessageIs('success');
$user->refresh();
$this->assertCount(3, $user->companies, 'All three companies should be present after legacy company_id update');
$this->assertTrue($user->companies->contains($companyA), 'companyA should not have been stripped');
$this->assertTrue($user->companies->contains($companyB), 'companyB should not have been stripped');
$this->assertTrue($user->companies->contains($companyC), 'companyC should have been added');
}
public function test_legacy_company_id_on_update_is_idempotent_when_already_a_member()
{
[$companyA, $companyB] = Company::factory()->count(2)->create();
$user = User::factory()->create();
$user->companies()->sync([$companyA->id, $companyB->id]);
$actor = User::factory()->superuser()->create();
$this->actingAsForApi($actor)
->patchJson(route('api.users.update', $user), [
'first_name' => $user->first_name,
'last_name' => $user->last_name,
'username' => $user->username,
'company_id' => $companyA->id,
])
->assertOk()
->assertStatusMessageIs('success');
$user->refresh();
$this->assertCount(2, $user->companies, 'Company count should not change when company_id already in pivot');
}
public function test_post_with_invalid_company_ids_returns_error()
{
$actor = User::factory()->superuser()->create();