Fixed FD-55580 - added selectlist gate and tests

app/Http/Controllers/Api/AccessoriesController.php

@@ -405,6 +405,7 @@ class AccessoriesController extends Controller
      */
     public function selectlist(Request $request)
     {
+        $this->authorize('view.selectlists');
 
         $accessories = Accessory::select([
             'accessories.id',

app/Http/Controllers/Api/AssetsController.php

@@ -590,6 +590,7 @@ class AssetsController extends Controller
      */
     public function selectlist(Request $request): array
     {
+        $this->authorize('view.selectlists');
 
         $assets = Asset::select([
             'assets.id',

app/Http/Controllers/Api/ConsumablesController.php

@@ -356,6 +356,8 @@ class ConsumablesController extends Controller
      */
     public function selectlist(Request $request): array
     {
+        $this->authorize('view.selectlists');
+
         $consumables = Consumable::select([
             'consumables.id',
             'consumables.name',

app/Http/Controllers/Api/LicensesController.php

@@ -268,6 +268,8 @@ class LicensesController extends Controller
      */
     public function selectlist(Request $request): array
     {
+        $this->authorize('view.selectlists');
+
         $licenses = License::select([
             'licenses.id',
             'licenses.name',

app/Http/Controllers/Api/UsersController.php

@@ -380,6 +380,8 @@ class UsersController extends Controller
      */
     public function selectlist(Request $request): array
     {
+        $this->authorize('view.selectlists');
+
         $users = User::select(
             [
                 'users.id',

tests/Feature/Accessories/Api/AccessoriesForSelectListTest.php

@@ -10,6 +10,13 @@ use Tests\TestCase;
 
 class AccessoriesForSelectListTest extends TestCase implements TestsFullMultipleCompaniesSupport
 {
+    public function test_requires_view_selectlists_permission(): void
+    {
+        $this->actingAsForApi(User::factory()->create())
+            ->getJson(route('api.accessories.selectlist'))
+            ->assertForbidden();
+    }
+
     public function test_adheres_to_full_multiple_companies_support_scoping()
     {
         [$companyA, $companyB] = Company::factory()->count(2)->create();
@@ -18,8 +25,8 @@ class AccessoriesForSelectListTest extends TestCase implements TestsFullMultiple
         $accessoryB = Accessory::factory()->for($companyB)->create();
 
         $superuser = User::factory()->superuser()->create();
-        $userInCompanyA = $companyA->users()->save(User::factory()->viewAccessories()->make());
-        $userInCompanyB = $companyB->users()->save(User::factory()->viewAccessories()->make());
+        $userInCompanyA = $companyA->users()->save(User::factory()->editAccessories()->make());
+        $userInCompanyB = $companyB->users()->save(User::factory()->editAccessories()->make());
 
         $this->settings->enableMultipleFullCompanySupport();
 
@@ -49,7 +56,7 @@ class AccessoriesForSelectListTest extends TestCase implements TestsFullMultiple
     {
         [$accessoryA, $accessoryB] = Accessory::factory()->count(2)->create();
 
-        $this->actingAsForApi(User::factory()->viewAccessories()->create())
+        $this->actingAsForApi(User::factory()->editAccessories()->create())
             ->getJson(route('api.accessories.selectlist'))
             ->assertOk()
             ->assertJsonPath('total_count', 2)

tests/Feature/Assets/Api/AssetsForSelectListTest.php

@@ -9,12 +9,19 @@ use Tests\TestCase;
 
 class AssetsForSelectListTest extends TestCase
 {
+    public function test_requires_view_selectlists_permission(): void
+    {
+        $this->actingAsForApi(User::factory()->create())
+            ->getJson(route('assets.selectlist'))
+            ->assertForbidden();
+    }
+
     public function test_assets_can_be_searched_for_by_asset_tag()
     {
         Asset::factory()->create(['asset_tag' => '0001']);
         Asset::factory()->create(['asset_tag' => '0002']);
 
-        $response = $this->actingAsForApi(User::factory()->create())
+        $response = $this->actingAsForApi(User::factory()->createAssets()->create())
             ->getJson(route('assets.selectlist', ['search' => '000']))
             ->assertOk();
 
@@ -33,8 +40,8 @@ class AssetsForSelectListTest extends TestCase
         $assetB = Asset::factory()->for($companyB)->create(['asset_tag' => '0002']);
 
         $superUser = $companyA->users()->save(User::factory()->superuser()->make());
-        $userInCompanyA = $companyA->users()->save(User::factory()->viewAssets()->make());
-        $userInCompanyB = $companyB->users()->save(User::factory()->viewAssets()->make());
+        $userInCompanyA = $companyA->users()->save(User::factory()->createAssets()->make());
+        $userInCompanyB = $companyB->users()->save(User::factory()->createAssets()->make());
 
         $this->settings->disableMultipleFullCompanySupport();
 

tests/Feature/Consumables/Api/ConsumablesForSelectListTest.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Tests\Feature\Consumables\Api;
+
+use App\Models\Consumable;
+use App\Models\User;
+use Tests\TestCase;
+
+class ConsumablesForSelectListTest extends TestCase
+{
+    public function test_requires_view_selectlists_permission(): void
+    {
+        $this->actingAsForApi(User::factory()->create())
+            ->getJson(route('api.consumables.selectlist'))
+            ->assertForbidden();
+    }
+
+    public function test_consumables_are_returned_for_select_list(): void
+    {
+        [$consumableA, $consumableB] = Consumable::factory()->count(2)->create();
+
+        $this->actingAsForApi(User::factory()->createConsumables()->create())
+            ->getJson(route('api.consumables.selectlist'))
+            ->assertOk()
+            ->assertResponseContainsInResults($consumableA)
+            ->assertResponseContainsInResults($consumableB);
+    }
+}

tests/Feature/Licenses/Api/LicensesForSelectListTest.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Tests\Feature\Licenses\Api;
+
+use App\Models\License;
+use App\Models\User;
+use Tests\TestCase;
+
+class LicensesForSelectListTest extends TestCase
+{
+    public function test_requires_view_selectlists_permission(): void
+    {
+        $this->actingAsForApi(User::factory()->create())
+            ->getJson(route('api.licenses.selectlist'))
+            ->assertForbidden();
+    }
+
+    public function test_licenses_are_returned_for_select_list(): void
+    {
+        [$licenseA, $licenseB] = License::factory()->count(2)->create();
+
+        $this->actingAsForApi(User::factory()->createLicenses()->create())
+            ->getJson(route('api.licenses.selectlist'))
+            ->assertOk()
+            ->assertResponseContainsInResults($licenseA)
+            ->assertResponseContainsInResults($licenseB);
+    }
+}

tests/Feature/Users/Api/UsersForSelectListTest.php

@@ -10,6 +10,13 @@ use Tests\TestCase;
 
 class UsersForSelectListTest extends TestCase
 {
+    public function test_requires_view_selectlists_permission(): void
+    {
+        $this->actingAsForApi(User::factory()->create())
+            ->getJson(route('api.users.selectlist'))
+            ->assertForbidden();
+    }
+
     public function test_users_are_returned()
     {
         $users = User::factory()->superuser()->count(3)->create();
@@ -31,7 +38,7 @@ class UsersForSelectListTest extends TestCase
     {
         User::factory()->create(['first_name' => 'Luke', 'last_name' => 'Skywalker']);
 
-        Passport::actingAs(User::factory()->create());
+        Passport::actingAs(User::factory()->editUsers()->create());
         $response = $this->getJson(route('api.users.selectlist', ['search' => 'luke sky']))->assertOk();
 
         $results = collect($response->json('results'));
@@ -44,7 +51,7 @@ class UsersForSelectListTest extends TestCase
     {
         User::factory()->create(['first_name' => 'Luke', 'last_name' => 'Skywalker', 'email' => 'luke@jedis.org']);
 
-        Passport::actingAs(User::factory()->create());
+        Passport::actingAs(User::factory()->editUsers()->create());
         $response = $this->getJson(route('api.users.selectlist', ['search' => 'luke@jedis']))->assertOk();
 
         $results = collect($response->json('results'));
@@ -58,7 +65,7 @@ class UsersForSelectListTest extends TestCase
         $this->settings->enableMultipleFullCompanySupport();
 
         $jedi = Company::factory()->has(User::factory()->count(3)->sequence(
-            ['first_name' => 'Luke', 'last_name' => 'Skywalker', 'username' => 'lskywalker'],
+            ['first_name' => 'Luke', 'last_name' => 'Skywalker', 'username' => 'lskywalker', 'permissions' => json_encode(['users.edit' => '1'])],
             ['first_name' => 'Obi-Wan', 'last_name' => 'Kenobi', 'username' => 'okenobi'],
             ['first_name' => 'Anakin', 'last_name' => 'Skywalker', 'username' => 'askywalker'],
         ))->create();
@@ -86,7 +93,7 @@ class UsersForSelectListTest extends TestCase
         $this->settings->enableMultipleFullCompanySupport();
 
         $jedi = Company::factory()->has(User::factory()->count(3)->sequence(
-            ['first_name' => 'Luke', 'last_name' => 'Skywalker', 'username' => 'lskywalker', 'email' => 'lskywalker@jedis.org'],
+            ['first_name' => 'Luke', 'last_name' => 'Skywalker', 'username' => 'lskywalker', 'email' => 'lskywalker@jedis.org', 'permissions' => json_encode(['users.edit' => '1'])],
             ['first_name' => 'Obi-Wan', 'last_name' => 'Kenobi', 'username' => 'okenobi', 'email' => 'okenobi@jedis.org'],
             ['first_name' => 'Anakin', 'last_name' => 'Skywalker', 'username' => 'askywalker', 'email' => 'askywalker@alliance.org'],
         ))->create();