DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2024-12-24 05:04:07 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Added company scoping test

Browse source 
Signed-off-by: snipe <snipe@snipe.net>
This commit is contained in:
snipe 2024-06-01 03:10:29 +01:00
parent 03b0268dc2
commit 52af8afac2
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
tests/Feature/Api/Users/DeleteUsersTest.php
View file

@ -2,6 +2,8 @@
namespace Tests\Feature\Api\Users;
use App\Models\Asset;
use App\Models\Company;
use App\Models\Location;
use App\Models\User;
use App\Models\LicenseSeat;
@ -64,6 +66,36 @@ class DeleteUsersTest extends TestCase
->json();
}
public function testDisallowUserDeletionIfNotInSameCompanyIfNotSuperadmin()
{
$this->settings->enableMultipleFullCompanySupport();
[$companyA, $companyB] = Company::factory()->count(2)->create();
$superUser = $companyA->users()->save(User::factory()->superuser()->make());
$userInCompanyA = $companyA->users()->save(User::factory()->deleteUsers()->make());
$userInCompanyB = $companyB->users()->save(User::factory()->deleteUsers()->make());
$this->actingAsForApi($userInCompanyA)
->deleteJson(route('api.users.destroy', $userInCompanyB))
->assertStatus(403)
->json();
$this->actingAsForApi($userInCompanyB)
->deleteJson(route('api.users.destroy', $userInCompanyA))
->assertStatus(403)
->json();
$this->actingAsForApi($superUser)
->deleteJson(route('api.users.destroy', $userInCompanyA))
->assertOk()
->assertStatus(200)
->assertStatusMessageIs('success')
->json();
}
}