From a18f5e7fc0c2ce339b2c6247e239820a57c67622 Mon Sep 17 00:00:00 2001
From: Marcus Moore <contact@marcusmoore.io>
Date: Wed, 7 Jun 2023 14:22:22 -0700
Subject: [PATCH] Remove scopeCompanyables call from ConsumablesController

---
 .../Controllers/Api/ConsumablesController.php |  6 +-
 .../Api/Consumables/ConsumablesIndexTest.php  | 72 +++++++++++++++++++
 2 files changed, 73 insertions(+), 5 deletions(-)
 create mode 100644 tests/Feature/Api/Consumables/ConsumablesIndexTest.php

diff --git a/app/Http/Controllers/Api/ConsumablesController.php b/app/Http/Controllers/Api/ConsumablesController.php
index bac9440dca..385f306c25 100644
--- a/app/Http/Controllers/Api/ConsumablesController.php
+++ b/app/Http/Controllers/Api/ConsumablesController.php
@@ -45,11 +45,7 @@ class ConsumablesController extends Controller
                 'notes',
                 ];
 
-
-        $consumables = Company::scopeCompanyables(
-            Consumable::select('consumables.*')
-                ->with('company', 'location', 'category', 'users', 'manufacturer')
-        );
+        $consumables = Consumable::with('company', 'location', 'category', 'users', 'manufacturer');
 
         if ($request->filled('search')) {
             $consumables = $consumables->TextSearch(e($request->input('search')));
diff --git a/tests/Feature/Api/Consumables/ConsumablesIndexTest.php b/tests/Feature/Api/Consumables/ConsumablesIndexTest.php
new file mode 100644
index 0000000000..1d1a627c65
--- /dev/null
+++ b/tests/Feature/Api/Consumables/ConsumablesIndexTest.php
@@ -0,0 +1,72 @@
+<?php
+
+namespace Tests\Feature\Api\Consumables;
+
+use App\Models\Company;
+use App\Models\Consumable;
+use App\Models\User;
+use Illuminate\Testing\TestResponse;
+use Laravel\Passport\Passport;
+use Tests\Support\InteractsWithSettings;
+use Tests\TestCase;
+
+class ConsumablesIndexTest extends TestCase
+{
+    use InteractsWithSettings;
+
+    public function testConsumableIndexAdheresToCompanyScoping()
+    {
+        [$companyA, $companyB] = Company::factory()->count(2)->create();
+
+        $consumableA = Consumable::factory()->for($companyA)->create();
+        $consumableB = Consumable::factory()->for($companyB)->create();
+
+        $superUser = $companyA->users()->save(User::factory()->superuser()->make());
+        $userInCompanyA = $companyA->users()->save(User::factory()->viewConsumables()->make());
+        $userInCompanyB = $companyB->users()->save(User::factory()->viewConsumables()->make());
+
+        $this->settings->disableMultipleFullCompanySupport();
+
+        Passport::actingAs($superUser);
+        $response = $this->getJson(route('api.consumables.index'));
+        $this->assertResponseContains($response, $consumableA);
+        $this->assertResponseContains($response, $consumableB);
+
+        Passport::actingAs($userInCompanyA);
+        $response = $this->getJson(route('api.consumables.index'));
+        $this->assertResponseContains($response, $consumableA);
+        $this->assertResponseContains($response, $consumableB);
+
+        Passport::actingAs($userInCompanyB);
+        $response = $this->getJson(route('api.consumables.index'));
+        $this->assertResponseContains($response, $consumableA);
+        $this->assertResponseContains($response, $consumableB);
+
+        $this->settings->enableMultipleFullCompanySupport();
+
+        Passport::actingAs($superUser);
+        $response = $this->getJson(route('api.consumables.index'));
+        $this->assertResponseContains($response, $consumableA);
+        $this->assertResponseContains($response, $consumableB);
+
+        Passport::actingAs($userInCompanyA);
+        $response = $this->getJson(route('api.consumables.index'));
+        $this->assertResponseContains($response, $consumableA);
+        $this->assertResponseDoesNotContain($response, $consumableB);
+
+        Passport::actingAs($userInCompanyB);
+        $response = $this->getJson(route('api.consumables.index'));
+        $this->assertResponseDoesNotContain($response, $consumableA);
+        $this->assertResponseContains($response, $consumableB);
+    }
+
+    private function assertResponseContains(TestResponse $response, Consumable $consumable)
+    {
+        $this->assertTrue(collect($response['rows'])->pluck('name')->contains($consumable->name));
+    }
+
+    private function assertResponseDoesNotContain(TestResponse $response, Consumable $consumable)
+    {
+        $this->assertFalse(collect($response['rows'])->pluck('name')->contains($consumable->name));
+    }
+}