From b9fdb5880a8d8fa97e92768456f42965d6cfd7b8 Mon Sep 17 00:00:00 2001
From: spencerrlongg <spencer@spencerlong.com>
Date: Tue, 23 Jul 2024 13:48:43 -0500
Subject: [PATCH] quick push

---
 tests/Feature/Assets/Api/UpdateAssetTest.php | 27 ++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tests/Feature/Assets/Api/UpdateAssetTest.php b/tests/Feature/Assets/Api/UpdateAssetTest.php
index f890af5b1f..f8718c6bd4 100644
--- a/tests/Feature/Assets/Api/UpdateAssetTest.php
+++ b/tests/Feature/Assets/Api/UpdateAssetTest.php
@@ -424,4 +424,31 @@ class UpdateAssetTest extends TestCase
         $this->assertNull($asset->assigned_to);
         $this->assertNull($asset->assigned_type);
     }
+
+    public function testAssetCannotBeUpdatedByUserInSeparateCompany()
+    {
+        $this->markTestIncomplete('not done with this yet');
+
+        $this->settings->enableMultipleFullCompanySupport();
+
+        $companyA = Company::factory()->create();
+        $companyB = Company::factory()->create();
+        $userA = User::factory()->create([
+            'company_id' => $companyA->id,
+        ]);
+        $userB = User::factory()->create([
+            'company_id' => $companyB->id,
+        ]);
+        $asset = Asset::factory()->create([
+            'user_id'    => $userA->id,
+            'company_id' => $companyA->id,
+        ]);
+
+        $this->actingAsForApi($userB)
+            ->patchJson(route('api.assets.update', $asset->id), [
+                'name' => 'test name'
+            ])
+            ->assertStatus(403);
+
+    }
 }