Skip to content

Commit 7b679b7

Browse files
snipesnipe
committed
Merge remote-tracking branch 'origin/develop'
2 parents d626770 + 0d870d5 commit 7b679b7

3 files changed

Lines changed: 153 additions & 0 deletions

File tree

‎app/Http/Controllers/Api/PredefinedKitsController.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
use App\Http\Controllers\Controller;
77
use App\Http\Transformers\PredefinedKitsTransformer;
88
use App\Http\Transformers\SelectlistTransformer;
9+
use App\Models\Accessory;
10+
use App\Models\Consumable;
11+
use App\Models\License;
912
use App\Models\PredefinedKit;
1013
use Illuminate\Http\JsonResponse;
1114
use Illuminate\Http\Request;
@@ -183,6 +186,9 @@ public function storeLicense(Request $request, $kit_id): JsonResponse
183186
}
184187

185188
$license_id = $request->input('license');
189+
$license = License::findOrFail($license_id);
190+
$this->authorize('view', $license);
191+
186192
$relation = $kit->licenses();
187193
if ($relation->find($license_id)) {
188194
return response()->json(Helper::formatStandardApiResponse('error', null, ['license' => trans('admin/kits/general.license_error')]));
@@ -329,6 +335,9 @@ public function storeConsumable(Request $request, $kit_id): JsonResponse
329335
}
330336

331337
$consumable_id = $request->input('consumable');
338+
$consumable = Consumable::findOrFail($consumable_id);
339+
$this->authorize('view', $consumable);
340+
332341
$relation = $kit->consumables();
333342
if ($relation->find($consumable_id)) {
334343
return response()->json(Helper::formatStandardApiResponse('error', null, ['consumable' => trans('admin/kits/general.consumable_error')]));
@@ -402,6 +411,9 @@ public function storeAccessory(Request $request, $kit_id): JsonResponse
402411
}
403412

404413
$accessory_id = $request->input('accessory');
414+
$accessory = Accessory::findOrFail($accessory_id);
415+
$this->authorize('view', $accessory);
416+
405417
$relation = $kit->accessories();
406418
if ($relation->find($accessory_id)) {
407419
return response()->json(Helper::formatStandardApiResponse('error', null, ['accessory' => trans('admin/kits/general.accessory_error')]));

‎database/factories/UserFactory.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,11 @@ public function deletePredefinedKits()
430430
return $this->appendPermission(['kits.delete' => '1']);
431431
}
432432

433+
public function editPredefinedKits()
434+
{
435+
return $this->appendPermission(['kits.edit' => '1']);
436+
}
437+
433438
public function viewPredefinedKits()
434439
{
435440
return $this->appendPermission(['kits.view' => '1']);

‎tests/Feature/PredefinedKits/Api/AttachKitItemsTest.php‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
<?php
2+
3+
namespace Tests\Feature\PredefinedKits\Api;
4+
5+
use App\Models\Accessory;
6+
use App\Models\Consumable;
7+
use App\Models\License;
8+
use App\Models\PredefinedKit;
9+
use App\Models\User;
10+
use Tests\TestCase;
11+
12+
class AttachKitItemsTest extends TestCase
13+
{
14+
// -------------------------------------------------------------------------
15+
// Licenses
16+
// -------------------------------------------------------------------------
17+
18+
public function test_attaching_license_requires_kit_edit_permission()
19+
{
20+
$kit = PredefinedKit::factory()->create();
21+
$license = License::factory()->create();
22+
23+
$this->actingAsForApi(User::factory()->viewLicenses()->create())
24+
->postJson(route('api.kits.licenses.store', $kit), ['license' => $license->id, 'quantity' => 1])
25+
->assertForbidden();
26+
27+
$this->assertDatabaseMissing('kits_licenses', ['kit_id' => $kit->id, 'license_id' => $license->id]);
28+
}
29+
30+
public function test_attaching_license_requires_view_permission_on_license()
31+
{
32+
$kit = PredefinedKit::factory()->create();
33+
$license = License::factory()->create();
34+
35+
$this->actingAsForApi(User::factory()->editPredefinedKits()->create())
36+
->postJson(route('api.kits.licenses.store', $kit), ['license' => $license->id, 'quantity' => 1])
37+
->assertForbidden();
38+
39+
$this->assertDatabaseMissing('kits_licenses', ['kit_id' => $kit->id, 'license_id' => $license->id]);
40+
}
41+
42+
public function test_can_attach_license_with_both_permissions()
43+
{
44+
$kit = PredefinedKit::factory()->create();
45+
$license = License::factory()->create();
46+
47+
$this->actingAsForApi(User::factory()->editPredefinedKits()->viewLicenses()->create())
48+
->postJson(route('api.kits.licenses.store', $kit), ['license' => $license->id, 'quantity' => 1])
49+
->assertOk()
50+
->assertStatusMessageIs('success');
51+
52+
$this->assertDatabaseHas('kits_licenses', ['kit_id' => $kit->id, 'license_id' => $license->id]);
53+
}
54+
55+
// -------------------------------------------------------------------------
56+
// Consumables
57+
// -------------------------------------------------------------------------
58+
59+
public function test_attaching_consumable_requires_kit_edit_permission()
60+
{
61+
$kit = PredefinedKit::factory()->create();
62+
$consumable = Consumable::factory()->create();
63+
64+
$this->actingAsForApi(User::factory()->viewConsumables()->create())
65+
->postJson(route('api.kits.consumables.store', $kit), ['consumable' => $consumable->id, 'quantity' => 1])
66+
->assertForbidden();
67+
68+
$this->assertDatabaseMissing('kits_consumables', ['kit_id' => $kit->id, 'consumable_id' => $consumable->id]);
69+
}
70+
71+
public function test_attaching_consumable_requires_view_permission_on_consumable()
72+
{
73+
$kit = PredefinedKit::factory()->create();
74+
$consumable = Consumable::factory()->create();
75+
76+
$this->actingAsForApi(User::factory()->editPredefinedKits()->create())
77+
->postJson(route('api.kits.consumables.store', $kit), ['consumable' => $consumable->id, 'quantity' => 1])
78+
->assertForbidden();
79+
80+
$this->assertDatabaseMissing('kits_consumables', ['kit_id' => $kit->id, 'consumable_id' => $consumable->id]);
81+
}
82+
83+
public function test_can_attach_consumable_with_both_permissions()
84+
{
85+
$kit = PredefinedKit::factory()->create();
86+
$consumable = Consumable::factory()->create();
87+
88+
$this->actingAsForApi(User::factory()->editPredefinedKits()->viewConsumables()->create())
89+
->postJson(route('api.kits.consumables.store', $kit), ['consumable' => $consumable->id, 'quantity' => 1])
90+
->assertOk()
91+
->assertStatusMessageIs('success');
92+
93+
$this->assertDatabaseHas('kits_consumables', ['kit_id' => $kit->id, 'consumable_id' => $consumable->id]);
94+
}
95+
96+
// -------------------------------------------------------------------------
97+
// Accessories
98+
// -------------------------------------------------------------------------
99+
100+
public function test_attaching_accessory_requires_kit_edit_permission()
101+
{
102+
$kit = PredefinedKit::factory()->create();
103+
$accessory = Accessory::factory()->create();
104+
105+
$this->actingAsForApi(User::factory()->viewAccessories()->create())
106+
->postJson(route('api.kits.accessories.store', $kit), ['accessory' => $accessory->id, 'quantity' => 1])
107+
->assertForbidden();
108+
109+
$this->assertDatabaseMissing('kits_accessories', ['kit_id' => $kit->id, 'accessory_id' => $accessory->id]);
110+
}
111+
112+
public function test_attaching_accessory_requires_view_permission_on_accessory()
113+
{
114+
$kit = PredefinedKit::factory()->create();
115+
$accessory = Accessory::factory()->create();
116+
117+
$this->actingAsForApi(User::factory()->editPredefinedKits()->create())
118+
->postJson(route('api.kits.accessories.store', $kit), ['accessory' => $accessory->id, 'quantity' => 1])
119+
->assertForbidden();
120+
121+
$this->assertDatabaseMissing('kits_accessories', ['kit_id' => $kit->id, 'accessory_id' => $accessory->id]);
122+
}
123+
124+
public function test_can_attach_accessory_with_both_permissions()
125+
{
126+
$kit = PredefinedKit::factory()->create();
127+
$accessory = Accessory::factory()->create();
128+
129+
$this->actingAsForApi(User::factory()->editPredefinedKits()->viewAccessories()->create())
130+
->postJson(route('api.kits.accessories.store', $kit), ['accessory' => $accessory->id, 'quantity' => 1])
131+
->assertOk()
132+
->assertStatusMessageIs('success');
133+
134+
$this->assertDatabaseHas('kits_accessories', ['kit_id' => $kit->id, 'accessory_id' => $accessory->id]);
135+
}
136+
}

0 commit comments

Comments
 (0)